Communication method, device and system

Abstract

A communication method, device and system relate to the technical field of communication. The method comprises the steps that a first node / a second node acquires first information; establishing a first communication connection with a second node according to the first information, the first communication connection being used for transmitting data of a first service, and the first communication connection corresponding to a first communication technology; wherein the first node is a node accessing a network corresponding to a second communication technology, and the first service is a service of the first communication technology or a service of the second communication technology. Through the scheme, the security requirement of a heterogeneous communication technology in a converged communication scene can be met.

Description

[0001] This application is a divisional application. The application number of the original application is 202180102233.0, and the original application date is September 30, 2021. The entire contents of the original application are incorporated into this application by reference. Technical Field

[0002] The embodiments of the present application relate to the field of communication technology, and in particular to a communication method, device and system. Background Art

[0003] With the rapid development of informatization, mobile terminals (such as mobile phones, tablet computers, or other portable smart terminals, etc.) have become important and indispensable smart tools for individuals. After entering the era of mobile Internet, these mobile terminals are more convenient to use than traditional computers (such as desktop workstations, servers, etc.), but they are also more likely to threaten and damage personal information. Therefore, the security of communication technology is of vital importance.

[0004] With the rapid development of emerging industries such as smart cars, smart terminals, smart homes and smart manufacturing, innovative needs and applications continue to emerge. In some scenarios, designs for converged communications based on different communication technologies are proposed. However, how to ensure the security needs of heterogeneous communication technologies in converged communication scenarios remains an important issue that needs to be addressed urgently. Summary of the invention

[0005] The embodiments of the present application provide a communication method, device and system, which help to meet the security requirements of heterogeneous communication technologies in converged communication scenarios.

[0006] In a first aspect, an embodiment of the present application provides a communication method, which can be applied to a first node, and the first node can support a first communication technology and a second communication technology. The method may include: obtaining first information; establishing a first communication connection with a second node according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node is a node accessing a network corresponding to the second communication technology. By way of example, the first service may be a service of the first communication technology or a service of the second communication technology.

[0007] Through the above method, the first node can establish a first communication connection between the first node and the second node based on the first information associated with the first service, so that when the first node and the second node transmit service data, the communication connection corresponding to the first service can be used to transmit the data corresponding to the first service. Different communication connections can correspond to different service data transmissions to meet the security requirements in the converged communication scenario and ensure the security of the corresponding service data. For example, the first communication technology can be a short-distance communication technology, and the second communication technology can be the fifth generation mobile communication technology (5G).

[0008] It should be noted that the embodiments of the present application are only described using the fusion scenario based on the first communication technology and the first communication technology as an example. The embodiments of the present application can also be applied to other fusion communication scenarios. The first service can also include services corresponding to other communication technologies. The embodiments of the present application do not limit this.

[0009] In combination with the first aspect, in a possible implementation, the first information may include a first key for communication authentication with the second node, and obtaining the first information may include: obtaining the first key according to a type corresponding to the second communication technology, and / or according to a service type of the first service.

[0010] Through the above method, the first node can trigger the connection establishment process between the first node and the second node, and the first node can obtain the first key according to the current communication scenario and / or business requirements, so as to establish a corresponding first communication connection between the first node and the second node according to the obtained first key to transmit data corresponding to the first business. For example, the type corresponding to the second communication technology can refer to the type of communication standard adopted by the second communication technology, such as 5G technology.

[0011] In combination with the first aspect, in a possible implementation, the first information may include a first key for communication authentication with the second node, and the method further includes: receiving a first message from the second node, the first message carrying key type indication information or business type indication information; obtaining the first information includes: obtaining the first key according to the key type indication information or the business type indication information.

[0012] Through the above method, the connection establishment process between the first node and the second node can be triggered by the second node, and the first node can obtain the first key associated with the first service based on the key type indication information or the service type indication information from the second node, so as to establish a corresponding first communication connection between the first node and the second node based on the obtained first key to transmit data corresponding to the first service.

[0013] In combination with the first aspect, in a possible implementation method, establishing a first communication connection with a second node based on the first information includes: sending a second message associated with the first key to the second node, the second message is used for identity authentication of the first node; receiving a third message in response to the second message, the third message is used for identity authentication of the second node; and in a case where the identity authentication of the second node is successful, sending a fourth message to the second node, the fourth message is used to establish the first communication connection with the second node.

[0014] It should be noted that in the embodiment of the present application, the third message may correspond to one message, for example, the message may be used for the identity authentication of the second node, and implicitly indicates that the identity authentication of the first node is successful; or, for example, the message may be used to explicitly indicate that the identity authentication of the first node is successful, and may also be used for the identity authentication of the second node; or, the third message may correspond to at least two messages, for example, a message indicating that the identity authentication of the first node is successful, and a message used for the identity authentication of the second node, and the embodiment of the present application does not limit the specific implementation of the third message. Similarly, the fourth message may also correspond to one message, for example, the message is used to establish the first communication connection with the second node, and implicitly indicates that the identity authentication of the second node is successful; or, for example, the message may be used to establish the first communication connection with the second node, and may also be used to explicitly indicate that the identity authentication of the second node is successful; or, the fourth message may correspond to at least two messages, for example, a message used to establish the first communication connection with the second node, and a message used to indicate that the identity authentication of the second node is successful, and the embodiment of the present application does not limit the specific implementation of the fourth message.

[0015] Through the above method, the first node can perform mutual identity authentication (or identity authentication) with the second node based on the obtained first key, and after the mutual authentication is successful, a secure first communication connection is established between the two parties.

[0016] In combination with the first aspect, in a possible implementation manner, the first key is a key for a service of the first communication technology, or is a key for a service of the second communication technology.

[0017] In combination with the first aspect, in a possible implementation method, when the first service is a service of the first communication technology, the first key is a key used for the service of the first communication technology; and / or, when the first service is a service of the second communication technology, the first key is a key used for the service of the second communication technology.

[0018] Through the above method, the first node can obtain at least one key, and the first node can select from the at least one key according to the first service to establish a first communication connection corresponding to the first service to ensure the security of the service data of the first service.

[0019] In combination with the first aspect, in one possible implementation, the key used for the service of the second communication technology includes a trusted key or an untrusted key, wherein the trusted key is a key that has been successfully authenticated by the network, and the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than the priority of the untrusted key.

[0020] Through the above method, at least one key obtained by the first node can have a corresponding priority and / or usage principle, so that the first node can select a key closely related to the first business as the first key from the at least one key based on the first business, the priority and / or the usage principle.

[0021] It should be noted that in the embodiment of the present application, the keys and services are corresponding. When the first service is a service of the first communication technology, the keys for the services of the second communication technology are not used; when the first service is a service of the second communication technology, the keys for the services of the first communication technology are not used, and when there are trusted keys, untrusted keys are not used.

[0022] In combination with the first aspect, in a possible implementation manner, before establishing the first communication connection, the method further includes: receiving a key for a service of the second communication technology from the network.

[0023] Through the above method, in a converged communication scenario based on the first communication technology and the second communication technology, the network of the second communication technology can send a key for the service of the second communication technology to the first node, and the first node receives the key so as to establish a first communication connection between the first node and the second node based on the key in the converged communication scenario. It should be understood that in the embodiment of the present application, the key for the service of the second communication technology can be a default value or a dynamically changing value, and the embodiment of the present application does not limit this. In addition, if the key is a key that has been successfully authenticated by the network, the key is a trusted key, and if the key is a key that has not been authenticated by the network, the key is a trusted key.

[0024] In combination with the first aspect, in a possible implementation, the first information includes a first security context for communicating with the second node, and obtaining the first information includes: receiving a fifth message from the second node, the fifth message carrying an identifier associated with the first security context; obtaining the first information includes: obtaining the first security context based on the identifier.

[0025] Through the above method, there may be multiple sets of security contexts in the second node. For example, the second node may select a first security context from the multiple sets of security contexts according to the type corresponding to the second communication technology and / or according to the service type of the first service, and send the fifth message to the first node to indicate the identifier of the first security context. The first node may obtain the first security context corresponding to the first service according to the identifier associated with the first security context indicated by the second node, thereby establishing a secure first communication connection between the two parties based on the obtained first security context. For example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology.

[0026] In combination with the first aspect, in a possible implementation manner, the first security context is a security context for a service of the first communication technology, or is a security context for a service of the second communication technology.

[0027] In combination with the first aspect, in a possible implementation method, when the first service is a service of a first communication technology, the first security context is a security context for the service of the first communication technology; and / or, when the first service is a service of a second communication technology, the first security context is a security context for the service of the second communication technology.

[0028] In combination with the first aspect, in one possible implementation, the security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, wherein the trusted security context is a security context that has been successfully authenticated by the network, and the untrusted security context is a security context that has not been authenticated by the network, and the priority of the trusted security context is higher than that of the untrusted security context.

[0029] Through the above method, there can be at least one set of security contexts between the first node and the second node, and the at least one set of security contexts can have corresponding priorities and / or usage principles, so that the first node can select a security context closely related to the first business as the first security context from the at least one set of security contexts based on the first business, the priorities and / or usage principles.

[0030] It should be noted that in the embodiment of the present application, similar to the key, the security context also corresponds to the service. When the first service is a service of the first communication technology, the security context for the service of the second communication technology is not used; when the first service is a service of the second communication technology, the security context for the service of the first communication technology is not used, and when there is a trusted security context, the untrusted security context is not used.

[0031] In combination with the first aspect, in a possible implementation, before obtaining the first information, the method further includes: sending a sixth message to the second node, the sixth message carrying information indicating that the first node supports the second communication technology. It should be noted that in the embodiment of the present application, the first node supports the second communication technology, which can also be understood as the first node supports the transmission of the service of the second communication technology, the first node supports the service transmission corresponding to the second communication technology, or the first node supports the service transmission based on the second communication technology.

[0032] Through the above method, the first node can carry relevant indication information in the sixth message to inform the second node of the service types it supports, so that the second node can make a decision based on the business conducted between it and the first node, so as to establish a secure first communication connection between the two parties and transmit data of the first business.

[0033] In a second aspect, an embodiment of the present application provides a communication method, which is applied to a second node, and the second node may support a first communication technology, or the second node may support a first communication technology and a second communication technology. The method may include: obtaining first information; establishing a first communication connection with the first node according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node is a node accessing a network corresponding to a second communication technology. By way of example, the first service may be a service of the first communication technology or a service of the second communication technology.

[0034] In combination with the second aspect, in a possible implementation, the first information includes a first key for communication authentication with the first node, and obtaining the first information includes: obtaining the first key according to the type corresponding to the second communication technology, and / or according to the service type of the first service. For example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology. In combination with the second aspect, in a possible implementation, the method further includes: sending a first message to the first node, the first message carrying information associated with the first key. For example, the information associated with the first key may include key type indication information or service type indication information. In an optional implementation, the information associated with the first key may also be the first key.

[0035] In combination with the second aspect, in a possible implementation method, establishing the first communication connection with the first node based on the first information includes: receiving a second message from the first node, the second message is associated with the first key, and the second message is used for identity authentication of the first node; when the identity authentication of the first node is successful, sending a third message to the first node, and the third message is used for identity authentication of the second node; receiving a fourth message in response to the third message, and the fourth message is used to establish the first communication connection with the second node.

[0036] It should be noted that in the embodiment of the present application, the third message may correspond to one message, for example, the message may be used for the identity authentication of the second node, and implicitly indicates that the identity authentication of the first node is successful; or, for example, the message may be used to explicitly indicate that the identity authentication of the first node is successful, and may also be used for the identity authentication of the second node; or, the third message may correspond to at least two messages, for example, a message indicating that the identity authentication of the first node is successful, and a message used for the identity authentication of the second node, and the embodiment of the present application does not limit the specific implementation of the third message. Similarly, the fourth message may also correspond to one message, for example, the message is used to establish the first communication connection with the second node, and implicitly indicates that the identity authentication of the second node is successful; or, for example, the message may be used to establish the first communication connection with the second node, and may also be used to explicitly indicate that the identity authentication of the second node is successful; or, the fourth message may correspond to at least two messages, for example, a message used to establish the first communication connection with the second node, and a message used to indicate that the identity authentication of the second node is successful, and the embodiment of the present application does not limit the specific implementation of the fourth message.

[0037] In combination with the second aspect, in a possible implementation manner, the first key is a key for a service of the first communication technology, or is a key for a service of the second communication technology.

[0038] In combination with the second aspect, in one possible implementation, when the first service is a service of the first communication technology, the first key is a key used for the service of the first communication technology; and / or, when the first service is a service of the second communication technology, the first key is a key used for the service of the second communication technology.

[0039] In combination with the second aspect, in one possible implementation, the key used for the service of the second communication technology includes a trusted key or an untrusted key, wherein the trusted key is a key that has been successfully authenticated by the network, and the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than the priority of the untrusted key.

[0040] In combination with the second aspect, in a possible implementation manner, before establishing the first communication connection, the method further includes: receiving a key for a service of the second communication technology from the network.

[0041] In conjunction with the second aspect, in a possible implementation, the first information includes a first security context, the first security context is used for the second node to establish the first communication connection with the first node, and the obtaining of the first information includes: obtaining the first security context according to a type corresponding to the second communication technology and / or according to a service type of the first service. For example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology.

[0042] In conjunction with the second aspect, in a possible implementation manner, the first security context is a security context for a service of the first communication technology, or is a security context for a service of the second communication technology.

[0043] In combination with the second aspect, in one possible implementation, when the first service is a service of a first communication technology, the first security context is a security context for the service of the first communication technology; and / or, when the first service is a service of a second communication technology, the first security context is a security context for the service of the second communication technology.

[0044] In combination with the second aspect, in a possible implementation, the security context for the service of the second communication technology includes a trusted security context or an untrusted security context, wherein the trusted security context is a security context that has been successfully authenticated by the network, and the untrusted security context is a security context that has not been authenticated by the network, and the priority of the trusted security context is higher than the priority of the untrusted security context. In combination with the second aspect, in a possible implementation, the method further includes: sending a fifth message to the first node, the fifth message carrying an identifier associated with the first security context.

[0045] In combination with the second aspect, in a possible implementation, the method further includes: receiving a sixth message from the first node, the sixth message carrying information indicating that the first node supports the second communication technology. It should be noted that in the embodiment of the present application, the first node supports the second communication technology, which can also be understood as the first node supports the transmission of the service of the second communication technology, the first node supports the service transmission corresponding to the second communication technology, or the first node supports the service transmission based on the second communication technology.

[0046] In a third aspect, an embodiment of the present application provides a communication device, which is applied to a first node, and includes: a communication unit, which is used to communicate with a second node; a processing unit, which is used to obtain first information; a first communication connection is established with the second node according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node is a node accessing a network corresponding to the second communication technology. For example, the first service is a service of the first communication technology or a service of the second communication technology.

[0047] In combination with the third aspect, in a possible implementation, the first information includes a first key for communication authentication with the second node, and the processing unit is used to: obtain the first key according to the type corresponding to the second communication technology, and / or according to the service type of the first service. For example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology. In combination with the third aspect, in a possible implementation, the first information includes a first key for communication authentication with the second node, and the communication unit is used to: receive a first message from the second node, the first message carrying key type indication information or service type indication information; the processing unit is used to: obtain the first key according to the key type indication information or the service type indication information.

[0048] In combination with the third aspect, in a possible implementation, the communication unit is used to: send a second message associated with the first key to the second node, the second message is used for identity authentication of the first node; receive a third message in response to the second message, the third message is used for identity authentication of the second node; and when the identity authentication of the second node is successful, send a fourth message to the second node, the fourth message is used to establish the first communication connection with the second node.

[0049] In combination with the third aspect, in a possible implementation manner, the first key is a key for a service of the first communication technology, or is a key for a service of the second communication technology.

[0050] In combination with the third aspect, in one possible implementation method, when the first service is a service of the first communication technology, the first key is a key used for the service of the first communication technology; and / or, when the first service is a service of the second communication technology, the first key is a key used for the service of the second communication technology.

[0051] In combination with the third aspect, in one possible implementation, the key used for the service of the second communication technology includes a trusted key or an untrusted key, wherein the trusted key is a key that has been successfully authenticated by the network, and the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than the priority of the untrusted key.

[0052] In combination with the third aspect, in a possible implementation manner, before the processing unit establishes the first communication connection, the communication unit is further used to: receive a key for a service of the second communication technology from the network.

[0053] In combination with the third aspect, in a possible implementation, the first information includes a first security context for communicating with the second node, and the communication unit is used to: receive a fifth message from the second node, and the fifth message carries an identifier associated with the first security context; the processing unit is used to: obtain the first security context based on the identifier.

[0054] In combination with the third aspect, in a possible implementation manner, the first security context is a security context for a service of the first communication technology, or is a security context for a service of the second communication technology.

[0055] In combination with the third aspect, in one possible implementation, when the first service is a service of a first communication technology, the first security context is a security context for the service of the first communication technology; and / or, when the first service is a service of a second communication technology, the first security context is a security context for the service of the second communication technology.

[0056] In combination with the third aspect, in a possible implementation, the security context for the service of the second communication technology includes a trusted security context or an untrusted security context, wherein the trusted security context is a security context that has been successfully authenticated by the network, and the untrusted security context is a security context that has not been authenticated by the network, and the priority of the trusted security context is higher than the priority of the untrusted security context. In combination with the third aspect, in a possible implementation, the communication unit is also used to: send a sixth message to the second node before the processing unit obtains the first information, and the sixth message carries information used to indicate that the first node supports the second communication technology.

[0057] In a fourth aspect, an embodiment of the present application provides a communication device, comprising: a communication unit, configured to communicate with a first node; a processing unit, configured to obtain first information; establishing a first communication connection with the first node according to the first information, wherein the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node is a node accessing a network corresponding to a second communication technology. By way of example, the first service may be a service of the first communication technology or a service of the second communication technology.

[0058] In combination with the fourth aspect, in a possible implementation, the first information includes a first key for communication authentication with the first node, and the processing unit is used to: obtain the first key according to the type corresponding to the second communication technology, and / or according to the service type of the first service. By way of example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology. In combination with the fourth aspect, in a possible implementation, the communication unit is also used to: send a first message to the first node, and the first message carries information associated with the first key. By way of example, the information associated with the first key may, for example, include key type indication information or service type indication information.

[0059] In combination with the fourth aspect, in a possible implementation, the communication unit is used to: receive a second message from the first node, the second message is associated with the first key, and the second message is used for identity authentication of the first node; when the identity authentication of the first node is successful, send a third message to the second node, and the third message is used for identity authentication of the second node; receive a fourth message in response to the third message, and the fourth message is used to establish the first communication connection with the second node.

[0060] In combination with the fourth aspect, in a possible implementation manner, the first key is a key for a service of the first communication technology, or is a key for a service of the second communication technology.

[0061] In combination with the fourth aspect, in a possible implementation method, when the first service is a service of a first communication technology, the first key is a key used for the service of the first communication technology; and / or, when the first service is a service of a second communication technology, the first key is a key used for the service of the second communication technology.

[0062] In combination with the fourth aspect, in one possible implementation, the key used for the service of the second communication technology includes a trusted key or an untrusted key, wherein the trusted key is a key that has been successfully authenticated by the network, and the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than the priority of the untrusted key.

[0063] In combination with the fourth aspect, in a possible implementation manner, before the processing unit establishes the first communication connection, the method further includes: receiving a key for a service of the second communication technology from the network.

[0064] In conjunction with the fourth aspect, in a possible implementation, the first information includes a first security context, the first security context is used for the second node to establish the first communication connection with the first node, and the processing unit is used to: obtain the first security context according to a type corresponding to the second communication technology and / or according to a service type of the first service. For example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology.

[0065] In conjunction with the fourth aspect, in a possible implementation manner, the first security context is a security context for a service of the first communication technology, or is a security context for a service of the second communication technology.

[0066] In combination with the fourth aspect, in one possible implementation method, when the first service is a service of a first communication technology, the first security context is a security context for the service of the first communication technology; and / or, when the first service is a service of a second communication technology, the first security context is a security context for the service of the second communication technology.

[0067] In combination with the fourth aspect, in a possible implementation, the security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, wherein the trusted security context is a security context that has been successfully authenticated by the network, and the untrusted security context is a security context that has not been authenticated by the network, and the priority of the trusted security context is higher than the priority of the untrusted security context.

[0068] In combination with the fourth aspect, in a possible implementation manner, the communication unit is further used to: send a fifth message to the first node, where the fifth message carries an identifier associated with the first security context.

[0069] In combination with the fourth aspect, in a possible implementation manner, the communication unit is further used to: receive a sixth message from the first node, and the sixth message carries information indicating that the first node supports the second communication technology.

[0070] In a fifth aspect, an embodiment of the present application provides a communication device, comprising: a processor and a memory; the memory is used to store programs; the processor is used to execute the programs stored in the memory, so that the device implements the method described in the first aspect and any possible implementation of the first aspect above, or implements the method described in the second aspect and any possible implementation of the second aspect above.

[0071] In a sixth aspect, an embodiment of the present application provides a communication device, comprising: at least one processor and an interface circuit, the interface circuit being used to provide data or code instructions to the at least one processor, the at least one processor being used to implement the method described in the first aspect and any possible implementation of the first aspect through a logic circuit or executing code instructions, or to implement the method described in the second aspect and any possible implementation of the second aspect.

[0072] In a seventh aspect, an embodiment of the present application provides a communication system, comprising a communication device as described in the third aspect and any possible implementation of the third aspect, and a communication device as described in the fourth aspect and any possible implementation of the fourth aspect.

[0073] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program code, and when the program code runs on the computer, the computer executes the method described in the first aspect and any possible implementation of the first aspect, or, when the program code runs on the computer, the computer executes the method described in the second aspect and any possible implementation of the second aspect.

[0074] In the ninth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer, the computer executes the method described in the first aspect and any possible implementation of the first aspect, or executes the method described in the second aspect and any possible implementation of the second aspect.

[0075] In the tenth aspect, an embodiment of the present application provides a chip system, which includes a processor for calling a computer program or computer instructions stored in a memory so that the processor executes the method described in the first aspect and any possible implementation of the first aspect, or executes the method described in the second aspect and any possible implementation of the second aspect.

[0076] In combination with the tenth aspect, in a possible implementation, the processor is coupled to the memory through an interface.

[0077] In combination with the tenth aspect, in a possible implementation, the chip system also includes a memory, in which a computer program or computer instructions are stored.

[0078] In the eleventh aspect, an embodiment of the present application provides a processor for calling a computer program or computer instructions stored in a memory so that the processor executes the method described in the first aspect and any possible implementation of the first aspect, or executes the method described in the second aspect and any possible implementation of the second aspect.

[0079] In the twelfth aspect, an embodiment of the present application provides a terminal device, which can be used to implement the method described in the first aspect and any possible implementation of the first aspect, or to implement the method described in the second aspect and any possible implementation of the second aspect. By way of example, the terminal device includes but is not limited to: intelligent transportation equipment (such as cars, ships, drones, trains, trucks, etc.), intelligent manufacturing equipment (such as robots, industrial equipment, intelligent logistics, intelligent factories, etc.), and intelligent terminals (mobile phones, computers, tablet computers, PDAs, desktops, headphones, speakers, wearable devices, vehicle-mounted devices, etc.).

[0080] In the thirteenth aspect, an embodiment of the present application provides a vehicle, which can be used to implement the method described in the first aspect and any possible implementation of the first aspect, and / or to implement the method described in the second aspect and any possible implementation of the second aspect.

[0081] In the fourteenth aspect, an embodiment of the present application provides a vehicle, which may include the communication device described in the third aspect and any possible implementation of the third aspect, and / or implement the communication device described in the fourth aspect and any possible implementation of the fourth aspect.

[0082] Based on the implementations provided in the above aspects, the embodiments of the present application can be further combined to provide more implementations.

[0083] The technical effects that can be achieved by any possible implementation method in any of the second to fourteenth aspects mentioned above can be referred to the description of the technical effects that can be achieved by any possible implementation method in any of the first aspect mentioned above, and the repetitions will not be discussed here. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 A schematic diagram showing a system architecture applicable to an embodiment of the present application;

[0085] Figure 2 A schematic diagram showing a system architecture applicable to an embodiment of the present application;

[0086] Figure 3 A schematic diagram showing a flow chart of a communication method according to an embodiment of the present application is shown;

[0087] Figure 4a A schematic diagram showing a flow chart of a communication method according to an embodiment of the present application is shown;

[0088] Figure 4b A schematic diagram showing a flow chart of a communication method according to an embodiment of the present application is shown;

[0089] Figure 4c A schematic diagram showing a flow chart of a communication method according to an embodiment of the present application is shown;

[0090] Figure 4d A schematic diagram showing a flow chart of a communication method according to an embodiment of the present application is shown;

[0091] Figure 5 A schematic diagram showing a communication device according to an embodiment of the present application is shown;

[0092] Figure 6 A schematic diagram of a communication device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0093] The embodiments of the present application provide a communication method, device, and system, which are helpful to meet the security requirements of heterogeneous communication technologies in converged communication scenarios. The method and the device are based on the same technical concept. Since the principles of solving problems by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated. For ease of understanding, the following is an introduction in conjunction with the accompanying drawings and embodiments.

[0094] Figure 1 A schematic diagram of a system architecture applicable to an embodiment of the present application is shown.

[0095] See also Figure 1As shown, the system architecture may include a first node 110, a second node 120, and a third node 130. Among them, the first node 110 and the second node 120 can form a first communication system, and the two parties can use the first communication technology to communicate. The first node 110 and the third node 130 can form a second communication system, and the two parties can use the second communication technology to communicate, and the first communication technology is different from the second communication technology. In the fusion communication scenario of the first communication technology and the second communication technology, a communication connection can be established between the first communication system and the second communication system to form a heterogeneous communication system, so as to perform corresponding communication services and / or transmit communication service data in the heterogeneous communication system. For example, the heterogeneous communication system can also be called a fused communication system, or a tightly coupled (tight interworking) communication system, or an interworking (interworking) communication system.

[0096] In the embodiment of the present application, any one of the first node 110, the second node 120, or the third node 130 may be an electronic device having data transmission and reception capabilities.

[0097] For example, the electronic device may be a terminal device, including a device that provides voice and / or data connectivity to a user, specifically, a device that provides voice to a user, or a device that provides data connectivity to a user, or a device that provides voice and data connectivity to a user. For example, it may include a handheld device with a wireless connection function, or a processing device connected to a wireless modem. The terminal device may, for example, communicate with a core network via a radio access network (RAN) and exchange voice and / or data with the RAN.

[0098] In the specific implementation process, the terminal device may include but is not limited to vehicles, user equipment (UE), wireless terminal equipment, mobile terminal equipment, device-to-device (D2D) terminal equipment, vehicle to everything (V2X) terminal equipment, machine-to-machine / machine-type communications (M2M / MTC) terminal equipment, Internet of Things (IoT) terminal equipment or narrowband Internet of Things (NB-IoT) terminal equipment, subscriber unit, subscriber station, mobile station, mobile, remote station, access point (AP), remote terminal equipment, access terminal equipment, user terminal, user agent, or user equipment, etc. For another example, the terminal device may be specifically implemented as: a mobile phone (or "cellular" phone), or a computer with a mobile terminal device; a dedicated terminal device in IoT, or an industrial control device, or a remote medical device, or a smart grid device, or a smart city device, etc.; a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device, etc.; a personal communication service (PCS) phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), etc. In an optional design, the terminal device may also be implemented as a restricted device, such as a device with low power consumption, or a device with limited storage capacity, or a device with limited computing power, etc.In an optional design, the terminal device may include components such as a barcode, a radio frequency identification (RFID), a sensor, a global positioning system (GPS), a laser scanner, etc.

[0099] In an optional design, the terminal device can also be a wearable device. Wearable devices can also be called wearable smart devices or smart wearable devices, etc. They are a general term for the intelligent design of daily wearables using wearable technology to develop wearable devices, such as glasses, gloves, watches, clothing and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but can also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and independent of smartphones to achieve complete or partial functions, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets, smart helmets, and smart jewelry for vital sign monitoring.

[0100] In an optional design, the terminal device may also be a machine intelligence device such as a self-driving device, a transportation safety device, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, etc.

[0101] The various terminal devices introduced above, if located on a vehicle (eg placed in or installed in a vehicle), can be considered as vehicle-mounted terminal devices, which can also be called on-board units (OBU).

[0102] In an optional design, the terminal device may further include a relay. Alternatively, it can be understood that the terminal device may include any device capable of performing data communication with the base station.

[0103] For example, the electronic device may also be a network device, for example, an access network (AN) device, which may include a device in the access network that communicates with a wireless terminal device through one or more cells at an air interface, such as a base station or an access point. The base station may be used to convert received air frames to and from Internet Protocol (IP) packets, and serve as a router between the terminal device and the rest of the access network, wherein the rest of the access network may include an IP network. In an optional design, the network device may include a base station in a second generation (2G) communication system, or a base station in a third generation (3G) communication system, or a base station in a fourth generation (4G) communication system, such as an evolved base station (NodeB or eNB or e-NodeB, evolutionary Node B) in a long term evolution (LTE) system or long term evolution-advanced (LTE-A), or may also include a next generation node B (next generation node B, gNB) in a fifth generation (5G) new radio (NR) system (also referred to as an NR system), or may also include a centralized unit (CU) and a distributed unit (CU) in a cloud radio access network (Cloud RAN) system. unit, DU), and base stations in various future communication systems, such as base stations in the sixth generation (6G) communication system, which are not limited in the embodiments of the present application; for another example, the network device may include the network device in V2X, namely the road side unit (RSU). RSU may include a fixed infrastructure entity that supports V2X applications and may exchange messages with other entities that support V2X applications; for another example, the network device may also include a core network device, and the core network device may include one or more of the following in the 5G system: access and mobility management function (AMF), session management function (SMF), user plane function (UPF), or a mobility management entity (MME) in a 4G system.

[0104] It should be understood that in some technical scenarios, the name of an electronic device with similar data receiving and sending capabilities may not be called a node, but for the convenience of description, in the embodiments of the present application, electronic devices with data receiving and sending capabilities are collectively referred to as nodes.

[0105] In the embodiment of the present application, Figure 1 In the heterogeneous communication system shown, the device types of the first node 110, the second node 120, or the third node 130 can be the same or different. For example, the first node 110, the second node 120, and the second node 130 are all terminal devices or network devices, or the first node 110 and the second node 120 can be terminal devices, and the third node 130 can be a network device. For example, the first communication technology is a short-distance communication technology and the second communication technology is a 5G communication technology. Figure 2 As shown, the first node 110 and the second node 120 may be terminal devices with short-range communication functions, and the third node 130 may include but is not limited to access devices: trusted non-3GPP Gateway Function (TNGF), and core network equipment: at least one of SMF, AMF, UPF and data network (DN) and other functional entities. Among them, the first node 110 can support the first communication technology and the second communication technology, and can serve as the master node (or authorized node) of the second node 120, on the one hand, to perform short-range communication with the second node 120, and on the other hand, to perform 5G communication with the third node 130. It should be noted that the first node 110 can support the first communication technology, which can also be understood as the first node can support the service transmission based on the first communication technology, or the first node can support the service of the first communication technology; the first node 110 supports the second communication technology, which can also be understood as the second node can support the service transmission based on the second communication technology, or the second node can support the service of the second communication technology.

[0106] Each node or functional entity can be connected through an interface. The serial number or name of the interface is not limited in the embodiment of the present application. The interface defined in the 3GPP-related standard protocol of the 5G system can be used, or the interface in the future communication system can be used. For example, the second node 120 can communicate with the first node 110 through the Yt interface, the first node 110 can communicate with the TNGF through the Ta interface, and the second node 120 can communicate with the TNGF through the NWt interface. The second node 120 and the first node 110 can communicate with the AMF through the next generation network (next generation, N) 1 interface (referred to as N1), the network device (such as TNGF) communicates with the AMF through the N2 interface (referred to as N2), the TNGF communicates with the local UPF through the N3 interface (referred to as N3), and the UPF communicates with the DN through the N6 interface (referred to as N6). AMF communicates with SMF through the N11 interface (referred to as N11), and SMF communicates with UPF through the N4 interface (referred to as N4). As a result, the 5G network can perceive key information such as the device status, network status, and business status of the second node 120 through the first node 110, thereby achieving remote accessibility, perception, and controllability of industry site networks and businesses.

[0107] It should be noted that the above is only a schematic representation that the heterogeneous communication system may include the first node 110, the second node 120 and the third node 130, as well as the communication mode between each node and its functional module, and does not limit the number of each node and the serial number or name of the interface. In a specific implementation, the number of the first node 110, the second node 120, and the third node 130 may not be limited to one.

[0108] In addition, it should be noted that in an embodiment of the present application, in an optional design, the first node 110 can perform a radio resource control (RRC) establishment process with the third node 130. When the first node 110 and the third node 130 establish an RRC connection, the RRC state of the first node 110 is the RRC connection state. Subsequently, the RRC state of the first node 110 can be converted in the following states: RRC idle (RRC_IDLE) state, RRC connected (RRC_CONNECTED) state and RRC inactive (RRC_INACTIVE) state. In the converged communication scenario of the embodiment of the present application, the first node 110 can be in any of the above idle state, connected state, and inactive state. The embodiment of the present application does not limit this. In addition, in the embodiment of the present application, establishing a communication connection between any two nodes means that the two nodes can interact through the transmission of signals to communicate between the two nodes, including but not limited to physical connections or virtual connections, which will not be distinguished one by one below.

[0109] In the embodiments of the present application, short-range communication technology may include technology that supports wireless short-range communication. Wireless short-range communication includes the communication parties transmitting information through radio waves and the transmission distance is within a relatively short range (for example, within 100 meters). It can be called short-range wireless communication, including but not limited to Bluetooth technology, wireless fidelity (Wi-Fi) technology, near field communication (NFC) technology, Wi-Fi Aware technology, general short-range communication technology, and short-range communication technology specified by the Star Alliance. Short-range communication can be widely used in file transfer, remote control, screen projection, and perception of surrounding devices (such as smart cars, smart terminal devices, smart home devices, and smart manufacturing equipment). The following are examples of several short-range communication technologies.

[0110] Bluetooth: A radio technology that supports short-range communication between devices, enabling wireless information exchange between a wide range of devices including mobile phones, wireless headsets, laptops, and related peripherals. Using Bluetooth technology can effectively simplify communication between mobile communication terminal devices, and can also successfully simplify communication between devices and the Internet, making data transmission faster and more efficient, broadening the path for wireless communication.

[0111] Wireless fidelity (Wi-Fi): also known as wireless local area network (WLAN) direct connection or Wi-Fi Direct, is a member of the Wi-Fi protocol family that enables devices to easily connect to each other without the need for an intermediary wireless access point. Its use ranges from web browsing to file transfer, as well as communicating with multiple devices at the same time, which can give full play to the speed advantage of Wi-Fi. Devices that meet this standard can be easily connected even if they come from different manufacturers.

[0112] Wi-Fi Aware technology: It is responsible for the sensing and discovery part in Wi-Fi technology, and can help Wi-Fi devices perceive surrounding services, such as surrounding devices, and then use Wi-Fi Aware to achieve peer-to-peer (P2P) message interaction between two devices at close range. Since WIFI-Aware can sense surrounding devices, it can achieve a variety of functions, such as sensing nearby people and establishing connections, adding friends, playing the same game, etc.; or discovering surrounding devices to achieve photo sharing or location sharing, etc.; or, without accessing a network (such as cellular or wireless), you can securely send files to a printer, etc.

[0113] It should be noted that, in addition to the short-range communication technologies listed above, other existing short-range communication technologies, or other short-range communication technologies that may appear in the future as communication technologies evolve, may also be applicable to this solution.

[0114] In addition, it should be noted that Figure 2 Each functional entity or network element can also interact using a service-based interface. For example, the service-based interface provided by AMF to the outside world may be a network access and mobility management function (Namf) interface; the service-based interface provided by SMF to the outside world may be a network session management function (Nsmf) interface. For related descriptions, please refer to the 5G system architecture defined in the 3rd Generation Partnership Project (3GPP)-23501 standard, which will not be repeated here.

[0115] The various functions included in the system architecture may also be referred to as functional entities, network elements or other names. For example, SMF may be referred to as an SMF entity. In an optional design, the various functions in the embodiments of the present application may be implemented by one device, or may be implemented by multiple devices together, or may be implemented by one or more functional modules within a device, and the embodiments of the present application do not specifically limit this. It is understandable that the various functions involved in the embodiments of the present application may be functions of network elements in hardware devices, or may be software functions running on dedicated hardware, or may be a combination of hardware and software, or may be virtualized functions instantiated on a platform (e.g., a cloud platform).

[0116] It should be noted that the embodiments of the present application do not limit the distribution form of each function. In an optional design, the various functions included in the above system architecture may also correspond to other functional entities formed by the integration of any multiple functions mentioned above or with other functions, for example, a functional entity having two functions of session management and policy control, or a functional entity having three functions of session management, access and mobility management and policy control, or a functional entity having two functions of network openness and application functions.

[0117] It should be noted that Figure 1-2 The system architecture shown does not constitute a limitation of the system architecture to which the embodiments of the present application can be applied. Figure 2The number of terminal devices in the embodiment is just an example. In actual applications, the network device can provide services for multiple terminal devices. The network device, as well as all or part of the multiple terminal devices, can adopt the communication method provided in the embodiment of the present application. Each function or device involved in the embodiment of the present application can also be referred to as a communication device, which can be a general device or a special device, and the embodiment of the present application does not specifically limit this.

[0118] It should be noted that in the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0119] Furthermore, unless otherwise specified, the ordinal numbers such as "first", "second", and "third" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the priority or importance of multiple objects. For example, the first node, the second node, and the third node are only used to distinguish different nodes, rather than indicating the difference in priority or importance of the three nodes.

[0120] In addition, it should be noted that in each embodiment of the present application, the service of the first communication technology can be understood as a service implemented by the first communication technology (for example, a service implemented by a non-5G technology, and further such as a service implemented by a short-distance communication technology), or a service corresponding to the first communication technology (for example, a non-5G service, and further such as a short-distance communication service). The service of the second communication technology may include the service of the second communication technology in a converged communication scenario, wherein the service of the second communication technology can be understood as a service implemented by the second communication technology (for example, a service implemented by 5G), or a service corresponding to the second communication technology (for example, a 5G service). In each embodiment of the present application, the first communication connection corresponds to the first communication technology, and it can be understood that the first communication connection is a connection implemented based on the first communication technology. For example, when the first communication technology is a short-distance communication technology, the first communication connection is a connection implemented by using a short-distance communication technology. Further optionally, through the communication connection, the service of the first communication technology can be transmitted, or the service of the second communication technology can be transmitted. This will not be described one by one below. In each embodiment of the present application, the network corresponding to the second communication technology can be understood as a network that at least supports the second communication technology, or a network that at least supports service transmission based on the second communication technology, such as a 5G network, or a 5G core network.

[0121] based on Figure 1 and Figure 2 The system architecture shown, in the converged communication scenario of the embodiment of the present application, in an optional design, for the first communication system composed of the first node 110 and the second node 120, in order to ensure the communication security of the first communication system, the second node 120 can use a preset key to authenticate each other with the first node 110 when initially establishing a link with the first node 110 after selecting a trusted first node 110, and after the identity authentication is successful, establish a communication connection between the two parties based on the security context corresponding to the key. Further, in order to ensure the communication security of the heterogeneous communication system composed of the first node 110, the second node 120 and the third node 130, the second node 120 can also initiate a new identity authentication and / or security context negotiation process to the third node 130 through the first node 110 to negotiate and determine a new key and corresponding security context between the three.

[0122] In the case where there are at least two sets of keys and / or corresponding security contexts in the first node 110 and the second node 120, the first node 110 and the second node 120 can also select the required key or security context from the at least two sets of keys and / or corresponding security contexts, so as to establish a secure communication connection with the opposite node based on the selected key or security context, thereby ensuring the security requirements for executing corresponding communication services and / or transmitting communication service data between the two parties.

[0123] It should be noted that in the embodiment of the present application, the key is a parameter, which can be a parameter input in the algorithm for converting plaintext to ciphertext or the algorithm for converting ciphertext to plaintext. Any two of the first node 110, the second node 120, and the third node 130 can initiate an identity authentication process and / or a security context (SecurityContext) negotiation process based on the key. After the identity authentication between the two parties is successful, the two parties can obtain a consensus security context, that is, access control attributes. Based on the security context, the two parties can initiate a connection establishment process to establish a secure communication connection between the two parties. It should be understood that if there is already a consensus security context between any two of the first node 110, the second node 120, and the third node 130, there is no need for the two parties to perform the above-mentioned identity authentication process and / or security context negotiation process, and the consensus security context can be directly used to initiate a connection establishment process to establish a secure communication connection between the two parties.

[0124] It should be understood that in the embodiment of the present application, the first node 110, the second node 120 or the third node 130 can support one or more key negotiation algorithms, and any two of the first node 110, the second node 120 and the third node 130 can also complete the key negotiation between the two parties through information interaction before initiating the above-mentioned identity authentication process and / or security context negotiation process. For example, the key negotiation algorithm may include but is not limited to: an asymmetric encryption algorithm: such as a public key encryption (Rivest-Shamir-Adleman, RSA) algorithm, an elliptic curve encryption (Elliptic Curves Cryptography, ECC) algorithm, etc.; a dedicated key interaction algorithm: such as a Diffie-Hellman algorithm (DH) algorithm, an elliptic curve Diffie-Hellman key exchange (Elliptic Curve Diffie-Hellman keyExchange, ECDH), etc.; a shared key algorithm: a pre-shared key (Pre-shared key, PSK) algorithm, etc., which is not limited in the embodiment of the present application. For the sake of ease of description, the specific implementation process of the communication method of the embodiment of the present application will be introduced below by taking the PSK algorithm as an example, which will not be repeated here.

[0125] Among them, identity authentication is also called "identity authentication" and "identity authorization", which refers to the confirmation of the node identity through certain means. There are many ways to implement the identity authentication method, for example, an identity authentication method based on PSK, an identity authentication method based on biological characteristics, and an identity authentication method based on a public key encryption algorithm. Among them, the identity authentication based on pre-shared keys means that at least two nodes can share one or a group of keys, such as between the first node 110 and the second node 120, or between the first node 110 and the third node 130, or between the first node 110, the second node 120 and the third node 130. When identity authentication is required, the first node 110 or the second node 120 or the third node 130 can send the PSK (or related parameters associated with the PSK, and the specific implementation method of the related parameters is not limited in the embodiment of the present application) to the opposite node. After receiving the PSK, the opposite node checks whether the PSK is consistent with the locally stored key. If they are consistent, it can be determined that the identity authentication is successful, and if they are inconsistent, it can be determined that the identity authentication fails. Only when any two nodes successfully authenticate each other can they obtain a consensus security context and establish a secure communication connection between the two parties based on the security context to ensure the security needs of executing corresponding communication services and / or transmitting communication service data between the two parties.

[0126] In the specific implementation process, a possible implementation method is that the first node 110 and the second node 120 can select the first information associated with the first service (for example, including the first key and / or the first security context), and perform information interaction based on the first information to establish a first communication connection between the first node 110 and the second node 120. The first communication connection can be used to transmit data of the first service, so as to meet the security requirements in the converged communication scenario while enabling the third node 130 to perceive the relevant information of the second node 120 through the first node 110, thereby achieving remote accessibility, perception, and management of the network and service of the second node 120. During implementation, in different scenarios, the process of the communication method can be triggered by the first node 110 or the second node 120, and the embodiments of the present application do not limit this.

[0127] For ease of understanding, the communication method is described below in conjunction with the accompanying drawings and embodiments. It should be noted that the steps included in the various method embodiments described in this application are only examples of optional steps of the communication method, and do not limit the specific implementation process of the communication method. In some optional implementations, the steps in any method embodiment can also be exchanged in the order of implementation.

[0128] like Figure 3 As shown, in one example, the method flow may be triggered by the first node 110 and may include the following steps:

[0129] S310: The first node 110 obtains first information.

[0130] S320: The first node 110 establishes a first communication connection with the second node 120 according to the first information, where the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node 110 is a node accessing a network corresponding to a second communication technology.

[0131] It can be understood that the first information is associated with the first service. For example, the first service may be a service of the first communication technology or a service of the second communication technology.

[0132] It should be understood that in the embodiments of the present application, the first node and the second node are described to distinguish different nodes. In some examples, the first node may be the second node, and the second node may be the first node. Figure 3 The method flow shown in the figure may be triggered by the second node 120, that is, the second node 120 may obtain the first information and establish a first communication connection with the first node 110 according to the first information, which is not limited in this embodiment of the present application.

[0133] Among them, the above-mentioned first information may include relevant information required to establish a secure communication connection between the first node 110 and the second node 120. The first information may be pre-stored on the first node 110 or the second node 120 side, or may be obtained by the first node 110 or the second node 120 from the network side or other device side. The embodiment of the present application is not limited to this.

[0134] In the embodiment of the present application, the first node 110 and the second node 120 may be in a scenario without a security context, and the first information may include a first key for communication authentication between the first node 110 and the second node 120. When S320 is implemented, the first node 110 may perform identity authentication and security context negotiation processes with the second node 120 based on the first key, and then, based on the first security context obtained through negotiation, the first communication connection may be established between the first node 110 and the second node 120. Alternatively, the first node 110 and the second node 120 may be in a scenario with a security context, and the first information may include a first security context for communication between the first node 110 and the second node 120. When S320 is implemented, the first communication connection may be established between the first node 110 and the second node 120 based on the first security context.

[0135] In one possible design, when the first information is a key for communication authentication between the first node 110 and the second node 120, the key may include a preset key on the first node 110 or the second node 120 side, or the key may come from a network of the second communication technology (e.g., a core network on the third node 130 side), such as a key for a service of the second communication technology.

[0136] In the embodiment of the present application, the specific implementation process of S310-S320 is different in different situations. For ease of understanding, it is introduced below in conjunction with the method flow chart.

[0137] Scenario 1: The first information includes a first key used for communication authentication between the first node 110 and the second node 120 .

[0138] In this case, the first node 110 and the second node 120 have no first security context associated with the first service. When the first communication connection is established between the first node 110 and the second node 120, the first key may be obtained first, and then based on the obtained first key, identity authentication and negotiation of the first security context may be performed on each other. When the identity authentication between the two parties is successful and the first security context is obtained, the first node 110 may initiate a message for establishing a communication connection to the second node 120 based on the obtained first security context, so as to establish the first communication connection between the first node 110 and the second node 120 based on the first security context.

[0139] Method example 1:

[0140] In method example 1, the second node 120 may obtain the first key. After the second node 120 obtains the first key, it may report key type indication information or service type indication information to the first node 110. The first node 110 determines the first key according to the key type indication information or service type indication information reported by the second node 120, and performs identity authentication and security context negotiation process with the second node 120, thereby establishing a secure first communication connection between the first node 110 and the second node 120. It should be noted that steps S411-S419 included in method example 1 are only examples of optional steps. In some examples, the following steps may also be implemented in an interchangeable order, which is not specifically limited in the embodiments of the present application. Figure 4a As shown, the communication method may include the following steps:

[0141] S411 (optional): The first node 110 sends a sixth message (eg, a system message). Correspondingly, the second node 120 may receive the sixth message.

[0142] For example, the sixth message may carry (or bear) first indication information, and the first indication information may be used to indicate the service type supported by the first node 110 (including support for services corresponding to the second communication technology).

[0143] In an optional design, the first indication information may also indicate one or more key agreement algorithms supported by the first node 110, so that the second node 120 can select a key agreement algorithm that is also supported by the first node 110 from the key agreement algorithms supported by itself according to the first indication information to complete the key agreement between the two parties, so as to generate relevant authentication parameters for node identity authentication according to the key agreement algorithm determined by negotiation (such as the aforementioned PSK algorithm). It should be understood that the key agreement between the first node 110 and the second node 120 may not be limited to being implemented through the sixth message, and the embodiments of the present application do not limit this. For ease of understanding and explanation, the PSK algorithm is used as an example for introduction in this article.

[0144] Furthermore, the sixth message may also carry an identity of the first node 110 (eg, a domain ID), and the identity may be used to uniquely identify the first node 110 .

[0145] For example, the sixth message may be a unicast message, and in S411, the first node 110 may send the sixth message to the second node 120. Alternatively, the sixth message may be a broadcast message, and in S411, the first node 110 may broadcast the sixth message, and the second node 120 may be within the coverage of the broadcast signal and may receive the sixth message.

[0146] After receiving the sixth message, the second node 120 can learn the service type supported by the first node 110 by parsing the sixth message.

[0147] S412: The second node 120 (eg, the service layer of the second node 120) obtains the first key or the type of the first key according to the type corresponding to the second communication technology and / or according to the service type of the first service.

[0148] For example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology.

[0149] It should be understood that when implementing S412, the second node 120 can also obtain the first key or the type of the first key based on relevant indication information input by the user, or obtain the first key or the type of the first key based on relevant indication information from other devices. This embodiment of the present application does not limit this.

[0150] It should be understood that in the embodiment of the present application, the second node 120 may obtain the first key or the type of the first key in other ways, which is not limited in the embodiment of the present application.

[0151] In the embodiment of the present application, in a converged communication scenario based on the first communication technology and the second communication technology, the first key may include any of the following implementations:

[0152] Example 1: The first key is a key used for a service of the first communication technology.

[0153] The first key may be a key configured between the first node 110 and the second node 120 (for example, corresponding to the preset key mentioned above), which corresponds to the service of the first communication technology and can be used to establish a first communication connection after completing identity authentication and security context negotiation between the first node 110 and the second node 120, and execute the service of the first communication technology based on the established first communication connection, or securely transmit service data based on the first communication technology. Accordingly, the security context corresponding to the key is the security context of the service of the first communication technology. In the embodiment of the present application, for ease of distinction, the key for the service of the first communication technology may also be referred to as an ordinary key, and the security context corresponding to the ordinary key may also be referred to as an ordinary security context.

[0154] Wherein, taking the common key as a common PSK as an example, the configuration method of the common PSK may include any one of the following methods:

[0155] ① Key configuration method: Through a pre-configuration method, the common PSK is pre-configured on the first node 110 and the second node 120. The detailed implementation of the pre-configuration method is not described here.

[0156] ② Configuration password method: The user enters the same password on the first node 110 and the second node 120. The password can be converted into the common PSK, for example, it can be converted into the common PSK through an algorithm implementation in the node (such as a key agreement algorithm implementation). It should be understood that different second nodes 120 can use different passwords to access the same first node 110, which will not be repeated here.

[0157] ③ Third-party server authentication credential configuration method: The main purpose of the third-party server authentication credential configuration method is to identify whether the second node 120 meets the preset binding relationship with the first node 110. The second node 120 should be able to obtain the identity of the first node 110, and use the identity of the second node 120 and the identity of the first node 110 to generate verification information and send it to the third-party server to obtain the authentication password. After the first node 110 and the second node obtain the authentication password sent by the third-party server, they obtain the ordinary PSK based on the authentication password.

[0158] Through any of the above configuration methods, the same common PSK can be configured between the second node 120 and the first node 110. It should be understood that in the embodiment of the present application, the second node 120 and the first node 110 can also complete the configuration process of the PSK for the service of the first communication technology between the two nodes through other methods, which will not be repeated here.

[0159] Example 2: The first key is a key used for a service of the second communication technology.

[0160] For the convenience of distinction, the key used for the second communication technology may be referred to as a fusion key. In a specific implementation, the fusion key may include a trusted key or an untrusted key, wherein the trusted key is a key that has been successfully authenticated by the network (for example, in the fusion communication scenario mentioned above, the second node 120 initiates a new identity authentication and / or security context negotiation process to the third node 130 through the first node 110, and the new key between the three is determined), and the untrusted key is a key that has not been authenticated by the network (for example, the preset key used when the second node and the first node are initially established, and the preset key can be used for the first node and the second node to authenticate each other). The network here can be understood as the network corresponding to the third node, for example, it can be a 5G core network. It should be understood that in the embodiment of the present application, the key that has not been authenticated by the network can be understood as: a key that has not been confirmed by the network or does not need to be confirmed by the network (for example, a default key), or a key that has been confirmed by the network but has not been successfully confirmed. The first key may be a trusted key or an untrusted key. The first key corresponds to the service of the second communication technology and can be used to ensure that the service of the second communication technology is securely implemented between the first node 110, the second node 120 and the third node 130 or the service data implemented by the second communication technology is securely transmitted in the converged communication scenario. The first key may be, for example, a key negotiated between the third node 130 and at least one of the first node 110 and the second node 120 (for example, corresponding to the new key mentioned above, or corresponding to a trusted key). For example, the first key may be a key negotiated between the third node 130 and the first node 110, or another example, the first key may be a key negotiated between the third node 130 and the second node 120, or another example, the first key may be a key negotiated between the first node 110, the second node 120 and the third node 130; or another example, the first key may be an untrusted key.

[0161] Taking the fusion key as a fusion PSK as an example, the fusion PSK may be sent from the core network on the third node 130 side to the first node 110 and / or the second node 120, or the PSK may also be a default key parameter configured at the first node 110 or the second node 120, and the configuration implementation may be one of the three methods in Example 1 or other implementation methods, which is not limited in the embodiments of the present application. The first node or the second node may receive a fusion key from a network corresponding to the second communication technology. For example, before establishing a first communication connection between the first node and the second node, the first node or the second node may receive a fusion key from the network and save it locally, so that in the subsequent first communication connection establishment process, the first node or the second node may determine the first key used in the first communication connection establishment process according to the type of the corresponding second communication technology and / or according to the service type of the first service. The first node receives a fusion key from a network corresponding to the second communication technology before establishing the first communication connection, and it is also convenient for the first node to obtain the first key according to the received first information during the first communication connection establishment process.

[0162] Among them, if the PSK has not undergone the authentication and key negotiation process of the core network (such as the 5G core network) on the side of the third node 130 or no agreement has been reached through negotiation, the fused PSK is an untrusted fused PSK. If the fused PSK has undergone the authentication and / or key negotiation process of the core network on the side of the third node 130 and an agreement has been reached, the fused PSK is a trusted fused PSK. Accordingly, the security context corresponding to the trusted fused PSK is a trusted security context for the service of the second communication technology in a converged communication scenario, and the security context corresponding to the untrusted fused PSK is an untrusted security context for the service of the second communication technology in a converged communication scenario. It should be understood that in an embodiment of the present application, the network corresponding to the second communication technology can be understood as a network that at least supports the second communication technology, or a network that at least supports service transmission based on the second communication technology.

[0163] In embodiment S412, the second node 120 selects a key as the first key from at least two keys mentioned in the above example 1 or example 2 according to the type corresponding to the second communication technology and / or according to the service type of the first service.

[0164] It should be noted that in an embodiment of the present application, when there are multiple keys, the multiple keys may have priorities and usage principles, wherein the first key is associated with the first service, and selecting the first key from the multiple keys needs to at least follow the following principles: when the first service is a service of the first communication technology, the first key is the key used for the service of the first communication technology; and / or, when the first service is a service corresponding to the second communication technology, the first key is the key used for the service of the second communication technology.

[0165] Taking the above-mentioned ordinary PSK, trusted fusion PSK and untrusted fusion PSK as examples, the specific principles for using the multiple keys can be: 1) In the converged communication scenario, for the service of the second communication technology, if there is a trusted fusion PSK, the untrusted fusion PSK is not used, but the trusted fusion PSK is used, that is, the priority of the trusted fusion PSK is higher than the priority of the untrusted fusion PSK; 2) In the converged communication scenario, for the service of the second communication technology, when there is no trusted fusion PSK, the untrusted fusion PSK is used instead of the ordinary PSK; 3) For the service of the first communication technology, even if there is a fusion PSK, the ordinary PSK must be used to ensure the security of the private service between the first node 110 and the second node 120.

[0166] Based on the above-mentioned key usage principle, the second node 120 can obtain the corresponding first key or the type of the first key according to the service type of the first service. For example, if the first service is a service of the second communication technology in a converged communication scenario, then if there is a trusted converged PSK, the trusted converged PSK is used (further, if the connection establishment based on the trusted converged PSK fails, then the untrusted converged PSK is used), and if there is no trusted converged PSK, the untrusted converged PSK is used. Generally, the untrusted converged PSK can be a default value. For example, when the first node 110 and the second node 120 are devices that support the second communication technology, the first node 110 and the second node 120 can be configured with the untrusted converged PSK. For another example, if the first service is a service of the first communication technology, the first node 110 and the second node 120 can establish a first communication connection through a common PSK.

[0167] S413a: The second node 120 (eg, the service layer of the second node 120 ) sends a first message to the first node 110 . Accordingly, the first node 110 may receive the first message from the second node 120 .

[0168] In an embodiment of the present application, the first message may also be referred to as a key indication message, and the first message may carry information associated with the first key, such as key type indication information or service type indication information or other information.

[0169] In an embodiment of the present application, the key type indication information may be used to indicate that the key type is any of the following: an untrusted fusion key (e.g., the aforementioned untrusted fusion PSK), a trusted fusion key (e.g., the aforementioned trusted fusion PSK), or an ordinary key (e.g., the aforementioned ordinary PSK). The service type indication information may be used to indicate that the service type is any of the following: a service of the first communication technology, or, in a fusion communication scenario, a service of the second communication technology.

[0170] In some designs, the first message may also carry an identity of the second node 120 (eg, a media access layer identity). For example, the first message may be represented as the following tuple:

[0171] (ID, key type indication information or business type indication information).

[0172] S414: The first node 110 obtains the first key according to the key type indication information or the service type indication information.

[0173] In an embodiment of the present application, the first node 110 may store multiple keys. When implementing S414, the first node 110 may obtain the first key from the local multiple keys according to the key type indication information or the business type indication information. Alternatively, when implementing S414, the first node 110 may obtain the first key from other devices according to the key type indication information or the business type indication information, and this embodiment of the present application is not limited to this. For example, the first key may be any one of the ordinary PSK, untrusted fusion PSK or trusted fusion PSK as described above. The configuration process of the ordinary PSK, untrusted fusion PSK or trusted fusion PSK can refer to the relevant description in S412, and no specific description is given.

[0174] Thus, the first node 110 and the second node 120 can reach an agreement on the selected first key through negotiation. Further, the first node 110 and the second node 120 can perform identity authentication and security context negotiation processes based on the obtained first key.

[0175] For example, Figure 4a As shown, the identity authentication and security context negotiation process may include the following steps:

[0176] S415a (optional): The second node 120 sends an association request message to the first node 110. Correspondingly, the first node 110 receives the association request message.

[0177] For example, the association request message may carry the identity of the second node 120 (e.g., a domain identifier), and related authentication parameters for the identity authentication of the second node 120, including but not limited to the key agreement algorithm (e.g., represented by KE alg), key agreement parameters (e.g., represented by KEt), security capabilities (sec capabilities) and random numbers (e.g., represented by NONCEt) selected by the second node 120, etc. The security capabilities may include one or more of the key derivation function (KDF), encryption algorithm, integrity protection algorithm, and authentication encryption algorithm supported by the second node 120, which will not be described in detail here.

[0178] The first node 110 may process the association request message based on the relevant information carried in the association request message.

[0179] For example, for the second node 120 accessed by configuring a key, if the first node 110 is configured with a whitelist, the first node 110 can determine whether the fixed identity of the second node 120 is in the whitelist based on the identity identifier of the second node 120. If not, the association request message is discarded.

[0180] For another example, the first node 110 may determine whether the key agreement algorithm selected by the second node 120 is in the information carried by the aforementioned sixth message (e.g., the first indication information). If not, the association request message is discarded; if yes, the first node 110 may select the algorithm with the highest priority according to the security capability of the second node 120, the algorithm preference policy preconfigured by the first node 110, and the service type, including the key derivation function with the highest priority, the authentication encryption algorithm and integrity protection algorithm of the signaling plane, and the authentication encryption algorithm and integrity protection algorithm of the user plane with the highest priority, or the authentication encryption algorithm of the user plane with the highest priority. Among them, the algorithm preference policy can be implemented by a list of algorithms sorted by priority, such as the key derivation function priority list preconfigured by the first node 110, the signaling plane authentication encryption algorithm priority list, the signaling plane integrity protection algorithm priority list, the user plane authentication encryption algorithm priority list, the user plane integrity protection algorithm priority list, etc. The algorithms selected by the signaling plane and the user plane may be different. In an optional design, when the selected integrity algorithm or authentication encryption algorithm supports multiple message integrity code (MIC) lengths, the first node 110 can also select the MIC length of the signaling plane integrity protection according to the MIC length supported by the selected signaling plane integrity protection algorithm. This process can be implemented, for example, through corresponding operations of the Star Flash Alliance specification, or through other methods, which is not specifically limited in the embodiments of the present application.

[0181] In an optional design, the first node 110 may also generate relevant authentication parameters for identity authentication of the first node 110 based on the relevant information carried in the first message and / or the relevant algorithm selected by the first node 110 itself.

[0182] For example, the first node 110 may generate a private key and generate a corresponding public key according to the selected key agreement algorithm (for example, the specific key agreement algorithm can refer to the relevant description in S411), and the public key can be used as a key agreement parameter of the first node 110 (for example, represented by KEg). Alternatively, the first node 110 may generate a random number (for example, represented by NONCEg). Alternatively, the first node 110 may calculate a shared key (for example, represented by KKE) based on KEt and the key agreement algorithm carried in the first message. Alternatively, the first node 110 may calculate a shared key (for example, represented by Kgt) using a selected key derivation function based on KKE, NONCEt and NONCEg, and the calculation method is as follows:

[0183] Kgt=KDF(KKE,NONCEt,NONCEg).

[0184] Alternatively, the first node 110 may generate an identifier of Kgt (for example, represented by Kgt ID). Alternatively, the first node 110 may calculate an authentication parameter (for example, represented by AUTHg) in the following manner:

[0185] AUTHg=AUF(PSK, KKE, NONCEg, association request message)|high 32 bits.

[0186] Among them, AUF()|high 32 bits means that the parameters included in the brackets are operated by the key derivation function AUF, and then the high 32 bits of information are taken as AUTHg. AUF and the aforementioned KDF use the same authentication encryption algorithm.

[0187] The first node 110 may generate a security context request message (an example of the second message) based on the acquired first key and one or more of the above-mentioned related authentication parameters.

[0188] For example, the security context request message may include relevant authentication parameters for identity authentication of the first node 110, including but not limited to the key negotiation parameter KEg of the first node 110, the random number NONCEg, the identifier Kgt ID associated with the first security context corresponding to the first key, the selected algorithm (algorithm), the MIC length (MIC length) and the authentication parameter AUTHg. The selected algorithm (algorithm) may include one or more of the key derivation algorithm, the encryption algorithm and integrity protection algorithm of the signaling plane, the encryption algorithm and integrity protection algorithm of the user plane, and the authentication encryption algorithm of the user plane.

[0189] In an optional design, the first node 110 may also use the selected signaling plane integrity protection algorithm and integrity protection key Ks.int to perform integrity protection on the security context request message, that is, calculate the MIC and include the MIC in the security context request message.

[0190] For example, the security context request message can be represented as the following tuple:

[0191] (KEg,NONCEg,Kgt ID,algorithm,MIC length,AUTHg)MIC.

[0192] The ()MIC indicates that the security context request message is a message that has been processed with integrity protection.

[0193] S416 : The first node 110 sends a security context request message (an example of a second message) associated with the first key to the second node. Accordingly, the second node 120 receives the security context request message from the first node 110 .

[0194] In the embodiment of the present application, the second message can be used for the identity authentication of the first node 110. It should be understood that in the embodiment of the present application, the second message can be used for the identity authentication of the first node 110, which can be understood as the information contained or carried by the second message can be used for the identity authentication of the first node 110.

[0195] In an embodiment of the present application, the second message is associated with the first key. In an optional design, the information carried by the second message includes information generated based on the first key.

[0196] In an optional design, the second node 120 may calculate the shared key Kgt, the security key of the signaling plane, the security key of the user plane, etc. according to the key derivation function selected by the first node 110 in the same manner as the first node 110 .

[0197] In an optional design, the second node 120 may check the integrity of the second message, that is, check whether the MIC is correct. If the integrity verification fails, the second node 120 discards the message and may resend the association request message.

[0198] In an optional design, the second node 120 may also verify whether AUTHg is correct based on the first key agreed upon by negotiation. If AUTHg verification fails, the second node 120 discards the second message and may resend the association request message. It should be understood that in the embodiment of the present application, checking the integrity of the message may include checking the integrity of the information included in or carried by the message.

[0199] Furthermore, the second node 120 may also generate relevant authentication parameters for identity authentication of the second node 120 according to the relevant information carried in the security context request message and / or its own relevant algorithm.

[0200] For example, the second node 120 may calculate the authentication parameter AUTHt, and the calculation method complies with the following expression:

[0201] AUTHt=AUF(PSK, KKE, security context request message, NONCEt, key negotiation algorithm capability of the first node 110, first indication information)|high 32 bits;

[0202] Among them, AUF()|high 32 bits means that the parameters included in the brackets are operated by the key derivation function AUF, and then the high 32 bits of information are taken as AUTHt. AUF and the aforementioned KDF use the same authentication encryption algorithm.

[0203] In an optional design, the second node 120 may generate a security context response message (an example of a third message) based on the relevant authentication parameters generated above after successfully authenticating the identity of the first node 110.

[0204] S417: The second node 120 sends a security context response message (an example of the third message) to the first node 110. Accordingly, the first node 110 receives the security context response message from the second node 120.

[0205] In the embodiment of the present application, the third message may be used for identity authentication of the second node, and the third message may be sent when the identity authentication of the first node 110 is successful.

[0206] It should be understood that in the embodiment of the present application, the third message can be used to indicate the success of the identity authentication of the first node 110, and the identity authentication of the second node 120, and the third message contains or carries information used to indicate the success of the identity authentication of the first node and the information used for the identity authentication of the second node. In addition, as an optional design, in the embodiment of the present application, the information used to indicate the success of the identity authentication of the first node 110 and the information used for the identity authentication of the second node 120 can be sent through the same message or through different messages. Accordingly, the third message can correspond to one message or multiple messages, which is not limited in the embodiment of the present application. For example, the third message can include AUTHt.

[0207] For example, the second node 120 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the security context response message.

[0208] It should be understood that in the embodiment of the present application, the second node 120 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the security context response message. It can be understood that the second node 120 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the information contained or carried by the security context response message. The MIC generated by the integrity protection may be carried in the security context response message. When the signaling plane encryption protection is started, the second node 120 may use the encryption algorithm of the signaling plane and the encryption key Ks.enc to encrypt the security context response message.

[0209] For example, the security context response message may be expressed as follows:

[0210] (AUTHt)MIC.

[0211] Among them, AUTHt is an example of relevant authentication parameters carried in the security context response message, and ()MIC indicates that the security context response message is a message that has been processed with integrity protection.

[0212] In addition, if the second node 120 encrypts the security context response message (or encrypts the information contained in or carried by the security context response message), the first node 110 can decrypt the security context response message (or decrypt the information contained in or carried by the security context response message) after receiving the security context response message.

[0213] The first node 110 may check the integrity of the security context response message (or check the integrity of the message contained in or carried by the security context response message), and verify whether the AUTHt carried in the security context response message is correct. If the integrity or AUTHt verification fails, that is, the identity authentication of the second node 120 is unsuccessful, the first node 110 may send an association establishment failure message to the second node 120. If the integrity and AUTHt verifications pass, the first node 110 may generate a temporary ID (e.g., a physical layer identifier) ​​for the second node 120 to identify the identity of the second node 120.

[0214] The first node 110 may perform identity authentication on the second node 120 according to the relevant information carried in the security context response message. This process may be implemented, for example, through corresponding operations of the Star Alliance specification, or may be implemented in other ways, which is not specifically limited in the embodiments of the present application.

[0215] S418 : The first node 110 may send an association establishment message (an example of a fourth message) to the second node 120 when the identity authentication of the second node 120 succeeds. Accordingly, the second node 120 receives the association establishment message from the first node 110 .

[0216] In the embodiment of the present application, the fourth message may be used to establish the first communication connection with the second node, and the fourth request message may be sent when the identity authentication of the second node 120 is successful.

[0217] It should be understood that in the embodiment of the present application, the fourth message can be used to indicate that the identity authentication of the second node is successful, and to request to establish a first communication connection with the second node, and the third message includes or carries information for indicating that the identity authentication of the second node is successful and information for requesting to establish a first communication connection with the second node. In addition, as an optional design, in the embodiment of the present application, the information for indicating that the identity authentication of the second node is successful and the information for requesting to establish a first communication connection with the second node can be sent through the same message or through different messages. Accordingly, the fourth message can correspond to one message or multiple messages, and the embodiment of the present application does not limit this.

[0218] By way of example, the fourth message may include one or more of the following parameters generated by the first node 110 for the second node 120: a temporary ID (T-ID) (for example, a physical layer identifier), validity period (Kgt expiration) of the shared key Kgt, [GKc / GK], [GK ID], [Galgorithm], [GK validity period (GK expiration)].

[0219] Wherein, [GKc / GK] indicates that when the encryption protection of the unicast signaling plane is enabled, the group key of the group to which the second node 120 belongs (for example, represented by GK) is carried, and when the encryption protection of the unicast signaling plane is not enabled, GKc is carried. GKc is obtained by performing an XOR process on GK and a key (for example, represented by Kg) protecting the confidentiality of the group key GK:

[0220] Kg=KDF(Kgt,COUNTERg,"group key");

[0221] GKc=GK⊕Kg.

[0222] [GK ID] is the identifier of the GK, and Galgorithm is the group algorithm of the group to which the second node 120 belongs.

[0223] In an optional design, the first node 110 may use the integrity protection algorithm and integrity protection key Ks.int of the signaling plane to perform integrity protection on the association establishment message.

[0224] It should be understood that in the embodiment of the present application, the first node 110 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the association establishment message. It can be understood that the first node 110 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the information contained or carried by the association establishment message. The MIC generated by the integrity protection may be carried in the association establishment message. When the signaling plane encryption protection is activated, the first node 110 may use the encryption algorithm of the signaling plane and the encryption key Ks.enc to encrypt the association establishment message.

[0225] It should be understood that in an embodiment of the present application, the first node 110 can use the encryption algorithm and encryption key Ks.enc of the signaling plane to encrypt and protect the association establishment message. It can be understood that the first node 110 can use the encryption algorithm and encryption key Ks.enc of the signaling plane to encrypt and protect the information contained in or carried by the association establishment message.

[0226] For example, the association establishment message can be represented as the following tuple:

[0227] (Temporary ID,Kgt expiration,[GKc / GK],[GK ID],[Galgorithm],[GK expiration])MIC.

[0228] Among them, ()MIC indicates that the association establishment message is a message that has been processed with integrity protection.

[0229] In an optional design, when the second node 120 receives an association establishment failure message, it may re-initiate an association request message.

[0230] In an optional design, when the second node 120 receives the association establishment message, if the association establishment message is encrypted (or the information contained in or carried by the association establishment message is encrypted), the second node 120 may decrypt the association establishment message (or decrypt the information contained in or carried by the association establishment message). The second node 120 may also check the integrity of the association establishment message (or check the integrity of the information contained in or carried by the association establishment message).

[0231] If the integrity verification fails, the second node 120 discards the message.

[0232] If the integrity verification passes, S419: the second node 120 may send an association completion message to the first node 110. Accordingly, the first node 110 may receive an association completion message from the second node 120, and the association completion message may be used to indicate that the first communication connection is established successfully.

[0233] In an optional design, the second node 120 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the association completion message.

[0234] It should be understood that in the embodiment of the present application, the second node 120 may use the integrity protection algorithm and integrity protection key Ks.int of the signaling plane to perform integrity protection on the association completion message. It can be understood that the second node 120 may use the integrity protection algorithm and integrity protection key Ks.int of the signaling plane to perform integrity protection on the information contained or carried by the association completion message. When the signaling plane encryption protection is started, the second node 120 may use the encryption algorithm and encryption key Ks.enc of the signaling plane to encrypt and protect the association completion message. It should be understood that in the embodiment of the present application, the second node 120 may use the encryption algorithm and encryption key Ks.enc of the signaling plane to encrypt and protect the association completion message. It can be understood that the second node 120 may use the encryption algorithm and encryption key Ks.enc of the signaling plane to encrypt and protect the information contained or carried by the association completion message.

[0235] For example, the association completion message may be expressed as follows:

[0236] (Association Complete Message) MIC.

[0237] Among them, ()MIC indicates that the association completion message is a message that has been processed with integrity protection.

[0238] The first node 110 may process the received association completion message.

[0239] For example, if the association completion message is encrypted (or the information contained in or carried by the association completion message is encrypted), the first node 110 may decrypt the association completion message (or decrypt the information contained in or carried by the association completion message). Alternatively, the first node 110 may check the integrity of the association completion message (or check the integrity of the information contained in or carried by the association completion message). If the integrity verification fails, the message is discarded. If the integrity verification passes, the subsequent process is executed, which will not be repeated here.

[0240] After the above security context negotiation and association are completed, the first node 110 and the second node 120 may save the negotiated first security context.

[0241] By way of example, the first security context may include, but is not limited to, the aforementioned identity ID, temporary ID, Kgt, Kgt validity period, Kgt ID, key negotiation algorithm, encryption algorithm and integrity protection algorithm of the signaling plane, encryption key and integrity protection key of the signaling plane, encryption algorithm and integrity protection algorithm of the user plane or authentication encryption algorithm of the user plane, encryption key and integrity protection key of the user plane or authentication encryption key of the user plane, [GK], [GK ID], [group algorithm], [GK validity period], etc.

[0242] In an optional design, in the embodiment of the present application, the first node 110 and the second node 120 may also support a security context expiration deletion mechanism, and the node that needs to save the security context may configure a clock to support the mechanism, which will not be described in detail here. Alternatively, the first node 110 may also save the corresponding relationship between the identity identifier of the second node 120 and the first key, and the second node 120 may also save the corresponding relationship between the identity identifier of the first node 110 and the first key.

[0243] After the first communication connection is established, when the first node 110 and the second node 120 perform services, the service scope of the first communication connection can be determined according to the key type or the service type, and the services corresponding to the service scope can be transmitted.

[0244] For example, a communication connection (including security context) established based on a trusted converged PSK can only be used for services of the second communication technology in a converged communication scenario. A communication connection (including security context) established based on a common PSK is used for services of the first communication technology (e.g., services other than services of the second communication technology in a converged communication scenario).

[0245] Method Example 2:

[0246] In the second example of the method, the second node 120 can obtain the first key. After the second node 120 obtains the first key, it can simultaneously obtain the relevant parameters for the identity authentication of the second node 120, and carry the key type indication information or the service type indication information and the relevant parameters for the identity authentication of the second node 120 in the same message (such as the association request message), so that the first node 110 can determine the first key according to the key type indication information or the service type indication information reported by the second node 120, and perform the identity authentication and security context negotiation process with the second node 120 based on the relevant parameters reported by the second node 120, so as to establish a secure first communication connection between the first node 110 and the second node 120. It should be noted that steps S411-S419 included in the second example of the method are only examples of optional steps. In some examples, the following steps can also be implemented in an interchangeable order, which is not specifically limited in the embodiments of the present application.

[0247] like Figure 4b As shown, in method example 2, the communication method may include the following steps:

[0248] S411 (optional): The first node 110 sends a sixth message (eg, a system message). Accordingly, the second node 120 may receive the sixth message. Figure 4a The description of S411 introduced above will not be repeated here.

[0249] S412: The second node 120 (eg, the service layer of the second node 120) obtains the first key or the type of the first key according to the type corresponding to the second communication technology and / or according to the service type of the first service. Figure 4a The description of S412 introduced above will not be repeated here.

[0250] S413b: The second node 120 sends an association request message to the first node 110. Accordingly, the first node 110 may receive the association request message from the second node 120.

[0251] and Figure 4aCompared with the method example 1 introduced, in the method example 2, the key type indication information or the service type indication information is carried in the association request message sent by the second node 120, that is, the association request message in the method example 2 corresponds to the combination of the first message and the association request message in the method example 1, and the association request message can carry the ID of the first node 110, the key type indication information or the service type indication information, and the relevant authentication parameters for the identity authentication of the second node 120, including but not limited to the KE alg and KEt selected by the second node 120, the security capability of the second node 120 and NONCEt, etc. The security capability may include one or more of the KDF, encryption algorithm, integrity protection algorithm and authentication encryption algorithm supported by the second node 120. For detailed implementation, please refer to the above in conjunction with Figure 4a The descriptions of S413a and S415a introduced above will not be repeated here.

[0252] S414: The first node 110 obtains the first key according to the key type indication information or the service type indication information. Figure 4a The S414 introduced above will not be described in detail here.

[0253] S416: The first node 110 sends a security context request message (an example of a second message) associated with the first key to the second node. Accordingly, the second node 120 receives the security context request message from the first node 110. For detailed implementation, please refer to the above combined Figure 4a The description of S416 introduced above will not be repeated here.

[0254] S417: The second node 120 sends a security context response message (an example of the third message) to the first node 110. Accordingly, the first node 110 receives the security context response message from the second node 120. For detailed implementation, please refer to the above combined Figure 4a The description of S417 introduced above will not be repeated here.

[0255] S418: The first node 110 may send an association establishment message (an example of a fourth message) to the second node 120 when the identity authentication of the second node 120 is successful. Accordingly, the second node 120 receives the association establishment message from the first node 110. For detailed implementation, please refer to the above combined Figure 4a The description of S418 introduced above will not be repeated here.

[0256] S419: The second node 120 may send an association completion message to the first node 110. Accordingly, the first node 110 may receive the association completion message from the second node 120. For detailed implementation, please refer to the above combined Figure 4a The description of S419 introduced above will not be repeated here.

[0257] Method example three:

[0258] In method example 3, the first node 110 may obtain the first key, and the first node 110 may perform identity authentication and security context negotiation processes with the second node 120 according to the first key, thereby establishing a secure first communication connection between the first node 110 and the second node 120. It should be noted that steps S421-S427 included in method example 3 are only examples of optional steps. In some examples, the following steps may also be implemented in an alternate order, which is not specifically limited in the embodiments of the present application.

[0259] like Figure 4c As shown, the communication method may include the following steps:

[0260] S421 (optional): The first node 110 sends a sixth message (eg, a system message). Accordingly, the second node 120 may receive the sixth message. Figure 4a The S411 introduced above will not be described in detail here.

[0261] S422: The second node 120 sends an association request message to the first node 110. Accordingly, the first node 110 may receive the association request message from the second node 120.

[0262] In the embodiment of the present application, the association request message may carry the identity ID of the second node 120 (e.g., media access layer identifier), and related parameters for indicating the capabilities of the second node 120, including but not limited to the key agreement algorithm (e.g., represented by KE alg), key agreement parameters (e.g., represented by KEt), security capabilities (sec capabilities) of the second node 120, and random number NONCEt, etc. The security capabilities may include one or more of the key derivation function KDF, encryption algorithm, integrity protection algorithm, and authentication encryption algorithm supported by the second node 120, which will not be described in detail here.

[0263] For example, the association request message may be represented as the following tuple:

[0264] (ID,KE alg,KEt,sec capabilities,NONCEt).

[0265] S423: The first node 110 obtains the first key according to a type corresponding to the second communication technology and / or according to a service type of the first service.

[0266] It should be understood that when implementing S423, the first node 110 may also obtain the first key according to the relevant indication information input by the user or obtain the first key according to the relevant indication information from other devices, and this embodiment of the present application does not limit this. The detailed implementation of S423 can be found in the above combined Figure 4a The S412 introduced above will not be described in detail here.

[0267] S424: The first node 110 sends a security context request message (an example of a second message) to the second node according to the first key. Accordingly, the second node 120 receives the security context request message from the first node 110, where the security context request message is associated with the first key. For detailed implementation details, see Figure 4a The relevant description of S416 will not be repeated here.

[0268] S425: The second node 120 sends a security context response message (an example of the third message) to the first node 110. Accordingly, the first node 110 receives the security context response message from the second node 120. For detailed implementation details, see Figure 4a The relevant description of S417 will not be repeated here.

[0269] S426: When the identity authentication of the second node 120 is successful, the first node 110 sends an association establishment message (an example of the fourth message) to the second node. Accordingly, the second node 120 receives the association establishment message from the first node 110. For detailed implementation details, see Figure 4a The relevant description of S418 will not be repeated here.

[0270] S427: The second node 120 may send an association completion message to the first node 110. Accordingly, the first node 110 may receive the association completion message from the second node. Figure 4a The relevant description of S419 will not be repeated here.

[0271] Therefore, in Figure 4a , Figure 4b , Figure 4c In the communication method shown, in a scenario where multiple keys exist, the first node 110 and the second node 120 can select a first key associated with a first service, and complete an identity authentication and security context negotiation process between the two parties based on the first key to establish a secure first communication connection between the two parties, so that when the first node 110 and the second node 120 conduct business, data of the corresponding business can be transmitted according to the secure communication connection established using different keys, so as to meet the security requirements in the converged communication scenario and ensure the security of the corresponding business data.

[0272] Among them, Figure 4a , Figure 4b Compared to the communication method shown, Figure 4c In the communication method shown, the first node 110 can actively select a key as the first key for the second node 120 based on the relevant capabilities of the second node 120, such as the service type, service characteristics, communication capabilities, etc. reported during registration. As a result, there is no need to exchange the first message (i.e., the key indication message) between the second node 120 and the first node 110, which can reduce signaling overhead.

[0273] Scenario 2: the first information includes a first security context used for communication between the first node 110 and the second node 120 .

[0274] In this case, the first node 110 and the second node 120 both have at least two sets of security contexts, such as the aforementioned common security context, trusted security context, and untrusted security context. The first node 110 and the second node 120 can negotiate and determine the required first security context in the at least two sets of security contexts, and establish a secure first communication connection based on the first security context. It should be noted that steps S431-S435 included in scenario 2 are only examples of optional steps. In some examples, the following steps can also be exchanged in the order of implementation, which is not specifically limited in the embodiments of the present application.

[0275] like Figure 4d As shown, the communication method may include the following steps:

[0276] S431 (optional): The first node 110 sends a sixth message (eg, a system message). Accordingly, the second node 120 may receive the sixth message. Figure 4a The S411 introduced above will not be described in detail here.

[0277] S432: The second node 120 obtains the first security context or the type of the first security context according to the type corresponding to the second communication technology and / or according to the service type of the first service.

[0278] It should be understood that when implementing S432, the second node 120 may also obtain the first security context or the type of the first security context according to the relevant indication information input by the user, or obtain the first security context or the type of the first security context according to the relevant indication information from other devices, and the embodiment of the present application does not limit this. It should be understood that in the embodiment of the present application, the second node 120 may obtain the first security context or the type of the first security context in other ways, and the embodiment of the present application does not limit this.

[0279] In the embodiment of the present application, in a converged communication scenario, the first security context may include any of the following implementations:

[0280] Example 3: The first security context is a security context for services of the second communication technology.

[0281] Among them, the security context for the service of the second communication technology includes a trusted security context or an untrusted security context, wherein the trusted security context is a security context that has been successfully authenticated by the network, and the untrusted security context is a security context that has not been authenticated by the network. The network here can be understood as the network corresponding to the third node, for example, it can be a 5G core network. It should be understood that in an embodiment of the present application, a security context that has not been authenticated by the network can be understood as: a security context that has not been confirmed by the network or does not need to be confirmed by the network (for example, a security context corresponding to a default key), or a security context that has been confirmed by the network but has not been successfully confirmed (for example, a security context corresponding to the aforementioned key that has not been authenticated by the network).

[0282] Taking the aforementioned security context corresponding to the PSK as an example, if the security context has not undergone the authentication and key negotiation process of the core network (e.g., 5G core network) on the third node 130 side or has not been negotiated to reach an agreement, the security context is an untrusted security context, corresponding to the aforementioned untrusted fused PSK. If the security context has undergone the authentication and key negotiation process of the core network on the third node 130 side and has been obtained through an agreement, the security context is a trusted security context, corresponding to the aforementioned trusted fused PSK.

[0283] Example 4: The first security context is a security context for a service of a first communication technology.

[0284] Among them, similar to the priorities and usage principles of the aforementioned multiple keys, in an embodiment of the present application, the at least two sets of security contexts may also have security context priorities and usage principles, wherein the first security context is associated with the first service, and selecting the first security context from the at least two sets of security contexts needs to at least follow the following principles: when the first service is a service of the first communication technology, the first security context is a security context for the service of the first communication technology; and / or, when the first service is a service of the second communication technology, the first security context is a security context for the service of the second communication technology.

[0285] For example, 1) for the services of the second communication technology in the converged communication scenario, if there is a trusted security context for the services of the second communication technology in the converged communication scenario, the untrusted security context for the services of the second communication technology in the converged communication scenario is not used, but the trusted security context is used, that is, the priority of the trusted security context is higher than the priority of the untrusted security context; 2) for the services of the second communication technology in the converged communication scenario, the security context for the services of the second communication technology in the converged communication scenario is used, and the security context for the services of the first communication technology is not used, that is, the priority of the untrusted security context for the services of the second communication technology in the converged communication scenario is higher than the priority of the security context for the services of the first communication technology; 3) for the services of the first communication technology, even if there is a security context for the services of the second communication technology in the converged communication scenario, the security context for the services of the first communication technology is used to ensure the security of the private services between the first node 110 and the second node 120.

[0286] When implementing S432, the second node 120 may obtain the first security context based on the above-mentioned usage principle, such as a security context for a service of the first communication technology, or an untrusted security context in a converged communication scenario, or a trusted security context in a converged communication scenario, according to the type corresponding to the second communication technology and / or the service type of the first service. For example, the type corresponding to the second communication technology may refer to the type of communication standard adopted by the second communication technology, such as 5G technology.

[0287] S433: The second node 120 sends an association request message (an example of the fifth message) to the first node 110. Accordingly, the first node 110 receives the association request message.

[0288] For example, the association request message may include a temporary ID of the second node 120 (eg, a physical layer identifier) ​​and / or an identifier associated with the first security context, such as a Kgt ID.

[0289] In an optional design, the second node 120 may also use the integrity protection algorithm and integrity protection key Ks.int of the signaling plane to perform integrity protection on the association request message, and the calculated MIC may be carried in the association request message.

[0290] For example, the association request message may be represented as the following tuple:

[0291] (Temporary ID, Kgt ID) MIC.

[0292] Among them, ()MIC indicates that the association request message is a message that has been processed with integrity protection.

[0293] S434: The first node 110 obtains the first security context according to the temporary ID and / or the Kgt ID.

[0294] In an optional design, the first node 110 may check the integrity of the association request message according to the first security context.

[0295] If the first node 110 does not have the temporary ID of the second node 120, or does not have the corresponding first security context, or the first node 110 fails to verify the MIC, the first node 110 may send a failure message to the second node 120 and carry a reason value (not shown in the figure). After receiving the failure message, the second node 120 may initiate an identity authentication process and a security context negotiation process without a security context, for example, see Figure 4a or Figure 4b The method steps are not repeated here.

[0296] If the first node 110 successfully checks the integrity of the association request message, the first node 110 may generate a new temporary ID (T-ID) for the second node 120 .

[0297] S435: The first node 110 sends an association establishment message (ie, the seventh message) to the second node 120. Accordingly, the second node 120 may receive the seventh message from the first node.

[0298] In an optional design, the association establishment message may include a new temporary ID (T-ID) generated by the first node 110 for the second node 120.

[0299] In an optional design, the first node 110 may also use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the association establishment message. When the signaling plane encryption protection is activated, the first node 110 may use the encryption algorithm of the signaling plane and the encryption key Ks.enc to perform encryption protection on the association establishment message.

[0300] For example, the association establishment message can be represented as the following tuple:

[0301] (New Temporary ID) MIC.

[0302] Among them, ()MIC indicates that the association establishment message is a message that has been processed with integrity protection.

[0303] Wherein, if the first node 110 encrypts the association establishment message, the second node 120 may decrypt the association establishment message. The second node 120 may also check the integrity of the association establishment message. If the integrity verification fails, the message is discarded. If the integrity verification passes, S436: the second node 120 may send an association completion message (i.e., the eighth message) to the first node 110.

[0304] The second node 120 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the association completion message. When the signaling plane encryption protection is activated, the second node 120 may use the encryption algorithm of the signaling plane and the encryption key Ks.enc to perform encryption protection on the association completion message.

[0305] For example, the association completion message may be expressed as follows:

[0306] (Association Complete Message) MIC.

[0307] Among them, ()MIC indicates that the association completion message is a message that has been processed with integrity protection.

[0308] Therefore, in Figure 4d In the communication method shown, in a scenario where there are multiple sets of security contexts, the first node 110 and the second node 120 can select a first security context associated with a first service, and establish a first communication connection between the two parties based on the first security context, so that when the first node 110 and the second node 120 conduct business, the data of the corresponding business can be transmitted according to the first communication connection established based on different security contexts, so as to meet the security requirements in the converged communication scenario and ensure the security of the corresponding business data.

[0309] It should be noted that, in the embodiment of the present application, if the second node 120 fails to use the saved security context to establish an association with the first node 110 for multiple times, the second node 120 may try to delete the saved security context and use the aforementioned Figure 4a or Figure 4b The method shown initiates an association process without a security context between the second node 120 and the first node 110, which will not be described in detail here.

[0310] The embodiment of the present application also provides a communication device for executing the method executed by the first node in the above method embodiment. The relevant features can be found in the above method embodiment and will not be repeated here.

[0311] like Figure 5As shown, the device 500 may include: a communication unit 501, used to communicate with a second node; a processing unit 502, used to obtain first information; establish a first communication connection with the second node according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node is a node accessing a network corresponding to a second communication technology. For example, the first service may be a service of the first communication technology or a service of the second communication technology. For specific implementation methods, please refer to Figures 1 to 4d The detailed description in the illustrated embodiment will not be repeated here.

[0312] In an alternative design, Figure 5 The communication device 500 shown can also be used to execute the method executed by the second node in the above method embodiment, for example, the communication unit 501 is used to communicate with the first node; the processing unit 502 is used to obtain the first information; a first communication connection is established with the first node according to the first information, the first communication connection is used to transmit data of the first service, and the first communication connection corresponds to the first communication technology; wherein the first node is a node accessing a network corresponding to the second communication technology. For example, the first service can be a service of the first communication technology or a service of the second communication technology. The relevant features can be referred to the above method embodiment, which will not be repeated here.

[0313] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. Each functional unit in the embodiments of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0314] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0315] In a possible implementation, an embodiment of the present application provides a computer-readable storage medium, which stores a program code. When the program code runs on the computer, the computer executes the above method embodiment.

[0316] In a possible implementation, an embodiment of the present application provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the above method embodiment.

[0317] In a simple embodiment, those skilled in the art can imagine that the communication devices in the above embodiments can all be used. Figure 6 The form shown.

[0318] like Figure 6 The device 600 shown includes at least one processor 610 and a communication interface 630. In an optional design, a memory 620 may also be included.

[0319] The specific connection medium between the processor 610 and the memory 620 is not limited in the embodiment of the present application.

[0320] In such Figure 6 In the device, the processor 610 can transmit data through the communication interface 630 when communicating with other devices.

[0321] When the communication device uses Figure 6 When the form shown is Figure 6 The processor 610 in the apparatus 600 can call the computer-executable instructions stored in the memory 620 so that the apparatus 600 can execute the method executed by the communication device in any of the above method embodiments.

[0322] An embodiment of the present application also relates to a chip system, which includes a processor for calling a computer program or computer instructions stored in a memory so that the processor executes the method of any of the above embodiments.

[0323] In a possible implementation manner, the processor may be coupled to the memory through an interface.

[0324] In a possible implementation, the chip system may also directly include a memory, in which a computer program or computer instructions are stored.

[0325] For example, the memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM).

[0326] An embodiment of the present application also relates to a processor, which is used to call a computer program or computer instruction stored in a memory so that the processor executes the method described in any of the above embodiments.

[0327] For example, in the embodiment of the present application, the processor is an integrated circuit chip with signal processing capabilities. For example, the processor can be a field programmable gate array (FPGA), a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips, which can implement or execute the disclosed methods, steps and logic diagrams in the embodiment of the present application. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor are combined to execute. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0328] It should be understood that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0329] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0330] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0331] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: Applied to the first node, the method comprises: Obtaining first information; Establishing a first communication connection with a second node according to the first information, where the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; The first node is a node accessing a network corresponding to the second communication technology, and the first service is a service of the first communication technology or a service of the second communication technology.

2. The method according to claim 1, characterized in that The first information includes a first key used for communication authentication with the second node, and the obtaining of the first information includes: The first key is obtained according to a type corresponding to the second communication technology and / or according to a service type of the first service.

3. The method according to claim 1, characterized in that The first information includes a first key used for communication authentication with the second node, and the method further includes: receiving a first message from the second node, where the first message carries key type indication information or service type indication information; The obtaining of the first information includes: The first key is acquired according to the key type indication information or the service type indication information.

4. The method according to claim 2 or 3, characterized in that: The establishing a first communication connection with the second node according to the first information includes: Sending a second message associated with the first key to the second node, where the second message is used for identity authentication of the first node; receiving a third message in response to the second message, the third message being used for identity authentication of the second node; In a case where the identity authentication of the second node is successful, a fourth message is sent to the second node, where the fourth message is used to establish the first communication connection with the second node.

5. The method according to any one of claims 2 to 4, characterized in that: In the case where the first service is a service of the first communication technology, the first key is a key used for the service of the first communication technology; or, When the first service is a service of the second communication technology, the first key is a key used for the service of the second communication technology.

6. The method according to claim 5, characterized in that The key used for the service of the second communication technology includes a trusted key or an untrusted key, wherein the trusted key is a key that has been successfully authenticated by the network, and the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than that of the untrusted key.

7. The method according to any one of claims 1 to 6, characterized in that Before establishing the first communication connection, the method further includes: A key for traffic of the second communication technology is received from the network.

8. The method according to claim 1, characterized in that The first information includes a first security context for communicating with the second node, and the acquiring the first information includes: receiving a fifth message from the second node, the fifth message carrying an identifier associated with the first security context; The obtaining of the first information includes: The first security context is acquired according to the identifier.

9. The method according to claim 8, characterized in that In a case where the first service is a service of the first communication technology, the first security context is a security context for the service of the first communication technology; or, In a case where the first service is a service of the second communication technology, the first security context is a security context used for the service of the second communication technology.

10. The method according to claim 9, characterized in that The security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, wherein the trusted security context is a security context that has been successfully authenticated by the network, and the untrusted security context is a security context that has not been authenticated by the network, and the priority of the trusted security context is higher than that of the untrusted security context.

11. The method according to any one of claims 1 to 10, characterized in that Before obtaining the first information, the method further includes: A sixth message is sent to the second node, where the sixth message carries information indicating that the first node supports the second communication technology.

12. A communication method, characterized in that: Applied to the second node, the method comprises: Obtaining first information; Establishing a first communication connection with a first node according to the first information, where the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; The first node is a node accessing a network corresponding to the second communication technology, and the first service is a service of the first communication technology or a service of the second communication technology.

13. The method according to claim 12, characterized in that The first information includes a first key used for communication authentication with the first node, and the obtaining of the first information includes: The first key is obtained according to a type corresponding to the second communication technology and / or according to a service type of the first service.

14. The method according to claim 13, characterized in that The method further comprises: A first message is sent to the first node, where the first message carries information associated with the first key.

15. The method according to claim 13 or 14, characterized in that The establishing the first communication connection with the first node according to the first information includes: receiving a second message from the first node, where the second message is associated with the first key and is used for identity authentication of the first node; When the identity authentication of the first node succeeds, sending a third message to the first node, where the third message is used for the identity authentication of the second node; A fourth message is received in response to the third message, the fourth message being used to establish the first communication connection with the second node.

16. The method according to any one of claims 13 to 15, characterized in that In the case where the first service is a service of the first communication technology, the first key is a key used for the service of the first communication technology; or, When the first service is a service of the second communication technology, the first key is a key used for the service of the second communication technology.

17. The method according to claim 16, characterized in that The key used for the service of the second communication technology includes a trusted key or an untrusted key, wherein the trusted key is a key that has been successfully authenticated by the network, and the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than that of the untrusted key.

18. The method according to any one of claims 12 to 17, characterized in that: Before establishing the first communication connection, the method further includes: A key for traffic of the second communication technology is received from the network.

19. The method according to claim 12, characterized in that The first information includes a first security context, and the first security context is used for the second node to establish the first communication connection with the first node. The acquiring the first information includes: The first security context is acquired according to a type corresponding to the second communication technology and / or according to a service type of the first service.

20. The method according to claim 19, characterized in that In a case where the first service is a service of the first communication technology, the first security context is a security context for the service of the first communication technology; or, In a case where the first service is a service of the second communication technology, the first security context is a security context used for the service of the second communication technology.

21. The method according to claim 20, characterized in that The security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, wherein the trusted security context is a security context that has been successfully authenticated by the network, and the untrusted security context is a security context that has not been authenticated by the network, and the priority of the trusted security context is higher than that of the untrusted security context.

22. The method according to any one of claims 19 to 21, characterized in that The method further comprises: A fifth message is sent to the first node, where the fifth message carries an identifier associated with the first security context.

23. The method according to any one of claims 12 to 22, characterized in that The method further comprises: A sixth message is received from the first node, where the sixth message carries information indicating that the first node supports the second communication technology.

24. A communication device, characterized in that: Applied to the first node, including: a communication unit, configured to communicate with the second node; A processing unit, used to obtain first information; establish a first communication connection with the second node according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node is a node accessing a network corresponding to a second communication technology, and the first service is a service of the first communication technology or a service of the second communication technology.

25. The device according to claim 24, characterized in that The first information includes a first key used for communication authentication with the second node. When the first service is a service of the first communication technology, the first key is a key for the service of the first communication technology; or, when the first service is a service of the second communication technology, the first key is a key for the service of the second communication technology.

26. A communication device, characterized in that: include: a communication unit, configured to communicate with the first node; A processing unit, configured to obtain first information; A first communication connection is established with the first node according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein the first node is a node accessing a network corresponding to a second communication technology, and the first service is a service of the first communication technology or a service of the second communication technology.

27. The device according to claim 26, characterized in that The first information includes a first key used for communication authentication with the first node. When the first service is a service of the first communication technology, the first key is a key used for the service of the first communication technology; or, when the first service is a service of the second communication technology, the first key is a key used for the service of the second communication technology.

28. A communication device, characterized in that: It includes at least one processor and an interface circuit, wherein the interface circuit is used to provide data or code instructions to the at least one processor, and the at least one processor is used to implement the method as described in any one of claims 1-11 through a logic circuit or by executing code instructions, or to implement the method as described in any one of claims 12-23.

29. A communication system, characterized in that: The invention comprises a communication device for implementing the method as claimed in any one of claims 1 to 11, and a communication device for implementing the method as claimed in any one of claims 12 to 23.

30. A computer-readable storage medium, characterized in that: The computer-readable medium stores a program code, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 11; or, when executed on a computer, enables the computer to execute the method according to any one of claims 12 to 23.

Images