Communication method and device

Abstract

The invention relates to the technical field of communication, and discloses a communication method and device. The method comprises: a terminal device sending a first de-registration request message to a network device, and receiving a security mode command message from the network device, the security mode command message being used for starting a first security context; sending a response message of the security mode command message to the network device according to the security mode command message, and enabling the first security context; receiving a response message of the first de-registration request message from the network equipment; according to the present NAS security context (the first security context) and the non-present NAS security context (the second security context), integrity protection verification is attempted to be performed on the response message of the de-registration request message, so that it is convenient to ensure that the terminal device completes de-registration under the condition that the security mode control process conflicts with the de-registration process.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] 5G mobility management (MM) common procedures (5GMM common procedures) may include the identity authentication process, authorization process and security mode control process of the terminal device. Among them, the security mode control process can be carried out in a specified process (such as a registration process, a business process). Since the deregistration process may also be carried out in the specified process, there may be a conflict between the security mode control process and the deregistration process. For example, when the terminal device sends a deregistration request message to the network device and the network device sends a security mode command message to the terminal device, the security mode control process will conflict with the deregistration process.

[0003] However, when the security mode control process conflicts with the deregistration process, how the terminal device completes the deregistration still needs further research. Summary of the invention

[0004] The present application provides a communication method and apparatus for solving the problem that a terminal device cannot complete deregistration when a security mode control process conflicts with a deregistration process.

[0005] In a first aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or a chip or a chip system (such as a system-on-a-chip (SoC)) or a functional module in the terminal device. Taking the application of the method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, and the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, and the security mode command message is used to enable a first security context; if the security mode command message is received during the deregistration process, the security mode command message is ignored.

[0006] By adopting the above method, when the security mode control process conflicts with the deregistration process, the terminal device can ignore the security mode command message (i.e. interrupt the security mode control process), thereby making the behaviors of the terminal device and the network device consistent, thereby ensuring that the terminal device completes the deregistration.

[0007] In one possible design, ignoring the security mode command message includes: not sending a response message to the security mode command message, and / or not enabling the first security context.

[0008] In one possible design, the method also includes: receiving a response message to the first de-registration request message from the network device; and performing an integrity protection check on the response message according to a second security context enabled by the terminal device.

[0009] In one possible design, the first deregistration request message does not carry the first ciphertext element.

[0010] In a second aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or a chip system (such as SoC) or a functional module in a terminal device. Taking the method applied to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, the security mode command message is used to enable a first security context; according to the security mode command message, sends a response message of the security mode command message to the network device, and enables the first security context; receives a response message of the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, the response message of the first deregistration request message is integrity-checked according to the first security context; in the case where the integrity protection check of the response message of the first deregistration request message fails according to the first security context, the response message of the first deregistration request message is integrity-checked according to the second security context, the second security context is the security context that the terminal device has enabled before enabling the first security context.

[0011] Using the above method, when the security mode control process conflicts with the deregistration process, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby ensuring that the terminal device completes the deregistration.

[0012] In one possible design, the method also includes: if an integrity protection check on a response message to the first deregistration request message fails according to the second security context, performing local deregistration; or, if an integrity protection check on a response message to the first deregistration request message fails according to the second security context, sending a second deregistration request message to the network device, wherein the second deregistration request message is used by the terminal device to request deregistration.

[0013] In a third aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or a chip system (such as SoC) or a functional module in a terminal device. Taking the application of the method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, and the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, and the security mode command message is used to enable a first security context; according to the security mode command message, sends a response message of the security mode command message to the network device, and enables the first security context; receives a response message of the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, the response message of the first deregistration request message is integrity-checked according to the second security context, and the second security context is a security context that the terminal device has enabled before enabling the first security context.

[0014] In one possible design, the method further includes: if the integrity protection check on the response message of the first deregistration request message fails according to the second security context, then performing an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0015] Using the above method, when the security mode control process conflicts with the deregistration process, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby ensuring that the terminal device completes the deregistration.

[0016] In one possible design, the method also includes: if an integrity protection check on a response message to the first deregistration request message fails according to the first security context, performing local deregistration; or, if an integrity protection check on a response message to the first deregistration request message fails according to the first security context, sending a second deregistration request message to the network device, wherein the second deregistration request message is used by the terminal device to request deregistration.

[0017] In a fourth aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or a chip system (such as SoC) or a functional module in a terminal device. Taking the method applied to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, and the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, and the security mode command message is used to enable a first security context; according to the security mode command message, sends a response message of the security mode command message to the network device, and enables the first security context; receives a response message to the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, and the response message of the first deregistration request message is a ciphertext message, then the response message of the first deregistration request message is integrity-protected and checked according to the first security context; or, if the security mode command message is received during the deregistration process, and the response message of the first deregistration request message is a plaintext message, then enter the deregistration state.

[0018] By adopting the above method, when the security mode control process conflicts with the deregistration process, the terminal device can decide whether to perform integrity protection check on the deregistration acceptance message according to the current NAS security context based on whether the deregistration acceptance message is plain text, thereby ensuring that the terminal device completes the deregistration.

[0019] In a fifth aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or a chip system (such as SoC) or a functional module in a terminal device. Taking the method applied to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, and the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, and the security mode command message is used to enable a first security context; if the security mode command message is received during the deregistration process, and the first deregistration request message does not carry the first ciphertext element, then ignore the security mode command message; or, if the security mode command message is received during the deregistration process, and the first deregistration request message carries the first ciphertext element, then send a response message of the security mode command message to the network device, and enable the first security context.

[0020] By adopting the above method, the terminal device can determine whether to interrupt the security mode control process based on whether the first deregistration request message carries the first ciphertext element, thereby avoiding the terminal device interrupting the security mode control process triggered by the network device due to the failure of integrity protection verification of the first ciphertext element, and facilitating the terminal device to complete the deregistration.

[0021] In one possible design, ignoring the security mode command message includes: not enabling the first security context, and / or not sending a response message to the security mode command message.

[0022] In one possible design, when executing the method of ignoring the security mode command message, the method also includes: receiving a response message to the first de-registration request message from the network device; when the response message to the first de-registration request message is a ciphertext message, performing an integrity protection check on the response message according to a second security context enabled by the terminal device; or, when the response message to the first de-registration request message is a plaintext message, entering a de-registration state.

[0023] In one possible design, when executing the enabling of the first security context, the method also includes: receiving a response message to the first de-registration request message from the network device; performing an integrity protection check on the response message to the first de-registration request message according to the first security context; and in a case where the integrity protection check on the response message to the first de-registration request message according to the first security context fails, performing an integrity protection check on the response message to the first de-registration request message according to a second security context, wherein the second security context is a security context that has been enabled by the terminal device before enabling the first security context.

[0024] In one possible design, the method also includes: if an integrity protection check on a response message to the first deregistration request message fails according to the second security context, performing local deregistration; or, if an integrity protection check on a response message to the first deregistration request message fails according to the second security context, sending a second deregistration request message to the network device, wherein the second deregistration request message is used by the terminal device to request deregistration.

[0025] In one possible design, when executing the enabling of the first security context, a response message to the first de-registration request message from the network device is received; and an integrity protection check is performed on the response message to the first de-registration request message according to the second security context, where the second security context is a security context that has been enabled by the terminal device before enabling the first security context.

[0026] In one possible design, the method further includes: if the integrity protection check on the response message of the first deregistration request message fails according to the second security context, then performing an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0027] In one possible design, the method also includes: if an integrity protection check on a response message to the first deregistration request message fails according to the first security context, performing local deregistration; or, if an integrity protection check on a response message to the first deregistration request message fails according to the first security context, sending a second deregistration request message to the network device, wherein the second deregistration request message is used by the terminal device to request deregistration.

[0028] In one possible design, when the enabling of the first security context is executed, a response message to the first de-registration request message from the network device is received; when the response message to the first de-registration request message is a ciphertext message, an integrity protection check is performed on the response message to the first de-registration request message according to the first security context; or, when the response message to the first de-registration request message is a plaintext message, a de-registration state is entered.

[0029] In one possible design, the response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained based on the first security context.

[0030] In a sixth aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or a chip system (such as SoC) or a functional module in a terminal device, etc. Taking the application of the method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, and the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, and the security mode command message is used to enable a first security context; if the security mode command message is received before the deregistration process is completed, local deregistration is performed.

[0031] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can perform local deregistration, thereby ensuring that the terminal device completes the deregistration.

[0032] In one possible design, the method further includes: ignoring the safety mode command message.

[0033] In one possible design, ignoring the security mode command message includes: not enabling the first security context, and / or not sending a response message to the security mode command message.

[0034] In one possible design, the first deregistration request message does not carry the first ciphertext element.

[0035] In a seventh aspect, the present application provides a communication method, which can be applied to a network device, a processor or chip or chip system (such as SoC) or a functional module in a network device, etc. Taking the method applied to a network device as an example, the network device sends a security mode command message to a terminal device, and the security mode command message is used to enable a first security context; in the process of waiting for a response message to the security mode command message, a first deregistration request message is received from the terminal device, and the first deregistration request message is used for the terminal device to request deregistration; a response message to the security mode command message from the terminal device is received; according to the response message to the security mode command message, the first security context is enabled; and a response message to the first deregistration request message is sent to the terminal device, and the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

[0036] By adopting the above method, when the security mode control process conflicts with the deregistration process, the network device does not interrupt the security mode control process, thereby ensuring that the terminal device completes the deregistration.

[0037] In one possible design, the method further includes: if the first deregistration request message carries a first ciphertext element, continuing to wait for receiving a response message to the security mode command message.

[0038] In an eighth aspect, the present application provides a communication method, which can be applied to a network device, a processor or chip or a chip system (such as SoC) or a functional module in a network device, etc. Taking the method applied to a network device as an example, the network device receives a first deregistration request message from a terminal device, the first deregistration request message is used by the terminal device to request deregistration, and the first deregistration request message carries a first ciphertext cell; if the integrity protection check of the first ciphertext cell fails according to the second security context, a security mode command message is sent to the terminal device, and the security mode command message is used to enable the first security context; a response message to the security mode command message from the terminal device is received; according to the response message to the security mode command message, the first security context is enabled; and a response message to the first deregistration request message is sent to the terminal device, and the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

[0039] In one possible design, the response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained based on the first security context.

[0040] In one possible design, the method further includes:

[0041] An authentication request message is sent to the terminal device, where the authentication request message is used to request the terminal device to create a first security context.

[0042] In a ninth aspect, the present application provides a communication device, which has the function of implementing any one of the first to eighth aspects above. For example, the communication device includes a module or unit or means corresponding to the operation involved in any one of the first to eighth aspects above. The function or unit or means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0043] In a possible design, the communication device includes a processing unit and a communication unit, wherein the communication unit can be used to send and receive signals to achieve communication between the communication device and other devices, for example, the communication unit is used to send system information to a terminal; the processing unit can be used to perform some internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations involved in any one of the first to eighth aspects above.

[0044] In one possible design, the communication device includes a processor, which can be used to couple with a memory. The memory can store necessary computer programs or instructions for implementing the functions involved in any one of the first to eighth aspects. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of the first to eighth aspects.

[0045] In one possible design, the communication device includes a processor and a memory, and the memory can store necessary computer programs or instructions for implementing the functions involved in any one of the first to eighth aspects. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of the first to eighth aspects.

[0046] In one possible design, the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design or implementation of the first to eighth aspects above.

[0047] It can be understood that in the ninth aspect above, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. In addition, the above processors can be one or more, and the memories can be one or more. The memory can be integrated with the processor, or the memory can be separately set from the processor. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be set on different chips respectively. The embodiment of the present application does not limit the type of memory and the setting method of the memory and the processor.

[0048] In a tenth aspect, the present application provides a communication system, which may include a terminal device and a network device; wherein the terminal device is used to execute the method in any possible design or implementation of the first to sixth aspects; the network device is used to send the security mode command message to the terminal device; and send a response message of the first deregistration request message to the terminal device. Alternatively, the network device is used to execute the method in any possible design or implementation of the seventh or eighth aspects; the terminal device is used to send the first deregistration request message to the network device; and send a response message of the security mode command message to the network device.

[0049] In the eleventh aspect, the present application provides a computer-readable storage medium, in which a computer program (or computer-readable instructions) is stored. When a computer reads and executes part or all of the computer-readable instructions, the method in any possible design of the first to eighth aspects above is executed.

[0050] Exemplarily, a computer-readable storage medium can be any available medium that can be accessed by a computer. By way of example but not limitation, a computer-readable medium can include a non-transitory computer-readable medium, a random-access memory (RAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a CD-ROM or other optical disk storage, a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer.

[0051] In a twelfth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the method in any possible design of the first to eighth aspects mentioned above is executed.

[0052] In the thirteenth aspect, the present application provides a chip (or chip system), wherein the chip includes a processor, the processor is coupled to a memory, and the memory stores a computer program; the processor is used to call part or all of the computer program in the memory, so that the method in any possible design of the first to eighth aspects above is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of a network architecture;

[0054] Figure 2 A flow chart of a 5G mobility management public process in a registration process;

[0055] Figure 3 A schematic diagram of a process in which a security mode control process conflicts with a deregistration process;

[0056] Figure 4 A flow chart corresponding to a communication method provided in an embodiment of the present application;

[0057] Figure 5 A flow chart corresponding to another communication method provided in an embodiment of the present application;

[0058] Figure 6 A flow chart corresponding to another communication method provided in an embodiment of the present application;

[0059] Figure 7 A flow chart corresponding to another communication method provided in an embodiment of the present application;

[0060] Figure 8 A flow chart corresponding to another communication method provided in an embodiment of the present application;

[0061] Fig. 9 is an exemplary block diagram of a device involved in an embodiment of the present application;

[0062] Fig.10 A schematic diagram of the structure of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The technical scheme in the embodiment of the present application will be described below in conjunction with the accompanying drawings in the embodiment of the present application. The terms "first", "second", etc. and other various terminology labels (if any) in the specification and claims and the accompanying drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable in appropriate circumstances, so that the embodiments described here can be implemented in a sequence other than the content illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment including a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0064] The technical solution provided in this application can be applied to various communication systems, such as: fifth generation (5th generation, 5G) or new radio (new radio, NR) system, long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD) system, etc. The technical solution provided in this application can also be applied to future communication systems, such as the sixth generation mobile communication system. The technical solution provided in this application can also be applied to device to device (D2D) communication, vehicle to everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of things (IoT) communication system or other communication systems.

[0065] The following will be combined Figure 1 (a) and Figure 1 (b) in the figure illustrates a 5G system applicable to the embodiment of the present application. It should be understood that the 5G system described in this article is only an example and should not constitute any limitation to the present application. It should also be understood that some network elements in the 5G system can communicate using a service-oriented interface or a point-to-point interface. Figure 1 (a) and Figure 1 (b) in the figure introduces the 5G system framework based on point-to-point interface and the 5G system framework based on service-oriented interface respectively.

[0066] As an example, Figure 1(a) shows a schematic diagram of the network architecture of a 5G system 100a to which an embodiment of the present application is applicable. Figure 1 (a) is a schematic diagram of the 5G network architecture based on service-oriented interfaces. Figure 1 As shown in (a), the network architecture may include but is not limited to the following network elements (or referred to as functional network elements, functional entities, nodes, devices, etc.):

[0067] (Radio) access network (R)AN) equipment, access and mobility management function (AMF) network element, session management function (SMF) network element, user plane function (UPF) network element, policy control function (PCF) network element, unified data management (UDM) network element, application function (AF) network element, data network (DN), authentication server function (AUSF) network element, unified data management (UDM) network element, unified data repository (UDR), etc.

[0068] Below Figure 1 The network elements shown in (a) are briefly introduced as follows:

[0069] 1. User equipment (UE): can be called terminal equipment, terminal device, access terminal, user unit, user station, mobile station, mobile station (MS), mobile terminal (MT), remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. A terminal can be a device that provides voice / data connectivity to a user, such as a handheld device with wireless connection function, a vehicle-mounted device, etc. At present, some examples of terminals may include: mobile phones, tablet computers, computers with wireless transceiver functions (such as laptop computers, PDAs, etc.), mobile Internet devices (MIDs), virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or future evolved public land mobile communication networks (public land mobile network, PLMN) terminals, etc.

[0070] In addition, the terminal can also be a terminal in the Internet of Things (IoT) system. IoT is an important part of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network of human-machine interconnection and object-to-object interconnection. IoT technology can achieve massive connections, deep coverage, and terminal power saving through narrow band (NB) technology, for example.

[0071] In addition, the terminal can also include smart printers, train detectors, etc. Its main functions include collecting data (part of the terminal equipment), receiving control information and downlink data from network equipment, and sending electromagnetic waves to transmit uplink data to network equipment.

[0072] It should be understood that the terminal can be any device that can access the network. The terminal and the access network device can communicate with each other using a certain air interface technology.

[0073] Optionally, the terminal can be used to act as a base station. For example, the terminal can act as a scheduling entity that provides sidelink signals between terminals in V2X or D2D, etc. For example, a cell phone and a car communicate with each other using sidelink signals. A cell phone and a smart home device communicate with each other without relaying the communication signal through a base station.

[0074] 2. (Wireless) access network equipment: referred to as access network equipment in the embodiments of the present application, which is used to provide network access functions for authorized user equipment in a specific area, and can use transmission tunnels with different service qualities according to the level of the user equipment, business requirements, etc.

[0075] Access network equipment can manage wireless resources, provide access services for user equipment, and then complete the forwarding of control signals and data between user equipment and the core network. Access network equipment can also be understood as base stations in traditional networks.

[0076] Exemplarily, the access network device in the embodiment of the present application can be any communication device with wireless transceiver function for communicating with user equipment. The access network device includes but is not limited to an evolved NodeB (eNB) or a gNB in ​​a 5G system, or a transmission point (TRP or TP), or one or a group of (including multiple antenna panels) antenna panels of a base station in a 5G system, or can also be a network node constituting a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit (DU), etc.

[0077] In some deployments, the gNB may include a centralized unit (CU) and a DU. The gNB may also include an active antenna unit (AAU). The CU implements some functions of the gNB, and the DU implements some functions of the gNB. For example, the CU is responsible for processing non-real-time protocols and services, and implementing the functions of the radio resource control (RRC) and packet data convergence protocol (PDCP) layers. The DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of the radio link control (RLC) layer, the media access control (MAC) layer, and the physical (PHY) layer. The AAU implements some physical layer processing functions, radio frequency processing, and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be converted from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU, or, sent by the DU+AAU. It can be understood that the access network device can be a device including one or more of a CU node, a DU node, and an AAU node. In addition, the CU may be divided into an access network device in an access network, or the CU may be divided into an access network device in a core network (CN), and this application does not limit this.

[0078] 3. UPF network element: used for packet routing and forwarding, as well as quality of service (QoS) processing of user plane data.

[0079] 4. AMF network element: The access and mobility management function network element is mainly used for mobility management and access management, etc. It can be used to implement other functions of MME except session management, such as access authorization / authentication and other functions.

[0080] 5. SMF network element: mainly used for session management, allocation and management of Internet protocol (IP) addresses of user equipment, selection of endpoints of manageable user plane functions, policy control and charging function interfaces, and downlink data notification.

[0081] 6. PCF network element: a unified policy framework used to guide network behavior and provide policy rule information for control plane functional network elements (such as AMF, SMF, etc.).

[0082] 7. AF network element: used for data routing affected by applications, open functional network element of wireless access network, interacting with the policy framework for policy control, etc.

[0083] 8. UDM network element: used to process UE identification, access authentication, registration and mobility management, etc.

[0084] 9. AUSF network element: used for authentication services and key generation to achieve two-way authentication of user devices and support a unified authentication framework.

[0085] 10. UDR: used to store the contract information of UDM network elements, policy information of PCF network elements, etc.

[0086] 11. DN: DN is a network outside the operator network. The operator network can access multiple DNs. Multiple services can be deployed on DN, which can provide data and / or voice services to terminal devices. For example, DN is the private network of a smart factory. The sensors installed in the workshop of the smart factory can be terminal devices. The control server of the sensors is deployed in DN, and the control server can provide services for the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, DN is the internal office network of a company. The mobile phones or computers of the company's employees can be terminal devices. The employees' mobile phones or computers can access information, data resources, etc. on the company's internal office network.

[0087] Figure 1 In (a), Nausf, Nnef, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the 3GPP standard protocol and are not limited here.

[0088] exist Figure 1 In the network architecture shown in (a), each network element can communicate with each other through the interface shown in the figure. For example, the UE and AMF can interact through the N1 interface, and the interaction message can be called an N1 message (N1 Message). The RAN and AMF can interact through the N2 interface, and the N2 interface can be used to send non-access stratum (NAS) messages, etc. The RAN and UPF can interact through the N3 interface, and the N3 interface can be used to transmit user plane data, etc. The SMF and UPF can interact through the N4 interface, and the N4 interface can be used to transmit information such as tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages. The UPF and DN can interact through the N6 interface, and the N6 interface can be used to transmit user plane data, etc. The relationship between other interfaces and each network element is as follows: Figure 1 As shown in (a), for the sake of brevity, they are not described in detail here.

[0089] like Figure 1 (b) is a schematic diagram of a 5G network architecture based on a point-to-point interface. The functions of the network elements can be found in Figure 1 The introduction of the functions of the corresponding network elements in (a) will not be repeated here. Figure 1 (b) and Figure 1 The main difference of (a) is that: Figure 1 The interfaces between the network elements in (b) are point-to-point interfaces rather than service-oriented interfaces.

[0090] exist Figure 1 In the architecture shown in (b), the interface names and functions between the network elements are as follows:

[0091] 1) N7: The interface between PCF and SMF, used to send protocol data unit (PDU) session granularity and service data flow granularity control strategy.

[0092] 2) N15: Interface between PCF and AMF, used to deliver UE policies and access control related policies.

[0093] 3) N5: Interface between AF and PCF, used for issuing application service requests and reporting network events.

[0094] 4) N4: The interface between SMF and UPF is used to transfer information between the control plane and the user plane, including the control of the forwarding rules, QoS control rules, traffic statistics rules, etc. for the user plane and the reporting of information on the user plane.

[0095] 5) N11: The interface between SMF and AMF, used to transfer PDU session tunnel information between RAN and UPF, transfer control messages sent to UE, transfer radio resource control information sent to RAN, etc.

[0096] 6) N2: The interface between AMF and RAN, used to transmit radio bearer control information from the core network to the RAN.

[0097] 7) N1: The interface between AMF and UE, access-independent, used to deliver QoS control rules, etc. to the UE.

[0098] 8) N8: Interface between AMF and UDM, used by AMF to obtain access and mobility management related subscription data and authentication data from UDM, and AMF to register UE's current mobility management related information with UDM.

[0099] 9) N10: The interface between SMF and UDM, used by SMF to obtain session management related subscription data from UDM, and SMF to register UE current session related information with UDM.

[0100] 10) N35: Interface between UDM and UDR, used by UDM to obtain user contract data information from UDR.

[0101] 11) N36: Interface between PCF and UDR, used by PCF to obtain policy-related contract data and application data-related information from UDR.

[0102] 12) N12: Interface between AMF and AUSF, used by AMF to initiate an authentication process to AUSF, which can carry a subscription concealed identifier (SUCI) as a contract identifier.

[0103] 13) N13: Interface between UDM and AUSF, used by AUSF to obtain the user authentication vector from UDM to execute the authentication process.

[0104] In order to facilitate the understanding of the embodiments of the present application, some of the terms involved in the present application are exemplified below. It is understandable that the terms given below are explained using the 5G system as an example, but it should be understood that in other communication systems (such as the future sixth-generation communication system), the following terms may have other names, and this application does not limit this.

[0105] (1) 5G mobility management public procedures

[0106] The 5G mobility management public process may include the terminal device identity authentication process, authorization process and security mode control process, etc. The 5G mobility management public process may be embedded in the specified process, that is, the 5G mobility management public process may be performed in the specified process; for example, the specified process includes the registration process, the business process, etc.

[0107] Combine the following Figure 2 , taking “5G mobility management public process is carried out in the registration process” as an example, a possible implementation is described.

[0108] Figure 2 The following is a flow chart of the 5G mobility management public process in the registration process. Figure 2 As shown, the process may include:

[0109] S201, the terminal device sends a registration request message to the AMF network element; accordingly, the AMF network element receives the registration request message.

[0110] Here, the registration request message is a NAS message, and the registration request message may include a registration type, and the registration type may be, for example, initial registration. Optionally, the registration request message also includes SUCI, and for example, SUCI includes a subscription permanent identifier (SUPI) type, a home network identifier, a routing identifier, a SUPI protection algorithm identifier, etc. SUCI is an encrypted version of SUPI, which is used to ensure that SUPI is not leaked in the air interface and to ensure normal authentication of the terminal device and the network.

[0111] It is understandable that the terminal device and the AMF network element can communicate through the access network device. For example, the terminal device can send an RRC message to the access network device, and the RRC message includes a registration request message; accordingly, after receiving the RRC message, the access network device can forward the registration request message to the AMF network element.

[0112] S202, the AMF network element sends an identity request message to the terminal device; accordingly, the terminal device receives the identity request message.

[0113] Exemplarily, if the AMF network element does not obtain SUCI (for example, the terminal device does not provide SUCI to the AMF network element, that is, the registration request message does not include SUCI), the AMF network element can send an identity request message to the terminal device, and the identity request message is used to obtain SUCI.

[0114] S203, the terminal device sends an identity response message to the AMF network element, and the identity response message includes SUCI.

[0115] S204, the AMF network element sends an authentication request message to the terminal device; accordingly, the terminal device receives the authentication request message.

[0116] Here, after completing the authentication of the terminal device, the AMF network element can derive the keys (such as integrity protection keys and encryption keys) used for secure communication between the AMF network element and the terminal device, thereby completing the creation of a security context on the AMF side; then, the AMF network element sends an authentication request message to the terminal device to request the completion of the creation of a security context on the terminal device side.

[0117] Exemplarily, the authentication request message may carry a set of authentication parameters and also carry parameters for the terminal device to create a security context.

[0118] S205, the terminal device sends an authentication response message to the AMF network element; accordingly, the AMF network element receives the authentication response message.

[0119] Exemplarily, after receiving the authentication request message, the terminal device can trigger the authentication algorithm to generate a set of parameters. If the set of parameters is consistent with the authentication parameters carried in the authentication request message, the terminal device can be considered to be a legitimate network, thereby completing the terminal device's authentication of the network; further, the terminal device can create a security context based on the parameters used to create a security context for the terminal device. The terminal device can send the authentication result to the AMF network element through an authentication response message.

[0120] S206, the AMF network element sends a security mode command (SMC) message to the terminal device; accordingly, the terminal device receives the security mode command message.

[0121] Here, the security mode command message is used to instruct the terminal device to enable the security context so as to securely process the NAS message.

[0122] Exemplarily, the security mode command message may include an identifier of the security context to be enabled.

[0123] S207, the terminal device sends a response message to the security mode command message to the AMF network element, and the response message is, for example, a security mode complete (SMP) message; accordingly, the AMF network element receives the security mode complete message, and enables the security context according to the security mode complete message (the security context enabled by the AMF network element and the terminal device is the same).

[0124] S208, the AMF network element sends a response message to the registration request message to the terminal device, such as a registration accept message; accordingly, the terminal device receives the registration accept message.

[0125] It can be understood that the above S202 and S203 are steps in the identity authentication process, S204 and S205 are steps in the authentication process, and S206 and S207 are steps in the security mode control process. Other possible steps may also be included in the identity authentication process, the authentication process or the security mode control process. For example, in the authentication process, the AMF network element may also communicate with other core network elements, which is not limited in the embodiment of the present application.

[0126] In addition, the above description is based on the example of performing the identity authentication process, the authorization process, and the security mode control process in the registration process. In other possible scenarios, any one or any two of the identity authentication process, the authorization process, and the security mode control process may also be performed in the registration process (or business process). For example, if the registration request message includes SUCI, the identity authentication process may not be performed.

[0127] (2) Security context

[0128] The security context involved in the embodiments of the present application may be a non-access stratum (NAS) security context. By executing the above security mode control process, the terminal device and the network device may enable the same NAS security context and communicate according to the NAS security context to improve the security of communication between the terminal device and the network device.

[0129] Exemplarily, the NAS security context may include a key for integrity protection / integrity protection verification, and optionally, a key for encryption / decryption. The NAS security context may be identified by a key identifier, such as a key set identifier for next generation radio access network (ngKSI). Among them, a NAS security context in use or in an activated state may be referred to as a current NAS security context, and a NAS security context that is not currently in use or in an inactivated state may be referred to as a non-current NAS security context.

[0130] The terminal device may store the NAS security context in a universal subscriber identity module (USIM) or non-volatile memory in the terminal device. For example, if the USIM of the terminal device supports the storage of registration management parameters, the terminal device may store the current NAS security context on the USIM and mark the NAS security context stored on the USIM as valid. If the USIM of the terminal device does not support the storage of registration management parameters, the terminal device may store the NAS security context in a non-volatile memory and mark the NAS security context stored in the non-volatile memory as valid.

[0131] Exemplarily, the registration request message may carry ngKSI. If the value of ngKSI is any value from 0 to 6, it indicates that there is a valid security context in the terminal device. If the value of ngKSI is 7, it indicates that there is no valid security context in the terminal device.

[0132] (3) Registration process

[0133] The deregistration process can be triggered by the terminal device or by the core network element. Taking the deregistration process triggered by the terminal device as an example, the terminal device can send a deregistration request message to the AMF network element (that is, the terminal device starts the deregistration process), and the deregistration request message can include the deregistration type (for example, the deregistration type is non-shutdown, or shutdown); accordingly, after receiving the deregistration request message, the AMF network element can send a response message to the deregistration request message to the terminal device, and the response message is, for example, a deregistration acceptance message. If the terminal device has established a PDU session, then after receiving the deregistration request message, the AMF network element can send a session context release request message to the SMF network element to release the session context of the terminal device, and then send a deregistration acceptance message to the terminal device.

[0134] After receiving the deregistration acceptance message, the terminal device performs integrity protection verification on the deregistration acceptance message according to the security context, and decrypts the deregistration acceptance message after the integrity protection verification succeeds. After the decryption succeeds, the terminal device can consider that the deregistration process is completed and enters the deregistration state. The deregistration state can be understood as the 5G mobility management deregistration (5GMM-deregistered) state. In the 5GMM-deregistered state, the network device does not know the location of the terminal device and cannot access the terminal device.

[0135] According to the above description, the security mode control process can be carried out in a specified process (such as a registration process, a business process). Since the deregistration process may also be carried out in the specified process, there may be a conflict between the security mode control process and the deregistration process. For example, when the terminal device sends a deregistration request message to the AMF network element, and the AMF network element sends a security mode command message to the terminal device, it will cause a conflict between the security mode control process and the deregistration process. Exemplarily, from the perspective of the terminal device, if the terminal device receives a security mode command message during the deregistration process, it can be determined that the security mode control process conflicts with the deregistration process; wherein the deregistration process may refer to the process from the terminal device initiating the deregistration process (such as sending a deregistration request message) to the terminal device completing the deregistration process (such as receiving a deregistration acceptance message). From the perspective of the AMF network element, if the AMF network element receives a de-registration request message during the security mode control process, it can be determined that the security mode control process conflicts with the de-registration process; wherein, the security mode control process may refer to the process from the AMF network element initiating the security mode control process (such as sending a security mode command message) to the AMF network element completing the security mode control process (i.e. receiving a security mode completion message).

[0136] For terminal devices, the current protocol stipulates that once the terminal device receives a security mode command message, the terminal device will enable a new security context according to the security mode command message. Therefore, in the event of a conflict between the security mode control process and the deregistration process, the terminal device can enable a new security context according to the security mode command message and perform integrity protection verification on the deregistration acceptance message according to the new security context.

[0137] For AMF network elements, the current protocol stipulates that when the security mode control process conflicts with the deregistration process, the AMF network element can interrupt the security mode control process, that is, the AMF network element does not enable a new security context (maintains the previously enabled security context, or maintains the plain text if the security context was not enabled before), and performs integrity protection on the deregistration acceptance message according to the previously enabled security context, and then sends the deregistration acceptance message to the terminal device.

[0138] For example, Figure 3 FIG. 4 is a possible flow diagram of a conflict between the security mode control process and the deregistration process. Figure 3 As shown, the process may include:

[0139] S301, the terminal device sends a registration request message to the AMF network element.

[0140] Exemplarily, there is no valid security context in the terminal device, and therefore the registration request message sent by the terminal device is a plain text message.

[0141] S302, the terminal device and the AMF network element execute the authentication process.

[0142] Specifically, through the authentication process, the same security context can be created in the terminal device and the AMF network element.

[0143] Here, the specific implementation of the authentication process can refer to the existing technology and will not be repeated here.

[0144] Optionally, before the terminal device and the AMF network element execute the authentication process, they may also execute the identity authentication process, without specific limitation.

[0145] S303, the terminal device sends a deregistration request message to the AMF network element; accordingly, the AMF network element receives the deregistration request message.

[0146] Exemplarily, during the registration process of the terminal device, if the terminal device terminates the deregistration process for some reason and starts the deregistration process, the terminal device can send a deregistration request message to the AMF network element.

[0147] S304, the AMF network element sends a security mode command message to the terminal device; accordingly, the terminal device receives the security mode command message.

[0148] Assume that the terminal device sends a deregistration request message and the AMF network element sends a security mode command message at the same time (or the interval between the two is short), which causes a conflict between the security mode control process and the deregistration process.

[0149] S305, the terminal device enables the security context according to the security mode command message, and sends a security mode completion message to the AMF network element; accordingly, the AMF network element receives the security mode completion message.

[0150] S306, the AMF network element sends a registration acceptance message to the terminal device.

[0151] S307: The terminal device discards the registration acceptance message.

[0152] Since the security mode control process conflicts with the deregistration process, the AMF network element interrupts the security mode control process (i.e., does not enable the security context) and sends a deregistration acceptance message to the terminal device, which is a plain text message. However, since the terminal device has enabled the security context, but the received deregistration acceptance message is a plain text message, the terminal device will discard the plain text message, resulting in the terminal device being unable to complete the deregistration and thus unable to initiate a new round of registration.

[0153] From this, it can be seen that when the security mode control process conflicts with the deregistration process, the terminal device enables a new security context, but the AMF network element does not enable a new security context, that is, the behaviors of the terminal device and the AMF network element are inconsistent (the security contexts used are inconsistent), which will cause the deregistration process to fail to complete.

[0154] Based on this, an embodiment of the present application provides a communication method for solving the problem that the terminal device cannot complete deregistration when a security mode control process conflicts with a deregistration process.

[0155] The embodiments of the present application are described in detail below in conjunction with Embodiments 1 to 5. It can be understood that the technical solution provided in the embodiments of the present application can be applied to wireless communications between multiple communication devices, such as multiple communication devices including terminal devices and network devices, wherein the network device can be an AMF network element, or other devices having some or all of the functions of an AMF network element. In the embodiments of the present application, when not otherwise specified, "terminal device" may refer to the terminal device itself, or to a component in the terminal device, such as a chip or a chip system; "network device" may refer to the network device itself, or to a component in the network device, such as a chip or a chip system.

[0156] Embodiment 1

[0157] In the first embodiment, when the security mode control process conflicts with the deregistration process, the network device can follow the provisions of the protocol (i.e. interrupt the security mode control process) and improve the implementation on the terminal device side to ensure that the terminal device completes the deregistration.

[0158] Figure 4 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 4 As shown, the process may include:

[0159] S401, the terminal device sends a first deregistration request message to the network device.

[0160] The first deregistration request message may be used to request deregistration of the terminal device, or in other words, used by the terminal device to request deregistration; accordingly, the network device receives the first deregistration request message.

[0161] Exemplarily, the terminal device may send a first deregistration request message to the network device during a registration process or a business process. The embodiment of the present application does not limit the scenario in which the terminal device sends the first deregistration request message.

[0162] The deregistration requested by the first deregistration request message may be a non-shutdown deregistration and is not limited.

[0163] S402: The network device sends a security mode command message to the terminal device.

[0164] The security mode command message may be used to enable the first security context; accordingly, the terminal device receives the security mode command message.

[0165] Exemplarily, with respect to the above S401 and S402: from the perspective of the terminal device, the terminal device may receive a security mode command message from the network device after sending a first deregistration request message; from the perspective of the network device, the network device may receive a first deregistration request message from the terminal device after sending a security mode command message. Similar descriptions in other embodiments below (such as S501 and S502 in Embodiment 2, S601 and S602 in Embodiment 3, and S701 and S702 in Embodiment 4) can be understood by reference.

[0166] S403: If the security mode command message is received during the deregistration process, the terminal device ignores the security mode command message.

[0167] Among them, the deregistration process may refer to the deregistration process initiated by the terminal device through the first deregistration request message, which belongs to the existing technology and will not be repeated here.

[0168] In addition, the security mode command message is received during the deregistration process of the terminal device, which can be understood or replaced by the security mode control process of the terminal device conflicting with the deregistration process. The above "the security mode command message is received during the deregistration process" can also be replaced by other descriptions, such as "the security mode command message is received before the end of the deregistration process" without restriction.

[0169] Exemplarily, after receiving the safe mode command message, the terminal device can determine whether the safe mode command message is received during the deregistration process. There can be many specific implementation methods. For example, when the terminal device starts the deregistration process (for example, sending a first deregistration request), it can enter the deregistration initiation state (or set a flag that the deregistration process is being executed). When receiving the safe mode command message, it is determined whether the safe mode command message is received during the deregistration process by determining whether the terminal device is in the deregistration initiation state. If the terminal device is in the deregistration initiation state, the safe mode command message is received during the deregistration process; or, if the terminal device is not in the deregistration initiation state, the safe mode command message is not received during the deregistration process.

[0170] The above “the terminal device ignores the safe mode command message” may also be replaced by other descriptions, such as “the terminal device interrupts the safe mode control process” or “the terminal device discards the safe mode command message”.

[0171] The terminal device ignoring the security mode command message may include: the terminal device not sending a response message to the security mode command message (for example, a security mode completion message), and / or not enabling the first security context.

[0172] S404: If the first deregistration request message is received in the process of waiting for a response message to receive a security mode command message, the network device does not enable the first security context.

[0173] After the network device sends the security mode command message, it can wait to receive a response message to the security mode command message. If the network device receives a first deregistration request message while waiting to receive a response message to the security mode command message, it can be determined that the security mode control process conflicts with the deregistration process, and the first security context is not enabled. The network device not enabling the first security context can be replaced by the network device interrupting the security mode control process.

[0174] For example, after the network device sends a safe mode command message, a timer can be started (the duration of the timer is the duration of waiting for receiving a response message to the safe mode command message). If a first deregistration request message is received during the operation of the timer, it can be determined that the first deregistration request message is received during the process of waiting for receiving a response message to the safe mode command message, that is, it is determined that the safe mode control process conflicts with the deregistration process. The embodiment of the present application does not limit the specific implementation of the network device determining that the safe mode control process conflicts with the deregistration process.

[0175] Optionally, the above method further includes:

[0176] S405, the network device sends a response message to the first deregistration request message to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the second security context.

[0177] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message.

[0178] Taking the existence of a valid security context (such as the second security context) in the network device and the terminal device as an example, the network device and the terminal device can maintain or enable or use the second security context, that is, the second security context continues to be valid; in this case, the network device performs integrity protection and encryption on the deregistration acceptance message to be sent according to the second security context, and sends the deregistration acceptance message to the terminal device; in this case, the deregistration acceptance message is a ciphertext message.

[0179] S406: The terminal device performs integrity protection check on the deregistration acceptance message according to the second security context.

[0180] Exemplarily, when the integrity protection check of the deregistration acceptance message is successful according to the second security context, the terminal device can decrypt the deregistration acceptance message according to the second security context, and then complete the deregistration process and enter the deregistration state after the decryption is successful. Optionally, when the integrity protection check of the deregistration acceptance message fails according to the second security context, the terminal device can perform local deregistration, or re-initiate the deregistration process, such as sending a second deregistration request message to the network device.

[0181] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, both the terminal device and the network device can interrupt the security mode control process and communicate according to the second security context, thereby making the behaviors of the terminal device and the network device consistent, thereby ensuring that the terminal device completes the deregistration.

[0182] It is understandable that the above is based on "there is a valid security context in the network device and the terminal device". In other examples, there is no valid security context in the terminal device and the network device. In this case, the above S405 can be replaced by S405-a, and the above S406 can be replaced by S406-a.

[0183] S405-a, the network device sends a response message to the first deregistration request message to the terminal device, and the response message to the first deregistration request message is a plain text message.

[0184] S406-a, the terminal device receives a response message to the first deregistration request message and enters a deregistration state.

[0185] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, both the terminal device and the network device can interrupt the security mode control process and communicate in plain text, thereby making the behaviors of the terminal device and the network device consistent, thereby ensuring that the terminal device completes the deregistration.

[0186] Embodiment 2

[0187] In embodiment 2, when the security mode control process conflicts with the deregistration process, the network device may follow the provisions of the protocol (i.e., interrupt the security mode control process) or may not interrupt the security mode control process, and improve the implementation on the terminal device side to ensure that the terminal device completes the deregistration.

[0188] Figure 5 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 5 As shown, the process may include:

[0189] S501, the terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration; accordingly, the network device receives the first deregistration request message.

[0190] S502, the network device sends a security mode command message to the terminal device, where the security mode command message is used to enable a first security context; accordingly, the terminal device receives the security mode command message.

[0191] S503, the terminal device sends a response message to the security mode command message to the network device according to the security mode command message, and enables the first security context; correspondingly, the network device receives the response message to the security mode command message.

[0192] Here, the embodiment of the present application does not limit the order in which the terminal device enables the first security context and sends a response message to the security mode command message.

[0193] S504, the network device sends a response message to the first deregistration request message to the terminal device; correspondingly, the terminal device receives a response message to the first deregistration request message from the network device.

[0194] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message.

[0195] For example, before the terminal device enables the first security context, there is a valid security context (such as the second security context) in the terminal device and the network device, and the second security context is the security context that has been enabled before the terminal device enables the first security context. Among them, before the terminal device enables the first security context, the second security context is the current NAS security context. After the terminal device enables the first security context, the current NAS security context is switched to the first security context, and the second security context is a non-current NAS security context.

[0196] In this case, as a possible implementation, if the network device determines that the first deregistration request message is received in the process of waiting for the response message of the security mode command message, the security mode control process can be interrupted, that is, the network device can not enable the first security context. For example, the network device maintains the second security context to continue to be valid, and processes the deregistration acceptance message to be sent according to the second security context (such as integrity protection and encryption), and sends a deregistration acceptance message to the terminal device, and the deregistration acceptance message is a ciphertext message.

[0197] As another possible implementation, if the network device determines that the first deregistration request message is received in the process of waiting for a response message to the security mode command message, the security mode control process can be continued, and after receiving the response message to the security mode command message, the first security context is enabled. Further, the network device processes the deregistration acceptance message to be sent according to the first security context (such as integrity protection and encryption), and sends a deregistration acceptance message to the terminal device, where the deregistration acceptance message is a ciphertext message.

[0198] S505: If the security mode command message is received during the deregistration process, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0199] S506: When the integrity protection check on the response message to the first deregistration request message fails according to the first security context, the terminal device performs an integrity protection check on the response message to the first deregistration request message according to the second security context.

[0200] Exemplarily, when the integrity protection check of the deregistration acceptance message is successful according to the first security context, the terminal device can decrypt the deregistration acceptance message according to the first security context, and then complete the deregistration process and enter the deregistration state after the decryption is successful. When the integrity protection check of the deregistration acceptance message fails according to the first security context, the terminal device can perform an integrity protection check on the deregistration acceptance message according to the second security context.

[0201] Further optionally, in the case where the integrity protection check of the deregistration acceptance message according to the second security context is successful, the terminal device may decrypt the deregistration acceptance message according to the second security context, and then after the decryption is successful, complete the deregistration process and enter the deregistration state. In the case where the integrity protection check of the deregistration acceptance message according to the second security context fails, the terminal device may perform local deregistration; or the terminal device may re-initiate the deregistration process, such as sending a second deregistration request message to the network device.

[0202] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can attempt to perform an integrity protection check on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby increasing the possibility of successful integrity protection check on the deregistration acceptance message and ensuring that the terminal device completes the deregistration.

[0203] In other examples, the above S505 can be replaced by S505 - a, and the above S506 can be replaced by S506 - a.

[0204] S505-a, if the security mode command message is received during the deregistration process, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the second security context.

[0205] S506-a, when the integrity protection check on the response message of the first deregistration request message according to the second security context fails, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0206] Exemplarily, when the integrity protection check of the deregistration acceptance message is successful according to the second security context, the terminal device can decrypt the deregistration acceptance message according to the second security context, and then complete the deregistration process and enter the deregistration state after the decryption is successful. When the integrity protection check of the deregistration acceptance message fails according to the second security context, the terminal device can perform an integrity protection check on the deregistration acceptance message according to the first security context.

[0207] Further optionally, in the case where the integrity protection check of the deregistration acceptance message according to the first security context is successful, the terminal device may decrypt the deregistration acceptance message according to the first security context, and then after the decryption is successful, the deregistration process is completed and the deregistration state is entered. In the case where the integrity protection check of the deregistration acceptance message according to the first security context fails, the terminal device may perform local deregistration; or the terminal device may re-initiate the deregistration process, such as sending a second deregistration request message to the network device.

[0208] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can attempt to perform an integrity protection check on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby increasing the possibility of successful integrity protection check on the deregistration acceptance message and ensuring that the terminal device completes the deregistration.

[0209] It can be understood that the above is based on "before the terminal device enables the first security context, there is a valid security context in the terminal device and the network device". In other examples, before the terminal device enables the first security context, there is no valid security context in the terminal device and the network device. In this case, S504 can be replaced by S504-b, the above S505 can be replaced by S505-b, and the above S506 can be replaced by S506-b.

[0210] S504-b, the network device sends a response message to the first deregistration request message to the terminal device; correspondingly, the terminal device receives a response message to the first deregistration request message from the network device.

[0211] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message.

[0212] As a possible implementation, if the security mode control process conflicts with the deregistration process, the network device may interrupt the security mode control process, that is, the network device may not enable the first security context. For example, the network device may maintain plain text and send a deregistration acceptance message to the terminal device, and the deregistration acceptance message is a plain text message.

[0213] As another possible implementation, if the security mode control process conflicts with the deregistration process, the network device can continue the security mode control process, that is, the network device can enable the first security context. The network device processes the deregistration acceptance message to be sent according to the first security context (such as integrity protection and encryption), and sends the deregistration acceptance message to the terminal device, and the deregistration acceptance message is a ciphertext message.

[0214] S505-b, if the security mode command message is received during the deregistration process, and the response message to the first deregistration request message is a ciphertext message, the terminal device performs an integrity protection check on the response message to the first deregistration request message according to the first security context.

[0215] Exemplarily, when the integrity protection check of the response message of the first deregistration request message is successful according to the first security context, the terminal device can decrypt the deregistration acceptance message according to the first security context, and then complete the deregistration process and enter the deregistration state after the decryption is successful. When the integrity protection check of the deregistration acceptance message fails according to the first security context, the terminal device can perform local deregistration; or the terminal device re-initiates the deregistration process, such as sending a second deregistration request message to the network device.

[0216] S506-b, if the security mode command message is received during the deregistration process, and the response message to the first deregistration request message is a plain text message, the terminal device enters the deregistration state.

[0217] By adopting the above method, when the security mode control process conflicts with the deregistration process, the terminal device can decide whether to perform integrity protection check on the deregistration acceptance message according to the current NAS security context based on whether the deregistration acceptance message is in plain text, so as to facilitate the terminal device to complete the deregistration.

[0218] Embodiment 3

[0219] In the third embodiment, when the security mode control process conflicts with the deregistration process, the network device can follow the provisions of the protocol (i.e. interrupt the security mode control process) and improve the implementation on the terminal device side to ensure that the terminal device completes the deregistration.

[0220] Figure 6 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 6 As shown, the process may include:

[0221] S601, the terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration; accordingly, the network device receives the first deregistration request message.

[0222] S602, the network device sends a security mode command message to the terminal device, where the security mode command message is used to enable a first security context; accordingly, the terminal device receives the security mode command message.

[0223] S603: If the security mode command message is received during the deregistration process, the terminal device performs local deregistration.

[0224] That is to say, if the security mode command message is received during the deregistration process, the terminal device does not need to wait for the deregistration acceptance message (or even if it receives the deregistration acceptance message, it can ignore the deregistration acceptance message, that is, there is no need to process the deregistration acceptance message), but instead performs local deregistration, thereby ensuring that the terminal device completes the deregistration.

[0225] Exemplarily, the terminal device may also ignore the security mode command message, for example, the terminal device does not send a response message to the security mode command message (ie, a full mode completion message), and / or does not enable the first security context.

[0226] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can perform local deregistration, thereby ensuring that the terminal device completes the deregistration.

[0227] Embodiment 4

[0228] In the fourth embodiment, when the security mode control process conflicts with the deregistration process, the terminal device can follow the provisions of the protocol (i.e., do not interrupt the security mode control process) and improve the implementation on the network device side to ensure that the terminal device completes the deregistration.

[0229] Figure 7 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 7 As shown, the process may include:

[0230] S701, the terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration.

[0231] S702, the network device sends a security mode command message to the terminal device, where the security mode command message is used to enable a first security context; accordingly, the terminal device receives the security mode command message.

[0232] S703: The network device receives a first deregistration request message from the terminal device while waiting for a response message to the security mode command message.

[0233] Exemplarily, when the network device receives the first deregistration request message from the terminal device while waiting to receive a response message to the security mode command message, the network device may not interrupt the security mode control process and continue to wait to receive a response message to the security mode command message.

[0234] As a possible implementation, the network device receives a first deregistration request message while waiting to receive a response message to a security mode command message. If the first deregistration request message carries a first ciphertext element, the network device may not interrupt the security mode control process and continue to wait for receiving a response message to the security mode command message; optionally, if the first deregistration request message does not carry the first ciphertext element, the network device may interrupt the security mode control process (for example, stop waiting to receive a response message to the security mode command message) or not interrupt the security mode control process.

[0235] S704, the terminal device sends a response message to the security mode command message to the network device, and enables the first security context; accordingly, the network device receives the response message to the security mode command message.

[0236] Exemplarily, the response message to the safety mode command message may be a safety mode completion message.

[0237] Exemplarily, if the terminal device determines that the security mode control process conflicts with the deregistration process, the security mode control process may not be interrupted, and a response message to the security mode command message may be sent to the network device, and the first security context may be enabled.

[0238] S705: The network device enables the first security context according to the response message to the security mode command message.

[0239] S706, the network device sends a response message to the first deregistration request message to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

[0240] The embodiment of the present application does not limit the specific time when the network device enables the first security context. For example, the network device can enable the first security context when receiving a security mode completion message.

[0241] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message. The network device may process the deregistration acceptance message to be sent according to the first security context (such as integrity protection and encryption), and then send it to the terminal device.

[0242] S707, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0243] Exemplarily, if the integrity protection check of the deregistration acceptance message is successful according to the first security context, the terminal device can decrypt the deregistration acceptance message according to the first security context, and then complete the deregistration process after the decryption is successful, and enter the deregistration state. Optionally, if the integrity protection check of the deregistration acceptance message fails according to the first security context, the terminal device can perform local deregistration, or re-initiate the deregistration process, such as sending a second deregistration request message to the network device.

[0244] By adopting the above method, when the security mode control process conflicts with the deregistration process, the terminal device and the network device do not interrupt the security mode control process, thereby ensuring that the terminal device completes the deregistration.

[0245] Embodiment 5

[0246] In embodiment five, when the security mode control process conflicts with the deregistration process, the terminal device can determine whether to interrupt the security mode control process based on whether the first deregistration request message carries a first ciphertext information element (IE) to ensure that the terminal device completes the deregistration.

[0247] Figure 8This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 8 As shown, the process may include:

[0248] S801, the terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration; accordingly, the network device receives the first deregistration request message.

[0249] Exemplarily, if there is no valid security context in the terminal device, the first deregistration request message sent by the terminal device does not carry the first ciphertext element. If there is a valid security context (i.e., the second security context) in the terminal device, the first deregistration request message sent by the terminal device may carry the first ciphertext element or may not carry the first ciphertext element. For example, if the terminal device needs to send relatively important information or privacy-related information (such as the duration of deregistration, etc.) to the network device, these plaintext information can be encrypted and integrity protected according to the second security context to obtain the first ciphertext element, and sent to the network device through the first deregistration request message.

[0250] The first ciphertext information element may be a non-clear IE. The first deregistration request message includes a non-access stratum information container (NAS MSG container), and the non-clear IE may be carried in the non-access stratum information container.

[0251] S802, the network device sends a security mode command message to the terminal device, where the security mode command message is used to enable a first security context; accordingly, the terminal device receives the security mode command message.

[0252] From the perspective of the network device, the first implementation is: the first deregistration request message carries the first ciphertext cell, and after receiving the first deregistration request message, the network device sends a security mode command message to the terminal device because the integrity protection check of the first ciphertext cell fails. For example, when the first deregistration request message carries the first ciphertext cell, if due to some possible factors, the security contexts used by the network device and the terminal device are inconsistent (for example, there is a valid security context in the terminal device, but there is no valid security context in the network device), after the network device receives the first deregistration request message, the integrity protection check of the first ciphertext cell may fail; therefore, the network device can send a security mode command message to the terminal device so that the security contexts used by the network device and the terminal device are consistent.

[0253] Optionally, before the network device sends a security mode command message to the terminal device, the network device and the terminal device may perform an authentication process so that the network device and the terminal device respectively create a new security context (such as a first security context).

[0254] The second implementation: before receiving the first deregistration reception message, the network device sends a security mode command message to the terminal device. There are many triggering factors for the network device to send the security mode command message, which are not specifically limited.

[0255] It can be seen from the above two implementations that the network device may send a security mode command message to the terminal device due to failure of integrity protection check on the first ciphertext cell; or may send a security mode command message to the terminal device due to other reasons.

[0256] From the perspective of the terminal device, after receiving the security mode command message, the terminal device may execute S803 or S804.

[0257] S803: If the security mode command message is received during the deregistration process and the first deregistration request message does not carry the first ciphertext element, the terminal device ignores the security mode command message.

[0258] Exemplarily, the implementation of the terminal device ignoring the security mode command message may refer to Embodiment 1 or Embodiment 3, which will not be described in detail.

[0259] S804, if the security mode command message is received during the deregistration process, and the first deregistration request message carries the first ciphertext element, the terminal device sends a response message to the security mode command message to the network device, and enables the first security context.

[0260] Exemplarily, when the first deregistration request message carries the first ciphertext cell, if the terminal device receives a security mode command message during the deregistration process, it is possible that the network device sends the security mode command message to the terminal device after receiving the first deregistration request message because the integrity protection check on the first ciphertext cell fails, or it is also possible that the network device sends the security mode command message to the terminal device before receiving the first deregistration reception message. Since the terminal device cannot determine whether the network device sends the security mode command message because the integrity protection check on the first ciphertext cell fails, in order to avoid the terminal device interrupting the security mode control process triggered by the network device due to the failure of the integrity protection check on the first ciphertext cell, when the first deregistration request message carries the first ciphertext cell, the terminal device can send a response message to the security mode command message (such as a security mode completion message) and enable the first security context.

[0261] The security mode completion message may carry a second ciphertext cell, and the second ciphertext cell and the first ciphertext cell correspond to the same plaintext information. That is, the terminal device may encrypt and integrity protect the above plaintext information (such as important information or privacy-related information) according to the first security context, obtain the second ciphertext cell, and send it to the network device through the security mode completion message.

[0262] The implementation after S803 or S804 is introduced below in combination with Situation 1 and Situation 2 respectively.

[0263] (1) Scenario 1:

[0264] In scenario 1, it is assumed that the network device in S802 sends the security mode command message due to failure in integrity protection check of the first ciphertext cell (ie, the first implementation).

[0265] From the perspective of the network device: the network device can complete the message according to the security mode, enable the first security context, and perform integrity protection verification on the second ciphertext cell according to the first security context, and then after the integrity protection verification and decryption of the second ciphertext cell according to the first security context are successful, the plaintext information corresponding to the second ciphertext cell can be obtained. Further, the network device can send a deregistration acceptance message to the terminal device, and the deregistration acceptance message is a ciphertext message processed according to the first security context.

[0266] From the perspective of the terminal device: after receiving the deregistration acceptance message, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the first security context and the second security context, referring to the description in Example 2.

[0267] (2) Scenario 2:

[0268] In scenario 2, it is assumed that the network device in S802 sends the security mode command message due to other reasons (except for the failure of integrity protection check on the first ciphertext cell) (ie, the second implementation).

[0269] The implementation in this case can refer to the description in Example 2. For example, the network device can interrupt the security mode control process, or it can not interrupt the security mode control process. The terminal device can attempt to perform integrity protection check on the deregistration acceptance message based on the first security context and the second security context.

[0270] It can be understood that the above description is based on the example of "when the first deregistration request message does not carry the first ciphertext element, the terminal device ignores the security mode command message (i.e., interrupts the security mode control process)". In other embodiments, when the first deregistration request message does not carry the first ciphertext element, the terminal device may not interrupt the security mode control process. Please refer to the description in Example 2 or Example 4 for details.

[0271] With respect to the above embodiments, it can be understood that:

[0272] (1) In the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships. In addition, in the same embodiment, different implementations or different examples can also be referenced or referred to each other.

[0273] (2) The various numerical numbers involved in this application are only for the convenience of description and are not used to limit the scope of this application. The step numbers of the above-mentioned flowcharts are only an example of the execution process and do not constitute a restriction on the order of execution of the steps. That is, the size of the step number does not mean the order of execution. The execution order of each step should be determined by its function and internal logic. In addition, not all the steps shown in each flowchart are steps that must be executed. Some steps can be added or deleted based on each flowchart according to actual needs.

[0274] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the interaction between the terminal device and the network device. It is understandable that in order to achieve the above functions, the terminal device and the network device may include hardware structures and / or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0275] The embodiment of the present application can divide the terminal device and the network device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0276] In the case of an integrated unit, Fig. 9 A possible exemplary block diagram of the device involved in the embodiments of the present application is shown. Fig. 9 As shown, the device 900 may include: a processing unit 902 and a communication unit 903. The processing unit 902 is used to control and manage the actions of the device 900. The communication unit 903 is used to support the communication between the device 900 and other devices. Optionally, the communication unit 903 is also called a transceiver unit, and may include a receiving unit and / or a sending unit, which are respectively used to perform receiving and sending operations. The device 900 may also include a storage unit 901 for storing program code and / or data of the device 900.

[0277] (1) The apparatus 900 may be a terminal device in the above embodiments (such as embodiments 1 to 5). The processing unit 902 may support the apparatus 900 in executing the actions of the terminal device in the above method embodiments. Alternatively, the processing unit 902 mainly executes the internal actions of the terminal device in the method embodiments, and the communication unit 903 may support the communication between the apparatus 900 and other devices.

[0278] For example, in one embodiment, the communication unit 903 is used to: send a first deregistration request message to a network device, wherein the first deregistration request message is used by the terminal device to request deregistration; receive a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; according to the security mode command message, send a response message to the security mode command message to the network device, and enable the first security context; receive a response message to the first deregistration request message from the network device; the processing unit 902 is used to: if the security mode command message is received during the deregistration process, perform an integrity protection check on the response message of the first deregistration request message according to the first security context; in the event that the integrity protection check on the response message of the first deregistration request message fails according to the first security context, perform an integrity protection check on the response message of the first deregistration request message according to a second security context, wherein the second security context is a security context that has been enabled by the terminal device before enabling the first security context.

[0279] In one possible design, the processing unit 902 is also used to: if the integrity protection check of the response message of the first de-registration request message fails according to the second security context, then perform local de-registration; or, the communication unit 903 is also used to: if the integrity protection check of the response message of the first de-registration request message fails according to the second security context, then send a second de-registration request message to the network device, and the second de-registration request message is used by the terminal device to request deregistration.

[0280] In another embodiment, the communication unit 903 is used to: send a first deregistration request message to a network device, wherein the first deregistration request message is used by the terminal device to request deregistration; receive a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; according to the security mode command message, send a response message of the security mode command message to the network device, and enable the first security context; receive a response message of the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, the processing unit 902 is used to: perform integrity protection check on the response message of the first deregistration request message according to the second security context, wherein the second security context is a security context that has been enabled by the terminal device before enabling the first security context.

[0281] In one possible design, the processing unit 902 is further used to: if the integrity protection check on the response message of the first de-registration request message fails according to the second security context, then perform an integrity protection check on the response message of the first de-registration request message according to the first security context.

[0282] In one possible design, the processing unit 902 is further used to: if the integrity protection check of the response message of the first de-registration request message fails according to the first security context, then perform local de-registration; or, the communication unit 903 is further used to: if the integrity protection check of the response message of the first de-registration request message fails according to the first security context, then send a second de-registration request message to the network device, and the second de-registration request message is used by the terminal device to request deregistration.

[0283] (2) The apparatus 900 may be a network device in the above embodiments (such as embodiments 1 to 5). The processing unit 902 may support the apparatus 900 in executing the actions of the network device in the above method embodiments. Alternatively, the processing unit 902 mainly executes the internal actions of the network device in the method embodiments, and the communication unit 903 may support the communication between the apparatus 900 and other devices.

[0284] For example, in one embodiment, the communication unit 903 is used to: send a security mode command message to a terminal device, wherein the security mode command message is used to enable a first security context; receive a first deregistration request message from the terminal device, wherein the first deregistration request message is used by the terminal device to request deregistration; receive a response message to the security mode command message from the terminal device; the processing unit 902 is used to: enable the first security context based on the response message to the security mode command message; the communication unit 903 is also used to: send a response message to the first deregistration request message to the terminal device, wherein the response message to the first deregistration request message is a ciphertext message obtained based on the first security context.

[0285] In another embodiment, the communication unit 903 is used to: receive a first deregistration request message from a terminal device, wherein the first deregistration request message is used by the terminal device to request deregistration, and the first deregistration request message carries a first ciphertext element; if an integrity protection check of the first ciphertext element fails according to a second security context, a security mode command message is sent to the terminal device, wherein the security mode command message is used to enable a first security context; receive a response message to the security mode command message from the terminal device; the processing unit 902 is used to: enable the first security context according to the response message of the security mode command message; the communication unit 903 is also used to: send a response message to the first deregistration request message to the terminal device, wherein the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

[0286] In one possible design, the response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained based on the first security context.

[0287] In a possible design, the communication unit 903 is further used to: send an authentication request message to the terminal device, where the authentication request message is used to request the terminal device to create a first security context.

[0288] It should be understood that the division of the units in the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And the units in the device can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some units can also be implemented in the form of software calling through processing elements, and some units can be implemented in the form of hardware. For example, each unit can be a separately established processing element, or it can be integrated in a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, and called and executed by a certain processing element of the device. The function of the unit. In addition, all or part of these units can be integrated together, or they can be implemented independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. In the implementation process, each operation of the above method or each unit above can be implemented by an integrated logic circuit of hardware in the processor element or in the form of software calling through a processing element.

[0289] In one example, the unit in any of the above devices may be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASIC), or one or more digital singnal processors (DSP), or one or more field programmable gate arrays (FPGA), or a combination of at least two of these integrated circuit forms. For another example, when the unit in the device can be implemented in the form of a processing element scheduler, the processing element can be a processor, such as a general-purpose central processing unit (CPU), or other processors that can call programs. For another example, these units can be integrated together and implemented in the form of a SoC.

[0290] The above unit for receiving is an interface circuit of the device, which is used to receive signals from other devices. For example, when the device is implemented in the form of a chip, the receiving unit is an interface circuit of the chip used to receive signals from other chips or devices. The above unit for sending is an interface circuit of the device, which is used to send signals to other devices. For example, when the device is implemented in the form of a chip, the sending unit is an interface circuit of the chip used to send signals to other chips or devices.

[0291] Based on the above embodiments, the present application also provides a communication device, referring to Fig.10As shown, the communication device 1000 may include a processor 1001. Optionally, the communication device 1000 may further include a memory 1002. The memory 1002 may be disposed inside the communication device 1000 or outside the communication device 1000.

[0292] Specifically, the processor 1001 may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and a NP. The processor 1001 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0293] The processor 1001 and the memory 1002 are interconnected. Optionally, the processor 1001 and the memory 1002 are interconnected via a bus 1003; the bus 1003 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0294] In an optional implementation, the memory 1002 is used to store programs, etc. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory 1002 may include a RAM, and may also include a non-volatile memory (non-volatile memory), such as one or more disk memories. The processor 1001 executes the application stored in the memory 1002 to implement the above functions, thereby realizing the functions of the communication device 1000.

[0295] Exemplarily, the communication device 1000 may be the terminal device in the above embodiment; or may be the network device in the above embodiment.

[0296] In one embodiment, when the communication device 1000 implements the function of the terminal device in the above method embodiment, the transceiver 1001 can implement the transceiver operation performed by the terminal device in the above method embodiment; the processor 1001 can implement other operations except the transceiver operation performed by the terminal device in the above method embodiment. For specific related descriptions, please refer to the related descriptions in the above embodiments, which will not be described in detail here.

[0297] In another embodiment, when the communication device 1000 implements the function of the network device in the above method embodiment, the transceiver 1001 can implement the transceiver operation performed by the network device in the above method embodiment; the processor 1001 can implement other operations except the transceiver operation performed by the network device in the above method embodiment. For specific related descriptions, please refer to the related descriptions in the above embodiments, which will not be described in detail here.

[0298] An embodiment of the present application also provides a communication system, which includes the terminal device and network device involved in the above embodiment.

[0299] The terms "system" and "network" in the embodiments of the present application can be used interchangeably. "At least one" refers to one or more, and "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B, which can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following (single)" or its similar expression refers to any combination of these items, including any combination of single (single) or plural (single). For example, "at least one of A, B and C" includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects.

[0300] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0301] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0302] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0303] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0304] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; According to the security mode command message, sending a response message of the security mode command message to the network device, and enabling the first security context; receiving a response message to the first deregistration request message from the network device; If the security mode command message is received during the deregistration process, performing an integrity protection check on a response message of the first deregistration request message according to the first security context; In the event that an integrity protection check on a response message to the first deregistration request message fails according to the first security context, an integrity protection check is performed on the response message to the first deregistration request message according to a second security context, where the second security context is a security context that was enabled by the terminal device before the first security context was enabled.

2. The method according to claim 1, characterized in that: The method further comprises: If the integrity protection check of the response message to the first deregistration request message according to the second security context fails, performing local deregistration; or, If the integrity protection check of the response message of the first deregistration request message fails according to the second security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

3. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; According to the security mode command message, sending a response message of the security mode command message to the network device, and enabling the first security context; receiving a response message to the first deregistration request message from the network device; If the security mode command message is received during the deregistration process, an integrity protection check is performed on the response message of the first deregistration request message according to the second security context, where the second security context is the security context that has been enabled by the terminal device before enabling the first security context.

4. The method according to claim 3, characterized in that The method further comprises: If the integrity protection check performed on the response message of the first deregistration request message according to the second security context fails, the integrity protection check is performed on the response message of the first deregistration request message according to the first security context.

5. The method according to claim 4, characterized in that The method further comprises: If the integrity protection check of the response message to the first deregistration request message fails according to the first security context, local deregistration is performed; or, If the integrity protection check of the response message of the first deregistration request message fails according to the first security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

6. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; According to the security mode command message, sending a response message of the security mode command message to the network device, and enabling the first security context; receiving a response message to the first deregistration request message from the network device; If the security mode command message is received during the deregistration process, and the response message to the first deregistration request message is a ciphertext message, performing integrity protection check on the response message to the first deregistration request message according to the first security context; or, If the security mode command message is received during the deregistration process, and the response message to the first deregistration request message is a plain text message, the deregistration state is entered.

7. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; If the security mode command message is received during the deregistration process, and the first deregistration request message does not carry the first ciphertext information element, then ignoring the security mode command message; or, If the security mode command message is received during the deregistration process and the first deregistration request message carries the first ciphertext element, a response message of the security mode command message is sent to the network device, and the first security context is enabled.

8. The method according to claim 7, characterized in that The ignoring the safety mode command message comprises: The first security context is not enabled, and / or a response message to the security mode command message is not sent.

9. The method according to claim 7 or 8, characterized in that: In the case of executing the step of ignoring the safety mode command message, the method further includes: receiving a response message to the first deregistration request message from the network device; When the response message to the first deregistration request message is a ciphertext message, performing integrity protection check on the response message according to the second security context enabled by the terminal device; or When the response message to the first deregistration request message is a plain text message, the deregistration state is entered.

10. The method according to claim 7, characterized in that In the case of performing the enabling of the first security context, the method further includes: receiving a response message to the first deregistration request message from the network device; performing an integrity protection check on a response message to the first deregistration request message according to the first security context; In the event that an integrity protection check on a response message to the first deregistration request message fails according to the first security context, an integrity protection check is performed on the response message to the first deregistration request message according to a second security context, where the second security context is a security context that was enabled by the terminal device before the first security context was enabled.

11. The method according to claim 10, characterized in that The method further comprises: If the integrity protection check of the response message to the first deregistration request message according to the second security context fails, performing local deregistration; or, If the integrity protection check of the response message of the first deregistration request message fails according to the second security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

12. The method according to claim 7, characterized in that In the case of performing the enabling of the first security context, the method further includes: receiving a response message to the first deregistration request message from the network device; An integrity protection check is performed on a response message to the first deregistration request message according to the second security context, where the second security context is a security context that has been enabled by the terminal device before the first security context is enabled.

13. The method according to claim 12, characterized in that The method further comprises: If the integrity protection check performed on the response message of the first deregistration request message according to the second security context fails, the integrity protection check is performed on the response message of the first deregistration request message according to the first security context.

14. The method according to claim 13, characterized in that The method further comprises: If the integrity protection check of the response message to the first deregistration request message fails according to the first security context, local deregistration is performed; or, If the integrity protection check of the response message of the first deregistration request message fails according to the first security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

15. The method according to claim 7, characterized in that In the case of performing the enabling of the first security context, the method further includes: receiving a response message to the first deregistration request message from the network device; When the response message to the first deregistration request message is a ciphertext message, performing integrity protection check on the response message to the first deregistration request message according to the first security context; or, When the response message to the first deregistration request message is a plain text message, the deregistration state is entered.

16. The method according to any one of claims 7 to 15, characterized in that The response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained according to the first security context.

17. A communication method, characterized in that: The method is applied to a network device or a chip in the network device, and the method comprises: Sending a security mode command message to the terminal device, where the security mode command message is used to enable the first security context; In the process of waiting for receiving a response message to the security mode command message, receiving a first deregistration request message from the terminal device, where the first deregistration request message is used by the terminal device to request deregistration; Receiving a response message to the security mode command message from the terminal device; enabling the first security context according to a response message to the security mode command message; A response message to the first deregistration request message is sent to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

18. The method according to claim 17, characterized in that The method further comprises: If the first deregistration request message carries the first ciphertext element, continue to wait for receiving a response message to the security mode command message.

19. A communication method, characterized in that: The method is applied to a network device or a chip in the network device, and the method comprises: receiving a first deregistration request message from a terminal device, where the first deregistration request message is used by the terminal device to request deregistration, and the first deregistration request message carries a first ciphertext information element; If the integrity protection check of the first ciphertext cell according to the second security context fails, sending a security mode command message to the terminal device, where the security mode command message is used to enable the first security context; Receiving a response message to the security mode command message from the terminal device; enabling the first security context according to a response message to the security mode command message; A response message to the first deregistration request message is sent to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

20. The method according to claim 19, characterized in that The response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained according to the first security context.

21. The method according to claim 19 or 20, characterized in that The method further comprises: An authentication request message is sent to the terminal device, where the authentication request message is used to request the terminal device to create a first security context.

22. A communication system, characterized in that: The system includes a network device and a terminal device; The terminal device is used to perform the method according to any one of claims 1 to 16; The network device is used to send the security mode command message to the terminal device; And sending a response message of the first deregistration request message to the terminal device.

23. A communication system, characterized in that: The system includes a network device and a terminal device; The network device is used to perform the method according to any one of claims 17 to 21; The terminal device is used to send the first deregistration request message to the network device; And, sending a response message of the security mode command message to the network device.

24. A communication device, characterized in that: Comprising modules for executing the method as claimed in any one of claims 1 to 21.

25. A communication device, characterized in that: It comprises a processor, the processor is coupled to a memory, and a computer program is stored in the memory; the processor is used to call part or all of the computer program in the memory so that the method as claimed in any one of claims 1 to 21 is executed.

26. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when part or all of the computer program is executed by a computer, the method according to any one of claims 1 to 21 is executed.

27. A computer program product, characterized in that When a computer reads and executes the computer program product, the method according to any one of claims 1 to 21 is executed.

Images