Identity verification method and device

Abstract

The embodiment of the invention discloses an identity verification method and device, and the method comprises the steps: transmitting a first request message to a first network device in an NPN, the first request message being used for the first network device to determine a second request message, and the second request message being used for requesting a second network device corresponding to the NPN to carry out the identity verification of a terminal device; a first response message sent by the first network device through the access network device is received, and the first response message is used for indicating whether the identity verification of the terminal device succeeds or not, so that the terminal device and the accessed network can authenticate each other, access the network safely, obtain the service provided by the network, and improve the service quality. The information interaction security between the terminal equipment and the access network is effectively protected, and the security and privacy of the system are improved.

Description

Identity verification method and device Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an identity authentication method and device. Background Art

[0002] 3GPP Technical Report TR 23.700 addresses the key issues of "Non-Public Network (NPN) as Hosting Network to Provide Access to Localized Services" and "Terminal Discovery, Selection, and Access to NPN as Hosting Network and Receiving Localized Services." Specifically, NPNs can act as hosting networks to provide localized services.

[0003] However, in related technologies, there is no mutual authentication mechanism between the terminal device and the hosting network, which makes it possible for both the terminal and the network to be impersonated, leading to security issues such as information leakage and malicious tampering.

[0004] Summary of the Invention

[0005] A first embodiment of the present application provides an identity authentication method, which is executed by a terminal device and includes:

[0006] Sending a first request message to a first network device in a non-public network NPN through an access network device, where the first request message is used by the first network device to determine a second request message, where the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device;

[0007] Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful.

[0008] A second aspect of the present application provides an identity authentication method, which is performed by a first core network device and includes:

[0009] Receiving a first request message sent by a terminal device through an access network device;

[0010] Sending, according to the first request message, a second request message to a second network device corresponding to the non-public network NPN where the first network device is located, wherein the second request message is used to request the second network device to authenticate the terminal device;

[0011] receiving a result of the terminal device identity authentication sent by the second network device;

[0012] According to the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful.

[0013] A third aspect of the present application provides an identity authentication method, which is performed by a second core network device and includes:

[0014] receiving a second request message sent by the first network device, where the second request message is determined by the first network device according to the first request message sent by the terminal device, and the second request message is used to request the second network device corresponding to the non-public network (NPN) where the first network device is located to authenticate the terminal device;

[0015] The result of the terminal device identity authentication is sent to the first network device, and the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful.

[0016] A fourth aspect of the present application provides an identity authentication device, which is applied to a terminal device and includes:

[0017] a transceiver unit, configured to send a first request message to a first network device in a non-public network (NPN) through an access network device, wherein the first request message is used by the first network device to determine a second request message, and the second request message is used to request a second network device corresponding to the NPN to authenticate the device;

[0018] The transceiver unit is further configured to receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the device identity authentication is successful.

[0019] A fifth embodiment of the present application provides an identity authentication device, which is applied to a first core network device and includes:

[0020] A transceiver unit, configured to receive a first request message sent by a terminal device through an access network device;

[0021] a processing unit, configured to send, according to the first request message, a second request message to a second network device corresponding to the non-public network NPN where the apparatus is located, wherein the second request message is used to request the second network device to authenticate the terminal device;

[0022] The transceiver unit is further configured to receive a result of the terminal device identity authentication sent by the second network device;

[0023] The processing unit is further configured to send a first response message to the terminal device through the access network device based on a result of the identity authentication of the terminal device, wherein the first response message is configured to indicate whether the identity authentication of the terminal device is successful.

[0024] A sixth aspect of the present application provides an identity authentication device, which is applied to a second core network device and includes:

[0025] a transceiver unit, configured to receive a second request message sent by a first network device, where the second request message is determined by the first network device based on the first request message sent by the terminal device, and the second request message is used to request the device corresponding to the non-public network (NPN) where the first network device is located to authenticate the terminal device;

[0026] The transceiver unit is further configured to send a result of the terminal device identity authentication to the first network device, wherein the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful.

[0027] The seventh aspect embodiment of the present application proposes a communication device, which includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory so that the device performs the identity authentication method described in the first aspect embodiment above.

[0028] The eighth aspect embodiment of the present application proposes a communication device, which includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program stored in the memory so that the device executes the identity authentication method described in the second aspect embodiment, or executes the identity authentication method described in the third aspect embodiment.

[0029] The ninth aspect embodiment of the present application proposes a communication device, which includes a processor and an interface circuit. The interface circuit is used to receive code instructions and transmit them to the processor. The processor is used to run the code instructions to enable the device to execute the identity authentication method described in the first aspect embodiment above.

[0030] The tenth aspect embodiment of the present application proposes a communication device, which includes a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the identity authentication method described in the second aspect embodiment, or execute the identity authentication method described in the third aspect embodiment.

[0031] The eleventh embodiment of the present application proposes a computer-readable storage medium for storing instructions, which, when executed, enables the identity authentication method described in the first embodiment to be implemented.

[0032] The twelfth aspect embodiment of the present application proposes a computer-readable storage medium for storing instructions. When the instructions are executed, the identity authentication method described in the above-mentioned second aspect embodiment is implemented, or the identity authentication method described in the above-mentioned third aspect embodiment is implemented.

[0033] The thirteenth aspect of the present application provides a computer program which, when executed on a computer, enables the computer to execute the identity authentication method described in the first aspect.

[0034] The fourteenth embodiment of the present application proposes a computer program, which, when running on a computer, enables the computer to execute the identity authentication method described in the second embodiment, or execute the identity authentication method described in the third embodiment.

[0035] An embodiment of the present application provides an identity authentication method and apparatus, which sends a first request message to a first network device in a non-public network NPN, where the first request message is used by the first network device to determine a second request message, where the second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device, and receives a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can mutually authenticate each other, the terminal device can securely access the network, and obtain services provided by the network, thereby effectively protecting the security of information interaction between the terminal device and the accessed network and improving the security and privacy of the system.

[0036] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

[0038] FIG1 is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0039] FIG2 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0040] FIG3 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0041] FIG4 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0042] FIG5 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0043] FIG6 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0044] FIG7 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0045] FIG8 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0046] FIG9 is a flow chart of an identity authentication method provided in an embodiment of the present application;

[0047] FIG10 is a flow chart of an identity authentication method according to an embodiment of the present application;

[0048] FIG11 is a flow chart of an identity authentication method according to an embodiment of the present application;

[0049] FIG12 is a schematic structural diagram of an identity authentication device provided in an embodiment of the present application;

[0050] FIG13 is a schematic structural diagram of an identity authentication device provided in an embodiment of the present application;

[0051] FIG14 is a schematic structural diagram of an identity authentication device provided in an embodiment of the present application;

[0052] FIG15 is a schematic diagram of a communication system provided in an embodiment of the present application;

[0053] FIG16 is a schematic structural diagram of another identity authentication device provided in an embodiment of the present application;

[0054] FIG17 is a schematic structural diagram of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numbers in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible implementations consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0056] The terms used in the embodiments of this application are for the purpose of describing specific embodiments only and are not intended to limit the embodiments of this application. The singular forms "a" and "the" used in the embodiments of this application and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0057] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of the embodiments of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to a determination."

[0058] The embodiments of the present application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be understood as limiting the present application.

[0059] In order to better understand the identity authentication method disclosed in the embodiment of the present application, the communication system to which the embodiment of the present application is applicable is first described below.

[0060] Please refer to Figure 1, which is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application. The communication system may include, but is not limited to, a terminal device and a core network device. The number and form of devices shown in Figure 1 are for example purposes only and do not constitute a limitation on the embodiments of the present application. In actual applications, two or more network devices and two or more terminal devices may be included. The communication system shown in Figure 1 includes, for example, a terminal device 101, a first network device 102, and a second network device 103.

[0061] It should be noted that the technical solutions of the embodiments of the present application can be applied to various communication systems, such as Long Term Evolution (LTE) systems, fifth-generation mobile communication systems, 5G new air interface systems, or other future new mobile communication systems.

[0062] The terminal device 101 in the embodiment of the present application is an entity on the user side for receiving or transmitting signals, such as a mobile phone. The terminal device can also be called a terminal device (terminal), user equipment (UE), mobile station (MS), mobile terminal device (MT), etc. The terminal device can be a car with communication function, a smart car, a mobile phone (Mobile Phone), a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control (Industrial Control), a wireless terminal device in self-driving (Self-Driving), a wireless terminal device in remote medical surgery (Remote Medical Surgery), a wireless terminal device in smart grid (Smart Grid), a wireless terminal device in transportation safety (Transportation Safety), a wireless terminal device in smart city (Smart City), a wireless terminal device in smart home (Smart Home), etc. The embodiment of the present application does not limit the specific technology and specific device form adopted by the terminal device.

[0063] In an embodiment of the present application, the first network device 102 is a core network device in a non-public network NPN. The first network device 102 may be an authentication server function (AUSF). It is understandable that other core network devices may also be present in the non-public network NPN, such as access and mobility management function (AMF), security anchor function (SEAF), unified data management (UDM), network slice-specific authentication and authorization function (NSSAAF), and the like.

[0064] In this embodiment of the present application, the second network device 103 is a network-side entity capable of providing services to the non-public network (NPN) where the first network device resides. For example, the second network device can be a server capable of providing authentication services, etc., for the NPN. For example, the second network device can be an Authentication, Authorization, Accounting (AAA) server, etc.

[0065] In various embodiments of the present application, the non-public network NPN may be a stand-alone non-public network (SNPN).

[0066] 3GPP Technical Report TR 23.700 addresses the key issues of "Non-Public Network (NPN) as Hosting Network to Provide Access to Localized Services" and "Terminal Discovery, Selection, and Access to NPN as Hosting Network and Receiving Localized Services." Specifically, NPNs can act as hosting networks to provide localized services.

[0067] However, in related technologies, there's no mutual authentication mechanism between the terminal device and the managed network, which makes both the terminal and the network potentially impersonated. If the terminal device hasn't authenticated itself with the network, it could be impersonating; if the network hasn't authenticated itself with the terminal device, the network could also be impersonating. Information exchange between the terminal device and the managed network without mutual authentication can lead to security issues such as information leakage and malicious tampering.

[0068] It can be understood that in each embodiment of the present application, the information interaction between the terminal device and each core network device is completed through transparent transmission of the access network device.

[0069] It can be understood that the communication system described in the embodiment of the present application is for the purpose of more clearly illustrating the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided by the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present application is also applicable to similar technical problems.

[0070] The identity verification method and device provided by this application are described in detail below with reference to the accompanying drawings.

[0071] Please refer to Figure 2, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is executed by a terminal device. This method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 2, the method may include the following steps:

[0072] Step 201: Send a first request message to a first network device in the NPN through an access network device. The first request message is used by the first network device to determine a second request message. The second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.

[0073] In an embodiment of the present application, the terminal device can send a first request message to the first network device in the NPN through the access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device.

[0074] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0075] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0076] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0077] Optionally, the second network device may be an AAA server.

[0078] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0079] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0080] As another possible implementation, the first request message includes an identifier of the terminal device.

[0081] Optionally, the identifier of the terminal device may be at least one of the following: a Subscription Permanent Identifier (SUPI), a Subscription Concealed Identifier (SUCI), an anonymous SUPI, an anonymous SUCI, an onboarding SUCI, or an onboarding SUPI.

[0082] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0083] In some embodiments, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up (onboarding) online at the NPN to obtain authentication credentials and does not need the NPN to provide services (the NPN does not have the subscription information of the terminal device). The terminal device can also send a first indication information to the first network device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.

[0084] It should be noted that if the NPN includes the subscription data of the terminal device, the first network device sends a message to the UDM to request the UDM to decide to perform authentication with the terminal device based on the subscription data of the terminal device. The first network device is able to receive the response message sent by the UDM to determine to perform authentication with the terminal device, and send the second request message to the second network device through the Network Slice-Specific Authentication and Authorization Function (NSSAAF) in the NPN.

[0085] Optionally, the first network device starts a Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.

[0086] If the NPN does not have the subscription data for the terminal device, the first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending the message to the UDM. After receiving the first indication information, the first network device may not send the message to the UDM, but instead directly send the second request message to the second network device through the NSSAAF in the NPN.

[0087] Optionally, the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.

[0088] The identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contracted SUCI, and online contracted SUPI.

[0089] As a possible implementation, the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.

[0090] Optionally, the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0091] Optionally, the local policy may be determined based on the identifier of the terminal device, and ignores querying the UDM to determine whether the identifier of the terminal device has corresponding subscription information.

[0092] As another possible implementation, the first indication information is used to indicate that the NPN does not include subscription data of the terminal device. The first network device can determine to omit sending a message to the UDM based on the received first indication information.

[0093] Similarly, optionally, the first network device may determine to ignore interaction with the UDM based on the first indication information, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0094] Optionally, the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.

[0095] In some implementations, the NPN may not include the subscription data of the terminal device, and the first network device may not omit sending a message to the UDM. The first network device may still send a message to the UDM to initiate the Nudm_UEAuthentication_Get service operation, and receive a response indicating that the subscription information of the terminal device was not found. The first network device does not reject the first request of the terminal device and still sends the second request message to the second network device through the NSSAAF in the NPN.

[0096] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0097] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0098] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device. The mutual authentication method may be authentication based on the Extensible Authentication Protocol (EAP). The mutual authentication between the terminal device and the second network device may also use other identity authentication methods. The embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0099] Step 202: Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful.

[0100] In an embodiment of the present application, a terminal device can receive a first response message sent by a first network device via an access network device, wherein the first response message can indicate whether the identity authentication of the terminal device is successful. The first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.

[0101] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0102] In some embodiments, the first response message indicates that the terminal device identity authentication is successful, and the terminal device is able to determine the master session key (MSK) and to determine the first security key K based on the MSK. AUSFThe terminal device can be based on a key derivation function (KDF) according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF It is used by the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.

[0103] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0104] It should also be noted that the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0105] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0106] Optionally, the second security key K stored in the SEAF SEAF It is sent by the first network device to the SEAF.

[0107] It can be understood that if the first response message indicates that the identity authentication of the terminal device has failed, the terminal device is denied access to the NPN and cannot obtain the credential of successful identity authentication provided by the second network device.

[0108] In summary, by sending a first request message to a first network device in a non-public network NPN, the first request message is used by the first network device to determine a second request message, the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device, and receive a first response message sent by the first network device through the access network device, the first response message is used to indicate whether the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network and improves the security and privacy of the system.

[0109] Please refer to Figure 3, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is executed by a terminal device. This method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 3, the method may include the following steps:

[0110] Step 301: Send a first request message to a first network device in an NPN through an access network device. The first request message is used by the first network device to determine a second request message. The second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.

[0111] In an embodiment of the present application, the terminal device can send a first request message to the first network device in the NPN through the access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device.

[0112] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0113] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0114] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0115] Optionally, the second network device may be an AAA server.

[0116] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0117] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0118] As another possible implementation, the first request message includes an identifier of the terminal device.

[0119] Optionally, the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, and online contract SUPI.

[0120] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0121] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0122] In some embodiments, the NPN includes subscription data of the terminal device, and the first network device sends a message to the UDM to request that the UDM determine to perform authentication with the terminal device based on the subscription data of the terminal device. The first network device can receive a response message sent by the UDM to determine to perform authentication with the terminal device, and send the second request message to the second network device via the NSSAAF in the NPN.

[0123] Optionally, the first network device starts a Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.

[0124] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0125] In some implementations, the NPN may not include the subscription data of the terminal device (for example, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up for the NPN online (onboarding) to obtain authentication credentials without requiring the NPN to provide services, etc.), and the first network device may not omit sending a message to the UDM. The first network device may still send a message to the UDM to initiate the Nudm_UEAuthentication_Get service operation, and receive a response that the subscription information of the terminal device is not queried. The first network device does not reject the first request of the terminal device, and still sends the second request message to the second network device through the NSSAAF in the NPN.

[0126] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device, and the mutual authentication method may be EAP-based authentication. The mutual authentication between the terminal device and the second network device may also use other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0127] Step 302: Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate that the identity authentication of the terminal device is successful.

[0128] In an embodiment of the present application, a terminal device can receive a first response message sent by a first network device via an access network device, the first response message being able to indicate that the identity authentication of the terminal device is successful. The first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.

[0129] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0130] Step 303: Determine the master session key MSK.

[0131] In the embodiment of the present application, the first response message indicates that the terminal device identity authentication is successful, the terminal device can determine the master session key MSK, and can determine the first security key K based on the MSK. AUSF .

[0132] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0133] Step 304: Determine the first security key K based on the MSK AUSF .

[0134] In the embodiment of the present application, the terminal device can determine the first security key K according to the MSK AUSF .

[0135] Optionally, the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0136] Step 305: Based on the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key KSEAF Used by the terminal device to access the NPN.

[0137] In the embodiment of the present application, the terminal device can be based on a key derivation function KDF, according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

[0138] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0139] As an example, the input parameter KEY of the key derivation function KDF is the first security key K AUSF The input parameters S of the key derivation function KDF may include:

[0140] The code number FC of the key derivation function is 0x6C;

[0141] Parameter P0 is the service network name;

[0142] Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.

[0143] Optionally, the second security key K SEAF It can be used for the terminal device to interact with the security anchor function SEAF in the NPN, and the second security key K stored in the SEAF SEAF It is sent by the first network device to the SEAF.

[0144] In summary, by sending a first request message to the first network device in the NPN, the first request message is used by the first network device to determine the second request message, the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device, receive the first response message sent by the first network device through the access network device, the first response message is used to indicate that the terminal device authentication is successful, determine the master session key MSK, and according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF It is used for the terminal device to access the NPN, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network and obtain the services provided by the network, effectively protecting the security of information interaction between the terminal device and the accessed network, and improving the security and privacy of the system.

[0145] Please refer to Figure 4, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in the embodiment of the present application is executed by a terminal device. This method can be executed independently or in combination with any other embodiment of the present application. As shown in Figure 4, the method may include the following steps:

[0146] Step 401: Send a first request message to a first network device in the NPN through an access network device. The first request message is used by the first network device to determine a second request message. The second request message is used to request a second network device corresponding to the NPN to authenticate the terminal device.

[0147] In an embodiment of the present application, the terminal device can send a first request message to the first network device in the NPN through the access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device.

[0148] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0149] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0150] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0151] Optionally, the second network device may be an AAA server.

[0152] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0153] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0154] As another possible implementation, the first request message includes an identifier of the terminal device.

[0155] Optionally, the identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contract SUCI, and online contract SUPI.

[0156] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0157] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0158] Step 402: Send first indication information to the first network device, where the first indication information is used by the first network device to determine to omit sending a message to the UDM in the NPN.

[0159] In an embodiment of the present application, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is signing up online (onboarding) at the NPN to obtain authentication credentials without the need for the NPN to provide services (the NPN does not have the subscription information of the terminal device). The terminal device can also send a first indication information to the first network device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.

[0160] It should be noted that, as previously described, if the NPN includes the terminal device's subscription data, the first network device sends a message to the UDM requesting that the UDM determine to perform authentication with the terminal device based on the terminal device's subscription data. The first network device is capable of receiving a response message sent by the UDM to determine to perform authentication with the terminal device, and then sends the second request message to the second network device via the NSSAAF in the NPN.

[0161] In an embodiment of the present application, the NPN does not have subscription data for the terminal device. The first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending a message to the UDM. After receiving the first indication information, the first network device may not send a message to the UDM, but instead directly send the second request message to the second network device through the NSSAAF in the NPN.

[0162] Optionally, the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.

[0163] The identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contracted SUCI, and online contracted SUPI.

[0164] As a possible implementation, the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.

[0165] Optionally, the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0166] Optionally, the local policy may be determined based on the terminal device's identifier, omitting querying the UDM to determine whether the terminal device's identifier has corresponding subscription information. As another possible implementation, the first indication information is used to indicate that the NPN does not include the terminal device's subscription data, and the first network device can determine to omit sending a message to the UDM based on the received first indication information.

[0167] Similarly, optionally, the first network device may determine to ignore interaction with the UDM based on the first indication information, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0168] Optionally, the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.

[0169] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0170] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device, and the mutual authentication method may be EAP-based authentication. The mutual authentication between the terminal device and the second network device may also use other identity authentication methods, and the embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0171] Step 403: Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate that the identity authentication of the terminal device is successful.

[0172] In an embodiment of the present application, a terminal device can receive a first response message sent by a first network device via an access network device, the first response message being able to indicate that the identity authentication of the terminal device is successful. The first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.

[0173] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0174] Step 404: Determine the master session key MSK.

[0175] In the embodiment of the present application, the first response message indicates that the terminal device identity authentication is successful, the terminal device can determine the master session key MSK, and can determine the first security key K based on the MSK. AUSF .

[0176] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0177] Step 405: Determine the first security key K based on the MSK AUSF .

[0178] In the embodiment of the present application, the terminal device can determine the first security key K according to the MSK AUSF .

[0179] Optionally, the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0180] Step 406: Based on the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

[0181] In the embodiment of the present application, the terminal device can be based on a key derivation function KDF, according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

[0182] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0183] As an example, the input parameter KEY of the key derivation function KDF is the first security key K AUSF The input parameters S of the key derivation function KDF may include:

[0184] The code number FC of the key derivation function is 0x6C;

[0185] Parameter P0 is the service network name;

[0186] Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.

[0187] Optionally, the second security key K SEAF It can be used for the terminal device to interact with the security anchor function SEAF in the NPN, and the second security key K stored in the SEAF SEAF It is sent by the first network device to the SEAF.

[0188] In summary, by sending a first request message to the first network device in the NPN, the first request message is used by the first network device to determine the second request message, the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device, sending a first indication message to the first network device, the first indication message is used by the first network device to determine to omit sending a message to the UDM in the NPN, receiving a first response message sent by the first network device through the access network device, the first response message is used to indicate that the terminal device identity authentication is successful, determining the master session key MSK, and according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF It is used for the terminal device to access the NPN, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network and obtain the services provided by the network, effectively protecting the security of information interaction between the terminal device and the accessed network, and improving the security and privacy of the system.

[0189] Please refer to Figure 5, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in this embodiment of the present application is performed by the first network device. This method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 5, the method may include the following steps:

[0190] Step 501: Receive a first request message sent by a terminal device through an access network device.

[0191] In an embodiment of the present application, the first network device can receive a first request message sent by the terminal device through the access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.

[0192] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0193] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0194] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0195] Optionally, the second network device may be an AAA server.

[0196] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0197] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0198] As another possible implementation, the first request message includes an identifier of the terminal device.

[0199] Optionally, the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user concealed identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, or an online contract SUPI.

[0200] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0201] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0202] Step 502: According to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, where the second request message is used to request the second network device to authenticate the terminal device.

[0203] In an embodiment of the present application, the first network device can send a second request to a second network device corresponding to the NPN where the first network device is located according to the first request message, requesting the second network device to authenticate the terminal device.

[0204] As mentioned above, in the embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0205] In some embodiments, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up online with the NPN (onboarding) to obtain authentication credentials and does not need the NPN to provide services (the NPN does not have the subscription information of the terminal device). The first network device can also receive first indication information sent by the terminal device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.

[0206] It should be noted that if the NPN includes the subscription data of the terminal device, the first network device sends a message to the UDM to request the UDM to decide to perform authentication with the terminal device based on the subscription data of the terminal device. The first network device is capable of receiving the response message sent by the UDM to determine to perform authentication with the terminal device, and sends the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

[0207] Optionally, the first network device starts a Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.

[0208] If the NPN does not have the subscription data for the terminal device, the first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending the message to the UDM. After receiving the first indication information, the first network device may not send the message to the UDM, but instead directly send the second request message to the second network device through the NSSAAF in the NPN.

[0209] Optionally, the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.

[0210] The identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contracted SUCI, and online contracted SUPI.

[0211] As a possible implementation, the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.

[0212] Optionally, the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0213] Optionally, the local policy may be determined based on the identifier of the terminal device, and ignores querying the UDM to determine whether the identifier of the terminal device has corresponding subscription information.

[0214] As another possible implementation, the first indication information is used to indicate that the NPN does not include subscription data of the terminal device. The first network device can determine to omit sending a message to the UDM based on the received first indication information.

[0215] Similarly, optionally, the first network device may determine to ignore interaction with the UDM based on the first indication information, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0216] Optionally, the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.

[0217] In some implementations, the NPN may not include the terminal device's subscription data, and the first network device may not omit sending a message to the UDM. The first network device may still send a message to the UDM to initiate the Nudm_UEAuthentication_Get service operation, and upon receiving a response indicating that the terminal device's subscription information was not found, the first network device does not reject the terminal device's first request and still sends the second request message to the second network device via the NSSAAF in the NPN.

[0218] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0219] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device. The mutual authentication method may be authentication based on the Extensible Authentication Protocol (EAP). The mutual authentication between the terminal device and the second network device may also use other identity authentication methods. The embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0220] Step 503: Receive the terminal device identity authentication result sent by the second network device.

[0221] In an embodiment of the present application, the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.

[0222] The first network device can receive the verification result sent by the second network device through the NSSAAF.

[0223] Optionally, the verification result may include the SUPI of the terminal device.

[0224] Step 504: Based on the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device. The first response message is used to indicate whether the identity authentication of the terminal device is successful.

[0225] In an embodiment of the present application, the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful. The first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.

[0226] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0227] In some embodiments, the authentication result sent by the second network device is a successful authentication, the first response message indicates that the terminal device authentication is successful, the first network device can receive the master session key MSK sent by the second network device, and can determine the first security key K according to the MSK AUSF The first network device can be based on a key derivation function KDF, according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF It is used by the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.

[0228] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0229] It should also be noted that the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0230] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0231] Optionally, the first network device can send the second security key K to the security anchor function SEAF in the NPN. SEAF , the second security key K SEAF Used for information exchange between the terminal device and the SEAF.

[0232] It can be understood that if the first response message indicates that the identity authentication of the terminal device has failed, the terminal device is denied access to the NPN and cannot obtain the credential of successful identity authentication provided by the second network device.

[0233] It can also be understood that if the subscription data of the terminal device is not included in the NPN, the first network device omits sending a message to the UDM, or the first network device receives a response from the UDM that the subscription information of the terminal device is not queried, the first network device can omit notifying the UDM of the identity authentication result of the terminal device after receiving the verification result sent by the second network device to verify whether the terminal device has a valid subscription in the UDM.

[0234] In summary, by receiving a first request message sent by a terminal device through an access network device, according to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, the second request message is used to request the second network device to authenticate the terminal device, and the result of the terminal device identity authentication sent by the second network device is received. According to the result of the terminal device identity authentication, a first response message is sent to the terminal device through the access network device, and the first response message is used to indicate whether the terminal device identity authentication is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the security of information interaction between the terminal device and the accessed network and improves the security and privacy of the system.

[0235] Please refer to Figure 6, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in this embodiment of the present application is performed by the first network device. This method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 6, the method may include the following steps:

[0236] Step 601: Receive a first request message sent by a terminal device through an access network device.

[0237] In an embodiment of the present application, the first network device can receive a first request message sent by the terminal device through the access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.

[0238] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0239] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0240] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0241] Optionally, the second network device may be an AAA server.

[0242] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0243] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0244] As another possible implementation, the first request message includes an identifier of the terminal device.

[0245] Optionally, the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user concealed identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, or an online contract SUPI.

[0246] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0247] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0248] Step 602: According to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, where the second request message is used to request the second network device to authenticate the terminal device.

[0249] In an embodiment of the present application, the first network device can send a second request to a second network device corresponding to the NPN where the first network device is located according to the first request message, requesting the second network device to authenticate the terminal device.

[0250] As mentioned above, in the embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0251] In some embodiments, the NPN includes subscription data of the terminal device, and the first network device sends a message to the UDM to request the UDM to determine to perform authentication with the terminal device based on the subscription data of the terminal device. The first network device is capable of receiving a response message sent by the UDM to determine to perform authentication with the terminal device, and sends the second request message to the second network device through a network slice specific authentication and authorization function NSSAAF in the NPN.

[0252] Optionally, the first network device starts a Nudm_UEAuthentication_Get service operation, the first network device sends a Nudm_UEAuthentication_Get request message to the UDM, and the UDM sends a Nudm_UEAuthentication_Get response message to the first network device.

[0253] In some embodiments, the NPN may not include the subscription data of the terminal device (for example, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up online (onboarding) at the NPN to obtain authentication credentials and does not need the NPN to provide services, etc.), and the first network device may not omit sending a message to the UDM. The first network device can still send a message to the UDM to initiate the Nudm_UEAuthentication_Get service operation, and receive a response that the subscription information of the terminal device is not queried. The first network device does not reject the first request of the terminal device, and still sends the second request message to the second network device through the NSSAAF in the NPN.

[0254] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0255] In an embodiment of the present application, after receiving the terminal device identifier sent by the first network device, the NSSAAF may determine the type of identifier to send to the second network device (such as an AAA server / application server, etc.) based on a local policy. For example, based on the realm portion of the terminal device identifier, it may determine whether to send a SUPI or an external terminal device identifier (such as a Generic Public Subscription Identifier (GPSI), an IP Multimedia Subsystem (IMS) Private User Identifier (IMPI), etc.) to the second network device.

[0256] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device. The mutual authentication method may be authentication based on the Extensible Authentication Protocol (EAP). The mutual authentication between the terminal device and the second network device may also use other identity authentication methods. The embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0257] Step 603: Receive the result of the terminal device identity authentication sent by the second network device, which is that the identity authentication is successful.

[0258] In an embodiment of the present application, the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.

[0259] The first network device can receive the verification result sent by the second network device through the NSSAAF.

[0260] Optionally, the verification result may include the SUPI of the terminal device.

[0261] It is understandable that if the NPN includes the subscription data of the terminal device, the first network device can also notify the UDM of the identity authentication result of the terminal device after receiving the verification result sent by the second network device to verify whether the terminal device has a valid subscription in the UDM.

[0262] It can also be understood that if the subscription data of the terminal device is not included in the NPN, the first network device receives a response from the UDM that the subscription information of the terminal device is not found. After receiving the verification result sent by the second network device, the first network device can omit notifying the UDM of the identity authentication result of the terminal device to verify whether the terminal device has a valid subscription in the UDM.

[0263] Step 604: Receive the master session key MSK sent by the second network device.

[0264] In the embodiment of the present application, the terminal device identity authentication is successful, the first network device can receive the master session key MSK sent by the second network device, and can determine the first security key K according to the MSK AUSF .

[0265] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0266] Optionally, the MSK may be included in the verification result sent by the second network device.

[0267] Step 605: Determine the first security key K based on the MSK AUSF .

[0268] In the embodiment of the present application, the first network device can determine the first security key K according to the MSK AUSF .

[0269] Optionally, the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0270] Step 606: Based on the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

[0271] In the embodiment of the present application, the first network device can be based on a key derivation function KDF, according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

[0272] It can be understood that the first network device and the terminal device are based on the same key derivation function, from the first security key K AUSF Derive the second security key K SEAF .

[0273] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0274] As an example, the input parameter KEY of the key derivation function KDF is the first security key K AUSF The input parameters S of the key derivation function KDF may include:

[0275] The code number FC of the key derivation function is 0x6C;

[0276] Parameter P0 is the service network name;

[0277] Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.

[0278] Step 607: Send the second security key K to the security anchor function SEAF in the NPN. SEAF .

[0279] In the embodiment of the present application, the first network device can also send the second security key K to the SEAF in the NPN. SEAF , the second security key K SEAF It can be used for information exchange between the terminal device and the security anchor function SEAF in the NPN.

[0280] Step 608: Based on the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device. The first response message is used to indicate that the identity authentication of the terminal device is successful.

[0281] In an embodiment of the present application, the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful. The first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.

[0282] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0283] In summary, by receiving a first request message sent by a terminal device through an access network device, according to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, the second request message is used to request the second network device to authenticate the terminal device, receive the result of the terminal device authentication sent by the second network device, the result is that the authentication is successful, receive the master session key MSK sent by the second network device, and determine the first security key K according to the MSK. AUSF , according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN, sending the second security key K to the security anchor function SEAF in the NPN SEAF According to the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device. The first response message is used to indicate that the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, and the terminal device can safely access the network and obtain the services provided by the network, effectively protecting the security of information interaction between the terminal device and the accessed network, and improving the security and privacy of the system.

[0284] Please refer to Figure 7, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in this embodiment of the present application is performed by the first network device. This method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 7, the method may include the following steps:

[0285] Step 701: Receive a first request message sent by a terminal device through an access network device.

[0286] In an embodiment of the present application, the first network device can receive a first request message sent by the terminal device through the access network device. After receiving the first request message, the first network device can determine a second request message based on the first request message. The second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.

[0287] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0288] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0289] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0290] Optionally, the second network device may be an AAA server.

[0291] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0292] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0293] As another possible implementation, the first request message includes an identifier of the terminal device.

[0294] Optionally, the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user concealed identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, or an online contract SUPI.

[0295] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0296] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0297] Step 702: Receive first indication information sent by the terminal device, where the first indication information is used by the first network device to determine to omit sending a message to the UDM in the NPN.

[0298] In an embodiment of the present application, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing in online (onboarding) at the NPN to obtain authentication credentials and does not need the NPN to provide services (the NPN does not have the subscription information of the terminal device). The first network device can also receive the first indication information sent by the terminal device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM.

[0299] It should be noted that, as previously described, if the NPN includes the terminal device's subscription data, the first network device sends a message to the UDM requesting that the UDM determine to perform authentication with the terminal device based on the terminal device's subscription data. The first network device is capable of receiving a response message sent by the UDM to determine to perform authentication with the terminal device, and then sends the second request message to the second network device via the NSSAAF in the NPN.

[0300] In an embodiment of the present application, the NPN does not have subscription data for the terminal device. The first indication information sent by the terminal device to the first network device can be used by the first network device to determine to omit sending a message to the UDM. After receiving the first indication information, the first network device may not send a message to the UDM, but instead directly send the second request message to the second network device through the NSSAAF in the NPN.

[0301] Optionally, the first indication information may be an identifier of the terminal device, or the first indication information is indication information used to indicate that the NPN does not include subscription data of the terminal device.

[0302] The identifier of the terminal device may be at least one of the following: SUPI, SUCI, anonymous SUPI, anonymous SUCI, online contracted SUCI, and online contracted SUPI.

[0303] As a possible implementation, the first indication information is an identifier of the terminal device. After receiving the first indication information, the first network device can determine to omit sending a message to the UDM according to a local policy of the first network device.

[0304] Optionally, the local policy may decide to ignore interaction with the UDM based on the realm portion in the identifier of the terminal device, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0305] Optionally, the local policy may be determined based on the terminal device's identifier, omitting querying the UDM to determine whether the terminal device's identifier has corresponding subscription information. As another possible implementation, the first indication information is used to indicate that the NPN does not include the terminal device's subscription data, and the first network device can determine to omit sending a message to the UDM based on the received first indication information.

[0306] Similarly, optionally, the first network device may determine to ignore interaction with the UDM based on the first indication information, and directly select an NSSAAF, and send the second request message to the second network device through the NSSAAF.

[0307] Optionally, the first network device may determine, based on the first indication information, to ignore querying the UDM whether the identifier of the terminal device has corresponding subscription information.

[0308] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0309] In an embodiment of the present application, after receiving the terminal device identifier sent by the first network device, the NSSAAF may determine, based on a local policy, the identifier type to send to the second network device (e.g., an AAA server / application server, etc.). For example, based on the realm portion of the terminal device identifier, it may determine whether to send a SUPI or an external terminal device identifier (e.g., a General Public User Identity (GPSI) or an IMS Private User Identity (IMPI)) to the second network device.

[0310] Step 703: According to the first request message, a second request message is sent to a second network device corresponding to the NPN where the first network device is located, where the second request message is used to request the second network device to authenticate the terminal device.

[0311] In an embodiment of the present application, the first network device can send a second request to a second network device corresponding to the NPN where the first network device is located according to the first request message, requesting the second network device to authenticate the terminal device.

[0312] As mentioned above, in the embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located, and a second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0313] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0314] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device. The mutual authentication method may be authentication based on the Extensible Authentication Protocol (EAP). The mutual authentication between the terminal device and the second network device may also use other identity authentication methods. The embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0315] Step 704: Receive the result of the terminal device identity authentication sent by the second network device, which is that the identity authentication is successful.

[0316] In an embodiment of the present application, the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.

[0317] The first network device can receive the verification result sent by the second network device through the NSSAAF.

[0318] Optionally, the verification result may include the SUPI of the terminal device.

[0319] It is understandable that if the NPN includes the subscription data of the terminal device, the first network device can also notify the UDM of the identity authentication result of the terminal device after receiving the verification result sent by the second network device to verify whether the terminal device has a valid subscription in the UDM.

[0320] It can also be understood that if the subscription data of the terminal device is not included in the NPN, the first network device receives the first indication information sent by the terminal device and determines to omit sending the message to the UDM. After receiving the verification result sent by the second network device, the first network device can omit notifying the UDM of the identity authentication result of the terminal device to verify whether the terminal device has a valid subscription in the UDM.

[0321] Step 705: Receive the master session key MSK sent by the second network device.

[0322] In the embodiment of the present application, the terminal device identity authentication is successful, the first network device can receive the master session key MSK sent by the second network device, and can determine the first security key K according to the MSK AUSF .

[0323] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0324] Optionally, the MSK may be included in the verification result sent by the second network device.

[0325] Step 706: Determine the first security key K based on the MSK AUSF .

[0326] In the embodiment of the present application, the first network device can determine the first security key K according to the MSK AUSF .

[0327] Optionally, the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0328] Step 707: Based on the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

[0329] In the embodiment of the present application, the first network device can be based on a key derivation function KDF, according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

[0330] It can be understood that the first network device and the terminal device are based on the same key derivation function, from the first security key K AUSF Derive the second security key K SEAF .

[0331] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0332] As an example, the input parameter KEY of the key derivation function KDF is the first security key K AUSF The input parameters S of the key derivation function KDF may include:

[0333] The code number FC of the key derivation function is 0x6C;

[0334] Parameter P0 is the service network name;

[0335] Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.

[0336] Step 708: Send the second security key K to the security anchor function SEAF in the NPN. SEAF .

[0337] In the embodiment of the present application, the first network device can also send the second security key K to the SEAF in the NPN. SEAF , the second security key K SEAF It can be used for information exchange between the terminal device and the security anchor function SEAF in the NPN.

[0338] Step 709: Based on the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device. The first response message is used to indicate that the identity authentication of the terminal device is successful.

[0339] In an embodiment of the present application, the first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful. The first network device can send the first response message to the terminal device based on the identity authentication result received from the second network device.

[0340] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0341] In summary, by receiving a first request message sent by a terminal device through an access network device, according to the first request message, receiving the first indication information sent by the terminal device, the first indication information is used by the first network device to determine to omit sending a message to the UDM in the NPN, and sending a second request message to the second network device corresponding to the NPN where the first network device is located, the second request message is used to request the second network device to authenticate the terminal device, receive the result of the terminal device authentication sent by the second network device, the result is that the authentication is successful, receive the master session key MSK sent by the second network device, and determine the first security key K according to the MSK. AUSF , according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN, sending the second security key K to the security anchor function SEAF in the NPN SEAF According to the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device. The first response message is used to indicate that the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, and the terminal device can safely access the network and obtain the services provided by the network, effectively protecting the security of information interaction between the terminal device and the accessed network, and improving the security and privacy of the system.

[0342] Please refer to Figure 8, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in this embodiment of the present application is performed by the second network device. This method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 8, the method may include the following steps:

[0343] Step 801: Receive a second request message sent by a first network device. The second request message is determined by the first network device based on the first request message sent by the terminal device. The second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.

[0344] In an embodiment of the present application, the second network device is capable of receiving a second request message sent by the first network device, where the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device. The second request message is determined by the first network device based on the first request message received from the terminal device through the access network device. After receiving the first request message, the first network device is capable of determining the second request message based on the first request message.

[0345] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0346] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0347] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0348] Optionally, the second network device may be an AAA server.

[0349] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0350] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0351] As another possible implementation, the first request message includes an identifier of the terminal device.

[0352] Optionally, the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user concealed identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, or an online contract SUPI.

[0353] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0354] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0355] In an embodiment of the present application, the first network device can send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

[0356] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0357] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device. The mutual authentication method may be authentication based on the Extensible Authentication Protocol (EAP). The mutual authentication between the terminal device and the second network device may also use other identity authentication methods. The embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0358] Step 802: Send the result of the terminal device identity authentication to the first network device. The result of the terminal device identity authentication is used to determine a first response message. The first response message is used to indicate whether the terminal device identity authentication is successful.

[0359] In an embodiment of the present application, the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.

[0360] In an embodiment of the present application, the second network device can send the verification result to the first network device through the NSSAAF.

[0361] Optionally, the verification result may include the SUPI of the terminal device.

[0362] In an embodiment of the present application, the result of the identity authentication can be used by the first network device to determine the first response information. The first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.

[0363] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0364] In some embodiments, the authentication result sent by the second network device is a successful authentication, the first response message indicates that the terminal device authentication is successful, the second network device can send the master session key MSK to the first network device, and the first network device can determine the first security key K according to the MSK. AUSF The first network device can be based on a key derivation function KDF, according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF It is used by the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.

[0365] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0366] It should also be noted that the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0367] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0368] Optionally, the second security key K SEAF It is used for the terminal device to exchange information with the security anchor function SEAF in the NPN, and the second security key K stored in the SEAF SEAF It is sent by the first network device to the SEAF.

[0369] It can be understood that if the first response message indicates that the identity authentication of the terminal device has failed, the terminal device is denied access to the NPN and cannot obtain the credential of successful identity authentication provided by the second network device.

[0370] In summary, by receiving the second request message sent by the first network device, the second request message is determined by the first network device based on the first request message sent by the terminal device, the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device, and send the result of the terminal device authentication to the first network device. The result of the terminal device authentication is used to determine the first response message, and the first response message is used to indicate whether the terminal device authentication is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the information interaction security between the terminal device and the accessed network and improves the security and privacy of the system.

[0371] Please refer to Figure 9, which is a flow chart of an identity authentication method provided in an embodiment of the present application. It should be noted that the identity authentication method in this embodiment of the present application is performed by the second network device. This method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 9, the method may include the following steps:

[0372] Step 901: Receive a second request message sent by a first network device. The second request message is determined by the first network device based on the first request message sent by the terminal device. The second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device.

[0373] In an embodiment of the present application, the second network device is capable of receiving a second request message sent by the first network device, where the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device. The second request message is determined by the first network device based on the first request message received from the terminal device through the access network device. After receiving the first request message, the first network device is capable of determining the second request message based on the first request message.

[0374] In an embodiment of the present application, the first network device may be an authentication service function AUSF.

[0375] In an embodiment of the present application, the second network device that authenticates the terminal device corresponds to the NPN where the first network device is located. A second network device only provides services for one NPN, that is, the second network device only provides services for the NPN where the first network device is located, and does not provide services for other networks.

[0376] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

[0377] Optionally, the second network device may be an AAA server.

[0378] In an embodiment of the present application, the first request message may include an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access, wherein the hosted network is constructed based on the NPN.

[0379] That is, as a possible implementation, the first request message includes the identifier of the terminal device and the identifier of the managed network that the terminal device requests to access.

[0380] As another possible implementation, the first request message includes an identifier of the terminal device.

[0381] Optionally, the identifier of the terminal device may be at least one of the following: a user permanent identifier SUPI, a user concealed identifier SUCI, an anonymous SUPI, an anonymous SUCI, an online contract SUCI, or an online contract SUPI.

[0382] It can be understood that in the embodiment of the present application, the network side can build multiple hosted networks based on the NPN to provide access to localized services, and each hosted network built has its own hosted network identifier.

[0383] It should also be noted that, in the embodiment of the present application, the first request message is sent by the terminal device to the first network device through the access and mobility management function AMF in the NPN.

[0384] In an embodiment of the present application, the first network device can send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

[0385] In this embodiment of the present application, the second request message includes the SUPI or anonymous SUPI of the terminal device.

[0386] In an embodiment of the present application, the terminal device is capable of performing mutual authentication with the second network device. The mutual authentication method may be authentication based on the Extensible Authentication Protocol (EAP). The mutual authentication between the terminal device and the second network device may also use other identity authentication methods. The embodiments of the present application do not specifically limit the mutual authentication method between the terminal device and the second network device.

[0387] Step 902: Send the result of the terminal device identity authentication to the first network device. The result of the terminal device identity authentication is used to determine a first response message. The first response message is used to indicate that the terminal device identity authentication is successful.

[0388] In an embodiment of the present application, the first network device is capable of receiving the identity authentication result sent by the second network device, and is capable of sending a first response message to the terminal device based on the identity authentication result.

[0389] In an embodiment of the present application, the second network device can send the verification result to the first network device through the NSSAAF.

[0390] Optionally, the verification result may include the SUPI of the terminal device.

[0391] In an embodiment of the present application, the result of the identity authentication can be used by the first network device to determine the first response information. The first network device can send a first response message to the terminal device through the access network device, and the first response message can indicate whether the identity authentication of the terminal device is successful.

[0392] It should be noted that, in an embodiment of the present application, the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN.

[0393] Step 903: Send the master session key MSK to the first network device.

[0394] In the embodiment of the present application, the authentication result sent by the second network device is a successful authentication, the first response message indicates that the terminal device authentication is successful, the second network device can send the master session key MSK to the first network device, and the first network device can determine the first security key K according to the MSK. AUSF The first network device can be based on a key derivation function KDF, according to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF It is used by the terminal device to access the NPN and to interact with the security anchor function SEAF in the NPN.

[0395] It should be noted that the MSK is determined through negotiation between the terminal device and the second network device that have been successfully authenticated, that is, the terminal device and the second network device can determine the same MSK.

[0396] It should also be noted that the first security key K is determined based on the MSK AUSF It can be that 128 bits or 256 bits of the MSK are used as the first security key K AUSF .

[0397] Optionally, if the first request message includes a managed network identifier, the serving network name is the managed network identifier. If the first request message does not include a managed network identifier, the serving network name is the identifier of the NPN.

[0398] As an example, the input parameter KEY of the key derivation function KDF is the first security key K AUSF The input parameters S of the key derivation function KDF may include:

[0399] The code number FC of the key derivation function is 0x6C;

[0400] Parameter P0 is the service network name;

[0401] Parameter L0 is the length of the data included in parameter P0, that is, the length of the data of the service network name.

[0402] Optionally, the second security key K SEAF It is used for the terminal device to interact with the security anchor function SEAF in the NPN, and the second security key K stored in the SEAF SEAF It is sent by the first network device to the SEAF.

[0403] In summary, by receiving the second request message sent by the first network device, the second request message is determined by the first network device based on the first request message sent by the terminal device, the second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device, and send the result of the terminal device authentication to the first network device. The result of the terminal device authentication is used to determine the first response message, and the first response message is used to indicate that the terminal device authentication is successful, and send the master session key MSK to the first network device, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, which effectively protects the information interaction security between the terminal device and the accessed network and improves the security and privacy of the system.

[0404] Please refer to Figure 10, which is a flowchart of an identity authentication method provided by an embodiment of the present application. This method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 10, the method may include the following steps:

[0405] 1. A terminal device can select an NPN and initiate terminal device registration in the NPN. The registration message may include the terminal device's identifier and / or the identifier of the managed network that the terminal device requests access. The managed network is built based on the NPN.

[0406] 2. The AMF in the NPN should send a Nausf_UEAuthentication_Authenticate request to the AUSF (first network device) to request identity authentication of the terminal device. The request message includes the identity of the terminal device and / or the identity of the hosted network that the terminal device requests to access. The AMF can discover and select the AUSF according to the standards specified in 3GPP technical specification TS 23.501.

[0407] 3. AUSF (first network device) can initiate Nudm_UEAuthentication_Get service operation, and AUSF sends Nudm_UEAuthentication_Get request to UDM. AUSF can discover and select UDM according to the standards specified in 3GPP technical specification TS 23.501.

[0408] 4. The UDM can decide to authenticate the terminal device entity based on the subscription information, or can decide to authenticate the terminal device entity based on the SUPI realm part in the Network Access Identifier (NAI) format.

[0409] 5. The UDM shall provide the SUPI or anonymous SUPI to the AUSF (first network device) and shall instruct the AUSF to perform authentication using the second network device corresponding to the NPN.

[0410] If the NPN does not have the subscription information of the terminal device, AUSF can receive the response sent by the UDM, and UDM and AUSF do not terminate the process.

[0411] 6. According to the instruction of the UDM, the AUSF (first network device) may initiate the Nnssaaf_AIWF_Authenticate service operation according to the provisions of 3GPP technical specification TS 23.501 and send an Nnssaaf_AIWF_Authenticate request to the NSSAAF. The definition of NSSAAF may be referred to in 3GPP technical specification TS 23.501.

[0412] If the NPN does not contain the subscription information of the terminal device, AUSF can receive the response sent by the UDM. The UDM and AUSF do not terminate the process. AUSF can still initiate the Nnssaaf_AIWF_Authenticate service operation and send the Nnssaaf_AIWF_Authenticate request to the NSSAAF.

[0413] The Nnssaaf_AIWF_Authenticate request includes the identifier of the terminal device (SUPI or anonymous SUPI).

[0414] 7. The NSSAAF can select a second network device based on the domain name corresponding to the realm portion of the SUPI, perform relevant protocol conversion, and relay the EAP message to the second network device.

[0415] 8. The terminal device and the second network device can perform mutual authentication. The second network device can function as a network device providing authentication services (e.g., an EAP server) for identity verification. The EAP identity received by the second network device in the EAP Response / Identity message in step 7 may include an anonymous SUPI. In this case, the second network device uses EAP method-specific EAP Identity Request / Response messages to obtain the terminal device's identity as part of EAP authentication between the terminal device and the second network device.

[0416] 9. After successful authentication, the second network device can provide the MSK and SUPI (i.e., the identifier of the terminal device used for successful EAP authentication) to the NSSAAF.

[0417] 10. NSSAAF returns the MSK and SUPI to AUSF (first network device) using the Nnssaaf_AIWF_Authenticate response message.

[0418] 11. The AUSF (first network device) notifies the UDM of the authentication result of the received SUPI by initiating a Nudm_ueIdentification_ResultConfirmation service operation, i.e., sending a Nudm_ueIdentification_ResultConfirmation request to the UDM, to verify whether the SUPI corresponds to a valid subscription in the NPN.

[0419] 12. UDM stores the authentication status of SUPI.

[0420] 13. UDM sends a Nudm_ueIdentification_ResultConfirmation response to AUSF (first network device). If there is no subscription corresponding to the SUPI, UDM shall return an error.

[0421] It is understood that if the NPN does not contain the subscription information for the terminal device, the UDM and AUSF do not terminate the process in steps 3-5, and the AUSF may still initiate the Nnssaaf_AIWF_Authenticate service operation. However, in steps 11-13, the AUSF may not notify the UDM of the authentication result of the received SUPI to verify whether the SUPI corresponds to a valid subscription in the NPN, that is, the above steps 11-13 may be omitted.

[0422] 14. AUSF can use 256 bits or 128 bits of MSK as the first security key K AUSF AUSF can also derive the first security key K from a key derivation function KDF. AUSF The second security key K is derived from SEAF The key derivation function is as described in the previous embodiments and will not be repeated here.

[0423] 15. AUSF can combine the indication of successful authentication of the terminal device (first response message) with the SUPI of the terminal device and the second security key K calculated in step 14. SEAF Send it to AMF / SEAF together.

[0424] 16. AMF / SEAF can send an indication of successful authentication to the terminal device in a non-access stratum (NAS) message (first response message).

[0425] 17. After receiving the indication of successful verification (first response message), the terminal device can determine the master session key MSK and use 256 bits or 128 bits of MSK as the first security key K AUSF The terminal device can also derive the first security key K from the same key derivation function KDF. AUSF The second security key K is derived from SEAF The key derivation function is as described in the previous embodiments and will not be repeated here.

[0426] In summary, the identity authentication method provided in the embodiment of the present application can provide a mutual authentication mechanism between the terminal device and the access network, so that the terminal device and the access network can authenticate each other, the terminal device can securely access the network and obtain the services provided by the network, effectively protecting the information interaction security between the terminal device and the access network, and improving the security and privacy of the system.

[0427] Please refer to Figure 11, which is a flowchart of an identity authentication method provided by an embodiment of the present application. This method can be performed independently or in combination with any other embodiment of the present application. As shown in Figure 11, the method may include the following steps:

[0428] 1. A terminal device can select an NPN and initiate terminal device registration in the NPN. The registration message may include the terminal device's identifier and / or the identifier of the managed network that the terminal device requests access. The managed network is built based on the NPN.

[0429] 2. The AMF in the NPN should send a Nausf_UEAuthentication_Authenticate request to the AUSF (first network device) to request identity authentication of the terminal device. The request message includes the identity of the terminal device and / or the identity of the hosted network that the terminal device requests to access. The AMF can discover and select the AUSF according to the standards specified in 3GPP technical specification TS 23.501.

[0430] If the NPN does not have the subscription information of the terminal device (for example, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing in online (onboarding) at the NPN to obtain authentication credentials and does not need the NPN to provide services, etc.), the first indication information sent by the terminal device to the AUSF can be used by the AUSF to determine to omit sending a message to the UDM (that is, to omit steps 3-5 in the embodiment shown in Figure 10). After receiving the first indication information, the AUSF may not send a message to the UDM, but directly send the second request message to the second network device through the NSSAAF in the NPN.

[0431] 3. The AUSF (first network device) may initiate an Nnssaaf_AIWF_Authenticate service operation and send an Nnssaaf_AIWF_Authenticate request to the NSSAAF according to the provisions of 3GPP technical specification TS 23.501. The definition of NSSAAF may be referred to in 3GPP technical specification TS 23.501.

[0432] The Nnssaaf_AIWF_Authenticate request includes the identifier of the terminal device (SUPI or anonymous SUPI).

[0433] 4. The NSSAAF can select a second network device based on the domain name corresponding to the realm portion of the SUPI, perform relevant protocol conversion, and relay the EAP message to the second network device.

[0434] 5. The terminal device and the second network device can perform mutual authentication. The second network device can function as a network device providing authentication services (e.g., an EAP server) for identity verification. The EAP identity received by the second network device in the EAP Response / Identity message in step 7 may include an anonymous SUPI. In this case, the second network device uses EAP method-specific EAP Identity Request / Response messages to obtain the terminal device's identity as part of EAP authentication between the terminal device and the second network device.

[0435] 6. After successful authentication, the second network device can provide the MSK and SUPI (i.e., the identifier of the terminal device used for successful EAP authentication) to the NSSAAF.

[0436] 7. NSSAAF returns the MSK and SUPI to AUSF (the first network device) using the Nnssaaf_AIWF_Authenticate response message.

[0437] If the NPN does not have the subscription information of the terminal device (for example, the terminal device may be accessing the NPN and the NPN does not have the subscription data of the terminal device, or the terminal device is only signing up (onboarding) at the NPN to obtain authentication credentials and does not need the NPN to provide services, etc.), the AUSF (first network device) may not notify the UDM of the authentication result of the received SUPI to verify whether the SUPI corresponds to a valid subscription in the NPN (that is, steps 11-13 in the embodiment shown in FIG10 are omitted).

[0438] 8. AUSF can use 256 bits or 128 bits of MSK as the first security key K AUSF AUSF can also derive the first security key K from a key derivation function KDF. AUSF The second security key K is derived from SEAF The key derivation function is as described in the previous embodiments and will not be repeated here.

[0439] 9. AUSF can combine the indication of successful authentication of the terminal device (first response message) with the SUPI of the terminal device and the second security key K calculated in step 8 SEAF Send it to AMF / SEAF together.

[0440] 10. AMF / SEAF can send an indication of successful authentication to the terminal device in a non-access stratum (NAS) message (first response message).

[0441] 11. After receiving the indication of successful verification (first response message), the terminal device can determine the master session key MSK and use 256 bits or 128 bits of MSK as the first security key K AUSF The terminal device can also derive the first security key K from the same key derivation function KDF. AUSF The second security key K is derived from SEAF The key derivation function is as described in the previous embodiments and will not be repeated here.

[0442] In summary, the identity authentication method provided in the embodiment of the present application can provide a mutual authentication mechanism between the terminal device and the access network, so that the terminal device and the access network can authenticate each other, the terminal device can securely access the network and obtain the services provided by the network, effectively protecting the information interaction security between the terminal device and the access network, and improving the security and privacy of the system.

[0443] Corresponding to the identity authentication methods provided in the above-mentioned embodiments, the present application also provides an identity authentication device. Since the identity authentication device provided in the embodiments of the present application corresponds to the methods provided in the above-mentioned embodiments, the implementation method of the identity authentication method is also applicable to the identity authentication device provided in the following embodiments and will not be described in detail in the following embodiments.

[0444] Please refer to Figure 12, which is a structural diagram of an identity authentication device provided in an embodiment of the present application.

[0445] As shown in FIG12 , the identity authentication device 1200 includes a transceiver unit 1210 , wherein:

[0446] The transceiver unit 1210 is configured to send a first request message to a first network device in a non-public network NPN through an access network device, wherein the first request message is used by the first network device to determine a second request message, wherein the second request message is used to request a second network device corresponding to the NPN to authenticate the device;

[0447] The transceiver unit 1210 is further configured to receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the device identity authentication is successful.

[0448] Optionally, the second network device is configured to provide services for a unique NPN corresponding to the second network device.

[0449] Optionally, the first request message includes an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.

[0450] Optionally, the terminal device is accessing the NPN and the NPN does not include the subscription information of the terminal device. The transceiver unit 1210 is also used to: send first indication information to the first network device, and the first indication information is used by the first network device to determine to omit sending messages to the unified data management function UDM in the NPN.

[0451] Optionally, the first indication information is an identifier of the terminal device; or, the first indication information is used to indicate that the NPN does not include subscription information of the terminal device.

[0452] Optionally, the first response message is used to indicate that the terminal device identity authentication is successful. The device also includes a processing unit (not shown in the figure), which is used to: determine the master session key MSK; determine the first security key KAUSF based on the MSK; determine the second security key KSEAF based on the first security key KAUSF and the service network name, and the second security key KSEAF is used for the terminal device to access the NPN.

[0453] Optionally, the first request message includes an identifier of the hosting network, and the service network name is the identifier of the hosting network.

[0454] Optionally, the first request message does not include the identifier of the hosting network, and the serving network name is the identifier of the NPN.

[0455] Optionally, the second security key KSEAF is used by the terminal device to interact with the security anchor function SEAF in the NPN through the access network device, and the second security key KSEAF stored in the SEAF is sent to the SEAF by the first network device.

[0456] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and billing.

[0457] Optionally, the first request message is sent by the terminal device to the first network device through the access network device and the access and mobility management function AMF in the NPN; the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN and the access network device.

[0458] The identity authentication device of this embodiment can send a first request message to a first network device in a non-public network NPN, where the first request message is used by the first network device to determine a second request message, where the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device, and receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful, so that the terminal device and the accessed network can authenticate each other, securely access the network, and obtain services provided by the network, thereby effectively protecting the security of information interaction between the terminal device and the accessed network and improving the security and privacy of the system.

[0459] Please refer to Figure 13, which is a structural diagram of an identity authentication device provided in an embodiment of the present application.

[0460] As shown in FIG13 , the identity authentication device 1300 includes a transceiver unit 1310 and a processing unit 1320 , wherein:

[0461] The transceiver unit 1310 is configured to receive a first request message sent by a terminal device through an access network device;

[0462] The processing unit 1320 is configured to send a second request message to a second network device corresponding to the non-public network NPN where the apparatus is located according to the first request message, wherein the second request message is used to request the second network device to authenticate the terminal device;

[0463] The transceiver unit 1310 is further configured to receive a result of the terminal device identity authentication sent by the second network device;

[0464] The processing unit 1320 is further configured to send a first response message to the terminal device through the access network device according to the result of the terminal device identity authentication, where the first response message is used to indicate whether the terminal device identity authentication is successful.

[0465] Optionally, the second network device is configured to provide services for a unique NPN corresponding to the second network device.

[0466] Optionally, the first request message includes an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.

[0467] Optionally, the terminal device is accessing the NPN and the NPN does not include the subscription information of the terminal device. The transceiver unit 1310 is also used to: receive first indication information sent by the terminal device, and the first indication information is used by the first network device to determine to omit sending a message to the unified data management function UDM in the NPN; and send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

[0468] Optionally, the first indication information is an identifier of the terminal device; or, the first indication information is used to indicate that the NPN does not include subscription information of the terminal device.

[0469] Optionally, the first indication information is an identifier of the terminal device, and the first indication information is used to instruct the first network device to omit sending a message to the UDM according to a local policy of the first network device.

[0470] Optionally, the first indication information is used to indicate that the NPN does not include subscription information of the terminal device, and the first indication information is used to instruct the first network device to omit sending a message to the UDM according to the first indication information.

[0471] Optionally, the terminal device is accessing the NPN and the NPN does not include the subscription information of the terminal device. The transceiver unit 1310 is further used to: query the subscription information of the terminal device from the unified data management function UDM in the NPN, and no subscription information of the terminal device is found; and send the second request message to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

[0472] Optionally, the first response message is used to indicate that the terminal device identity authentication is successful, and the processing unit 1320 is also used to: receive the master session key MSK sent by the second network device; determine the first security key KAUSF based on the MSK; determine the second security key KSEAF based on the first security key KAUSF and the service network name, and the second security key KSEAF is used for the terminal device to access the NPN.

[0473] Optionally, the first request message includes an identifier of the hosting network, and the service network name is the identifier of the hosting network.

[0474] Optionally, the first request message does not include the identifier of the hosting network, and the serving network name is the identifier of the NPN.

[0475] Optionally, the transceiver unit 1310 is further configured to send the second security key KSEAF to the security anchor function SEAF in the NPN, where the second security key KSEAF is used by the terminal device to interact with the security anchor function SEAF in the NPN through the access network device.

[0476] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and billing.

[0477] Optionally, the first request message is sent by the terminal device to the first network device through the access network device and the access and mobility management function AMF in the NPN; the first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN and the access network device.

[0478] The identity authentication device of this embodiment can receive a first request message sent by a terminal device through an access network device, and based on the first request message, send a second request message to a second network device corresponding to the NPN where the first network device is located, wherein the second request message is used to request the second network device to authenticate the terminal device, receive the result of the terminal device identity authentication sent by the second network device, and based on the result of the terminal device identity authentication, send a first response message to the terminal device through the access network device, wherein the first response message is used to indicate whether the terminal device identity authentication is successful, so that the terminal device and the accessed network can authenticate each other, securely access the network, and obtain services provided by the network, thereby effectively protecting the security of information interaction between the terminal device and the accessed network and improving the security and privacy of the system.

[0479] Please refer to Figure 14, which is a structural diagram of an identity authentication device provided in an embodiment of the present application.

[0480] As shown in FIG14 , the identity authentication device 1400 includes a transceiver unit 1410 , wherein:

[0481] The transceiver unit 1410 is configured to receive a second request message sent by the first network device, where the second request message is determined by the first network device based on the first request message sent by the terminal device, and is used to request the device corresponding to the non-public network (NPN) where the first network device is located to authenticate the terminal device;

[0482] The transceiver unit 1410 is further configured to send the terminal device identity authentication result to the first network device, where the terminal device identity authentication result is used to determine a first response message, where the first response message is used to indicate whether the terminal device identity authentication is successful.

[0483] Optionally, the second network device is configured to provide services for a unique NPN corresponding to the second network device.

[0484] Optionally, the first request message includes an identifier of the terminal device and / or an identifier of a hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.

[0485] Optionally, the transceiver unit 1410 is also used to: receive the second request message sent by the first network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

[0486] Optionally, the first response message is used to indicate that the terminal device identity authentication is successful, and the transceiver unit 1410 is also used to: send the master session key MSK to the first network device; the MSK is used by the first network device to determine the first security key KAUSF, and the first security key KAUSF and the service network name are used by the first network device to determine the second security key KSEAF.

[0487] Optionally, the first request message includes an identifier of the hosting network, and the service network name is the identifier of the hosting network.

[0488] Optionally, the first request message does not include the identifier of the hosting network, and the serving network name is the identifier of the NPN.

[0489] Optionally, the service provided by the second network device to the NPN includes at least one of authentication, authorization and billing.

[0490] The identity authentication device of this embodiment can receive a second request message sent by a first network device, where the second request message is determined by the first network device based on the first request message sent by the terminal device. The second request message is used to request the second network device corresponding to the NPN where the first network device is located to authenticate the terminal device, and send the result of the terminal device identity authentication to the first network device. The result of the terminal device identity authentication is used to determine a first response message, which is used to indicate whether the terminal device identity authentication is successful, so that the terminal device and the accessed network can authenticate each other, the terminal device can securely access the network, and obtain the services provided by the network, thereby effectively protecting the security of information interaction between the terminal device and the accessed network and improving the security and privacy of the system.

[0491] Please refer to Figure 15, which is a schematic diagram of a communication system provided in an embodiment of the present application.

[0492] As shown in FIG15 , the communication system includes: a terminal device, a first network device, and a second network device, wherein:

[0493] Terminal device, used to execute the method shown in the embodiments of Figures 2 to 4

[0494] A first network device, configured to execute the method shown in the embodiments of FIG. 5 to FIG. 7 ;

[0495] The second network device is configured to execute the method shown in the embodiments of FIG. 8 to FIG. 9 .

[0496] In order to implement the above embodiments, the embodiments of the present application also propose a communication device, including: a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device executes the method shown in the embodiments of Figures 2 to 4.

[0497] In order to implement the above embodiments, the embodiments of the present application also propose a communication device, including: a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device executes the method shown in the embodiments of Figures 5 to 7, or executes the method shown in the embodiments of Figures 8 to 9.

[0498] In order to implement the above embodiments, the embodiments of the present application also propose a communication device, including: a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to execute the method shown in the embodiments of Figures 2 to 4.

[0499] In order to implement the above embodiments, the embodiments of the present application also propose a communication device, including: a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to execute the method shown in the embodiments of Figures 5 to 7, or execute the method shown in the embodiments of Figures 8 to 9.

[0500] Please refer to Figure 16, which is a schematic diagram of the structure of another identity verification device provided in an embodiment of the present application. Identity verification device 1600 can be a network device, a terminal device, a chip, a chip system, or a processor that supports the network device to implement the above-mentioned method, or a chip, a chip system, or a processor that supports the terminal device to implement the above-mentioned method. This device can be used to implement the method described in the above-mentioned method embodiment. For details, please refer to the description of the above-mentioned method embodiment.

[0501] The identity verification device 1600 may include one or more processors 1601. Processor 1601 may be a general-purpose processor or a dedicated processor. For example, it may be a baseband processor or a central processing unit (CPU). The baseband processor may be used to process communication protocols and communication data, while the CPU may be used to control the identity verification device (e.g., a base station, a baseband chip, a terminal device, a terminal device chip, a DU or CU, etc.), execute computer programs, and process computer program data.

[0502] Optionally, the identity verification device 1600 may further include one or more memories 1602, on which a computer program 1603 may be stored. The processor 1601 executes the computer program 1603 to cause the identity verification device 1600 to perform the method described in the above method embodiment. The computer program 1603 may be fixed in the processor 1601, in which case the processor 1601 may be implemented by hardware.

[0503] Optionally, data may also be stored in the memory 1602. The identity verification device 1600 and the memory 1602 may be provided separately or integrated together.

[0504] Optionally, the identity verification device 1600 may further include a transceiver 1605 and an antenna 1606. The transceiver 1605 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, and is configured to implement transceiver functions. The transceiver 1605 may include a receiver and a transmitter. The receiver may be referred to as a receiver or a receiving circuit, and is configured to implement a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, and is configured to implement a transmitting function.

[0505] Optionally, the identity authentication device 1600 may further include one or more interface circuits 1607. The interface circuit 1607 is configured to receive code instructions and transmit the code instructions to the processor 1601. The processor 1601 executes the code instructions to enable the identity authentication device 1600 to perform the method described in the above method embodiment.

[0506] In one implementation, processor 1601 may include a transceiver for implementing receiving and transmitting functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing the receiving and transmitting functions may be separate or integrated. The transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or may be used for transmitting or delivering signals.

[0507] In one implementation, the identity authentication device 1600 may include a circuit that can implement the functions of sending, receiving, or communicating in the aforementioned method embodiments. The processor and transceiver described in this application can be implemented on an integrated circuit (IC), an analog IC, a radio frequency integrated circuit (RFIC), a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0508] The identity verification device described in the above embodiments may be a network device or a terminal device, but the scope of the identity verification device described in this application is not limited thereto, and the structure of the identity verification device may not be limited to Figures 12-14. The identity verification device may be an independent device or part of a larger device. For example, the identity verification device may be:

[0509] (1) An independent integrated circuit (IC), or chip, or chip system or subsystem;

[0510] (2) a collection of one or more ICs, optionally including a storage component for storing data and computer programs;

[0511] (3) ASIC, such as modem;

[0512] (4) Modules that can be embedded in other devices;

[0513] (5) Receivers, terminal devices, intelligent terminal devices, cellular phones, wireless devices, handheld devices, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.;

[0514] (6)Others, etc.

[0515] If the identity authentication device can be a chip or a chip system, please refer to the schematic diagram of the chip structure shown in Figure 17. The chip shown in Figure 17 includes a processor 1701 and an interface 1702. The number of processors 1701 can be one or more, and the number of interfaces 1702 can be multiple.

[0516] For the case where the chip is used to implement the functions of the network device in the embodiment of the present application:

[0517] Interface 1702, used for transmitting code instructions to the processor;

[0518] The processor 1701 is configured to execute code instructions to execute the method shown in FIG. 5 to FIG. 7 , or to execute the method shown in FIG. 8 to FIG. 9 .

[0519] For the case where the chip is used to implement the functions of the terminal device in the embodiments of the present application:

[0520] Interface 1702, used for transmitting code instructions to the processor;

[0521] The processor 1701 is configured to execute code instructions to perform the methods shown in FIG. 2 to FIG. 4 .

[0522] Optionally, the chip further includes a memory 1703, which is used to store necessary computer programs and data.

[0523] Those skilled in the art will also appreciate that the various illustrative logical blocks and steps listed in the embodiments of the present application can be implemented by electronic hardware, computer software, or a combination of both. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the functions for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of the present application.

[0524] An embodiment of the present application also provides a communication system, which includes the identity authentication device as a terminal device in the embodiments of Figures 12 to 14 above, or the system includes the identity authentication device as a terminal device in the embodiment of Figure 16 above.

[0525] The present application also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.

[0526] The present application also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.

[0527] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. Available media may be magnetic media (eg, floppy disks, hard disks, tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state disks (SSDs)).

[0528] Those skilled in the art will understand that the various numerical numbers such as first and second involved in this application are only for the convenience of description and are not used to limit the scope of the embodiments of this application, and also indicate the order of precedence.

[0529] In this application, at least one can also be described as one or more, and multiple can be two, three, four or more, which is not limited in this application. In the embodiments of this application, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", and there is no order of precedence or size between the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0530] The correspondences shown in the tables in this application can be configured or predefined. The values ​​of the information in each table are examples only and can be configured to other values, which are not limited by this application. When configuring the correspondence between information and parameters, it is not necessarily required to configure all the correspondences shown in each table. For example, in the tables in this application, the correspondences shown in certain rows may not be configured. For another example, appropriate deformation adjustments can be made based on the above tables, such as splitting, merging, etc. The names of the parameters shown in the titles of the above tables can also use other names that can be understood by the communication device, and the values ​​or representations of the parameters can also use other values ​​or representations that can be understood by the communication device. When implementing the above tables, other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables, etc.

[0531] The predefined in this application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

[0532] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0533] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0534] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the embodiments of the present application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in the present invention can be achieved, and this document is not limited here.

[0535] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. An identity authentication method, characterized in that: The method is executed by a terminal device, and includes: Sending a first request message to a first network device in a non-public network NPN through an access network device, where the first request message is used by the first network device to determine a second request message, where the second request message is used to request the second network device corresponding to the NPN to authenticate the terminal device; Receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful.

2. The method according to claim 1, characterized in that The second network device is configured to provide services for a unique NPN corresponding to the second network device.

3. The method according to claim 1, characterized in that The first request message includes the identifier of the terminal device and / or the identifier of the hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.

4. The method according to claim 1, wherein The terminal device is accessing the NPN and the NPN does not include subscription information of the terminal device, and the method further includes: First indication information is sent to the first network device, where the first indication information is used by the first network device to determine to omit sending a message to a unified data management function (UDM) in the NPN.

5. The method according to claim 4, characterized in that The first indication information is an identifier of the terminal device; or, the first indication information is used to indicate that the NPN does not include subscription information of the terminal device.

6. The method according to claim 3, characterized in that The first response message is used to indicate that the identity authentication of the terminal device is successful, and the method further includes: Determine the master session key MSK; According to the MSK, the first security key K is determined AUSF ; According to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

7. The method according to claim 6, characterized in that The first request message includes the identifier of the hosting network, and the service network name is the identifier of the hosting network.

8. The method according to claim 6, characterized in that The first request message does not include the identifier of the hosting network, and the serving network name is the identifier of the NPN.

9. The method according to claim 6, characterized in that The second security key K SEAF The terminal device is used to interact with the security anchor function SEAF in the NPN through the access network device, and the second security key K stored in the SEAF SEAF It is sent by the first network device to the SEAF.

10. The method according to claim 2, characterized in that The service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

11. The method according to any one of claims 1 to 10, characterized in that The first request message is sent by the terminal device to the first network device through the access network device and the access and mobility management function AMF in the NPN; The first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN and the access network device.

12. An identity authentication method, characterized in that: The method is performed by a first network device, and the method includes: Receiving a first request message sent by a terminal device through an access network device; Sending, according to the first request message, a second request message to a second network device corresponding to the non-public network NPN where the first network device is located, wherein the second request message is used to request the second network device to authenticate the terminal device; receiving a result of the terminal device identity authentication sent by the second network device; According to the result of the identity authentication of the terminal device, a first response message is sent to the terminal device through the access network device, where the first response message is used to indicate whether the identity authentication of the terminal device is successful.

13. The method according to claim 12, characterized in that The second network device is configured to provide services for a unique NPN corresponding to the second network device.

14. The method according to claim 12, characterized in that The first request message includes the identifier of the terminal device and / or the identifier of the hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.

15. The method according to claim 12, characterized in that The terminal device is accessing the NPN and the NPN does not include subscription information of the terminal device, and the method further includes: receiving first indication information sent by the terminal device, where the first indication information is used by the first network device to determine to omit sending a message to a unified data management function (UDM) in the NPN; The second request message is sent to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

16. The method according to claim 15, characterized in that The first indication information is an identifier of the terminal device; or, the first indication information is used to indicate that the NPN does not include subscription information of the terminal device.

17. The method according to claim 16, characterized in that The first indication information is an identifier of the terminal device, and the first indication information is used to instruct the first network device to omit sending a message to the UDM according to a local policy of the first network device.

18. The method according to claim 16, characterized in that The first indication information is used to indicate that the NPN does not include the subscription information of the terminal device, and the first indication information is used to instruct the first network device to omit sending a message to the UDM according to the first indication information.

19. The method according to claim 12, wherein: The terminal device is accessing the NPN and the NPN does not include subscription information of the terminal device, and the method further includes: querying a unified data management function (UDM) in the NPN for subscription information of the terminal device, and failing to find the subscription information of the terminal device; The second request message is sent to the second network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

20. The method according to claim 14, wherein The first response message is used to indicate that the identity authentication of the terminal device is successful, and the method further includes: Receiving a master session key MSK sent by the second network device; According to the MSK, the first security key K is determined AUSF ; According to the first security key K AUSF and the service network name, determine the second security key K SEAF , the second security key K SEAF Used by the terminal device to access the NPN.

21. The method according to claim 20, characterized in that The first request message includes the identifier of the hosting network, and the service network name is the identifier of the hosting network.

22. The method according to claim 20, characterized in that The first request message does not include the identifier of the hosting network, and the serving network name is the identifier of the NPN.

23. The method according to claim 20, characterized in that The method further comprises: Send the second security key K to the security anchor function SEAF in the NPN SEAF , the second security key K SEAF Used for the terminal device to interact with the security anchor function SEAF in the NPN through the access network device.

24. The method according to claim 13, wherein The service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

25. The method according to any one of claims 12 to 24, characterized in that: The first request message is sent by the terminal device to the first network device through the access network device and the access and mobility management function AMF in the NPN; The first response message is sent by the first network device to the terminal device through the access and mobility management function AMF in the NPN and the access network device.

26. An identity authentication method, characterized in that: The method is performed by a second network device, and the method includes: receiving a second request message sent by the first network device, where the second request message is determined by the first network device according to the first request message sent by the terminal device, and the second request message is used to request the second network device corresponding to the non-public network (NPN) where the first network device is located to authenticate the terminal device; The result of the terminal device identity authentication is sent to the first network device, and the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful.

27. The method according to claim 26, characterized in that The second network device is configured to provide services for a unique NPN corresponding to the second network device.

28. The method according to claim 26, characterized in that The first request message includes the identifier of the terminal device and / or the identifier of the hosted network that the terminal device requests to access; the hosted network is constructed based on the NPN.

29. The method according to claim 26, wherein The method further comprises: Receive the second request message sent by the first network device through the network slice specific authentication and authorization function NSSAAF in the NPN.

30. The method according to claim 28, wherein The first response message is used to indicate that the identity authentication of the terminal device is successful, and the method further includes: Sending a master session key MSK to the first network device; The MSK is used by the first network device to determine the first security key K AUSF , the first security key K AUSF The service network name is used by the first network device to determine the second security key K SEAF .

31. The method according to claim 30, wherein The first request message includes the identifier of the hosting network, and the service network name is the identifier of the hosting network.

32. The method according to claim 30, wherein The first request message does not include the identifier of the hosting network, and the serving network name is the identifier of the NPN.

33. The method according to claim 27, wherein The service provided by the second network device to the NPN includes at least one of authentication, authorization and accounting.

34. An identity verification device, characterized in that The device comprises: a transceiver unit, configured to send a first request message to a first network device in a non-public network (NPN) through an access network device, wherein the first request message is used by the first network device to determine a second request message, and the second request message is used to request a second network device corresponding to the NPN to authenticate the device; The transceiver unit is further configured to receive a first response message sent by the first network device through the access network device, where the first response message is used to indicate whether the device identity authentication is successful.

35. An identity verification device, characterized in that: The device comprises: A transceiver unit, configured to receive a first request message sent by a terminal device through an access network device; a processing unit, configured to send, according to the first request message, a second request message to a second network device corresponding to the non-public network NPN where the apparatus is located, wherein the second request message is used to request the second network device to authenticate the terminal device; The transceiver unit is further configured to receive a result of the terminal device identity authentication sent by the second network device; The processing unit is further configured to send a first response message to the terminal device through the access network device based on a result of the identity authentication of the terminal device, wherein the first response message is configured to indicate whether the identity authentication of the terminal device is successful.

36. An identity verification device, characterized in that The device comprises: a transceiver unit, configured to receive a second request message sent by a first network device, where the second request message is determined by the first network device based on the first request message sent by the terminal device, and the second request message is used to request the device corresponding to the non-public network (NPN) where the first network device is located to authenticate the terminal device; The processing unit is further configured to send a result of the terminal device identity authentication to the first network device, wherein the result of the terminal device identity authentication is used to determine a first response message, and the first response message is used to indicate whether the terminal device identity authentication is successful.

37. A communication device, characterized in that: The device includes a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device performs the method according to any one of claims 1 to 11, or performs the method according to any one of claims 12 to 25, or performs the method according to any one of claims 26 to 33.

38. A communication device, characterized in that: include: processor and interface circuits; The interface circuit is used to receive code instructions and transmit them to the processor; The processor is configured to run the code instructions to execute the method according to any one of claims 1 to 11, or to execute the method according to any one of claims 12 to 25, or to execute the method according to any one of claims 26 to 33.

39. A computer-readable storage medium storing instructions, which, when executed, implement the method according to any one of claims 1 to 11, or the method according to any one of claims 11 to 25, or the method according to any one of claims 26 to 33.

40. A communication system, characterized in that: The communication system comprises: A terminal device, configured to execute the method according to any one of claims 1 to 11; A first network device, configured to perform the method according to any one of claims 12 to 25; The second network device is configured to execute the method according to any one of claims 26 to 33.

Images