Communication method and device

Abstract

The invention provides a communication method, and the method comprises the steps that a first security module can execute a security trusted service or manage the first security module based on a request of a communication node or a security module serving other communication nodes, and feeds back an execution or management result to a requester. Therefore, the security function and the management function are opened to different communication nodes, each process of the security function is standardized, the modularization of the security function is realized, and the independent deployment, flexible expansion and convenient maintenance of the security function are facilitated.

Description

A communication method and device Technical Field

[0001] The present application relates to the field of communications, and more particularly, to a communication method and a communication device. Background Art

[0002] Communications network security technology is an interdisciplinary field that intersects communications networks and security. Communications network security capabilities are often strongly coupled with other network capabilities, with security messages embedded within control plane messages. For example, access authentication and key agreement are embedded within the user registration process, terminal-side security capability reporting is embedded within the terminal capability reporting set, and private network authentication is embedded within the private network access process. This strong coupling of security and communications capabilities ensures efficient utilization of network resources.

[0003] With the development of communications technology, the tight coupling of communications network and security technologies has led to a situation where communications dominate and security plays a supporting role. This has limited the development of security capabilities within communications networks in many ways. For example, due to the tight coupling of security protocols with other protocols, modifications to security protocols often affect multiple network functions within the process. When network function modifications are requested, it's difficult to objectively justify the need for security upgrades unless the vulnerability has been clearly identified. When network vulnerabilities are exploited and an attack is imminent or has already occurred, rapid upgrades are difficult due to the varying security capabilities embedded in different network functions.

[0004] Therefore, when security technology serves the communication network, how to continuously evolve and update independently of the communication network to achieve the decoupling of security functions from communication functions becomes an issue worthy of attention.

[0005] Summary of the Invention

[0006] The present application proposes a communication method and a communication device that can deploy independent security functions, thereby enabling independent security services in communication nodes, ensuring independent updating and maintenance of security functions, and improving the security performance of communications.

[0007] In the first aspect, a communication method is provided, which can be executed by a first security module. The first security module can be a security function unit, module or device, or a chip or circuit in a security function unit, module or device, or a logic module or software that can implement all or part of the security function. This application does not limit this.

[0008] The method includes: a first security module executes a first security service or performs management of the first security module based on a first request message sent by a requester, the first security service is used to call security capabilities, the requester includes a first node, a second node or a second security module, the first security module is a module serving the first node, and the second security module is a module serving the second node; the first security module sends a first feedback message to the requester, and the first feedback message is used to feedback the execution result or management result of the first security service to the requester.

[0009] In the present application, the first security module and the second security module are security function modules serving different communication nodes.

[0010] In the present application, the first security module may also perform a first security service or manage the first security module based on a first notification message received from the requester. The first notification message may be status change notification information of the requester, for example, a terminal device accessing an access network device.

[0011] In the present application, the first security module may also autonomously trigger the execution of the first security service or the first security service management. For example, the first security module executes the first security service according to the first period, or the first security module executes the first security service according to the first timer.

[0012] The first period or the first timer may be preset.

[0013] Exemplarily, the first security module may periodically upload data to the blockchain.

[0014] The periodic trusted service request corresponds to the periodic triggering of authentication in the existing network, thereby improving security.

[0015] In this application, when the requesting party is the first node, the first request message includes the identity of the second node, which is used to indicate the destination node of the trusted service, for example, indicating the party to be authenticated in the authentication service, indicating the prover in the trusted proof service, etc.

[0016] In this application, when the requesting party is the second security module, the first request message includes security parameters for the first security module to execute a specific security algorithm. For example, the first security module on the Access and Mobility Management Function (AMF) side in the authentication service carries the authentication vector when sending a UE authentication request to the second security module on the terminal side.

[0017] In the present application, when the requesting party is the second node, the first security module can obtain the security parameters that need to be input into the security algorithm. For example, the input parameters when the first security module executes a specific security algorithm are pre-set or can be directly obtained by the first security module. For example, in a trusted proof service, the blockchain timestamp can be used as a challenge value in the trusted proof service, and the first security module inputs the challenge value as a parameter of the security algorithm.

[0018] In the present application, when the requester is the first node, the first request message may include management requirement information, which may be understood as the security requirement of the first node. The first security module manages the first security module based on the management requirement information.

[0019] In the present application, when the requesting party is the second security module, the first request message may include management target information, which can be understood as the goal of managing the first security module, for example, the establishment, deletion, status setting of the first security module, or the management of the capability unit in the first security module, as well as the adjustment and update of the configuration file based on the capability unit, etc.

[0020] According to the communication method provided in this application, the first security module can execute secure and trusted services or manage the first security module based on requests from communication nodes or security modules serving other communication nodes, and provide feedback on the execution or management results to the requesting party. This opens security functions to different communication nodes, standardizes the various security function processes, and achieves modularization of security functions, facilitating independent deployment, flexible expansion, and convenient maintenance of security functions.

[0021] In combination with the first aspect, in some implementations of the first aspect, the requester is the first node, and the first request message includes the identity of the second node or the management requirement information of the first node.

[0022] Based on the above technical solution, in this application, when a communication node requests a security service, it can include the identity of the trusted service destination node in the request message. Based on the identity of the trusted service destination node, the first security module can determine the trusted policy corresponding to that identity and further use this trusted policy to determine the specific security algorithm and security parameters to use. In contrast, in the prior art, when a communication node requests a security function, it requires preprocessing results from the communication node, such as the calculation of the security algorithm or the acquisition of security parameters. This simplifies the processing of the first node and protects the transmission of security parameters.

[0023] On the other hand, when the communication node of the present application requests security services, it can also carry management requirements in the request message, such as a security requirements list. The first security module adjusts the capability unit of the first security module according to the specific security requirements to meet the security requirements raised by the first node.

[0024] With reference to the first aspect, in certain implementations of the first aspect, the requester is the second security module, and the first request message includes security parameters or management target information of the first security module.

[0025] Based on the above technical solution, when the communication node of this application requests security services, it can also carry a management target in the request message, such as the name of the managed capability unit. The first security module performs management of the first security module according to the specific management target to meet the security requirements raised by the first node.

[0026] In combination with the first aspect, in certain implementations of the first aspect, the first security module includes a first module and / or a second module, the first module is used to call a security algorithm, obtain security parameters, or request at least one of a second security service from the second security module, and the second module is used to perform management of the first security service or management of the first module.

[0027] Based on the above solution, the two types of first security modules can be used to perform security services or management services respectively.

[0028] In combination with the first aspect, in certain implementations of the first aspect, the first security module includes a scheduling unit and a capability unit, the first request message includes the identity of the second node, and the first security module executes the first security service, including: the scheduling unit calls the security algorithm of the first security service and / or obtains the parameters of the first security service through the capability unit according to the first request message.

[0029] Based on the above solution, the scheduling unit in the first security module can call the applicable security algorithm or security parameters by calling the capability unit to execute the first security service.

[0030] In combination with the first aspect, in certain implementations of the first aspect, the first security module also includes an interface unit, and the method also includes: the interface unit receives a first request message from the requester, the first request message including the first security service requested by the requester; the interface unit generates a first task queue based on the first request message and sends the first task queue to the scheduling unit; the scheduling unit calls the security algorithm of the first security service and / or obtains the parameters of the first security service through the capability unit based on the first task queue; the scheduling unit sends the execution result to the interface unit.

[0031] According to the above technical solution, different functional units in the first security module can implement different functions, thereby executing the first security service.

[0032] In combination with the first aspect, in certain implementations of the first aspect, the first security module includes a scheduling unit, a management unit and a capability unit, the first request message includes management requirement information of the first node or management target information of the first security module, and the first security module performs management of the first security module, including: the management unit performs management of the capability unit through the scheduling unit according to the first request message.

[0033] According to the above technical solution, the management unit in the first security module can manage the capability units, make the internal capability units pluggable, and deploy and install different capability units according to the needs of the communication nodes, thereby improving the flexibility and applicability of the first security module.

[0034] In combination with the first aspect, in certain implementations of the first aspect, the first security module also includes an interface unit, and the method also includes: the interface unit receives a first request message from the requester and sends it to the scheduling unit; the scheduling unit sends the first request message to the management unit; the management unit performs management of the capability unit through the scheduling unit based on the first request message; the management unit modifies the configuration file and sends a management response message to the interface unit through the scheduling unit; the interface unit sends a management response message to the requester, and the management response message is used to feedback the management result of the management request to the requester.

[0035] According to the above technical solution, in the first security module, the management unit can manage the capability units through the scheduling unit based on the management request message received by the interface unit. Furthermore, the management results can be sent to the interface unit by modifying the configuration file to implement the update management of the internal capability units. This allows for the deployment and installation of different capability units based on the needs of the communication nodes. This improves the flexibility and applicability of the first security module.

[0036] In combination with the first aspect, in certain implementations of the first aspect, when the first module serves the requester, the requester is a terminal device, and the first module is deployed within the requester, or the first module is deployed outside the requester.

[0037] According to the above technical solution, the first module can be deployed inside or outside the terminal device, which is flexible in deployment and improves applicability.

[0038] In combination with the first aspect, in certain implementations of the first aspect, when the first module and / or the second module serves the requester, the requester is an access network device, and the first module and / or the second module is deployed within the requester, or the first module and / or the second module is deployed outside the requester.

[0039] According to the above technical solution, the first module or the second module can be deployed inside the access network device and installed together with the access network device, or can be deployed outside the access network device and deployed independently, but can still provide security services for the access network device.

[0040] In combination with the first aspect, in certain implementations of the first aspect, when the first module serves the requester, the requester is a core network device, and the first module and the second module are deployed in a network function manner of the core network.

[0041] In combination with the first aspect, in certain implementations of the first aspect, the first security module communicates with the requester through a first interface, and the first interface is used by the requester to initiate a request for the first security service, and the first interface is also used by the first security module to send a response to execute the first security service; when the first security module serves the requester, the first interface is also used by the requester to initiate a request for management and configuration of the first security module, and the first interface is also used by the first security module to send a response to the management and configuration of the first security module.

[0042] According to the above technical solution, a communication interface is provided, which can be used for the first security module of this application to communicate with the communication node, realize the decoupling of the security and trust capabilities of the communication network end and both sides of the network from other capabilities, and standardize the external interface.

[0043] In combination with the first aspect, in certain implementations of the first aspect, the second module communicates with the first module through a second interface, the second interface is used to transmit requests and responses for the first security service, and the second interface is also used to transmit requests and responses for the management and configuration of the first module by the second module.

[0044] According to the above technical solution, a communication interface is provided, which can be used for communication between the first security modules of the present application, to achieve decoupling of security and trust capabilities from other capabilities on both sides of different security modules, and to standardize external interfaces.

[0045] On the second aspect, a communication method is provided, which can be executed by a requester. The requester can be a terminal device, an access network device or a security module (a second security module), or a chip or circuit in the terminal device, access network device or security module, or a logic module or software that can realize all or part of the functions of the terminal device, access network device or security module. This application does not limit this.

[0046] The method includes: a requesting party sends a first request message to a first security module, the first request message is used to request the first security module to execute a first security service or perform management of the first security module, the first security service is used to call security capabilities, the requesting party includes a first node, a second node or a second security module, the first security module is a module serving the first node, and the second security module is a module serving the second node; the requesting party receives a first feedback message from the first security module, the first feedback message is used to feed back to the requesting party the execution result of the first security service or the management result of the first security module.

[0047] According to the communication method provided by this application, a requester requiring a trusted service or security module management sends a request to a first security module, along with the identity of the target node for the trusted service or security parameters. Based on this identity or security parameters, the first security module executes the trusted service and provides feedback to the requester on the results of the trusted service execution. This process allows the requester to directly obtain the results of the trusted service without having to participate in any calculations or processing. This simplifies the requester's processing while ensuring communication security.

[0048] In conjunction with the second aspect, in a possible implementation manner, the requesting party is the first node, and the first request message includes the identity of the second node or management requirement information of the first node.

[0049] In conjunction with the second aspect, in a possible implementation manner, the requesting party is the second security module, and the first request message includes security parameters or management target information of the first security module.

[0050] On the third aspect, a communication device is provided, which can be a first security module. The first security module can be a security function unit, module or device, or a chip or circuit in a security function unit, module or device, or a logic module or software that can realize all or part of the security function. This application does not limit this.

[0051] The device includes: a processing unit, used to execute a first security service or perform management of a first security module based on a first request message sent by a requester, the first security service is used to call security capabilities, the requester includes a first node, a second node or a second security module, the first security module is a module serving the first node, and the second security module is a module serving the second node; an interface unit, used to send a first feedback message to the requester, the first feedback message is used to feedback the execution result or management result of the first security service to the requester.

[0052] In combination with the third aspect, in certain implementations of the third aspect, the requester is the first node, and the first request message includes the identity of the second node or management requirement information of the first node.

[0053] In combination with the third aspect, in certain implementations of the third aspect, the requester is the second security module, and the first request message includes security parameters or management target information of the first security module.

[0054] In combination with the third aspect, in certain implementations of the third aspect, the first security module includes a first module and / or a second module, the first module is used to call a security algorithm, obtain security parameters, or request at least one of a second security service from the second security module, and the second module is used to perform management of the first security service or management of the first module.

[0055] In combination with the third aspect, in certain implementations of the third aspect, the processing unit includes a scheduling unit and a capability unit, the first request message includes an identity identifier of the second node, and the scheduling unit is used to call the security algorithm of the first security service and / or obtain the parameters of the first security service through the capability unit according to the first request message.

[0056] In combination with the third aspect, in certain implementations of the third aspect, the processing unit also includes a capability unit, and the interface unit is further used to receive a first request message from the requester, the first request message including the first security service requested by the requester; the interface unit is further used to generate a first task queue based on the first request message and send the first task queue to the scheduling unit; the scheduling unit is specifically used to call the security algorithm of the first security service and / or obtain the parameters of the first security service through the capability unit based on the first task queue; the scheduling unit is also used to send the execution result to the interface unit.

[0057] In combination with the third aspect, in certain implementations of the third aspect, the processing unit includes a scheduling unit, a management unit, and a capability unit, the first request message includes management requirement information of the first node or management target information of the first security module, the management unit is specifically used to perform management of the capability unit through the scheduling unit according to the first request message, and the management request message includes the management requirement or management target of the requester.

[0058] In combination with the third aspect, in certain implementations of the third aspect, the interface unit is further used to receive a first request message from the requester and send it to the scheduling unit; the scheduling unit is further used to send the first request message to the management unit; the management unit is further used to perform management of the capability unit through the scheduling unit based on the first request message; the management unit is further used to modify the configuration file and send a management response message to the interface unit through the scheduling unit; the interface unit is further used to send a management response message to the requester, and the management response message is used to feedback the management result of the management request to the requester.

[0059] In combination with the third aspect, in certain implementations of the third aspect, when the first module serves the requester, the requester is a terminal device, and the first module is deployed within the requester, or the first module is deployed outside the requester.

[0060] In combination with the third aspect, in certain implementations of the third aspect, when the first module and / or the second module serves the requester, the requester is an access network device, and the first module and / or the second module is deployed within the requester, or the first module and / or the second module is deployed outside the requester.

[0061] In combination with the third aspect, in certain implementations of the third aspect, when the first module and / or the second module serves the requester, the requester is a core network device, and the first module and the second module are deployed in a network function manner of the core network.

[0062] In combination with the third aspect, in certain implementations of the third aspect, the first security module communicates with the requester through a first interface, and the first interface is used by the requester to initiate a request for the first security service, and the first interface is also used by the first security module to send a response to execute the first security service; when the first security module serves the requester, the first interface is also used by the requester to initiate a request for management and configuration of the first security module, and the first interface is also used by the first security module to send a response to the management and configuration of the first security module.

[0063] In combination with the third aspect, in certain implementations of the third aspect, the second module communicates with the first module through a second interface, the second interface is used to transmit requests and responses for the first security service, and the second interface is also used to transmit requests and responses for the management and configuration of the first module by the second module.

[0064] In the fourth aspect, a communication device is provided, which can be a requester. The requester can be a terminal device, an access network device or a security module (a second security module), or a chip or circuit in the terminal device, access network device or security module, or a logical module or software that can realize all or part of the functions of the terminal device, access network device or security module. This application does not limit this.

[0065] The device includes: an interface unit for sending a first request message to a first security module, the first request message is used to request the first security module to execute a first security service or perform management of the first security module, the first request message includes an identity identifier or security parameters of a communication node, the first security service is used to call security capabilities, and the requester includes a communication node or a second security module; the interface unit is also used to receive a first feedback message from the first security module, the first feedback message is used to feedback the execution result or management result of the first security service to the requester.

[0066] In a fifth aspect, a communication device is provided, comprising a processor coupled to a memory and configured to execute instructions in the memory to implement the method described above in any one of the first to second aspects, and any possible implementation of the first to second aspects. Optionally, the device further comprises a memory, which may be deployed separately from the processor or may be deployed centrally. Optionally, the device further comprises a communication interface, the processor being coupled to the communication interface. In one implementation, the communication interface may be a transceiver, or an input / output interface.

[0067] When the device is a chip, the communication interface may be an input / output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip or chip system, etc. The processor may also be embodied as a processing circuit or a logic circuit.

[0068] Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0069] In a specific implementation, the processor may be one or more chips, the input circuit may be an input pin, the output circuit may be an output pin, and the processing circuit may be a transistor, a gate circuit, a trigger, or various logic circuits. The input signal received by the input circuit may be, but is not limited to, received and input by a receiver, and the signal output by the output circuit may be, but is not limited to, output to and transmitted by a transmitter. The input circuit and the output circuit may be the same circuit, which functions as an input circuit and an output circuit at different times. The embodiments of the present application do not limit the specific implementation of the processor and various circuits.

[0070] In a sixth aspect, a communication device is provided, which includes a logic circuit and an input / output interface, wherein the logic circuit is used to couple with the input / output interface and transmit data through the input / output interface to execute any aspect of the above-mentioned first to second aspects, and any possible implementation method of the first to second aspects.

[0071] In a seventh aspect, a communication system is provided, which includes the first module in any possible implementation of the first aspect or the second aspect.

[0072] In an eighth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instructions). When the computer-readable storage medium is run on a computer, the computer executes any one of the above-mentioned first to second aspects, and any possible implementation of the first to second aspects.

[0073] In the ninth aspect, a computer program product is provided, which includes: a computer program (also referred to as code, or instructions), which, when executed, enables a computer to execute any one of the above-mentioned first to second aspects, and any possible implementation of the first to second aspects.

[0074] In the tenth aspect, a circuit system is provided, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that a communication device equipped with the circuit system executes a method in any possible implementation of the first or second aspect above.

[0075] The circuit system may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0076] In an eleventh aspect, a circuit system is provided for executing the method in any possible implementation of the first aspect or the second aspect.

[0077] The beneficial effects brought about by the third to eleventh aspects mentioned above can be referred to the description of the beneficial effects in the first to second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] FIG1 shows a schematic diagram of a wireless communication system 100 applicable to an embodiment of the present application.

[0079] FIG2 shows a schematic diagram of a network architecture 200 applicable to an embodiment of the present application.

[0080] FIG3 shows a schematic diagram of a network architecture 300 applicable to an embodiment of the present application.

[0081] FIG4 shows a schematic diagram of a deployment architecture of a security module provided in a specific embodiment of the present application.

[0082] FIG5 shows a schematic diagram of a deployment architecture of a security module provided in a specific embodiment of the present application.

[0083] FIG6 shows a schematic diagram of a deployment architecture of a first security module provided in a specific embodiment of the present application.

[0084] FIG7 shows a schematic diagram of a communication interface provided in a specific embodiment of the present application.

[0085] FIG8 shows a schematic diagram of a communication interface provided in a specific embodiment of the present application.

[0086] FIG9 shows a schematic diagram of a communication interface provided in a specific embodiment of the present application.

[0087] FIG10 shows a communication process of internal units of a security module provided in a specific embodiment of the present application.

[0088] FIG11 shows a schematic interaction diagram applicable to the communication method provided in a specific embodiment of the present application.

[0089] FIG12 shows another schematic interaction diagram applicable to the communication method provided in a specific embodiment of the present application.

[0090] FIG13 shows another schematic interaction diagram applicable to the communication method provided in a specific embodiment of the present application.

[0091] FIG14 shows a flowchart of an authentication service provided in a specific embodiment of the present application.

[0092] FIG15 shows a flowchart of a trusted certification service applicable to a specific embodiment of the present application.

[0093] FIG16 shows a flowchart of an authorization service provided in a specific embodiment of the present application.

[0094] FIG17 shows a flowchart of an encryption and decryption service applicable to a specific embodiment of the present application.

[0095] Figure 18 shows a flowchart of a blockchain data upload or download service provided in a specific embodiment of the present application.

[0096] FIG19 shows a schematic block diagram of a communication device applicable to an embodiment of the present application.

[0097] Figure 20 shows a schematic architecture diagram of a communication device suitable for use in an embodiment of the present application. DETAILED DESCRIPTION

[0098] The technical solution in this application will be described below with reference to the accompanying drawings.

[0099] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: Global System of Mobile communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, Universal Mobile Telecommunications System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system, Fifth Generation (5G) mobile communication system or new radio (NR), wireless local area network (WLAN) system, wireless fidelity (WiFi) system. Among them, the 5G mobile communication system can be a non-standalone (NSA) or standalone (SA) network.

[0100] The technical solution provided in this application can also be applied to machine type communication (MTC), long term evolution-machine (LTE-M), device-to-device (D2D) network, machine-to-machine (M2M) network, Internet of Things (IoT) network or other networks. Among them, the IoT network can include, for example, the Internet of Vehicles. Among them, the communication mode in the Internet of Vehicles system is collectively referred to as vehicle to other devices (vehicle to X, V2X, X can represent anything), for example, the V2X can include: vehicle to vehicle (V2V) communication, vehicle to infrastructure (V2I) communication, vehicle to pedestrian (V2P) communication or vehicle to network (V2N) communication, etc.

[0101] The technical solution provided in this application can also be applied to future communication systems, such as the sixth generation (6G) mobile communication system, etc. This application does not limit this.

[0102] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0103] Figure 1 is a schematic diagram of a communication system 100 applicable to an embodiment of the present application. As shown in Figure 1, the communication system 100 may include at least one network device, such as the network device 110 shown in Figure 1; the communication system 100 may also include at least one terminal device, such as the terminal device 120 shown in Figure 1. The network device 110 and the terminal device 120 can communicate via a wireless link. Each communication device, such as the network device 110 or the terminal device 120, can be configured with multiple antennas. For each communication device in the communication system, the configured multiple antennas may include at least one transmitting antenna for sending signals and at least one receiving antenna for receiving signals. Therefore, communication between the communication devices in the communication system and between the network device 110 and the terminal device 120 can be achieved through multi-antenna technology.

[0104] It should be understood that FIG1 is only a simplified schematic diagram for ease of understanding, and the communication system may further include other network devices or other terminal devices, which are not shown in FIG1 .

[0105] It should also be understood that the communication system 100 shown in Figure 1 is only an example of an application scenario of an embodiment of the present application. The present application can also be applied to communication between any two devices, for example, communication between terminal devices, and communication between network devices.

[0106] FIG2 is a schematic diagram of a network architecture 200 applicable to the communication system of the present application.

[0107] As shown in Figure 2, the network architecture of the communication system includes but is not limited to the following network elements:

[0108] 1. User Equipment (UE): The user equipment in the embodiments of the present application may also be referred to as user equipment (UE), mobile station (MS), mobile terminal (MT), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc.

[0109] The user equipment may be a device that provides voice / data connectivity to the user, for example, a handheld device or a vehicle-mounted device with a wireless connection function. At present, some examples of terminals include: mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, user equipment in future 5G networks or future evolved public land mobile communication networks (PLMNs). The embodiment of the present application does not limit this.

[0110] As an example and not a limitation, in the embodiment of the present application, the user device may also be a wearable device. Wearable devices may also be called wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include those that are fully functional, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.

[0111] Furthermore, in the embodiments of the present application, the user device may also be a user device in an Internet of Things (IoT) system. The IoT is an important component of future information technology development. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network that interconnects humans and machines, and objects and things.

[0112] In the embodiments of the present application, IoT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrowband NB technology. For example, an NB can include one resource block (RB), that is, the NB bandwidth is only 180KB. To achieve massive access, it is necessary to require that terminals are discrete in access. According to the communication method of the embodiments of the present application, it can effectively solve the congestion problem of massive IoT terminals when accessing the network through NB.

[0113] In addition, the access device in the embodiment of the present application may be a device for communicating with a user device. The access device may also be referred to as an access network device or a wireless access network device. For example, the access device may be an evolved NodeB (eNB or eNodeB) in an LTE system, or a wireless controller in a cloud radio access network (CRAN) scenario, or the access device may be a relay station, an access point, a vehicle-mounted device, a wearable device, and an access device in a future 5G network or an access device in a future evolved PLMN network, etc. It may be an access point (AP) in a WLAN, or a gNB in ​​a new radio system (NR). The embodiment of the present application is not limited.

[0114] In addition, in the embodiment of the present application, the user equipment may also communicate with user equipment of other communication systems, for example, inter-device communication, etc. For example, the user equipment may also transmit (for example, send and / or receive) time synchronization messages with user equipment of other communication systems.

[0115] 2. Access device (AN / RAN): The access device in the embodiment of the present application may be a device for communicating with a user equipment. The access device may also be referred to as an access network device or a wireless access network device. For example, the access device may be an evolved NodeB (eNB or eNodeB) in an LTE system, or a wireless controller in a cloud radio access network (CRAN) scenario, or the access device may be a relay station, an access point, a vehicle-mounted device, a wearable device, an access device in a 5G network, or an access device in a future evolved PLMN network, etc. It may be an access point (AP) in a WLAN, or a gNB in ​​an NR system. The embodiment of the present application is not limited thereto.

[0116] In addition, in the embodiment of the present application, the access device is a device in the RAN, or in other words, a RAN node that connects the user equipment to the wireless network. For example, as an example and not a limitation, the access device can be listed as: gNB, transmission reception point (TRP), evolved Node B (eNB), radio network controller (RNC), Node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home evolved NodeB, or home Node B, HNB), base band unit (BBU), or wireless fidelity (Wifi) access point (AP). In a network structure, the network device may include a centralized unit (CU) node, a distributed unit (DU) node, or a RAN device including a CU node and a DU node, or a RAN device including a control plane CU node (CU-CP node) and a user plane CU node (CU-UP node) and a DU node.

[0117] An access device provides services for a cell, and a user device communicates with the access device through the transmission resources used by the cell (e.g., frequency domain resources, or spectrum resources). The cell may be a cell corresponding to the access device (e.g., a base station). The cell may belong to a macro base station or a base station corresponding to a small cell. Small cells may include: metro cells, micro cells, pico cells, femto cells, etc. These small cells have the characteristics of small coverage and low transmission power, and are suitable for providing high-speed data transmission services.

[0118] In addition, multiple cells can operate simultaneously on the same frequency on a carrier in an LTE or 5G system. In some special scenarios, the concepts of carrier and cell can be considered equivalent. For example, in a carrier aggregation (CA) scenario, when a secondary carrier is configured for a UE, both the carrier index of the secondary carrier and the cell identification (Cell ID) of the secondary cell operating on the secondary carrier are carried. In this case, the concepts of carrier and cell can be considered equivalent, for example, a user equipment accessing a carrier is equivalent to accessing a cell.

[0119] The communication system of the present application can also be applied to vehicle to everything (V2X) technology, that is, the user equipment of the present application can also be a car, for example, a smart car or a self-driving car.

[0120] The "X" in V2X represents different communication goals. V2X can include but is not limited to: vehicle to vehicle (V2V), vehicle to infrastructure (V2I), vehicle to network (V2N), and vehicle to pedestrian (V2P).

[0121] In V2X, access devices can configure "zones" for UEs. These zones can also be called geographic regions. Once configured, the world is divided into multiple zones, defined by reference points, length, and width. When determining a zone identifier (ID), the UE uses the zone's length, width, the number of zones in the length, the number of zones in the width, and the reference points. This information can be configured by the access device.

[0122] V2X services can be provided in two ways: using the Proximity-based Services Communication 5 (PC5) interface and the Uu interface. The PC5 interface is defined based on a sidelink, enabling direct communication between communication devices (e.g., vehicles). The PC5 interface can be used both out of coverage (OOC) and in coverage (IC), but only authorized communication devices can use it for transmission.

[0123] 3. Access and Mobility Management Function (AMF) network element: Mainly used for mobility management and access management, etc., and can be used to implement other functions of the mobility management entity (MME) in the LTE system except session management, such as lawful interception and access authorization / authentication. When the AMF network element provides services for a session in a user equipment, it will provide control plane storage resources for the session to store the session identifier, the SMF network element identifier associated with the session identifier, etc. In the embodiment of the present application, it can be used to implement the functions of the access and mobility management network element.

[0124] 4. Session Management Function (SMF) network element: This element is primarily used for session management, allocating and managing Internet Protocol (IP) addresses for user devices, selecting and managing endpoints for user plane functions, policy control, or charging function interfaces, and downlink data notification. In embodiments of the present application, this element can be used to implement the functions of the session management network element.

[0125] 5. Policy Control Function (PCF) network element: A unified policy framework used to guide network behavior, providing policy rule information and flow-based billing control functions for control plane function network elements (such as AMF, SMF network elements, etc.).

[0126] 6. Unified data management (UDM) network element: Mainly responsible for processing UE subscription data, including the storage and management of user identities, user subscription data, authentication data, etc.

[0127] 7. User Plane Function (UPF) network element: This element can be used for packet routing and forwarding, or for quality of service (QoS) processing of user plane data. User data can be connected to the data network (DN) through this element, and user data can also be received from the data network and transmitted to the user equipment through the access network equipment. The transmission resources and scheduling functions provided to the user equipment in the UPF network element are managed and controlled by the SMF network element. In the embodiments of the present application, this element can be used to implement the functions of the user plane network element.

[0128] 8. Network Exposure Function (NEF) network element: Used to securely expose services and capabilities provided by 3GPP network functions to the outside world, mainly supporting secure interaction between 3GPP networks and third-party applications.

[0129] 9. Application Function (AF) NE: This NE is used to perform application-influenced data routing, access network open function NEs, or interact with the policy framework for policy control, such as influencing data routing decisions, policy control functions, or providing third-party services to the network side.

[0130] 10. Network Slice Selection Function (NSSF) network element: mainly responsible for network slice selection, and determines the network slice instance that the UE is allowed to access based on the UE's slice selection auxiliary information, contract information, etc.

[0131] 11. Authentication Server Function (AUSF) network element: supports 3GPP and non-3GPP access authentication.

[0132] 12. Network Repository Function (NRF) network element: supports registration and discovery of network functions.

[0133] 13. Unified Data Repository (UDR) network element: stores and retrieves contract data used by UDM and PCF.

[0134] In this network architecture, the N2 interface is the reference point between the RAN and AMF entities, used for sending NAS (Non-Access Stratum) messages, etc.; the N3 interface is the reference point between the RAN and UPF network elements, used for transmitting user plane data, etc.; the N4 interface is the reference point between the SMF network element and the UPF network element, used for transmitting information such as tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages.

[0135] It should be understood that the UE, (R)AN, UPF and DN in Figure 2 are generally referred to as data plane network functions and entities. The user's data traffic can be transmitted through the PDU session established between the UE and the DN, and the transmission will pass through the two network function entities (R)AN and UPF; the other parts are called control plane network functions and entities, which are mainly responsible for functions such as authentication and authorization, registration management, session management, mobility management and policy control, so as to achieve reliable and stable transmission of user layer traffic.

[0136] It should be understood that the above-mentioned network architecture applied to the embodiment of the present application is only an example of the network architecture described from the perspective of traditional point-to-point architecture and service-oriented architecture. The network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present application.

[0137] It should be understood that the interface names between the various network elements in Figure 2 are only examples. In specific implementations, the interface names may be other names, and this application does not specifically limit this. In addition, the names of the messages (or signaling) transmitted between the various network elements are only examples and do not constitute any limitation on the functions of the messages themselves.

[0138] It should be noted that the above-mentioned "network element" can also be referred to as an entity, device, apparatus or module, etc., and this application does not specifically limit it. Moreover, in this application, for the sake of ease of understanding and explanation, the description of "network element" is omitted in some descriptions. For example, the SMF network element is referred to as SMF. In this case, the "SMF" should be understood as the SMF network element or SMF entity. The description of the same or similar situations will be omitted below.

[0139] It is understandable that the above entities or functions can be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform).

[0140] It should be understood that the above-mentioned network architecture applied to the embodiment of the present application illustrates an example of a service-oriented architecture, in which the core network sets up special network elements for different types of communication services, that is, communication-related functions can be provided in the form of services. In the embodiment of the present application, communication-related functions are not limited to the functional network elements listed in Figure 2, and the embodiment of the present application does not limit this.

[0141] It should be noted that the security of the existing 5G network is dispersed among various communication nodes as a function. For example, AUSF supports authentication for 3GPP access and non-3GPP access; SEAF provides authentication function in the service network and can support the initial authentication process based on subscription concealed identifier (SUCI); AMF supports encryption and integrity protection of NAS signaling; NRF supports two-way authentication function with other NFs and supports authorization function for other NFs; NEF supports two-way authentication function with AF and supports encryption, integrity protection and replay protection of messages between NF and NF through transport layer security (TLS); base station supports encryption, integrity protection and replay protection of messages between UE and CU through PDCP protocol, and supports two-way authentication function, encryption, integrity protection and replay protection between CU and DU; UE supports two-way authentication function with core network, supports encryption, integrity protection and replay protection of NAS signaling between UE and core network, and supports radio resource control (RRC) between UE and base station through packet data convergence protocol (PDCP). The 5G LTE standard also includes encryption, integrity protection, and replay protection for 5G control (RRC) messages, privacy protection for converting the subscription permanent identifier (SUPI) to a 5G globally unique temporary UE identifier (5G-GUTI), upper-layer application-visible security features, and user-configurable security features.

[0142] Currently, most security functions are implemented within communications equipment, without standardized interfaces between them. This significantly limits their development. For example, setting up security functions is complex and labor-intensive, which is inconsistent with future network development trends. Furthermore, security functions are implemented on individual NFs, and modifications to security protocols often involve multiple NFs in the process, leading to complex deployment and high maintenance costs. Furthermore, when network vulnerabilities are exploited and an attack is imminent or has already occurred, rapid upgrades are difficult due to the varying security capabilities embedded in different network functions. As communications services increasingly demand more security, existing security deployments are clearly unable to meet these demands, leading to communications security issues.

[0143] Secure transmission is the basic guarantee of communication. Existing security functions are strongly coupled with communication functions. The embodiments of the present application can deploy independent security functions, thereby enabling independent security services in communication nodes and improving the security performance of communication.

[0144] The present application provides a security function module, which is not limited to hardware or software. The security function module includes an interface unit, a scheduling unit, a management unit, and a capability unit. The interface unit, management unit, and capability unit each communicate point-to-point with the scheduling unit, with no interface between them. In the following specific embodiments, the first module and the second module can be two different types of security function modules. The first security module and the second security module are two security function modules serving different communication nodes, and are represented by security module #1 and security module #2, respectively, in the specific embodiments.

[0145] The interface unit is responsible for translating and negotiating between the device or function and other devices or functions, as well as orchestrating internal tasks (capability unit call logic); the scheduling unit is responsible for executing the orchestration issued by the interface unit; the management unit is responsible for management affairs such as updating and plugging in internal components of the device or function, as well as routine management functions such as logging and alarming; and the capability unit performs specific capability operations. There can be multiple capability units, and different capability units can implement different security capabilities. Capability units can be adjusted according to specific needs, for example, capability units can be added, removed, or updated. The device or function can support hardware / software interfaces externally, and based on the hardware / software interfaces, it can support CP / UP / MP and other standardized protocols.

[0146] Based on the security function module, based on different capability properties, it is specifically divided into two categories: the first module and the second module. The first module is used to call security algorithms, obtain security parameters or request security services from other security function modules; the second module is used to perform management of security services or management of the first module.

[0147] Exemplarily, the second module performs management of security services, which can be the management, addition, deletion, and granting of new capabilities (data on-chain, downloading, participation in public disclosure mechanisms, smart contracts, etc.) of blockchain nodes in blockchain services.

[0148] It should be understood that in this application, the capability units can be adjusted according to specific needs, and the management of the first module by the second module can be the management of the capability units in the first module. For example, capability units can be added, removed or updated.

[0149] The internal functional units of the first module and the second module are described in detail below.

[0150] The first module includes a first scheduling unit, a first capability unit, a first management unit, and a first interface unit. The first interface unit contains all capability formats and parameters that the first security module may use during a specific trusted negotiation process and is the first security module's only external channel. The interface unit receives tasks from management functions or other network functions, translates them, decomposes the sequential task flow, and passes them to the scheduling unit for execution. The first scheduling unit provides queue scheduling between modules within the first security module based on the sequential task queue received from the interface unit, ensuring the correct order of inter-function access within the first security module. The first management unit provides internal management functions for the first security module, including setting and updating the attributes of the first security module, as well as hot-swap management, monitoring, and warnings for modules within the first security module. The first capability unit, trusted storage environment, basic cryptography, authorization, trusted proof, privacy protection, and blockchain are currently the enabling modules. 1) The trusted storage environment ensures the secure storage of trusted roots and high-security data and functional logic; 2) The basic cryptographic enabling module includes symmetric, asymmetric, hash, signature, homomorphic encryption, postquantum cryptography (PQC) and atomic implementation of the corresponding algorithms, and is scalable; 3) The authorization enabling module includes static authorization and token-based authorization, as well as other authorization methods that may appear in the future; 4) The measurement enabling module provides a credibility measurement function based on the measurement + comparison mode. This function relies on the trusted root, trusted startup and execution logic in the trusted storage environment, and starts work according to different trusted measurement triggering times. It can directly submit the measurement value and measurement judgment result to the operator, user, and application party or third party that needs this information. It can also use blockchain to achieve consensus storage of this information, and can also use centralized storage and authorized access; 5) The privacy protection enabling module includes a variety of privacy protection algorithms that can be used, such as multi-party computation (MPC), data shielding, Data Masking, zero-knowledge proof, differential privacy, etc.; 6) Blockchain enabling modules execute transaction consensus, link communication and smart contracts, and have open capabilities, allowing the customizing party to build a business blockchain for specific business logic by calling the enabling modules, such as distributed public key infrastructure (DPKI) chain, identity management (IDM) chain, and network behavior record chain; 7) Any trusted enabling modules that may be added.

[0151] The second module includes a second scheduling unit, a second capability unit, a second management unit, and a second interface unit. The second interface unit serves as the communication interface between the second module and external network functions. It receives tasks from management or other network functions, translates them, decomposes the sequential task flow, and then transfers them to the second scheduling unit for execution. The second scheduling unit also performs translation and sequential task flow decomposition, providing queue scheduling between the various function execution modules within the second module, ensuring the correct order of inter-function access within the engine. The second management unit, distinct from the network management plane security management function, is used to create and manage online trust connections related to business processes. It serves blockchain-based services created under the consensus model, including blockchain creation and multi-chain communication. The second capability unit refers to the ability to analyze network behavior data and formulate security policies. After collecting behavior information, the 6G network's own AI capabilities can analyze and formulate policies. Alternatively, third-party professional service capabilities can be integrated, with behavior data de-identified and then analyzed and formulated by a third party. Alternatively, third-party service modules (such as Defense Solutions) can be embedded within the second module, becoming internalized as part of the second module. The trusted policies output by the second module are output via the second interface unit.

[0152] FIG3 is a schematic diagram of a network architecture 300 suitable for use in the present application.

[0153] Taking the existing network architecture as an example, the security function module can be deployed in the existing communication node. For example, the security function module can be deployed on the terminal side, as shown in Figure 3. The first module can be integrated with the function of the UE, that is, the first module can be deployed inside the UE. For example, the first module can be deployed on the ME and communicate with the function of the UICC through an interface, or it can be combined with the UICC. The first module can be deployed separately from the UE, that is, the first module can be deployed outside the UE as a functional entity. The security function can be deployed on the outside of the access network device in the form of a functional entity, or it can be deployed on the inside of the access network device in the form of a logical function. For example, when the access network device can include a CU node and a DU node, the first module or the second module can be deployed only on the CU, or it can be deployed on both the CU and the DU. The first module or the second module can be deployed on the core network device, or it can be deployed outside the core network device in the form of a functional entity. For example, the first module in Figure 3 is independently deployed on the bus in the form of a network function of the core network.

[0154] The following is a detailed description of the three deployment scenarios of the security function module.

[0155] Case 1: The second module is deployed on the terminal side.

[0156] Figure 4 shows three deployment states of the first module on the terminal side. As shown in Figure 4 (a), the first module can be co-located with the UE, that is, deployed inside the UE, and the first module is combined with the smart card function. For example, the first module can communicate with the function of the mobile phone card through an interface, wherein the card can be in the form of SIM, USIM, vSIM, eSIM, softSIM, iSIM, eUICC, etc. As shown in Figure 4 (b), the first module can be co-located with the UE, that is, deployed inside the UE, and the first module can be deployed on the ME (outside the UICC) in the form of other hardware cards, and can communicate with the card through an interface. As shown in Figure 4 (c), the first module can be deployed separately from the UE, that is, neither on the UICC nor on the ME, and has interfaces with the UICC and ME respectively for communication, for example, connecting to the UE through the ME external interface Type-C.

[0157] Case 2: The first module and the second module are deployed on the access network side.

[0158] Figure 5 shows four deployment states of the first and second modules on the access network side. If the access network equipment is divided into cNodes and sNodes, where the cNode is the centralized control node on the access network side and the sNode is the service logic node that can receive management and control from the cNode, then the trusted function deployment has the following situations: As shown in Figure 5 (a), the cNode deploys the second module and the first module, and the sNode deploys the first module and accepts the management of the second module from the cNode. The first module is deployed in the cNode / sNode in the form of a hardware card, and TW1 is the internal interface. As shown in Figure 5 (b), the first module or the second module is deployed independently from the cNode / sNode. Each cNode / sNode can communicate with its own first module or second module. TW1 is the network interface. As shown in Figure 5 (c), the second module is deployed independently and can communicate with all cNodes. The first module is deployed in the cNode / sNode in the form of a hardware card. As shown in Figure 5 (d), the first module is deployed in the cNode / sNode in the form of a hardware card, and the second module is deployed in one cNode.

[0159] Case 3: The first and second modules are deployed on the core network side.

[0160] Figure 6 shows the deployment of the first and second modules on the core network side. The first and second modules are deployed on the core network side and connected to the SBI bus along with other network elements. The number of second modules can be one. The deployment of the first module can be divided into four scenarios: 1) There is a single, general first module in the core network, which includes all security functions required by the core network; 2) There are multiple, partially-integrated first modules in the core network, providing security services for different NFs; 3) There is a single, general first module and multiple, partially-integrated first modules in the core network. The general first module provides the setup and configuration functions for the other first modules. If OAM, RAN, UE, or third parties wish to obtain core network security service information, they can do so directly from the general first module's files; 4) The first module is deployed at a physical implementation boundary. For example, when different NFs are implemented on a single server, a single first module is deployed for that server, providing trusted functionality for all NFs running on the server.

[0161] It should be noted that, depending on the needs of different communication nodes, security function modules deployed at different nodes can implement different security functions. The following uses the first security module as an example. This first security module can serve any communication node or third-party requesting node. Any communication node or third-party requesting node is described using the requesting party as an example.

[0162] It should be understood that the above deployment form is only an example. Whether on the network side, terminal side or application side, the security function module can form the basis of multi-party negotiation and trusted communication with a unified external interface.

[0163] The following describes the three new communication interfaces (referred to as the first interface, the second interface, and the third interface) added to this application.

[0164] First interface: the interface between the first module / second module and the communication node

[0165] Figure 7 shows a schematic diagram of a first interface between the first module / second module and a communication node. The first interface is used by a requester to initiate a request for a first security service, and is also used by the first module / second module to send a response for executing the first security service.

[0166] The requester may be a communication node, or may be the first module or the second module.

[0167] For example, when a communication node needs to perform security services such as encryption, authentication, authorization, trusted proof, privacy protection, or blockchain-related functions, it can initiate a trusted service request and receive a trusted service response through the first interface. The trusted service response typically includes the result of calling a security algorithm or certain security-related parameters of the request.

[0168] When the first module / second module serves the requester, the first interface is also used for the requester to initiate a management and configuration request for the first module / second module, and the first interface is also used for the first module / second module to send a response to the management and configuration of the first module / second module.

[0169] For example, when the UE requires new security capabilities, it may request the first module to manage and configure the first module through the first interface. Specifically, it may request the first module to add a new capability unit so as to provide the new security capabilities.

[0170] For another example, when the access network device cancels a certain security capability, it can request the first module to delete the corresponding capability unit through the first interface. When the communication node cancels all security capabilities, it needs to delete the first module and the second module.

[0171] For another example, when a communication node is initially established, the usage scenario changes, or the security requirements change, it can initiate a network global trusted policy request to the second module through the first interface, requiring the second module to perform situational awareness and generate a network global trusted policy. The second module can collect information from the communication node through the first interface to obtain network-wide situational awareness.

[0172] The first module / second module serving the requesting party can be understood as the first module / second module being deployed inside or outside the communication node.

[0173] Second interface: the interface between the first module and the second module.

[0174] Figure 8 shows a schematic diagram of the second interface between the first module and the second module. The second interface is used to transmit requests and responses for the first security service, and is also used to transmit requests and responses for management and configuration of the first module by the second module.

[0175] For example, the first module and the second module can transmit a trusted policy through the second interface. The trusted policy is the result of trusted negotiation and declares security-related content such as the security algorithms used by the two nodes, enabled security capabilities, and activated trusted roots.

[0176] For another example, the first module and the second module can communicate the global network trust policy through the second interface. The global network trust policy is the network situation awareness result generated by the capability unit of the second module after collecting information from the entire network and providing it to the AI ​​for information analysis and processing.

[0177] Third interface: the interface between the first module and the internal functional units of the second module.

[0178] FIG9 shows a schematic diagram of a third interface between internal functional units of the safety function module.

[0179] It should be understood that the capability units within a security function module may originate from different security vendors. During implementation, equipment vendors may only implement other capability units. Capability units are freely selectable based on operators, applications, and even users. This ensures continuous adherence to the latest security technologies and ensures the advancement of communications network security. Therefore, the interfaces between modules within the trusted function must be open and standardized. Furthermore, standardized internal interfaces facilitate hot-swappability of security functions, enabling real-time, on-demand updates. Network security upgrades require only the security vendor's standardized capability units to be connected to the security function module, making this more convenient and efficient, and facilitating the future addition of other security technologies to the network.

[0180] The function of the third interface will be described in detail with reference to the communication process of the internal functional units of the safety function module shown in FIG10 .

[0181] Step S1010: The interface unit receives a request message from an external entity.

[0182] Step S1020: The interface unit converts the message into a sequential task queue and sends it to the scheduling unit.

[0183] In step S1030 , the scheduling unit calls the specific security algorithm of each logical function according to the sequential task queue.

[0184] Step S1040 : Each capability unit returns the result of the scheduling unit call to the scheduling unit.

[0185] Step S1050: The scheduling unit feeds back the result to the interface unit.

[0186] The interface unit further feeds the results back to external entities or generates new sequential task queues as needed.

[0187] The following specific embodiments are used to describe the technical solution of the present application in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0188] Figure 11 is a schematic diagram of a communication method 1100 applicable to the present application. The method 1100 shown in Figure 11 can be applicable to the systems or architectures shown in Figures 1 to 3. The method 1100 includes the following steps.

[0189] S1110. The requesting party sends a first request message to the first security module.

[0190] In the present application, the requester includes one of a first node, a second node, or a second security module. The first node may be a communication node served by the first security module, the second node may be a communication node served by the second security module, and the second security module and the first security module may be security function modules deployed in different communication nodes in the communication system.

[0191] It should be understood that the first node and the second node may be any communication node or application in the communication system, for example, a terminal device, an access network device, a core network element, or a third-party application. This embodiment of the present application does not limit this.

[0192] It should be understood that when the first security module is the second module deployed on the core network side, it can serve all communication nodes on the core network side. When the first security module is the second module deployed on the access network side, it can serve all communication nodes on the access network side and the UE side.

[0193] There may be multiple ways to trigger the first security module to perform security services or management of the first security module, and the requesting party sending a first request message or sending a first notification message to the first security module are two of the ways.

[0194] In a possible implementation, the requesting party sends a first request message to the first security module, where the first request message is used to request one or more trusted services from the first security module.

[0195] Specifically, the trusted service may be an existing trusted service, or a trusted service that may be added in future communications, or a trusted service required by any communication node or requester.

[0196] Optionally, the first request message may include a trusted service identifier or a trusted service list of multiple trusted services. The trusted service list of multiple trusted services is used to apply for multiple trusted services at one time.

[0197] In a possible implementation, the first request message includes an identity of a trusted service destination node.

[0198] The identity of the trusted service destination node is used to indicate the service object of the trusted service. For example, in the authentication service, the identity of the trusted service destination node is used to indicate the terminal device to be authenticated of the authentication service.

[0199] It should be understood that in the prior art, when a communication node requests a security function, it needs pre-processing results of the communication node, such as calculation of a security algorithm or acquisition of security parameters.

[0200] In this application, when a communication node requests a security service, it can include the identity of the trusted service destination node in the request message. Based on the identity of the trusted service destination node, the security module can determine the trusted policy corresponding to that identity and, using this trusted policy, determine the specific security algorithm and security parameters to be used. The trusted policy specifies the specific security algorithm and security parameters to be invoked.

[0201] Exemplarily, when the requesting party is the first node, the first request message includes the identity of the second node, which is used to indicate the destination node of the trusted service, for example, indicating the party to be authenticated in the authentication service, indicating the prover in the trusted proof service, etc.

[0202] In another possible implementation, the first request message includes a security parameter.

[0203] The security parameters are security parameters input when the security module executes a specific algorithm.

[0204] Exemplarily, when the requesting party is the second security module, the first request message includes security parameters for the first security module to execute a specific security algorithm. For example, when the first security module on the AMF side in the authentication service sends a UE authentication request to the second security module on the terminal side, it carries an authentication vector.

[0205] In another possible implementation, the first request message may not include the identifier and security parameters of the second node.

[0206] Exemplarily, when the requesting party is the second node, the first security module can obtain the security parameters that need to be input into the security algorithm. For example, the input parameters when the first security module executes a specific security algorithm are pre-set or can be directly obtained by the first security module. For example, in a trusted proof service, the blockchain timestamp can be used as a challenge value in the trusted proof service, and the first security module inputs the challenge value as a parameter of the security algorithm.

[0207] It should be understood that when the requesting party is the second node, the data packet header of the first request message already contains the identity indication of the second node, so the first request message may not include the identifier of the second node.

[0208] In another possible implementation, the first request message includes management requirement information of the first node.

[0209] For example, when the requesting party is the first node, the first node may send management requirement information to the first security module. The management requirement information can be understood as the security requirement of the first node. The first security module manages the first security module based on the management requirement information. For example, the first security module may adjust capability units in the first security module or add new capability units to meet the security requirement proposed by the first node.

[0210] In another possible implementation, the first request message includes management target information of the first security module.

[0211] Exemplarily, when the requesting party is the second security module, the second security module can send management target information to the first security module. The management target information can be understood as the goal of managing the first security module, such as the establishment, deletion, status setting of the first security module, or the management of the capability unit in the first security module, as well as the adjustment and update of the configuration file based on the capability unit, etc.

[0212] The management of the capability units in the first security module includes adding, deleting or setting the status of the capability units according to the requirements of the requesting party, so as to meet the security requirements of the requesting party.

[0213] In another possible implementation, the requesting party sends a first notification message to the first security module. The first notification message is used to notify the first security module of a first event. The first event may be a preset trigger event, specifically a status notification of the requesting party. For example, when the requesting party is a UE, the first event may be the UE accessing the access network device.

[0214] In this case, the first security module may pre-set a trusted service list, for example, a pre-set list by an operator, or a default list specified in a standard protocol, or a list generated during the trusted policy negotiation phase. This embodiment of the present application does not limit this.

[0215] In addition to the two methods described above, the first security module can also automatically trigger the execution of the trusted service according to a pre-set period. For example, if the first security module is a security module deployed on the core network side, it can regularly perform trustworthy certification on the access network device or terminal device, or it can regularly authenticate the terminal device. For another example, the first security module can regularly upload log data to the blockchain according to a period. Alternatively, the first security module can also trigger the trusted service based on a pre-set timer. This embodiment of the present application is not limited to this.

[0216] It can be understood that step S1110 is an optional step.

[0217] It should be noted that, before the first security module receives the first request message or the first notification message, the first security module completes a trust negotiation process with the requesting party. Specifically, a trust policy can be determined through the trust negotiation process.

[0218] One possible understanding of the trusted negotiation process is the process by which the first and second security modules involved in the negotiation generate a trusted policy based on the security requirements of the nodes served by the security modules and the security capabilities they can provide. This process occurs before the trusted service process. For more information, refer to 3GPP standard TS33.501.

[0219] The trust policy specifies the specific security algorithms and security parameters to be invoked. For example, authentication between the first and second nodes uses the authentication and key agreement (AKA), trust proof uses the trusted platform module (TPM), and encryption and decryption uses the Advanced Encryption Standard (AES) algorithm. After the trust policy is generated, it is associated with the identity and stored in the first and second security modules. For example, the first security module stores the second node identity and the trust policy for the first and second nodes, while the second security module stores the first node identity and the trust policy for the first and second nodes.

[0220] After receiving the trusted service request message, the first security module locates the trusted policy previously negotiated with the second security module through the second node identity carried in the message, and determines the specific security algorithm to be called and the security parameters to be used.

[0221] S1120: The first security module executes a first security service or manages the first security module based on the first request message.

[0222] The first security module calls a security algorithm, obtains security parameters, or requests at least one of a second security service from the second security module based on the first request message or the first notification message. The first security module performs management of the first security module, including management of the capability unit of the first security module and management of the first security module.

[0223] Specifically, the first security module determines the security algorithm to be called or the security parameters to be obtained according to the trust policy.

[0224] In one possible implementation, the first request message includes an identifier of the second node. The first security module can determine a trusted policy corresponding to the identifier based on the identifier of the second node, and further determine a specific security algorithm and security parameters to be used based on the trusted policy.

[0225] In a possible implementation, the first request message includes a security parameter, and the first security module directly inputs the security parameter into a security algorithm for calculation.

[0226] In a possible implementation, the first request message does not include the identifier or security parameters of the second node. In this case, the first security module may obtain the security parameters or preset the input security parameters in advance.

[0227] In one possible implementation, the first request message includes management requirement information of the first node. The first security module manages the first security module based on the management requirement information, for example, by adjusting capability units in the first security module or adding new capability units to meet the security requirements raised by the first node.

[0228] In one possible implementation, the first request message includes management target information of the first security module, and the first security module manages the first security module based on the management target information, for example, establishing, deleting, or setting the status of the first security module, or managing the capability unit in the first security module, and adjusting and updating the configuration file based on the capability unit.

[0229] It should be understood that if the trusted policy does not include the requested trusted service, the first security module may generate a security service rejection message to reject the trusted service request.

[0230] S1130: The first security module sends a first feedback message to the requesting party.

[0231] The first security module feeds back the execution result of the first security service and the management result of the first security module to the requester through the first feedback message.

[0232] It can be understood that the first feedback message may also be a trusted service rejection message.

[0233] Figure 12 is a schematic diagram of a communication method 1200 applicable to the present application. The first security module internal interface in Figure 12 includes an interface unit, a scheduling unit, and a capability unit. The communication method shown in Figure 12 is a trusted service process for executing a first security service on the first security module internal interface. In other words, the trusted service process can be implemented using method 1100.

[0234] The method 1200 for executing a trusted service using the above functional units specifically includes the following steps.

[0235] S1210 , the requesting party sends a request message # 1 to the interface unit of the first security module.

[0236] The request message #1 is used to request a first security service from the first security module.

[0237] The first secure service may be one or more trusted services.

[0238] The requester may be a communication node, such as a terminal device, an access network device, a core network device, or a third-party requester, or may be a second security module. This embodiment of the present application does not limit this.

[0239] It should be understood that the requester and the first security module may have a binding relationship, that is, the first security module serves the requester, for example, the requester is a terminal device, and the first security module is a functional module deployed on the terminal device; the requester and the first security module may also not have a binding relationship, that is, the first security module serves other devices, for example, the requester is a terminal device, and the first security module is a functional module deployed on an access network device. The requester may also be a second security module, for example, the first security module is a module deployed on a terminal device, and the requester is a module deployed on an access network device. This embodiment of the present application does not limit this.

[0240] When the requester is the first node, the request message #1 includes the identifier of node #2, which is used to indicate the destination node of a trusted service, for example, indicating the party to be authenticated in an authentication service, indicating the attestor in a trusted certification service, etc.

[0241] When the requesting party is the second security module, the request message #1 includes security parameters for the first security module to execute a specific security algorithm.

[0242] S1220: The interface unit generates a first task queue according to the request message #1.

[0243] Specifically, the interface unit determines a specific trusted service according to the request message #1, divides the execution process of the trusted service into multiple tasks in a fine-grained manner, and generates a first task queue, which is used to indicate a sequential queue for executing the multiple tasks.

[0244] S1230: The interface unit sends the first task queue to the scheduling unit.

[0245] S1240: The scheduling unit calls a security algorithm and / or security parameters of a first security service from the capability unit according to the first task queue.

[0246] Specifically, the scheduling unit determines the capability unit to be called according to the first task queue, and the corresponding capability unit executes the trusted algorithm or provides security parameters, and then the capability unit provides the algorithm execution result or the obtained security parameters to the scheduling unit.

[0247] Exemplarily, the scheduling unit determines the corresponding trust policy according to the identifier of node #2, determines the corresponding security parameters and security algorithm through the trust policy, and then schedules the corresponding capability unit to perform algorithm calculation.

[0248] Exemplarily, the scheduling unit inputs a security algorithm according to the security parameters in the request message #1, and then schedules the corresponding capability unit to execute the algorithm calculation.

[0249] S1250, the scheduling unit provides the execution result of the algorithm or the obtained security parameters to the interface unit, and the interface unit generates a feedback message #1 and sends it to the requesting party.

[0250] The feedback message #1 includes the execution result of the trusted service.

[0251] It is understood that the execution result of the feasible service may be the result of running the security algorithm or the security parameter of the request, which is not limited in the embodiment of the present application.

[0252] Figure 13 is a schematic diagram of a communication method 1300 applicable to the present application. The internal functional units of the first security module in Figure 13 include an interface unit, a scheduling unit, and a capability unit, and may also include a management unit. The communication method shown in Figure 13 is a service flow for executing trusted function management via the internal interface of the first security module. In other words, the trusted function management service flow can be implemented using method 1100.

[0253] The method 1300 for executing the trusted function management service using the above functional units specifically includes the following steps.

[0254] S1310: The requesting party sends a request message #2 to the scheduling unit through the interface unit of the first security module.

[0255] The request message #2 is used to request the first security module to manage the trusted function.

[0256] When the requesting party is the first node, request message #2 includes the management requirement information of node #1. This information indicates the security requirements of the first node. The first security module manages the first security module based on the management requirement information. For example, the first security module adjusts the capability units in the first security module or adds new capability units to meet the security requirements of the first node.

[0257] Exemplarily, the management requirement information includes the type of management, a list of security requirements of the requester, etc. This embodiment of the present application does not limit this.

[0258] When the requesting party is the second security module, the request message #1 includes management target information of the first security module, indicating the management target of the first security module, such as the creation, deletion, or status setting of the first security module, or the management of capability units in the first security module, as well as the adjustment and update of configuration files based on the capability units.

[0259] Exemplarily, the management target information includes the name of the specific capability unit to be managed, the ID of the algorithm, etc. This embodiment of the present application does not limit this.

[0260] It should be understood that the requester and the first security module may have a binding relationship, that is, the first security module serves the requester, for example, the requester is a terminal device, and the first security module is a functional module deployed on the terminal device; the requester and the first security module may also not have a binding relationship, that is, the first security module serves other devices, for example, the requester is a terminal device, and the first security module is a functional module deployed on an access network device. The requester may also be a second security module, for example, the first security module is a module deployed on a terminal device, and the requester is a module deployed on an access network device. This embodiment of the present application does not limit this.

[0261] S1320, the scheduling unit sends the request message #2 to the management unit.

[0262] S1330: The management unit manages the capability unit through the scheduling unit according to the request message #2.

[0263] It should be understood that different capability units provide different security services, and the capability units are configured according to the security requirements of the requester.

[0264] Specifically, the management unit determines the security requirements of the requester according to the management requirement information in the request message #2, thereby determining the capability unit to be managed.

[0265] Furthermore, the management unit manages the capability unit through the scheduling unit.

[0266] Exemplarily, the scheduling unit may set the status or attributes of the capability units to be managed, update, add or delete capability units, etc.

[0267] Exemplarily, the scheduling unit may find the capability unit to be managed by the name of the capability unit, the ID of the capability unit, or the address of the capability unit.

[0268] S1340: The management unit modifies the configuration file according to the execution result.

[0269] Specifically, the management unit updates the configuration file according to the management result of the capability unit.

[0270] For example, some capability units are deleted, or some capability units are added.

[0271] S1350: The interface unit generates feedback information #2 according to the management result.

[0272] The management unit sends the management result to the scheduling unit, and the scheduling unit sends the management result to the interface unit.

[0273] The interface unit generates a feedback message #2 and sends it to the requesting party.

[0274] The feedback message #2 includes the execution result of the trusted function management.

[0275] It is understood that the execution result of the trusted function management may be an update result of the capability unit corresponding to the trusted service requested by the requester, which is not limited in the present embodiment.

[0276] Exemplarily, feedback message #2 may be a management response message.

[0277] Figure 14 is a flow chart of an authentication service applicable to the communication method of the present application. The authentication service process shown in Figure 14 can be a type of the first security service in the method shown in Figure 12, that is, the authentication service process can be implemented using method 1200, and specifically, method 1400 includes the following steps.

[0278] In this embodiment, mutual authentication between the core network and the UE is used as an example. Security module #1 serves as the core network security function module, and security module #2 serves as the UE security function module. Specifically, the authentication services are divided into core network authentication of the UE and UE authentication of the core network.

[0279] It should be noted that before the authentication process, the UE, security module #1, and core network security module #2 first execute a trusted policy intelligent negotiation process to obtain a trusted policy, which declares the authentication algorithm to be used.

[0280] The following steps S1410-S1450 are the authentication service process of AMF authenticating UE.

[0281] S1410, AMF sends request message #1 to interface unit #1 of security module #1.

[0282] The request message #1 is used to request authentication service from the security module #1.

[0283] The request message #1 includes the identity of the UE.

[0284] Exemplarily, the request message #1 may be an authentication service request message.

[0285] S1420, interface unit #1 generates task queue #1 according to request message #1.

[0286] Specifically, the interface unit #1 may translate the request message #1 and generate a task queue #1.

[0287] S1430, interface unit #1 sends the task queue #1 to scheduling unit #1.

[0288] Specifically, the interface unit #1 sends the task queue #1 and the UE ID to the scheduling unit #1.

[0289] S1440, the scheduling unit #1 calls the security algorithm of the authentication service from the capability unit #1 according to the task queue #1 to calculate and obtain an authentication response and an authentication vector.

[0290] Specifically, scheduling unit #1 first obtains the authentication parameters corresponding to the UE ID from the trusted root module according to task queue #1; then, according to the provisions of the trusted policy, calls the specific authentication algorithm in the basic cryptographic enabling module, inputs the authentication parameters, calculates the expected response of the core network authentication response (eXpected RESponse, XRES*), and generates an authentication vector AV; the scheduling unit saves the authentication response to the trusted root module and sends the authentication vector to interface unit #1.

[0291] The scheduling unit #1 determines the corresponding trust policy according to the identifier of the node #2, determines the corresponding authentication parameters based on the policy, and inputs the parameters into the authentication algorithm to generate an authentication vector.

[0292] It should be understood that in this application, capability unit #1 includes at least one capability unit, and the core network-side trusted root module #1 and basic cryptographic enablement module #1 are two capability units in capability unit #1. That is, in this embodiment, the scheduling unit calls the two capability units: the trusted root module and the basic cryptographic enablement module.

[0293] The authentication vector can be understood as a set of parameters for the authentication service.

[0294] Exemplarily, the authentication vector may include a random number RAND and an authentication token (AUthentication TokeN, AUTN).

[0295] S1450, scheduling unit #1 sends an authentication vector to interface unit #1, and interface unit #1 generates a request message #2.

[0296] Interface unit #1 sends a request message #2 to security module #2 to initiate an authentication service request. The specific process is shown in (b) of Figure 14. Interface unit #1 obtains an authentication response from interface unit #2 of security module #2.

[0297] It should be noted that, in this application, the authentication between the core network and the UE is used as an example. The information transmission between security module #1 and security module #2 needs to be forwarded between the core network element, the access network device, and the UE. When the two parties performing the authentication are different NFs in the core network, or the access network device and the core network element, or different access network devices, the information transmission between security module #1 and security module #2 does not need to be forwarded between the core network element, the access network device, and the UE. Instead, it can be directly exchanged by the security modules. Subsequent similar steps are similar to this, such as S1460, and will not be repeated here.

[0298] S1460, interface unit #1 receives feedback message #2 from interface unit #2 and sends it to scheduling unit #1.

[0299] After executing the authentication response, the security module #2 sends a feedback message #2 to the interface unit #1 through the interface unit #2. The feedback message #2 includes the UE authentication response RES.

[0300] S1470, scheduling unit #1 performs authentication and generates an authentication result.

[0301] Specifically, the calling unit #1 obtains the previously saved XRES from the trusted root module #1, calls the authentication algorithm of the basic password enabling module #1, inputs RES and XRES, and obtains the authentication result.

[0302] S1480, scheduling unit #1 authenticates the result to interface unit #1, and interface unit #1 generates feedback message #1 and sends it to AMF.

[0303] Feedback message #1 is used to feed back the authentication result to AMF.

[0304] Steps S1450 to S1454 in (b) of Figure 14 below are the process in which the AMF requests the UE to perform UE-side authentication service.

[0305] S1450 , security module #1 sends a request message #2 to security module #2.

[0306] Security module #2 receives request message #2 through interface unit #2.

[0307] The request message #2 is used to request authentication service from the security module #2.

[0308] This request message #2 includes an authentication vector.

[0309] Exemplarily, the request message #2 may be a UE authentication service request message.

[0310] S1451, interface unit #2 generates task queue #2 according to request message #2.

[0311] Specifically, the interface unit #2 may translate the request message #2 and generate a task queue #2.

[0312] S1452, interface unit #2 sends the task queue #2 to scheduling unit #2.

[0313] Specifically, the interface unit #2 sends the task queue #2 and the UE ID to the scheduling unit #2.

[0314] S1453, the scheduling unit #2 obtains the authentication service parameters from the trusted root module #2 according to the task queue #2, calls the security algorithm of the authentication service of the basic cryptographic enabling module #2 to verify the authentication vector and calculate the UE-side authentication response.

[0315] It should be understood that in this application, capability unit #2 includes at least one capability unit, and the trusted root module #2 and basic cryptographic enabling module #2 on the UE side are two capability units in capability unit #2. That is, in this embodiment, scheduling unit #2 calls both the trusted root module #2 and the basic cryptographic enabling module #2.

[0316] Specifically, scheduling unit #2 calls a specific authentication algorithm to verify the authentication vector according to task queue #2 and the provisions of the trusted policy to realize the UE's authentication of the core network; scheduling unit #2 obtains authentication parameters from trusted root module #2; scheduling unit #2 inputs the authentication parameters and the parameters in the received authentication vector into the basic cryptographic enabling module #2, and calculates the UE authentication response, which is used to be sent to the core network for the core network to authenticate the UE.

[0317] Exemplarily, the scheduling unit #2 calls an authentication algorithm to verify the AUTN, thereby enabling the UE to authenticate the network.

[0318] S1464, the scheduling unit #2 sends the UE authentication response to the interface unit #2, the interface unit #2 generates a feedback message #2, and the interface unit #2 sends the feedback message #2 to the security module #1.

[0319] Among them, feedback message #2 includes a UE authentication response, which is used to be sent to the core network for the core network to authenticate the UE.

[0320] According to the above technical solution, communication nodes requiring authentication services can perform the authentication process through the deployed security function modules. Authentication vectors and authentication responses can be exchanged only between the security function modules of the communication nodes, further improving security. This enables independent security services within the communication nodes, enhancing communication security performance.

[0321] Figure 15 is a flow chart of a trusted proof service applicable to the communication method of the present application. The trusted proof service process shown in Figure 15 can be a type of the first security service in the method shown in Figure 12, that is, the trusted proof service process can be implemented using method 1200. Specifically, method 1500 includes the following steps.

[0322] In this embodiment, the trusted proof of a verifier and an attester is used as an example. Both the verifier and the attester can be a UE, a RAN, or a NF. Security module #1 serves as the security function module of the verifier, and security module #2 serves as the security function module of the attester.

[0323] It should be noted that before the trust proof process, security module #1 and security module #2 first execute a trust policy intelligent negotiation process to obtain a trust policy, which declares the trust proof algorithm to be adopted.

[0324] The following steps S1510 to S1590 are the trusted certification service process of the verifier and the attester.

[0325] S1510, the verifier sends a request message #1 to the interface unit #1 of the security module #1.

[0326] The request message #1 is used to request a trusted certification service from the security module #1.

[0327] The request message #1 includes the identifier of the Attester.

[0328] Exemplarily, the request message #1 may be a trusted certification service request message.

[0329] In a possible implementation, the requester may first initiate a trusted proof service request to the verifier.

[0330] In a possible implementation, the trusted attestation process may be directly triggered by a verifier or an attester.

[0331] Exemplarily, the UE carries a verification service request message in a registration request message, requiring the core network to perform trustworthy certification of the UE during the UE access process, or the core network carries a verification service request in a registration response message.

[0332] S1520, interface unit #1 generates task queue #1 according to request message #1.

[0333] Specifically, the interface unit #1 may translate the request message #1 and generate a task queue #1.

[0334] S1530, interface unit #1 sends the task queue #1 to scheduling unit #1.

[0335] Specifically, the interface unit #1 sends the task queue #1 and the Attester ID to the scheduling unit #1.

[0336] S1540 , the scheduling unit # 1 calls the security algorithm of the trusted service from the capability unit # 1 according to the task queue # 1 to calculate and generate a challenge value.

[0337] Specifically, scheduling unit #1 first obtains the trusted proof parameters corresponding to the Attester ID from trusted root module #1 according to task queue #1; then, according to the provisions of the trusted policy, calls the trusted proof algorithm of measurement enabling module #1, inputs the authentication parameters, and calculates and generates the challenge value.

[0338] Among them, the scheduling unit #1 determines the corresponding trust policy according to the Attester's identification, determines the corresponding trust proof parameters through the policy, and inputs the trust proof algorithm to calculate and generate the challenge value.

[0339] It should be understood that in this application, capability unit #1 includes at least one capability unit, and the verifier-side trusted root module #1 and measurement enablement module #1 are two capability units within capability unit #1. That is, in this embodiment, the scheduling unit invokes both trusted root module #1 and measurement enablement module #1.

[0340] S1550, the scheduling unit #1 sends a challenge value to the interface unit #1, and the interface unit #1 generates a request message #2.

[0341] Interface unit #1 initiates a trusted service request to security module #2. The specific process is shown in (b) of Figure 15. Interface unit #1 obtains certification evidence from interface unit #2 of security module #2.

[0342] S1570, interface unit #1 sends certification evidence to scheduling unit #1.

[0343] S1580, the scheduling unit #1 obtains the reference value RV through the capability unit #1, calls the security algorithm of the trusted service from the capability unit #1, compares the proof evidence with the reference value, and obtains a result of the trusted proof.

[0344] Specifically, calling unit #1 obtains reference value RV from trusted root module #1, calls the security algorithm of trusted proof from measurement enabling module #1, compares the proof evidence with the reference value, and obtains the result of trusted proof.

[0345] S1590, the scheduling unit #1 sends the trusted proof result to the interface unit #1, and the interface unit #1 generates a feedback message #1 and sends the feedback message #1 to the verifier. The feedback message #1 includes the trusted proof result of the Attester.

[0346] Security module #1 sends the trusted proof result of node #2 to node #1 via feedback message #1.

[0347] Exemplarily, the feedback message #1 may be a trusted certification service response message.

[0348] The following is the process of security module #1 requesting proof of authentication from security module #2.

[0349] S1561 , security module #1 sends a request message #2 to interface unit #2 of security module #2.

[0350] The request message #2 is used to request the security module #2 for trusted proof evidence.

[0351] The request message #2 includes a challenge value.

[0352] Exemplarily, the request message #2 may be a certification evidence acquisition service request message.

[0353] It should be noted that in this application, the example of trusted proof between core network NFs is used. Information transferred between security module #1 and security module #2 does not require forwarding between core network elements, access network devices, and UEs; instead, security modules #1 and #2 interact directly. When trusted proof is performed between a core network element and a UE, information transferred between security module #1 and security module #2 requires forwarding between the core network element, access network devices, and UEs. Subsequent similar steps, such as S1565, are similar and will not be repeated here.

[0354] S1562, interface unit #2 generates task queue #2 according to request message #2.

[0355] Specifically, the interface unit #2 may translate the request message #2 and generate a task queue #2.

[0356] S1563, interface unit #2 sends the task queue #2 to scheduling unit #2.

[0357] Specifically, the interface unit #2 sends the task queue #2, the Verifier ID, and the challenge value to the scheduling unit #2.

[0358] S1564, scheduling unit #2 calls the security algorithm of the trusted service from capability unit #2 according to task queue #2 to generate proof evidence according to the challenge value.

[0359] Specifically, scheduling unit #2 first obtains trusted proof parameters from trusted root module #2 according to task queue #2; then calls the trusted proof algorithm of measurement enabling module #2 according to the provisions of the trusted policy, inputs the authentication parameters, and calculates and generates the challenge value.

[0360] It should be understood that in this application, capability unit #2 includes at least one capability unit, and the trusted root module #2 and measurement enablement module #2 on the Attester side are two capability units within capability unit #2. That is, in this embodiment, scheduling unit #2 invokes both the trusted root module #2 and the measurement enablement module #2.

[0361] S1565, the scheduling unit #2 sends the certification evidence to the interface unit #2, and the interface unit #2 generates a feedback message #2.

[0362] The feedback message #2 is used to send the generated certification evidence to the security module #1. The certification evidence is used by the security module #1 to determine the trustworthy certification result.

[0363] According to the above technical solution, communication nodes requiring trusted attestation services can execute the trusted attestation process through the deployed security function modules. Attestation evidence, reference values, and challenge values ​​can be exchanged only between the security function modules of the communication nodes, further improving security. This enables independent security services within the communication nodes, enhancing communication security.

[0364] Figure 16 is a flowchart of an authorization service applicable to the communication service of the present application. The authorization service process shown in Figure 16 can be a type of the first security service in the method shown in Figure 12, that is, the authorization service process can be implemented using method 1200, and specifically, method 1600 includes the following steps.

[0365] In this embodiment, the authorization service process is as follows: the NF Service Consumer initiates a token application service to the Security Module #1 of the Authorization Server (step shown in (a) of Figure 16 ), and the NF Service Producer verifies the token service (step shown in (b) of Figure 16 ). AuthServer, Consumer, and Producer can all be NFs. Among them, Security Module #1 serves as the security function module of the AuthServer, Security Module #2 serves as the security function module of the NF Service Consumer, and Security Module #3 serves as the security function module of the NF Service Producer.

[0366] Steps S1610-S1691 are the process of obtaining and saving the access token.

[0367] It should be noted that before the authorization service process, security module #1 and security module #2 first execute a trusted policy intelligent negotiation process to obtain a trusted policy, which declares the adopted authorization service algorithm.

[0368] S1610, NF Service Consumer sends request message #1 to interface unit #2 of security module #2.

[0369] The request message #1 is used to request authorization service from the security module #2.

[0370] The request message #1 includes the identifier of the NF Service Producer and the service name, where the service name refers to the name of the service requested by the NF Service Consumer to the NF Service Producer.

[0371] Exemplarily, the request message #1 may be an access token application request message.

[0372] S1620: Interface unit #2 sends request message #2 to interface unit #1 of security module #1.

[0373] The request message #2 is used to request authorization service from the security module #1.

[0374] The request message #2 includes the identifier of the NF Service Producer and the service name.

[0375] Exemplarily, the request message #2 may be an access token generation request message.

[0376] It should be noted that, in this application, the authorization service between core network NFs is used as an example. Information transmission between security module #1 and security module #2 does not require forwarding between core network elements, access network devices, and UEs; instead, security modules #1 and #2 interact directly. When authorization is performed between a core network element and a UE, information transmission between security module #1 and security module #2 requires forwarding between the core network element, access network devices, and UEs. Subsequent similar steps, such as S1660, are similar and will not be repeated here.

[0377] S1630, interface unit #1 generates task queue #1 according to request message #2.

[0378] Specifically, the interface unit #1 may translate the request message #2 and generate a task queue #1.

[0379] S1640: Interface unit #1 sends task queue #1 to scheduling unit #1.

[0380] Specifically, interface unit #1 sends the identifiers of task queue #1 and NF Service Producer to scheduling unit #1.

[0381] S1650 , scheduling unit # 1 generates an access token by calculating a security algorithm of the authorization service called from capability unit # 1 according to task queue # 1 .

[0382] Specifically, scheduling unit #1 first obtains the authorization service security parameters corresponding to the NF Service Producer ID from trusted root module #1 according to task queue #1; then, according to the provisions of the trusted policy, calls the authorization service security algorithm of authorization module #1 to calculate and generate an access token.

[0383] Specifically, scheduling unit #1 determines the corresponding trusted policy based on the identifier of the NF Service Producer, determines the corresponding authorization service security parameters based on the trusted policy, and inputs the authorization algorithm to generate an access token.

[0384] It should be understood that Capability Unit #1 in this application includes at least one capability unit, and the Trusted Root Module #1 and Authorization Module #1 on the AuthServer side are two capability units in Capability Unit #1. That is, in this embodiment, Scheduling Unit #1 calls both Trusted Root Module #1 and Authorization Module #1.

[0385] S1660, scheduling unit #1 sends the access token to interface unit #1, interface unit #1 generates feedback message #2, and sends feedback message #2 to interface unit #2.

[0386] The feedback message #2 is used to send the generated access token to the interface unit #2.

[0387] The feedback message #2 includes the access token.

[0388] Exemplarily, the feedback message #2 may be an access token generation response message.

[0389] S1670, interface unit #2 sends an access token to scheduling unit #2.

[0390] For example, the access token may be sent via a token save request message.

[0391] S1680: Scheduling unit #2 saves the access token to capability unit #2.

[0392] Specifically, the scheduling unit #2 saves the access token to the trusted root module #2.

[0393] It should be understood that Capability Unit #2 in this application includes at least one capability unit, and the Trusted Root Module #2 and Authorization Module #2 on the NF Service Consumer side are two capability units within Capability Unit #2. That is, in this embodiment, Scheduling Unit #2 invokes both Trusted Root Module #2 and Authorization Module #2.

[0394] S1690, the scheduling unit #2 sends the access token to the interface unit #2, and the interface unit #2 generates a feedback message #1 and sends the feedback message #1 to the security module #1.

[0395] The feedback message #1 is used to feedback the result of access token acquisition to NF Service Consumer.

[0396] The feedback message #1 includes the service name and the ID of the NF Service Producer.

[0397] Exemplarily, the feedback message #1 may be an access token response message.

[0398] The following steps S1691-S1697 are the verification service process of the access token.

[0399] It should be noted that before the authorization service process, security module #3 and security module #2 first execute a trusted policy intelligent negotiation process to obtain a trusted policy, which declares the adopted authorization service algorithm.

[0400] S1691, NF Service Consumer sends request message #3 to NF Service Producer.

[0401] Specifically, the request message #3 is used to request a communication service from the NF Service Producer. The request message #3 includes the name of the requested communication service. This step of the NF Service Producer can be understood as a trigger condition for the following trusted service.

[0402] S1692, NF Service Producer sends request message #4 to interface unit #3 of security module #3.

[0403] The request message #4 is used to request authorization service from the security module #3.

[0404] It can be understood that the NF Service Producer initiates an access token verification service request to the security module #3, that is, the service requested by the above request message #4.

[0405] The request message #4 includes the identifier of the NF Service Consumer.

[0406] Exemplarily, the request message #4 may be an access token verification request message.

[0407] S1693, interface unit #3 generates task queue #2 according to request message #4.

[0408] Specifically, the interface unit #3 may translate the request message #4 and generate a task queue #2.

[0409] S1694 , the interface unit # 3 may obtain the access token generated by the security module # 2 by requesting the access token from the security module # 2 .

[0410] Specifically, interface unit #3 sends a token acquisition request message to security module #2, which includes the communication service name. Security module #2 performs authorization service to obtain an access token based on the request message, and feeds back the obtained access token to security module #3 through a feedback message.

[0411] S1695, interface unit #3 sends the task queue #2 and the obtained access token to scheduling unit #3.

[0412] Specifically, the interface unit #3 sends the task queue #2 and the NF Service consumer ID to the scheduling unit #3.

[0413] S1696, the scheduling unit #3 calls the security algorithm of the authorization service from the capability unit #3 according to the task queue #2 to verify the access token.

[0414] Specifically, scheduling unit #3 first obtains the parameters corresponding to the NF Service Producer ID from trusted root module #3 according to task queue #2; then calls the authorization service algorithm of authorization module #3 to verify the access token according to the provisions of the trusted policy.

[0415] It should be understood that Capability Unit #3 in this application includes at least one capability unit, and the Trusted Root Module #2 and Authorization Module #2 on the NF Service Producer side are two capability units within Capability Unit #2. That is, in this embodiment, Scheduling Unit #2 invokes both Trusted Root Module #2 and Authorization Module #2.

[0416] S1697, the scheduling unit #3 sends the result of the access token to the interface unit #3, and the interface unit #3 generates a feedback message #3 and sends the feedback message #3 to the NF Service Producer.

[0417] This feedback message is used to send the access token verification result to the NF Service Producer.

[0418] According to the above technical solution, communication nodes requiring network authorization services can execute the authorization service process through the deployed security function modules. Access tokens can only be exchanged between the security function modules of the communication nodes, further improving security. This enables independent security services in the communication nodes, improving the security performance of communications.

[0419] Figure 17 is a flow chart of an encryption and decryption service applicable to the communication method of the present application. The encryption and decryption service process shown in Figure 17 can be a type of the first security service in the method shown in Figure 12, that is, the encryption and decryption service process can be implemented using method 1200. Specifically, method 1700 includes the following steps.

[0420] In this embodiment, the UE performs encryption services and the access network device performs decryption services as an example for description, wherein security module #1 serves as the security function module of the UE and security module #2 serves as the security function module of the access network device.

[0421] It should be noted that before performing encryption and decryption services, the UE and the access network device first perform a trusted policy intelligent negotiation process to obtain a trusted policy, which declares the encryption algorithm or decryption algorithm to be used.

[0422] In this embodiment, FIG17(a) is an encryption process, and FIG17(b) is a decryption process.

[0423] The specific steps of the encryption process shown in (a) of Figure 17 are as follows.

[0424] S1710, the UE sends a request message #1 to the interface unit #1 of the security module #1.

[0425] The request message #1 is used to request encryption service from the security module #1.

[0426] The request message #1 includes a plaintext message to be encrypted.

[0427] Exemplarily, the request message #1 may be an encrypted service request message.

[0428] S1720, interface unit #1 generates task queue #1 according to request message #1.

[0429] Specifically, the interface unit #1 may translate the request message #1 and generate a task queue #1.

[0430] S1730: Interface unit #1 sends task queue #1 to scheduling unit #1.

[0431] Specifically, the interface unit #1 sends the task queue #1 and the plaintext message to the scheduling unit #1.

[0432] S1740, scheduling unit #1 calls the security algorithm of the encryption service from capability unit #1 according to task queue #1 to perform encryption to obtain ciphertext.

[0433] Specifically, scheduling unit #1 first obtains the encryption key from trusted root module #1 according to task queue #1, calls the encryption algorithm of encryption module #1 according to the provisions of the trusted policy, inputs the plaintext message and encryption key, and calculates the ciphertext message.

[0434] Specifically, scheduling unit #1 determines the identity of the UE according to request message #1, determines the corresponding trust policy according to the identity, determines the encryption key according to the trust policy, and inputs the encryption key and the plaintext message into the encryption algorithm to generate a ciphertext message.

[0435] The request message #1 may include the identity of the UE, or the message header of the request message #1 may contain the identity of the UE, which is not limited in this application.

[0436] It should be understood that in this application, capability unit #1 includes at least one capability unit, and the trusted root module #1 and encryption module #1 on the terminal side are two capability units in capability unit #1. That is, in this embodiment, scheduling unit #1 calls both trusted root module #1 and encryption module #1.

[0437] S1750, the scheduling unit #1 sends a ciphertext message to the interface unit #1, and the interface unit #1 generates a feedback message #1 and sends the feedback message #1 to the UE.

[0438] The feedback message #1 is used to feed back the encryption result to the UE, that is, to feed back the ciphertext message.

[0439] The feedback message #1 includes a ciphertext message.

[0440] Exemplarily, the feedback message #1 may be an encrypted service response message.

[0441] The above steps S1710-S1750 are a process in which the UE requests encryption from the security function module deployed in the UE.

[0442] The following describes the process of decryption performed by the access network device through the security function module deployed on the access network device.

[0443] The specific steps of the decryption process shown in (b) of Figure 17 are as follows.

[0444] S1760: The access network device sends a request message #2 to the interface unit #2 of the security module #2.

[0445] The request message #2 is used to request a decryption service from the security module #2.

[0446] The request message #2 includes the ciphertext message to be decrypted.

[0447] Exemplarily, the request message #2 may be a decryption service request message.

[0448] S1770, interface unit #2 generates task queue #2 according to request message #2.

[0449] Specifically, the interface unit #2 may translate the request message #2 and generate a task queue #2.

[0450] S1780: Interface unit #2 sends task queue #2 to scheduling unit #2.

[0451] Specifically, interface unit #2 sends task queue #2 and the encrypted message to scheduling unit #2.

[0452] S1790, scheduling unit #2 calls the security algorithm of the decryption service from capability unit #2 according to task queue #2 to perform decryption to obtain plain text.

[0453] Specifically, scheduling unit #2 first obtains the decryption key from trusted root module #2 according to task queue #2, calls the decryption algorithm of decryption module #2 according to the provisions of the trusted policy, inputs the ciphertext message and decryption key, and calculates the plaintext message.

[0454] Specifically, scheduling unit #2 determines the identity of the access network device based on request message #2, determines the corresponding trust policy based on the identity, determines the decryption key based on the trust policy, and inputs the decryption key and the ciphertext message into the decryption algorithm to generate a plaintext message.

[0455] The request message #2 may include the identity of the access network device, or the message header of the request message #2 may contain the identity of the access network device, which is not limited in this application.

[0456] It should be understood that in this application, capability unit #2 includes at least one capability unit, and the trusted root module #2 and encryption module #2 on the access network side are two capability units in capability unit #2. That is, in this embodiment, scheduling unit #2 calls both the trusted root module #2 and the decryption module #2.

[0457] S1791, scheduling unit #2 sends a plaintext message to interface unit #2, interface unit #2 generates feedback message #2 and sends feedback message #2 to UE.

[0458] The feedback message #2 is used to feed back the decryption result to the access network device, that is, to feed back a plaintext message.

[0459] The feedback message #2 includes a plain text message.

[0460] Exemplarily, the feedback message #2 may be a decryption service response message.

[0461] It should be understood that the above-mentioned encryption process and decryption process are only exemplary illustrations, and the encryption and decryption service processes can be implemented through the deployed security function modules between any communication nodes. In addition, the encryption service and decryption service are independently executed according to business needs, and the embodiments of the present application do not limit this.

[0462] In a possible implementation, the security function module is integrated with the communication node. For example, the security function module is deployed together with the access network device in the form of a security component, an encryption card, or a decryption card.

[0463] In one possible implementation, the access network device may be divided into a CU unit and a DU unit. In this case, the security function module may be deployed in the CU unit, the DU unit, or both the CU unit and the DU unit.

[0464] If the security function module is deployed on both the CU unit and the DU unit, the encryption and decryption service process is the same as the process in Figure 8 above.

[0465] If the security function module is only deployed on the CU unit, the encryption process is initiated by the CU unit and implemented on the corresponding security function module to obtain the ciphertext message; the decryption process is directly performed by the DU unit.

[0466] According to the above technical solution, communication nodes that need encryption and decryption services can perform encryption and decryption processes through the deployed security function module, thereby improving security. This enables independent security services in communication nodes and improves the security performance of communications.

[0467] Figure 18 is a flow chart of a blockchain data upload or download service applicable to the present application. The data upload service or download service process shown in Figure 18 can be a type of the first security service in the method shown in Figure 12. That is, the blockchain data upload or download service process can be implemented using method 1200. Specifically, method 1800 includes the following steps.

[0468] In this embodiment, the NF that needs to upload data to the blockchain or download data from the blockchain can request data upload service or download service from the security function module of the core network. Security module #1 serves as the security function module of the core network device.

[0469] In this embodiment, FIG18( a ) is a process for uploading blockchain data, and FIG18( b ) is a process for downloading data from the blockchain.

[0470] The specific steps of the blockchain data upload service shown in (a) of Figure 18 are as follows.

[0471] S1810, NF sends request message #1 to interface unit #1 of security module #1.

[0472] Among them, the request message #1 is used to request security module #1 to upload data to the blockchain.

[0473] The request message #1 includes the data to be uploaded.

[0474] Exemplarily, the request message #1 may be a blockchain data upload request message.

[0475] It is understandable that the NF may be the NF that needs to upload data to the blockchain.

[0476] S1820, interface unit #1 generates task queue #1 according to request message #1.

[0477] Specifically, the interface unit #1 may translate the request message #1 and generate a task queue #1.

[0478] S1830, interface unit #1 sends the task queue #1 to scheduling unit #1.

[0479] Specifically, the interface unit #1 sends the task queue #1 and the data to be uploaded to the scheduling unit #1.

[0480] S1840 , scheduling unit # 1 calls a security algorithm from capability unit # 1 according to task queue # 1 to process the data to be uploaded.

[0481] Specifically, scheduling unit #1 first calls a specific security algorithm based on task queue #1 to verify whether NF has the authority to upload data to the blockchain. Then, according to the provisions of the trust policy, it calls a specific security algorithm, inputs the data to be uploaded, and packages it into the ledger data format for processing.

[0482] Optionally, scheduling unit #1 may also call encryption and integrity protection algorithms to further process the data.

[0483] S1850, scheduling unit #1 uploads the processed data to the blockchain through interface unit #1.

[0484] S1860, interface unit #1 sends feedback message #1 to NF.

[0485] The feedback message #1 is used to feed back the data upload result to node #1.

[0486] Exemplarily, the feedback message #1 may be a blockchain upload data response message.

[0487] The above steps S1810-S1860 are the service process in which the NF network element requests the security function module deployed in the core network to upload data to the blockchain.

[0488] The following describes the service process in which the NF network element requests to download data from the blockchain through the security function module deployed in the core network.

[0489] The specific steps of the service for downloading data from the blockchain shown in FIG18( b ) are as follows.

[0490] S1870: NF sends request message #2 to interface unit #1 of security module #1.

[0491] The request message #2 is used to request the security module #1 to download data from the blockchain.

[0492] The request message #2 includes information indicating the data to be downloaded from the blockchain.

[0493] Exemplarily, the indicative information of the data may be a data name, a data type, a data identifier, etc.

[0494] Exemplarily, the request message #2 may be a blockchain data download request message.

[0495] S1880, interface unit #1 generates task queue #2 according to request message #2.

[0496] Specifically, the interface unit #1 may translate the request message #2 and generate a task queue #2.

[0497] S1890, interface unit #1 sends the task queue #2 to scheduling unit #1.

[0498] Specifically, the interface unit #1 sends the task queue #2 and the data to be uploaded to the scheduling unit #1.

[0499] S1891, scheduling unit #1 calls the security algorithm from capability unit #1 according to task queue #2 to download the requested data from the blockchain.

[0500] Specifically, scheduling unit #1 first calls a specific security algorithm to verify whether NF has the authority to download data from the blockchain according to task queue #2, and then calls a specific security algorithm to download the requested data from the blockchain according to the provisions of the trust policy.

[0501] S1892, scheduling unit #1 downloads the requested data from the blockchain through interface unit #1.

[0502] S1893, interface unit #1 sends feedback message #2 to NF.

[0503] The feedback message #2 is used to feed back the data download result to node #1.

[0504] The feedback message includes the downloaded data or indicates whether the data download fails or succeeds.

[0505] Exemplarily, the feedback message #2 may be a response message for downloading data from the blockchain.

[0506] According to the above technical solution, communication nodes that require blockchain data upload or download services can execute the data upload or download service process through the deployed security function module. The security function module independently performs data processing such as permission authentication and data format conversion, thereby improving security. This enables independent security services in communication nodes and improves the security performance of communications.

[0507] The method provided in the embodiment of the present application is described in detail above with reference to Figures 11 to 18. Below, the apparatus provided in the embodiment of the present application is described in detail with reference to Figures 19 and 20. It should be understood that the description of the apparatus embodiment corresponds to the description of the method embodiment. Therefore, for matters not described in detail, reference can be made to the method embodiment above, and for the sake of brevity, no further description will be given here.

[0508] Figure 19 is a schematic block diagram of a communication device provided in an embodiment of the present application. The communication device 1900 shown in Figure 19 includes an interface unit 1910 and a processing unit 1920. The interface unit 1910 can communicate with the outside world, and the processing unit 1920 is used to process data. The interface unit 1910 can also be referred to as a communication interface or a communication unit.

[0509] Optionally, the interface unit 1910 may include a sending unit and a receiving unit. The sending unit is configured to perform the sending operation in the above method embodiment. The receiving unit is configured to perform the receiving operation in the above method embodiment.

[0510] It should be noted that the communication device 1900 may include a sending unit but not a receiving unit. Alternatively, the communication device 1900 may include a receiving unit but not a sending unit. The specific implementation depends on whether the above solution executed by the communication device 1900 includes a sending action and a receiving action.

[0511] Optionally, the communication device 1900 may further include a storage unit, which may be used to store instructions and / or data, and the processing unit 1920 may read the instructions and / or data in the storage unit.

[0512] In one design, the communication device 1900 may be used to execute the actions performed by the first security module in the above method embodiment.

[0513] Optionally, the communication device 1900 can perform the actions performed by the first security module in the above method embodiment. The first security module can be a security function unit, module, or device, or a chip or circuit in a security function unit, module, or device, or a logic module or software that can implement all or part of the functions of the security function unit, module, or device, and this application does not limit this.

[0514] Optionally, the communication device 1900 may be a first security module, the interface unit 1910 is configured to execute the receiving or sending operations of the first security module in the above method embodiment, and the processing unit 1920 is configured to execute the internal processing operations of the first security module in the above method embodiment.

[0515] Optionally, the communication device 1900 may be a device including a first security module. Alternatively, the communication device 1900 may be a component configured within the first security module, such as a chip within the first security module. In this case, the interface unit 1910 may be an interface circuit, a pin, etc. Specifically, the interface circuit may include an input circuit and an output circuit, and the processing unit 1920 may include a processing circuit.

[0516] In one possible implementation, the processing unit 1920 is used to: execute a first security service or perform management of a first security module based on a first request message sent by the requester, the first security service is used to call security capabilities, the requester includes a first node, a second node or a second security module, the first security module is a module serving the first node, and the second security module is a module serving the second node; the interface unit 1910 is used to: send a first feedback message to the requester, the first feedback message is used to feedback the execution result of the first security service or the management result of the first security module to the requester.

[0517] In a possible implementation, the requester is the first node, and the first request message includes the identity of the second node or the management requirement information of the first node.

[0518] In a possible implementation, the requester is the second security module, and the first request message includes security parameters or management target information of the first security module.

[0519] In one possible implementation, the first security module includes a first module and / or a second module, the first module is used to call a security algorithm, obtain security parameters, or request at least one of a second security service from the second security module, and the second module is used to perform management of the first security service or management of the first module.

[0520] In one possible implementation, the processing unit 1920 includes a scheduling unit and a capability unit, the first request message includes the identity of the second node, and the scheduling unit is used to call the security algorithm of the first security service and / or obtain the parameters of the first security service through the capability unit according to the first request message.

[0521] In one possible implementation, the processing unit 1920 also includes a capability unit, and the interface unit is further used to receive a first request message from the requester, where the first request message includes the first security service requested by the requester; the interface unit is further used to generate a first task queue based on the first request message and send the first task queue to the scheduling unit; the scheduling unit is specifically used to call the security algorithm of the first security service and / or obtain the parameters of the first security service through the capability unit based on the first task queue; the scheduling unit is also used to send the execution result to the interface unit.

[0522] In one possible implementation, the processing unit 1920 includes a scheduling unit, a management unit and a capability unit. The first request message includes management requirement information of the first node or management target information of the first security module. The management unit is specifically used to perform management of the capability unit through the scheduling unit according to the first request message.

[0523] In one possible implementation, the interface unit 1910 is also used to receive a first request message from the requester and send it to the scheduling unit, where the first request message includes the management request information sent by the requester; the scheduling unit is also used to send the first request message to the management unit; the management unit is also used to perform management of the capability unit through the scheduling unit based on the first request message; the management unit is also used to modify the configuration file and send a management response message to the interface unit through the scheduling unit; the interface unit is also used to send a management response message to the requester, and the management response message is used to feedback the management result of the management request to the requester.

[0524] In a possible implementation, when the first module serves the requester, the requester is a terminal device, and the first module is deployed inside the requester, or the first module is deployed outside the requester.

[0525] In one possible implementation, when the first module and / or the second module serves the requester, the requester is an access network device, and the first module and / or the second module is deployed within the requester, or the first module and / or the second module is deployed outside the requester.

[0526] In a possible implementation, when the first module and / or the second module serves the requester, the requester is a core network device, and the first module and the second module are deployed in a network function manner of the core network.

[0527] In one possible implementation, the first security module communicates with the requester through a first interface. The first interface is used by the requester to initiate a request for the first security service, and the first interface is also used by the first security module to send a response to execute the first security service; when the first security module serves the requester, the first interface is also used by the requester to initiate a request for management and configuration of the first security module, and the first interface is also used by the first security module to send a response to the management and configuration of the first security module.

[0528] In one possible implementation, the second module communicates with the first module through a second interface, and the second interface is used to transmit requests and responses for the first security service. The second interface is also used to transmit requests and responses for management and configuration of the first module by the second module.

[0529] Optionally, the communication device 1900 can perform the actions performed by the requesting party in the above method embodiment. The requesting party can be a terminal device, a network device, or a security module (a second security module), or a chip or circuit in the terminal device, network device, or security module, or a logic module or software that can implement all or part of the functions of the terminal device, network device, or security module. This application does not limit this.

[0530] Optionally, the communication device 1900 may be a requester, the interface unit 1910 is used to perform the receiving or sending operations of the requester in the above method embodiment, and the processing unit 1920 is used to perform the internal processing operations of the requester in the above method embodiment.

[0531] Alternatively, the communication device 1900 may be a device including a requester. Alternatively, the communication device 1900 may be a component configured in the requester, such as a chip in the requester. In this case, the interface unit 1910 may be an interface circuit, a pin, etc. Specifically, the interface circuit may include an input circuit and an output circuit, and the processing unit 1920 may include a processing circuit.

[0532] In one possible implementation, the interface unit 1910 is used to: send a first request message to the first security module, the first request message is used to request the first security module to execute a first security service or perform management of the first security module, the first security service is used to call security capabilities, the requester includes a first node, a second node or a second security module, the first security module is a module serving the first node, and the second security module is a module serving the second node; the interface unit 1910 is also used to: receive a first feedback message from the first security module, the first feedback message is used to feedback the execution result of the first security service or the management result of the first security module to the requester.

[0533] In a possible implementation, the requester is the first node, and the first request message includes the identity of the second node or the management requirement information of the first node.

[0534] In a possible implementation, the requester is the second security module, and the first request message includes security parameters or management target information of the first security module.

[0535] As shown in Figure 20, an embodiment of the present application further provides a communication device 2000. The communication device 2000 includes a processor 2010, which is coupled to a memory 2020. The memory 2020 is used to store computer programs or instructions and / or data. The processor 2010 is used to execute the computer programs or instructions and / or data stored in the memory 2020, so that the method in the above method embodiment is executed.

[0536] Optionally, the communication device 2000 includes one or more processors 2010.

[0537] Optionally, as shown in FIG20 , the communication device 2000 may further include a memory 2020 .

[0538] Optionally, the communication device 2000 may include one or more memories 2020 .

[0539] Optionally, the memory 2020 may be integrated with the processor 2010 or provided separately.

[0540] Optionally, as shown in Figure 20, the communication device 2000 may further include a transceiver 2030 and / or a communication interface, where the transceiver 2030 and / or the communication interface are used to receive and / or transmit signals. For example, the processor 2010 is used to control the transceiver 2030 and / or the communication interface to receive and / or transmit signals.

[0541] Alternatively, the device in transceiver 2030 that implements the receiving function may be considered a receiving module, and the device in transceiver 2030 that implements the transmitting function may be considered a transmitting module. That is, transceiver 2030 includes a receiver and a transmitter. A transceiver may also be sometimes referred to as a transceiver, a transceiver module, or a transceiver circuit. A receiver may also be sometimes referred to as a receiver, a receiving module, or a receiving circuit. A transmitter may also be sometimes referred to as a transmitter, a transmitter, a transmitting module, or a transmitting circuit.

[0542] As a solution, the communication device 2000 is used to implement the operations performed by the first security module in the above method embodiment. For example, the processor 2010 is used to implement the operations performed internally by the first security module in the above method embodiment (e.g., the operation of S1120), and the transceiver 2030 is used to implement the receiving or sending operations (e.g., the operations of S1110 or S1130) performed by the first security module in the above method embodiment.

[0543] As another solution, the communication device 2000 is used to implement the operations performed by the requesting party in the above method embodiments. For example, the transceiver 2030 is used to implement the receiving or sending operations (such as the operations of S1110 or S1130) performed by the requesting party in the above method embodiments.

[0544] It should be noted that the above-mentioned method embodiments of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-mentioned method embodiments can be completed by hardware integrated logic circuits in the processor or by software instructions. The above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0545] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0546] It should be understood that the term "and / or" in this document simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0547] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0548] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0549] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0550] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0551] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0552] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0553] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0554] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A communication method, characterized in that: include: The first security module executes a first security service or manages the first security module based on a first request message sent by a requester, where the first security service is used to invoke a security capability. The requester includes a first node, a second node, or a second security module. The first security module is a module serving the first node, and the second security module is a module serving the second node. The first security module sends a first feedback message to the requester, where the first feedback message is used to feed back to the requester an execution result of the first security service or a management result of the first security module.

2. The method according to claim 1, characterized in that The requesting party is the first node, and the first request message includes the identity of the second node or the management requirement information of the first node.

3. The method according to claim 1, characterized in that The requesting party is the second security module, and the first request message includes security parameters or management target information of the first security module.

4. The method according to any one of claims 1 to 3, characterized in that The first security module includes a first module and / or a second module, the first module is used to call a security algorithm, obtain security parameters or request at least one of a second security service from a second security module, and the second module is used to perform management of the first security service or management of the first module.

5. The method according to claim 1 or 2, characterized in that The first security module includes a scheduling unit and a capability unit, the first request message includes an identity of the second node, and the first security module performs the first security service, including: The scheduling unit calls the security algorithm of the first security service and / or obtains the parameters of the first security service through the capability unit according to the first request message.

6. The method according to claim 5, characterized in that The first security module further includes an interface unit, and the method further includes: The interface unit receives the first request message from the requester, where the first request message includes a first security service requested by the requester; The interface unit generates a first task queue according to the first request message and sends the first task queue to the scheduling unit; The scheduling unit calls the security algorithm of the first security service and / or obtains the parameters of the first security service through the capability unit according to the first task queue; The scheduling unit sends the execution result to the interface unit.

7. The method according to any one of claims 1 to 3, characterized in that The first security module includes a scheduling unit, a management unit, and a capability unit. The first request message includes management requirement information of the first node or management target information of the first security module. The first security module performs management of the first security module, including: The management unit manages the capability unit through the scheduling unit according to the first request message.

8. The method according to claim 7, characterized in that The first security module further includes an interface unit, and the method further includes: The interface unit receives the first request message from the requesting party and sends the message to the scheduling unit; The scheduling unit sends the first request message to the management unit; The management unit performs management of the capability unit through the scheduling unit based on the first request message; The management unit modifies the configuration file and sends a management response message to the interface unit through the scheduling unit; The interface unit sends the management response message to the requester, where the management response message is used to feed back a management result of the management request to the requester.

9. The method according to any one of claims 1 to 4, characterized in that When the first module serves the requester, the requester is a terminal device, and the first module is deployed inside the requester, or the first module is deployed outside the requester.

10. The method according to any one of claims 1 to 4, characterized in that When the first module and / or the second module serves the requester, the requester is an access network device, the first module and / or the second module is deployed within the requester, or the first module and / or the second module is deployed outside the requester.

11. The method according to any one of claims 1 to 4, characterized in that When the first module and / or the second module serves the requester, the requester is a core network device, and the first module and the second module are deployed in a core network network function manner.

12. The method according to any one of claims 1 to 4, characterized in that The first security module communicates with the requester via a first interface, the first interface being used by the requester to initiate a request for the first security service, and the first interface being used by the first security module to send a response for executing the first security service; When the first security module serves the requester, the first interface is further used for the requester to initiate a management and configuration request for the first security module, and the first interface is further used for the first security module to send a response to the management and configuration of the first security module.

13. The method according to any one of claims 1 to 4, characterized in that The second module communicates with the first module via a second interface, and the second interface is used to transmit requests and responses for the first security service. The second interface is also used to transmit requests and responses for the second module to manage and configure the first module.

14. A communication method, characterized in that: include: A requesting party sends a first request message to a first security module, where the first request message is used to request the first security module to execute a first security service or to manage the first security module, where the first security service is used to invoke a security capability. The requesting party includes a first node, a second node, or a second security module. The first security module is a module serving the first node, and the second security module is a module serving the second node. The requesting party receives a first feedback message from the first security module, where the first feedback message is used to feed back an execution result of the first security service or a management result of the first security module to the requesting party.

15. The method according to claim 14, characterized in that The requesting party is the first node, and the first request message includes the identity of the second node or the management requirement information of the first node.

16. The method according to claim 14, characterized in that The requesting party is the second security module, and the first request message includes security parameters or management target information of the first security module.

17. A communication device, characterized in that: include: a processing unit, configured to execute a first security service or manage a first security module based on a first request message sent by a requester, where the first security service is used to invoke a security capability, the requester includes a first node, a second node, or a second security module, the first security module is a module serving the first node, and the second security module is a module serving the second node; The interface unit is configured to send a first feedback message to the requesting party, where the first feedback message is used to feed back an execution result of the first security service or a management result of the first security module to the requesting party.

18. The device according to claim 17, characterized in that The requesting party is the first node, and the first request message includes the identity of the second node or the management requirement information of the first node.

19. The device according to claim 17, characterized in that The requesting party is the second security module, and the first request message includes security parameters or management target information of the first security module.

20. The communication device according to any one of claims 17 to 19, characterized in that: The first security module includes a first module and / or a second module, the first module is used to call a security algorithm, obtain security parameters or request at least one of a second security service from a second security module, and the second module is used to perform management of the first security service or management of the first module.

21. The communication device according to claim 17 or 18, characterized in that The processing unit includes a scheduling unit and a capability unit. The first request message includes the identity of the second node. The scheduling unit is used to call the security algorithm of the first security service and / or obtain the parameters of the first security service through the capability unit according to the first request message.

22. The communication device according to claim 21, wherein: The processing unit also includes a capability unit, and the interface unit is further used to receive the first request message from the requester, where the first request message includes the first security service requested by the requester; the interface unit is also used to generate a first task queue based on the first request message and send the first task queue to the scheduling unit; the scheduling unit is specifically used to call the security algorithm of the first security service and / or obtain the parameters of the first security service through the capability unit based on the first task queue; the scheduling unit is also used to send the execution result to the interface unit.

23. The communication device according to any one of claims 17 to 19, characterized in that: The processing unit includes a scheduling unit, a management unit and a capability unit. The first request message includes management requirement information of the first node or management target information of the first security module. The management unit is specifically used to perform management of the capability unit through the scheduling unit according to the first request message.

24. The communication device according to claim 23, wherein: The interface unit is further configured to receive the first request message from the requesting party and send it to the scheduling unit; the scheduling unit is further configured to send the first request message to the management unit; the management unit is further configured to perform management of the capability unit through the scheduling unit based on the first request message; the management unit is further configured to modify the configuration file and send a management response message to the interface unit through the scheduling unit; the interface unit is further configured to send the management response message to the requesting party, and the management response message is configured to feedback the management result of the management request to the requesting party.

25. The communication device according to any one of claims 17 to 20, characterized in that: When the first module serves the requester, the requester is a terminal device, and the first module is deployed inside the requester, or the first module is deployed outside the requester.

26. The communication device according to any one of claims 17 to 20, characterized in that: When the first module serves and / or the second module serves the requesting party, the requesting party is an access network device, the first module and / or the second module are deployed within the requesting party, or the first module and / or the second module are deployed outside the requesting party.

27. The communication device according to any one of claims 17 to 20, characterized in that: When the first module and / or the second module serves the requester, the requester is a core network device, and the first module and the second module are deployed in a core network network function manner.

28. The communication device according to any one of claims 17 to 20, characterized in that: The first security module communicates with the requester via a first interface, the first interface being used by the requester to initiate a request for the first security service, and the first interface being used by the first security module to send a response for executing the first security service; When the first security module serves the requester, the first interface is further used for the requester to initiate a management and configuration request for the first security module, and the first interface is further used for the first security module to send a response to the management and configuration of the first security module.

29. The communication device according to any one of claims 17 to 20, characterized in that: The second module communicates with the first module via a second interface, and the second interface is used to transmit requests and responses for the first security service. The second interface is also used to transmit requests and responses for the second module to manage and configure the first module.

30. A communication device, characterized in that: include: The interface unit is configured to send a first request message to a first security module, where the first request message is used to request the first security module to execute a first security service or perform management of the first security module, where the first security service is used to invoke a security capability, and the requesting party is a first node, a second node, or a second security module, where the first security module is a module serving the first node, and the second security module is a module serving the second node; The interface unit is further configured to receive a first feedback message from the first security module, where the first feedback message is configured to feed back an execution result of the first security service or a management result of the first security module to the requesting party.

31. The device according to claim 30, characterized in that The requesting party is the first node, and the first request message includes the identity of the second node or the management requirement information of the first node.

32. The device according to claim 30, characterized in that The requesting party is the second security module, and the first request message includes security parameters or management target information of the first security module.

33. A communication device, characterized in that: include: A processor, configured to execute a computer program stored in a memory, so that the communication device executes the communication method according to any one of claims 1 to 16.

34. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is run on a computer, the computer is caused to execute the communication method according to any one of claims 1 to 16.

35. A chip system, characterized in that: include: A processor, configured to call and run a computer program from a memory, so that a communication device equipped with the chip system executes the communication method as claimed in any one of claims 1 to 16.

Images