Emergency satellite communication equipment, communication method, communication equipment and communication system

Abstract

The invention provides an emergency satellite communication device, a communication method, a communication device and a system, and relates to the technical field of communication. The emergency satellite communication equipment comprises an access management module and a user management module, and the access management module is used for receiving a UE registration request from UE and sending a terminal authentication request comprising a user data migration identifier to a first network element of a home network corresponding to the UE according to the UE registration request; controlling a user management module to store UE user data from the home network according to the first message from the first network element; and the user management module is used for storing the UE user data and authenticating the UE according to the UE user data. According to the embodiment of the invention, the communication efficiency and communication stability of the emergency satellite communication equipment can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an emergency satellite communication device, a communication method, a communication device and a communication system. Background Art

[0002] The emergency communication integrated machine combines the functions of the 5G core network (5GC) and the base station functions. It can use satellite communications to establish a temporary 5G communication network without traditional network infrastructure. It can be used to provide emergency communications for terminal devices in emergencies or disasters. Due to the constraints of satellite communication methods, the emergency communication integrated machine is difficult to ensure stable communications for users in disaster areas when the satellite communication environment is unstable (for example, bad weather) or the satellite transmission capacity is insufficient (or there are too many communication requests).

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The purpose of the present disclosure is to provide an emergency satellite communication device, a communication method, a communication device and a communication system, which are used to improve the communication efficiency and communication stability of the emergency satellite communication device.

[0005] According to a first aspect of the present disclosure, an emergency satellite communication device is provided, comprising an access management module and a user management module, wherein the access management module is used to receive a UE registration request from a UE, and send a terminal authentication request including a user data migration identifier to a first network element of a home network corresponding to the UE according to the UE registration request; according to a first message from the first network element, control the user management module to store UE user data from the home network; the user management module is used to store the UE user data, and authenticate the UE according to the UE user data.

[0006] According to the second aspect of the present disclosure, a communication method is provided, which is executed by the access management module in the above-mentioned emergency satellite communication equipment, including: receiving a UE registration request; sending a terminal authentication request including a user data migration identifier to a first network element of a home network corresponding to the UE according to the UE registration request; and controlling a user management module to store UE user data from the home network according to a first message from the first network element, wherein the UE user data is used for UE authentication.

[0007] According to a third aspect of the present disclosure, a communication method is provided, which is executed by a first network element of a core network, including: receiving a terminal authentication request from an emergency satellite communication device, forwarding the terminal device authentication request to a second network element of the core network, the terminal authentication request including a user data migration identifier; responding to a second message from the second network element, storing UE user data carried by the second message, the UE user data being used for UE authentication; sending a third message to the emergency satellite communication device according to the second message to obtain UE response parameters; when it is determined that the UE authentication is successful according to the UE response parameters, sending a first message indicating that the UE authentication is successful to the emergency satellite communication device, the first message including the UE user data.

[0008] According to a fourth aspect of the present disclosure, a communication method is provided, which is executed by a first network element of a core network, including: receiving a terminal authentication request from an emergency satellite communication device, forwarding the terminal device authentication request to a second network element of the core network, the terminal authentication request including a user data migration identifier; responding to a second message from the second network element, obtaining an authentication vector and UE user data according to the second message, the UE user data being used for UE authentication; generating a service environment authentication vector according to the authentication vector, and forming a first message according to the service environment authentication vector and the UE user data; and sending the first message to the emergency satellite communication device.

[0009] According to a fifth aspect of the present disclosure, a communication method is provided, which is executed by a second network element of a core network, including: receiving a terminal authentication request from a first network element of the core network, and generating an authentication vector according to the terminal authentication request; when the terminal authentication request includes a user data migration identifier, obtaining UE user data of the UE corresponding to the terminal authentication request, and the UE user data is used for UE authentication; sending a second message including the authentication vector and the UE user data to the first network element; wherein the second network element includes a UDM.

[0010] According to a sixth aspect of the present disclosure, a communication device is provided, comprising a first network element and / or a second network element of a core network, wherein the first network element and the second network element are used to execute the communication method as described above.

[0011] According to the seventh aspect of the present disclosure, a communication system is provided, characterized in that it includes: the emergency satellite communication equipment as described above, used to execute the communication method executed by the emergency satellite communication equipment as described above; a terminal device, which communicates with the corresponding home network through the emergency satellite communication equipment, and sends a UE registration request to the emergency satellite communication equipment; a first communication device, which is provided with a first network element of a core network, and the first network element is used to execute the communication method executed by the first network element as described above, and the core network is the home network corresponding to the terminal device; a second communication device, which is provided with a second network element of the core network, and the second network element is used to execute the communication method executed by the second network element as described above.

[0012] The disclosed embodiment obtains UE user data from the home network corresponding to the UE when the UE registers with the emergency satellite communication device, and stores the data in a local user management module of the emergency satellite communication device, thereby realizing local backup of UE user data such as user contracts, authentication data, and location information. Subsequent operations such as conversations with the UE can be completed locally, thereby reducing the frequency of satellite use, preventing bad weather from affecting the dissemination of emergency messages, and improving the communication efficiency of emergency satellite communication equipment.

[0013] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0015] Figure 1 It is a schematic structural diagram of an emergency satellite communication device in an exemplary embodiment of the present disclosure.

[0016] Figure 2 It is a flow chart of a communication method according to an embodiment of the present disclosure.

[0017] Figure 3 It is a sub-flowchart of step S22 in the exemplary embodiment of the present disclosure.

[0018] Figure 4 It is a sub-flowchart of step S23 in the exemplary embodiment of the present disclosure.

[0019] Figure 5 It is a sub-flowchart of step S23 in another exemplary embodiment of the present disclosure.

[0020] Figure 6is a flow chart of a communication method according to an exemplary embodiment of the present disclosure.

[0021] Figure 7 is a flow chart of a communication method according to an exemplary embodiment of the present disclosure.

[0022] Figure 8 is a flow chart of a communication method according to an exemplary embodiment of the present disclosure.

[0023] Fig. 9 It is an interaction diagram corresponding to each communication method in the embodiment of the present disclosure.

[0024] Fig.10 It is an interaction diagram corresponding to each communication method in another embodiment of the present disclosure.

[0025] Fig.11 It is a schematic diagram of a communication device provided in an embodiment of the present disclosure.

[0026] Fig.12 is a schematic diagram of a communication system provided by an embodiment of the present disclosure DETAILED DESCRIPTION

[0027] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0028] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0029] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0030] Figure 1It is a schematic diagram of the structure of an emergency satellite communication device in an exemplary embodiment of the present disclosure.

[0031] refer to Figure 1 The emergency satellite communication device 100 may mainly include an access management module 1 and a user management module 2 .

[0032] The access management module 1 is used to receive a UE registration request from a UE, and send a terminal authentication request including a user data migration identifier to a first network element of a home network corresponding to the UE according to the UE registration request; and control the user management module 2 to store UE user data from the home network according to a first message from the first network element. Exemplarily, the access management module 1 includes an AMF network element, and in some embodiments, the access management module 1 also includes a SEAF network element.

[0033] The user management module 2 is used to store UE user data and authenticate the UE according to the UE user data.

[0034] In addition, the emergency satellite communication equipment 100 also includes an SMF network element 3, a UPF network element 4, a base station 5 (gNB), a service management module 6, a communication module 7, etc.

[0035] In an exemplary embodiment, the emergency satellite communication device 100 is, for example, an emergency communication 5G all-in-one machine, which can be used in 5G emergency communication scenarios and 5G communication scenarios based on satellite roaming, integrating multiple functional network elements to build a 5G communication network.

[0036] Among them, the AMF (Access and Mobility Management Function) network element is responsible for the access management and mobility management of the user equipment (UE). For example, it handles the processes related to the registration, connection and mobility of the UE, including ensuring the continuity of communication when the UE moves from one base station to another, and is also responsible for managing the connection establishment and release between the UE and the core network.

[0037] The SEAF (Security Anchor Function) network element is used to handle security-related matters of the user equipment (UE), collaborate with the AMF network element, and support the UE authentication process. For example, it collaborates with the authentication server function (AUSF) to initiate and manage the initial security context establishment process of the UE, ensuring that the secure communication foundation between the UE and the network is established.

[0038] In some emergency all-in-one machines (emergency satellite communication equipment 100), AMF network elements and SEAF network elements are usually set together as a whole. Because the functions of the two are closely related, and according to the 3GPP 5G core network architecture standard, AMF itself contains the functions of SEAF, which aims to reduce the interaction overhead between network elements by integrating related functions, improve network operation efficiency and performance, and better support the high bandwidth, low latency and other requirements of 5G networks. In addition, integrating AMF and SEAF as a whole in the emergency all-in-one machine makes it easier to deploy and manage quickly in emergency scenarios, so as to reduce the number of equipment, reduce hardware costs and space occupancy, and also simplify the complexity of operation and maintenance management, which is more suitable for the requirements of rapid deployment and simple operation and maintenance of equipment in emergency communication scenarios.

[0039] Therefore, in the embodiment of the present disclosure, the common functions of the two are described according to the access management module 1, and the subsequent communication method 200 is executed. In some embodiments, the access management module 1 may also include an AMF network element separately, and the communication method 200 is executed by the AMF network element.

[0040] In order to improve the communication efficiency and communication stability of emergency satellite communication equipment under satellite communication conditions, the embodiment of the present disclosure sets a user management module 2 in the emergency satellite communication equipment 100, and performs local UDM backup of UE user data such as user contracts, authentication data, and location information on the emergency satellite communication equipment 100, so that subsequent conversations and other operations can be completed locally on the emergency satellite communication equipment 100, thereby reducing the frequency of satellite use, avoiding the impact of bad weather on the dissemination of emergency messages, and avoiding being limited by satellite communication processing capabilities.

[0041] Exemplarily, the user management module 2 includes a UDM network element and / or an AUSF network element.

[0042] The AUSF (Authentication Server Function) network element is mainly responsible for processing authentication-related operations of the user equipment (UE) to ensure that only legitimate users can access the network. The AUSF interacts with multiple network elements to complete the authentication.

[0043] The Unified Data Management (UDM) network element is responsible for managing user data. It centrally stores and manages user subscription data, authentication data, and location information, and provides data support for other functional entities in the network.

[0044] UDM works closely with AUSF to provide user authentication data to AUSF so that AUSF can generate authentication vectors and perform authentication operations. At the same time, UDM also interacts with other network elements such as AMF to provide user data support for various functions in the network to ensure the normal operation of the network and user experience.

[0045] Since AUSF and UDM functions are closely related, in an exemplary embodiment, AUSF and UDM can be integrated together in the emergency satellite communication device 100 to integrate related functions, reduce the interaction overhead between network elements, improve network operation efficiency and performance, reduce the number of devices, reduce hardware costs and space occupancy, and simplify the complexity of operation and maintenance management. In some embodiments, AUSF network elements and UDM network elements can also be set separately. Regardless of whether the two are integrated or separately set, they are collectively referred to as user management module 2 in the disclosed embodiment.

[0046] SMF (Session Management Function) network element 3 is mainly responsible for processing operations related to user sessions, such as establishing a session connection between the user equipment (UE) and the data network (DN), allocating an IP address to the UE, managing and controlling the service quality of the session according to the user's service type and contract information, and participating in billing-related operations of the user session.

[0047] UPF (User Plane Function) network element 4 is responsible for forwarding and processing user data, such as grouping data from user equipment (UE), processing data packets according to the rules configured by SMF, routing UE data traffic to the correct destination, etc.

[0048] Base station 5 (gNB) is responsible for data transmission in the wireless access part. It converts the wireless signal sent by the UE into a data packet that can be transmitted in the core network and sends it to the UPF. After the UPF receives the data from the gNB, it performs subsequent forwarding processing and sends the data returned to the UE from the external network to the gNB, which is then transmitted to the UE via a wireless link.

[0049] Business management module 6, also known as the business management platform, is mainly responsible for managing and coordinating the entire process of emergency business, including task allocation, resource scheduling, progress monitoring, information collection and analysis, etc., to ensure the efficient and orderly development of emergency work and improve emergency response capabilities and processing efficiency.

[0050] The communication module 7 is used to perform signal conversion, frequency adaptation, protocol conversion and other operations on the communication transmission process between the device 100 and the satellite. For example, the communication signal sent by the network element in the device 100 is converted into a signal format suitable for satellite link transmission, including converting the frequency band and protocol used by the ground network into the frequency band and protocol required by satellite communication, thereby establishing a communication link between the emergency all-in-one machine and the satellite.

[0051] In actual operation, when an emergency occurs, such as a natural disaster that causes damage to the conventional ground communication network, the AMF network element in the access management module 1 receives registration requests from different UEs. These UEs may come from various disaster-stricken areas and correspond to different home networks (core networks where UEs are registered). The AMF network element sends a terminal authentication request to the first network element of the home network based on the received UE registration request, which carries the user data migration identifier. The SEAF network element closely cooperates with the AMF network element to strengthen security protection from the issuance of the terminal authentication request to the reception of the first message to prevent illegal intrusion and data tampering.

[0052] The UDM network element in the user management module 2 stores UE user data from the home network. The UE user data includes but is not limited to user contract data (user package details, service permissions, etc.), user authentication data (various keys, authentication algorithm identifiers, etc.), and user location information, providing a basis for subsequent local user authentication in the emergency satellite communication device 100. The AUSF network element in the user management module 2 identifies the identity of the UE that has successfully registered according to the authentication process based on the stored data. In this way, in the 5G emergency communication scenario, the number of satellite communications is reduced, reliable communication services are quickly provided to a large number of UEs that are pouring in, and smooth access is guaranteed for UEs roaming across regions, so that users can enjoy stable and secure 5G communication services in a satellite communication environment.

[0053] Next, combine Figure 1 The structure shown introduces in detail the communication method performed by the emergency satellite communication device 100.

[0054] Figure 2 It is a flow chart of a communication method according to an embodiment of the present disclosure.

[0055] Figure 2 The method shown can be Figure 1 The access management module 1 in the emergency satellite communication device 100 shown executes, including:

[0056] Step S21, receiving a UE registration request;

[0057] Step S22, sending a terminal authentication request including a user data migration identifier to a first network element of a home network corresponding to the UE according to the UE registration request;

[0058] Step S23: According to the first message from the first network element, the user management module is controlled to store the UE user data from the home network, where the UE user data is used for UE authentication.

[0059] Next, each step of method 200 is explained.

[0060] In step S21, the emergency satellite communication device 100 receives a registration request from a UE when the following conditions occur.

[0061] For example, when the UE is turned on for the first time and enters the coverage area of ​​the emergency satellite communication network, in order to access the network and obtain communication services, the UE will actively initiate a registration request to the emergency satellite communication device 100. The UE registration request mainly includes the UE's own device identification information, such as SUPI (Subscription Permanent Identifier, used to uniquely identify the user in the network) or SUCI (Subscription Concealed Identifier, an identifier after encrypting or hiding SUPI, used to transmit user identity information in an insecure link to prevent user identity leakage and enhance security). In some embodiments, it also includes the communication standards and frequency band information supported by the UE, such as whether the 5GNR frequency band is supported and the specific frequency band range, so that the access management module 1 in the emergency satellite communication device 100 can allocate appropriate communication resources for it based on this information to ensure smooth subsequent communications.

[0062] When a user carries a UE device and roams from a conventional terrestrial communication network or other satellite communication network into an emergency satellite communication network, the UE also needs to send a registration request to the emergency satellite communication device 100. The request includes roaming-related information, such as the original network identifier, which is used for the emergency satellite communication device 100 to interact and verify with the original network to avoid illegal roaming; it can also include a summary of some of the user's contract information in the original network, so that the emergency satellite communication device 100 can initially understand the user's service authority scope and provide some basic services and authority judgment before fully obtaining the complete contract data.

[0063] When the emergency satellite communication network adjusts key parameters such as communication frequency and encryption algorithm due to emergency situations, and the UE detects that the network parameters are inconsistent with its own storage, it will also send a registration request to the emergency satellite communication device 100. At this time, the UE registration request includes the currently detected network parameter information, such as the changed communication frequency value, the new encryption algorithm identifier, etc., so that the emergency satellite communication device 100 can know the network status of the UE, and then adjust the subsequent authentication and access process in a targeted manner to ensure the stability and security of communication.

[0064] In step S22, a terminal authentication request including a user data migration identifier is sent to a first network element of a home network corresponding to the UE according to the UE registration request.

[0065] Figure 3 It is a sub-flowchart of step S22 in the exemplary embodiment of the present disclosure.

[0066] refer to Figure 3 In an exemplary embodiment, step S22 may include:

[0067] Step S221, determining the home network corresponding to the UE according to the UE registration request;

[0068] Step S222, forming a terminal authentication request according to the UE registration request and the user data migration identifier;

[0069] Step S223: Send the terminal authentication request to the first network element of the home network.

[0070] Exemplarily, the first network element is, for example, an AUSF network element.

[0071] In step S221, the AMF network element in the access management module 1 first parses the key information in the UE registration request, such as the UE identification field carried by the UE registration request. By querying the pre-stored network identification and home network correspondence table, the home network information to which the UE belongs is located. The home network is the network that the user initially signs and establishes a long-term service relationship, providing users with a series of basic services including identity authentication and data management. For example, when a user purchases a mobile phone card package from a certain operator, the network of the operator is the user's home network. Different UEs may come from different home networks. Each home network has a core network, which is a key part of the home network and is used to provide important functions such as mobility management, session management, user authentication and data transmission. For example, in a 5G home network, the core network includes network elements such as AMF (access and mobility management function), SMF (session management function), UDM (unified data management) and AUSF (authentication server function), which work together to realize the home network's services to users.

[0072] In step S222, after determining the home network, the AMF network element combines the detailed parameters in the UE registration request, such as the service type requested by the UE, the communication frequency band and other information, and the preset user data migration identifier, and assembles them according to the preset authentication request template to form a terminal authentication request. The user data migration identifier is used to inform the home network that the UE user data corresponding to the UE needs to be obtained. The specific form of the user data migration identifier can be formulated through negotiation with the home network, and the embodiments of the present disclosure do not impose special restrictions on this.

[0073] In step S223, exemplarily, the first network element is, for example, the AUSF network element of the core network of the home network corresponding to the UE. The AMF network element encapsulates the assembled terminal authentication request and sends it to the AUSF network element of the home network. During the sending process, the encryption and verification mechanism can be used to ensure the integrity and confidentiality of the data to prevent the information from being stolen or tampered with during transmission. After successful sending, the AMF network element starts the timer and waits for the response of the AUSF network element. If no feedback is received within the specified time, it will be sent again according to the preset retransmission strategy to ensure the timeliness and reliability of the authentication process.

[0074] In step S23, according to the first message from the first network element, the user management module is controlled to store UE user data from the home network, where the UE user data is used for UE authentication.

[0075] In an exemplary embodiment, the first message is used to indicate that the UE authentication is successful and carries the UE user data.

[0076] Figure 4 It is a sub-flowchart of step S23 in the exemplary embodiment of the present disclosure.

[0077] refer to Figure 4 In an exemplary embodiment, step S23 may include:

[0078] Step S231, receiving a request response message from a first network element to a terminal authentication request, and determining whether the request response message is a first message indicating that UE authentication is successful;

[0079] Step S232: if the request response message is the first message, obtain UE user data carried by the first message;

[0080] Step S233, sending a local data backup request to the user management module, where the local data backup request includes UE user data;

[0081] Step S234: After determining that the user management module has completed storing the UE user data, a registration success message is returned to the UE.

[0082] In step S231, multiple communications may occur between the AMF network element and the AUSF network element of the home network during the authentication process based on a terminal authentication request. Therefore, when receiving the request response information for the terminal authentication request from the AUSF network element, it is necessary to identify the specific content of the request response information.

[0083] In step S232, when the confirmation request response message is the first message indicating that the UE authentication is successful, the AMF network element accurately extracts the UE user data from the first message according to the established data extraction protocol. These UE user data include but are not limited to user subscription data (such as SUPI, GPSI, NSSAI, DNN, QoS, SSC, access restriction data and roaming restriction data in access and mobility subscription data, etc.), user authentication data (such as RAND, AUTN, XRES*, KSEAF, long-term key K, OP / OPc in the authentication vector), user location information (such as TAI, AMFID) and other related information (such as UE capability information, security context, billing information), etc.

[0084] Among them, user contract data may include:

[0085] SUPI (Subscription Permanent Identifier) ​​is used to uniquely identify a user in the network.

[0086] GPSI (Generic Public Subscription Identifier) ​​is used for non-subscription related operations with users, such as billing.

[0087] NSSAI (Network Slice Selection Assistance Information) is used to help users select appropriate network slices.

[0088] DNN (Data Network Name) identifies the specific data network requested by the user.

[0089] QoS (Quality of Service) defines the service quality level expected by users, such as bandwidth, latency, etc.

[0090] SSC (Session and Service Continuity) ensures the continuity of services for users during mobility.

[0091] AMSD (Access and Mobility Subscription Data) includes access restriction data (restricting user access in certain areas or under certain conditions) and roaming restriction data (restricting user roaming outside a specific area).

[0092] The user authentication data may include an authentication vector, which may include:

[0093] RAND (Random Number) is used to generate an authentication response.

[0094] AUTN (Authentication Token) contains the network's authentication information for the user.

[0095] XRES (Expected Response) is used to verify whether the user's authentication response is correct.

[0096] KSEAF (Key for Serving Network Authentication Function) is used to generate other keys.

[0097] Long-term key (K): A key used for long-term secure communication.

[0098] OP / OPc (Operator Parameter / Operator Parameter Confidential): Operator parameter / operator confidential parameter, used for key generation and authentication.

[0099] User location information can include:

[0100] TAI (Tracking Area Identity) is used to identify the tracking area where the user is located.

[0101] AMFID (Access and Mobility Management Function Identifier) ​​is used to identify the AMF to which the user is currently connected.

[0102] Other relevant information may include:

[0103] UE capability information: capability information of user equipment, such as supported frequency bands, modulation modes, etc.

[0104] Security context: context information related to user security, such as encryption algorithms and keys.

[0105] Billing information: information related to user billing, such as billing rules, rates, etc.

[0106] The above is only an example, and those skilled in the art may set the specific content of the UE user data according to actual conditions, and the present disclosure does not impose any special limitation on this.

[0107] During the extraction process, if the UE user data is encrypted, the AMF network element can decrypt it using the pre-agreed quantum key and the decryption key corresponding to the home network digital certificate encryption, and verify the decrypted UE user data.

[0108] In step S233, after obtaining and verifying the UE user data, the AMF network element sends a local data backup request to the user management module 2 according to the internal communication mechanism. The local data backup request can be encapsulated in a preset data format, with the UE user data completely embedded therein, and with necessary operation instructions, clearly informing the user management module 2 that the storage operation needs to be performed.

[0109] In step S234, when the access management module 1 receives the storage completion confirmation signal sent by the user management module 2, the AMF network element sends a registration success message to the UE. In addition to clearly informing the UE that the registration is successful, the registration success message can also be accompanied by some basic network configuration information, such as the assigned temporary IP address, default gateway address, etc., so that the UE can quickly access the network to communicate.

[0110] After storing the UE user data, the user management module 2 subsequently provides the UE user data to other local network elements, thereby enabling the local network elements to perform communication management on the UE that has been successfully registered without frequent communication with the satellite.

[0111] For example, after successfully storing UE user data, the UDM network element in the user management module 2 can rely on the local processing capabilities of the emergency satellite communication equipment 100 and the NSSAI (network slice selection auxiliary information) in the user's contract data to screen out ground network slice resources suitable for the UE. When the UE initiates a session request, the UDM network element and the AMF network element in the access management module 1 work together locally in the emergency satellite communication equipment 100 to encrypt the session request based on the key information in the user authentication data to ensure the security of the session information. At the same time, with the help of user location information, such as AMFID (access and mobility management function identifier), the access point to which the UE is currently connected is quickly located, and the data transmission path is optimized locally in the emergency satellite communication equipment 100 to reduce transmission delays.

[0112] If the user's contract data shows that the user has activated the high-definition video call service, and the QoS (quality of service) parameters require high bandwidth and low latency, the UDM network element first selects the slice that meets the requirement from the local ground network slice resources of the emergency satellite communication equipment 100, and passes the relevant information to the AMF network element. After the AMF network element receives the session request from the UE, it encrypts the session request using the encryption key in the authentication data, and then quickly routes the encrypted request to the corresponding access point based on the user's location information locally in the emergency satellite communication equipment 100. During the session establishment process, the network resource allocation is dynamically adjusted by continuously comparing the service activation status and QoS requirements in the user's contract data to ensure the smoothness of the high-definition video call.

[0113] For another example, in the data transmission service, based on the DNN (data network name) in the user's contract data, the UDM network element in the user management module 2 identifies the specific data network requested by the user locally in the emergency satellite communication device 100, encrypts the transmitted data in combination with the key information in the user authentication data, and then optimizes the transmission path based on the user's location information. If the user's contract data shows that it has roaming restrictions, when the UE initiates a session request, the UDM network element will communicate with the AMF network element locally in the emergency satellite communication device 100 in advance to ensure that appropriate network resources are provided to the UE under the conditions of meeting the roaming restrictions.

[0114] Therefore, the emergency satellite communication equipment 100 can complete most of the communication management work for the UE locally, reduce the number of visits to the satellite link, reduce communication costs, improve communication efficiency, and provide users with a more stable and high-quality communication experience.

[0115] In some other embodiments, the first message is used to transmit the 5G service environment authentication vector and carry the UE user data.

[0116] Figure 5 It is a sub-flowchart of step S23 in another exemplary embodiment of the present disclosure.

[0117] refer to Figure 5 In another exemplary embodiment, step S23 may include:

[0118] Step S235, receiving a request response message from the first network element to the terminal authentication request, and determining whether the request response message is a first message for transmitting a service environment authentication vector;

[0119] Step S236: if the request response message is the first message, obtain UE user data carried by the first message;

[0120] Step S237, sending a local data backup request to the user management module, where the local data backup request includes UE user data;

[0121] Step S238: Send the service environment authentication vector to the UE so that the UE performs authentication according to the service environment authentication vector.

[0122] During the interaction with the core network, the access management module 1 will receive a service environment authentication vector from the first network element. The service environment authentication vector (5G SE AV) is used to transmit information for further authentication of the UE.

[0123] In an exemplary embodiment, the first network element can transmit the UE user data to the emergency satellite communication device 100 while transmitting the service environment authentication vector, thereby handing over all subsequent authentication work for the UE to the emergency satellite communication device 100 for local execution, further reducing the number of times the emergency satellite communication device 100 uses the satellite link to communicate with the core network of the home network, ensuring that the UE's initial authentication process is as unaffected by the satellite communication link as possible, and improving the efficiency and reliability of the initial authentication.

[0124] Corresponding to the emergency satellite communication device of the embodiment of the present disclosure, the embodiment of the present disclosure also provides a communication method for the core network to cooperate with the emergency satellite communication device 100, assist the emergency satellite communication device 100 in executing the communication method 200, and obtain UE user data from the core network when the UE registers and store it locally in the emergency satellite communication device 100.

[0125] Figure 6 is a flow chart of a communication method according to an exemplary embodiment of the present disclosure.

[0126] Figure 6 The communication method 600 shown may be performed by a first network element of a core network. In an exemplary embodiment, the method 600 may include:

[0127] Step S61, receiving a terminal authentication request from an emergency satellite communication device, and forwarding the terminal device authentication request to a second network element of the core network, wherein the terminal authentication request includes a user data migration identifier;

[0128] Step S62, responding to the second message from the second network element, storing UE user data carried in the second message, where the UE user data is used for UE authentication;

[0129] Step S63, sending a third message to the emergency satellite communication device according to the second message to obtain a UE response parameter;

[0130] Step S64: When it is determined according to the UE response parameters that the UE authentication is successful, a first message indicating that the UE authentication is successful is sent to the emergency satellite communication device, where the first message includes UE user data.

[0131] In an exemplary embodiment, the first network element comprises an AUSF network element of a core network, and the second network element comprises a UDM network element of the core network.

[0132] In step S61, after receiving the terminal authentication request sent by the emergency satellite communication equipment and successfully verifying it, the AUSF network element forwards the terminal authentication request to the UDM network element of the core network, i.e., the second network element, based on the preset routing strategy and combined with the home network identifier and other information in the request.

[0133] In step S62, the second message from the second network element, namely the UDM network element, may include the authentication vector and the UE user data. After receiving the second message from the UDM network element, the AUSF network element extracts the UE user data (for example, in the form of an encrypted package) in the second message and stores the UE user data in a local database by category.

[0134] In an exemplary embodiment, in step S63, the first network element, namely the AUSF network element, may obtain an authentication vector based on the second message, the authentication vector including at least an authentication random number, an authentication token, an expected response value and an authentication key; then, a derived expected response verification value is generated based on the expected response value; next, a third message is generated based on the authentication random number, the authentication token, the derived expected response verification value and the authentication key.

[0135] The authentication vector obtained from the second message is, for example, 5G HE AV. 5G HE AV is 5G Home Environment Authentication Vector, which is an authentication vector generated by the Unified Data Management (UDM) after receiving a user equipment (UE) authentication request from the Authentication Server Function (AUSF), and mainly includes the following fields:

[0136] Rand: Authentication random number, generated by the UDM network element based on a random algorithm to increase the randomness and security of authentication.

[0137] Aut N: Authentication token, which contains network identification, serial number, and verification information obtained through complex encryption transformation based on RAND and network key, and is used to verify the legitimacy of user identity. When the user equipment (UE) receives an authentication request containing RAND and AUTN, it performs a reverse check on AUTN based on the relevant key information stored in itself to verify whether the authentication request comes from a legitimate home network, effectively resisting counterfeit attacks from illegal networks.

[0138] Xres*: Expected response value, which is a result value pre-derived by the network side based on RAND, user contract key and other factors through a specific encryption function operation, and is used to compare and verify the response returned by the user device. After the UE receives RAND and calculates the response value using its own key, the network side compares the UE's response value with XRES. If the two match, the legitimacy of the UE's identity can be confirmed. This is the core comparison link in the authentication process.

[0139] Kausf: The authentication key between AUSF and UE, used for subsequent encryption and integrity protection operations. The authentication key plays various roles at different stages. On the one hand, it participates in the generation of RAND, AUTN, and XRES, providing encryption support for these key elements and ensuring the confidentiality of information; on the other hand, after successful authentication, the authentication key will also derive a series of sub-keys for subsequent communication sessions, such as encryption keys for data encryption and integrity keys for ensuring data integrity.

[0140] In the 5G network authentication scenario, the UDM in the home network responds to the terminal authentication request, extracts UE-related information, generates the above-mentioned authentication vector including RAND, and transmits it to the UE through network elements such as AUSF. The UE processes the received authentication vector elements one by one based on the key information shared with the home network stored in itself, and finally transmits the authentication response back to the network. The network side then compares the UE's response based on the pre-stored key values ​​such as XRES, and then decides whether to allow the UE to access the network, ensuring efficient and secure user access.

[0141] After the AUSF network element extracts the authentication vector from the second message, it uses a specific key derivation function to generate a derived expected response verification value based on the expected response value. This derivation process can introduce dynamic parameters such as timestamps and network identifiers to increase the difficulty for attackers to crack. AUSF calculates the derived expected response verification value HXRES based on XRES and Kausf (the key between AUSF and UE) so that when the UE returns an authentication response, it can verify whether the UE has the correct authentication information by comparing the response value calculated by the UE and HXRES. During the authentication process, the UE will calculate and return a response based on the received parameters (such as random numbers, etc.) and its own stored keys and other information. AUSF needs a corresponding calculation result (HXRES) for matching verification.

[0142] The AUSF network element arranges and combines the authentication random number, authentication token, derived expected response verification value and authentication key according to the preset message assembly format to generate a service environment authentication vector (5G SE AV), and generates a third message based on the service environment authentication vector. During the generation process, each data element can be encrypted, using encryption algorithms such as AES to prevent information leakage and ensure the security of the third message during transmission to the emergency satellite communication equipment.

[0143] In step S64, the AUSF network element immediately starts the verification process after receiving the UE response parameters returned by the emergency satellite communication device. The UE response parameters are compared with the locally stored derived expected response verification value. If the two match, the UE authentication is determined to be successful. At this time, the AUSF network element generates a first message indicating that the UE authentication is successful, and completely embeds the previously stored UE user data (such as an encrypted package) therein, and sends it to the emergency satellite communication device 100 to ensure that the emergency satellite communication device 100 obtains the UE user data and stores it locally.

[0144] Figure 6 The method shown can be used with Figure 4 The embodiments shown are implemented in conjunction with each other.

[0145] Next, we will introduce Figure 5 The illustrated embodiment cooperates with a method implemented by a first network element.

[0146] Figure 7 is a flow chart of a communication method according to an exemplary embodiment of the present disclosure.

[0147] Figure 7 The communication method 700 shown may be performed by a first network element of a core network. In an exemplary embodiment, the method 700 may include:

[0148] Step S71, receiving a terminal authentication request from an emergency satellite communication device, and forwarding the terminal device authentication request to a second network element of the core network, wherein the terminal authentication request includes a user data migration identifier;

[0149] Step S72, responding to the second message from the second network element, acquiring an authentication vector and UE user data according to the second message, where the UE user data is used for UE authentication;

[0150] Step S73, generating a service environment authentication vector according to the authentication vector, and forming a first message according to the service environment authentication vector and the UE user data;

[0151] Step S74: sending the first message to the emergency satellite communication device.

[0152] Figure 7Most of the methods shown are similar to Figure 6 The method shown corresponds to that shown in the figure, and will not be described in detail. The difference is that, in step S72, after obtaining the UE user data from the second message, the first network element does not store the UE user data locally, but in step S73, after generating the service environment authentication vector, the first network element directly generates a first message based on the service environment authentication vector and the UE user data and sends it to the emergency satellite communication device 100, and directly sends the subsequent authentication task to the emergency satellite communication device 100 for local execution, further reducing the number of satellite communications between the emergency satellite communication device 100 and the core network, and further improving the communication efficiency.

[0153] Figure 8 is a flow chart of a communication method according to an exemplary embodiment of the present disclosure.

[0154] Figure 8 The communication method 800 shown may be performed by a second network element of a core network. In an exemplary embodiment, the method 800 may include:

[0155] Step S81, receiving a terminal authentication request from a first network element of a core network, and generating an authentication vector according to the terminal authentication request;

[0156] Step S82, when the terminal authentication request includes a user data migration identifier, obtaining UE user data of the UE corresponding to the terminal authentication request, where the UE user data is used for UE authentication;

[0157] Step S83, sending a second message including an authentication vector and UE user data to the first network element;

[0158] The second network element includes UDM.

[0159] In step S81, after receiving the terminal authentication request from the AUSF network element (ie, the first network element), the UDM network element extracts the UE's identification information and the service type it requests, so as to adapt the corresponding authentication strategy according to the service characteristics and customize a dedicated authentication vector for the UE.

[0160] For example, a hash function is used to generate an authentication random number in the authentication vector based on the UE identifier, timestamp, and core network shared key. At the same time, an authentication token is derived based on a specific key derivation algorithm with the core network key as the source. Key parameters such as XRES (Expected Response), CK (Cipher Key), and IK (Integrity Key) are generated according to network security specifications to form a complete authentication vector.

[0161] Specifically, the UDM network element first extracts the SUCI (Subscription Concealed Identifier) ​​in the terminal authentication request, decrypts the SUCI into a SUPI (Subscription Permanent Identifier) ​​to obtain the user's real identity, so as to perform accurate authentication operations later.

[0162] After decrypting the SUCI, the UDM network element selects an appropriate authentication method. Depending on the network configuration and security policy, it may select authentication methods such as 5G AKA (5G Authentication and Key Agreement) or EAP-AKA (Extensible Authentication Protocol-Authentication and Key Agreement).

[0163] Next, the UDM network element calculates the authentication vector AV. The authentication vector AV contains multiple key elements, such as RAND (Random Number), AUTN (Authentication Token), XRES (Expected Response), CK (Cipher Key) and IK (Integrity Key).

[0164] After generating the authentication vector AV, the UDM network element will further calculate XRES* (Expected Response Star) and KAUSF (Key for Authentication Server Function). XRES* and KAUSF are parameters used for specific authentication scenarios and key management.

[0165] Finally, the UDM network element generates an authentication vector 5G HE AV (5G Home Environment Authentication Vector) corresponding to the UE. 5G HE AV contains elements such as RAND, AUTN, XRES* and KAUSF.

[0166] In step S82, when the UDM network element detects that the terminal authentication request carries the (agreed) user data migration identifier, the UE user data corresponding to the UE is extracted. The UE user data is as described above and will not be repeated here. The UDM network element can adopt a secure mechanism in local data migration. It can use the 5G core network digital certificate to encrypt the UE user data to form an encrypted package, or it can use a pre-set or online distributed quantum key to achieve quantum secure encryption to form an encrypted package of UE user data.

[0167] In step S83, the UDM network element encapsulates the authentication vector generated in step S81 and the UE user data obtained in step S82 to form a second message. Exemplarily, the authentication vector can be placed in a specially designated area in the message header to ensure that the first network element (i.e., AUSF network element) can accurately identify and quickly extract it at the moment of reception; and an encrypted package of UE user data is added to the message backend. Finally, the UDM network element sends the second message to the first network element (AUSF network element).

[0168] The following describes the interaction process of the above functional network elements.

[0169] Fig. 9 It is an interaction diagram corresponding to each communication method in the embodiment of the present disclosure.

[0170] refer to Fig. 9 The interaction process involves the UE, the access management module 1 and the user management module 2 of the emergency satellite communication device 100, the first network element (AUSF) and the second network element (UDM) of the core network of the UE's home network.

[0171] In step S901, the UE sends an initial UE registration request to the access management module 1 of the emergency satellite communication device 100, namely the AMF network element (access and mobility management function) / SEAF network element (security anchor function), and the request carries SUCI (user hidden identifier).

[0172] In step S902, after receiving the UE registration request, the access management module 1 of the emergency satellite communication device 100, namely AMF / SEAF, sends a terminal authentication request to the AUSF network element of the home network corresponding to the UE, and the request carries SUCI and user data migration identifier.

[0173] In step S903, after receiving the terminal authentication request from the emergency satellite communication device 100, the AUSF of the home network forwards the request to the UDM of the home network. The request also carries the SUCI and the user data migration identifier.

[0174] In step S904, the UDM performs authentication operations, including:

[0175] a. Decrypting SUCI into SUPI: UDM decrypts the received SUCI into SUPI (User Permanent Identifier).

[0176] b. Select authentication method (5G AKA / EAP-AKA): Select 5G Authentication and Key Agreement (AKA) or Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA) as the authentication method.

[0177] c. Calculate authentication vector AV(RAND, AUTN, XRES, CK, IK): Calculate the authentication vector containing the random number (RAND), authentication token (AUTN), expected response (XRES), encryption key (CK) and integrity key (IK).

[0178] d. Calculate XRES, KAUSF*: Further calculate the expected response asterisk (XRES*) and the authentication server function key (KAUSF).

[0179] e. Generate authentication vector 5G HE AV (RAND, AUTN, XRES*, KAUSF).

[0180] In step S905, the UDM identifies the user data migration identifier in the terminal authentication request and extracts the UE user data.

[0181] In step S906, the UDM uses a quantum key or a home network digital certificate to encrypt the UE user data.

[0182] In step S907, UDM sends a terminal authentication request response (second message) to the home network AUSF, and the response carries 5GHE AV and encrypted user information.

[0183] In step S908, the AUSF network element performs an authentication operation, which specifically includes:

[0184] a. Store XRES*, calculate HXRES* and KAUSF.

[0185] b. Generate the 5G service environment authentication vector, namely 5G SE AV (RAND, AUTN, HXRES*).

[0186] c. Encrypt and store UE user data.

[0187] Next comes the two-way authentication process between the UE and the home network.

[0188] In step S909, the home network AUSF sends a request response message (third message) of the terminal authentication request to the access management module 1 of the emergency satellite communication device 100, namely AMF / SEAF, and carries 5G SEAV in the request response message (third message).

[0189] In step S910, the access management module 1 of the emergency satellite communication device 100 sends a terminal authentication request response to the UE, and the response carries RAND, AUTN, Kausf, and ABBA parameters.

[0190] In step S911, the UE performs a MAC (Message Authentication Code) authentication operation using the received parameters.

[0191] In step S912, the UE calculates RES* (response star), Kausf and Kseaf (service environment authentication key).

[0192] In step S913, the UE sends an authentication response to the access management module 1 of the emergency satellite communication device 100, and the response carries RES*.

[0193] In step S914, the access management module 1 of the emergency satellite communication device 100 calculates HRES* (the hashed response asterisk) and compares it with XRES*.

[0194] In step S915, if the comparison result matches, the access management module 1 of the emergency satellite communication device 100 sends a terminal authentication request (ie, UE response parameter) to the home network AUSF, and the request carries RES*.

[0195] In step S916, the home network AUSF compares the received RES* with the stored HXRES*, and if they are the same, it is determined that the UE authentication is successful.

[0196] In step S917, after determining that the UE authentication is successful, the home network AUSF forms a first message including the UE user information.

[0197] In step S918, the home network AUSF sends the first message to the access management module 1 of the emergency satellite communication device 100, carrying the authentication result, SUPI, Kseaf and encrypted UE user data.

[0198] In step S919, the access management module 1 of the emergency satellite communication device 100 triggers a local data backup request to the user management module 2, and the request carries the SUCI and the encrypted UE user data.

[0199] In step S920, the user management module 2 of the emergency satellite communication device 100 decrypts the UE user data and stores it locally.

[0200] In step S921 , after determining that the data backup is successful, the user management module 2 sends a backup success response to the access management module 1 .

[0201] In step S922, the access management module 1 sends a registration success message to the UE according to the backup success response, thereby completing the UE registration process.

[0202] Fig.10 It is an interaction diagram corresponding to each communication method in another embodiment of the present disclosure.

[0203] refer to Fig.10 In another embodiment, step S907 and its previous interactions are Fig. 9 The same as the embodiment shown, after step S907, the process proceeds to step S1008.

[0204] In step S1008, the AUSF network element performs an authentication operation, which specifically includes:

[0205] a. Store XRES*, calculate HXRES* and KAUSF.

[0206] b. Generate the 5G service environment authentication vector, namely 5G SE AV (RAND, AUTN, HXRES*).

[0207] c. Generate a first message based on the 5G SE AV and UE user data.

[0208] In step S1009 , the AUSF network element sends the first message to the emergency satellite communication device 100 .

[0209] In step S1010, the access management module 1 of the emergency satellite communication device 100 sends a terminal authentication request response to the UE, and the response carries the RAND, AUTN, Kausf, and ABBA parameters. At the same time, in step S1011, a local data backup request is sent to the user management module 2, and the UE user data is carried in the local data backup request, so that the user management module 2 stores and decrypts the UE user data in step S1012.

[0210] In step S1013, the UE uses the parameters transmitted in step S1010 to perform a MAC (message authentication code) authentication operation. Fig. 9 The steps S911-S914 are the same as in FIG.

[0211] In step S1017, if the comparison result matches, the access management module 1 of the emergency satellite communication device 100 sends a UE response parameter to the local user management module 2, carrying RES*.

[0212] In step S1018, the user management module 2 compares the received RES* with the stored HXRES* locally according to the stored UE user data, and if they are the same, it is determined that the UE authentication is successful.

[0213] In step S1019 , the user management module 2 sends an authentication success response message to the access management module 1 .

[0214] In step S1020, the access management module 1 sends a registration success message to the UE according to the authentication success response, thereby completing the UE registration process.

[0215] It can be seen that Fig. 9 Compared with the embodiment, Fig.10 The illustrated embodiment only needs to receive a message from the core network once, and subsequent authentication is completed locally in the emergency satellite communication device 100, further reducing the dependence on the satellite communication link.

[0216] Fig.11 It is a schematic diagram of a communication device provided in an embodiment of the present disclosure.

[0217] refer to Fig.11 The communication device 1100 may include a first network element and / or a second network element of a core network, the first network element is used to execute the communication method 600 or 700, and the second network element is used to execute the communication method 800.

[0218] Fig.12 It is a schematic diagram of a communication system provided by an embodiment of the present disclosure.

[0219] refer to Fig.12 , the communication system 1200 includes:

[0220] Emergency satellite communication device 100, used to perform communication method 200;

[0221] The terminal device 121 communicates with the corresponding home network through the emergency satellite communication device 100 and sends a UE registration request to the emergency satellite communication device 100;

[0222] The first communication device 122 is provided with a first network element of a core network, the first network element is used for the communication method 600 or 700, and the core network is a core network of a home network corresponding to the terminal device;

[0223] The second communication device 123 is provided with a second network element of the core network, and the second network element is used to execute the communication method 800.

[0224] In some embodiments, the first communication device 122 and the second communication device 123 belong to the same hardware device.

[0225] In summary, in the 5G emergency communication scenario, the disclosed embodiment embeds a user data migration identifier in the UE registration process, enables the home network UDM to package and encrypt the UE user data and pre-transmit it to the home network AUSF for storage. When the UE authentication is passed, the home network AUSF sends the encrypted UE user data to the AMF of the emergency satellite communication device 100 through the first message, and the AMF triggers the local UDM to decrypt and store the encrypted UE user data. Thus, user data migration is achieved during the UE registration and authentication process, avoiding multiple satellite backhauls. At the same time, the user's subsequent business processes can be completed locally on the emergency satellite communication device 100, avoiding business interruptions due to satellite communication congestion and interruptions, and improving the communication efficiency and security of emergency communications.

[0226] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0227] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. An emergency satellite communication device, characterized in that: It includes an access management module and a user management module, wherein: The access management module is used to receive a UE registration request from a UE, and send a terminal authentication request including a user data migration identifier to a first network element of a home network corresponding to the UE according to the UE registration request; and control the user management module to store UE user data from the home network according to a first message from the first network element; The user management module is used to store the UE user data and authenticate the UE according to the UE user data.

2. The emergency satellite communication device according to claim 1, characterized in that: The access management module includes an AMF network element, the user management module includes a UDM network element and / or an AUSF network element, and the UE user data includes at least user subscription data, user authentication data, and user location information.

3. A communication method, characterized in that: Executed by the access management module in the emergency satellite communication device according to claim 1 or 2, comprising: Receive a UE registration request; Sending a terminal authentication request including a user data migration identifier to a first network element of a home network corresponding to the UE according to the UE registration request; According to the first message from the first network element, the user management module is controlled to store UE user data from the home network, where the UE user data is used for UE authentication.

4. The communication method according to claim 3, characterized in that: The sending, according to the UE registration request, a terminal authentication request including a user data migration identifier to a first network element of a home network corresponding to the UE includes: Determine a home network corresponding to the UE according to the UE registration request; Forming a terminal authentication request according to the UE registration request and the user data migration identifier; The terminal authentication request is sent to the first network element of the home network.

5. The communication method according to claim 3, characterized in that: The first message is used to indicate that the UE is successfully authenticated and carries the UE user data, and according to the first message from the first network element, controlling the user management module to store the UE user data from the home network includes: receiving a request response message from the first network element to the terminal authentication request, and determining whether the request response message is a first message indicating that the UE authentication is successful; If the request response message is the first message, obtaining UE user data carried by the first message; Sending a local data backup request to the user management module, where the local data backup request includes the UE user data; After determining that the user management module has completed storing the UE user data, a registration success message is returned to the UE.

6. The communication method according to claim 3, characterized in that: The first message is used to transmit the 5G service environment authentication vector and carry the UE user data, and according to the first message from the first network element, controlling the user management module to store the UE user data from the home network includes: receiving a request response message from the first network element to the terminal authentication request, and determining whether the request response message is a first message for transmitting a service environment authentication vector; If the request response message is the first message, obtaining UE user data carried by the first message; Sending a local data backup request to the user management module, where the local data backup request includes the UE user data; The service environment authentication vector is sent to the UE so that the UE performs authentication according to the service environment authentication vector.

7. A communication method, characterized in that: The method is executed by a first network element of a core network and includes: receiving a terminal authentication request from an emergency satellite communication device, and forwarding the terminal device authentication request to a second network element of the core network, wherein the terminal authentication request includes a user data migration identifier; In response to a second message from the second network element, storing UE user data carried by the second message, where the UE user data is used for UE authentication; Sending a third message to the emergency satellite communication device according to the second message to obtain a UE response parameter; When it is determined according to the UE response parameter that the UE authentication is successful, a first message indicating that the UE authentication is successful is sent to the emergency satellite communication device, where the first message includes the UE user data.

8. The communication method according to claim 7, characterized in that: The first network element includes an AUSF network element, and sending a third message to the emergency satellite communication device according to the second message includes: Acquire an authentication vector according to the second message, where the authentication vector includes at least an authentication random number, an authentication token, an expected response value, and an authentication key; generating a derived expected response verification value according to the expected response value; The third message is generated based on the authentication random number, the authentication token, the derived expected response verification value and the authentication key.

9. A communication method, characterized in that: The method is executed by a first network element of a core network and includes: receiving a terminal authentication request from an emergency satellite communication device, and forwarding the terminal device authentication request to a second network element of the core network, wherein the terminal authentication request includes a user data migration identifier; In response to a second message from the second network element, acquiring an authentication vector and UE user data according to the second message, where the UE user data is used for UE authentication; generating a service environment authentication vector according to the authentication vector, and forming a first message according to the service environment authentication vector and the UE user data; The first message is sent to the emergency satellite communication device.

10. A communication method, characterized in that: The process is executed by the second network element of the core network and includes: receiving a terminal authentication request from a first network element of the core network, and generating an authentication vector according to the terminal authentication request; When the terminal authentication request includes a user data migration identifier, obtaining UE user data of the UE corresponding to the terminal authentication request, where the UE user data is used for UE authentication; Sending a second message including the authentication vector and the UE user data to the first network element; Wherein, the second network element includes UDM.

11. A communication device, characterized in that: It includes a first network element and / or a second network element of a core network, wherein the first network element is used to execute the communication method as described in any one of claims 7 to 9, and the second network element is used to execute the communication method as described in claim 10.

12. A communication system, characterized in that: include: Emergency satellite communication equipment, as claimed in any one of claims 1 and 2, used to perform the communication method as claimed in any one of claims 3 to 6; The terminal device communicates with the corresponding home network through the emergency satellite communication device and sends a UE registration request to the emergency satellite communication device; A first communication device, provided with a first network element of a core network, wherein the first network element is used to execute the communication method according to any one of claims 7 to 9, and the core network is a core network of a home network corresponding to the terminal device; The second communication device is provided with a second network element of the core network, and the second network element is used to execute the communication method as claimed in claim 10.

Images