Communication method and communication device

Abstract

The invention provides a communication method and a communication device, which can enable a key between a terminal device and a second access network device not to depend on keys of the terminal device and a first access network device, and can be applied to more scenes. The method can be applied to communication systems. The method comprises the following steps: in a process that a terminal device communicates with a network through a first access network device, an access and mobility management network element generates a second key for security protection of communication between the terminal device and the first access network device by using a first key and a first parameter set, the first key is used for security protection of communication between the terminal device and the access and mobility management network element. In the process that the terminal device communicates with the network through the second access network device, the access and mobility management network element uses the first key and the second parameter set to generate a third key for security protection of communication between the terminal device and the second access network device and sends the third key, the second set of parameters is used to make the third key different from the second key.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and a communication device. Background Art

[0002] In a dual-connection scenario, a terminal device can be connected to multiple access network devices, and the key used for security protection of communications between the terminal device and the access network device can be called a security key. For security reasons, the security keys between the terminal device and different access network devices are different. Among them, taking the first access network device and the second access network device as an example, the security key between the terminal device and the first access network device can be calculated based on the root key (i.e., the key used for security protection of communications between the terminal device and the access and mobility management network element), and the security key between the terminal device and the second access network device is calculated based on the security key between the first access network device and the terminal. Among them, the first access network device can share the security key between the terminal device and the second access network device with the second access network device.

[0003] In the above solution, the security key between the terminal device and the second access network device depends on the security key between the terminal device and the first access network device, and the application scenario is limited. Summary of the invention

[0004] The embodiments of the present application provide a communication method and a communication device, which can ensure that the key between a terminal device and a second access network device is independent of the key between the terminal device and a first access network device, and can be applied to more scenarios.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a communication method is provided. The communication method includes: in a process of communicating with a network through a first access network device, a terminal device uses a first key and a first parameter set to generate a second key, the second key is used for security protection of communication between the terminal device and the first access network device, the first key is used for security protection of communication between the terminal device and an access and mobility management network element, and the first parameter set includes an access type identification code of the terminal device. In a process of communicating with a network through a second access network device, the terminal device uses the first key and the second parameter set to generate a third key, the third key is used for security protection of communication between the terminal device and the second access network device, and the second parameter set is used to make the third key different from the second key.

[0007] Based on the communication method provided in the first aspect, in the process of communicating through different access network devices, the terminal device generates a security key between the terminal device and the first access network device according to the first key and the first parameter set, that is, the first key, and generates a security key between the terminal device and the second access network device according to the first key and the second parameter set, that is, the third key. It can be seen that the generation of the second key and the third key both depend on the first key. In this way, the dependence of the third key on the second key can be avoided. In other words, the security key between the terminal device and the second access network device can be independent of the security key between the terminal device and the first access network device, so that the method can be applied to more scenarios.

[0008] In addition, since the first key can be calculated by the terminal device, that is, the first key does not rely on the communication between the first access network device and the second access network device, therefore, when there is no communication interface between the first access network device and the second access network device or the communication interface between the first access network device and the second access network device cannot communicate, secure isolation between the first access network device and the second access network device can still be achieved.

[0009] For example, in one possible design, the Xn interface between the first access network device and the second access network device does not exist, or the Xn interface between the first access network device and the second access network device cannot be used for communication. Since the first key can be calculated by the terminal device, that is, the generation of the first key does not depend on the Xn connection between the first access network device and the second access network device, in this way, when the Xn interface between the first access network device and the second access network device does not exist or the Xn interface cannot be used for communication, the security isolation between the first access network device and the second access network device can still be achieved.

[0010] In a possible design, the second parameter set includes a first parameter, wherein the first parameter is used to indicate that the terminal device performs dual access, or the first parameter is used to indicate that the terminal device performs satellite access, or the first parameter is an identifier of the second access network device, or the first parameter includes an uplink non-access stratum NAS count value for the second access network device, or the first parameter is determined based on a predefined counter or random number. In this way, by introducing the first parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of generating the key.

[0011] In one possible design scheme, the process of communicating with the network through the first access network device is the process of registering to the network through the first access network device, and the process of communicating with the network through the second access network device is the process of registering to the network through the second access network device.

[0012] In a possible design, the terminal device generates a second key using the first key and the first parameter set, which may include: the terminal device inputs the first key and the first parameter set into a key generation function to obtain the second key. The terminal device generates a third key using the first key and the second parameter set, which includes: the terminal device inputs the first key and the second parameter set into the key generation function to obtain the third key. In this way, the key generation function can be used to generate the key, and the existing key generation function can be used to reduce the complexity of the key generation process between the terminal device and the access network device.

[0013] In a possible design scheme, the method provided in the first aspect may further include: the terminal device receives a security mode command from an access and mobility management network element. The security mode command includes information for indicating a first parameter. In this way, the first parameter set can be indicated by the access and mobility management network element, which can ensure that the terminal device and the access and mobility management network element generate different keys for different accesses, while ensuring that under the same access mode, the access and mobility management network element and the terminal device use the same first parameter set to generate the same key for communication. In addition, multiplexing the security mode command to indicate the first parameter can reduce the interaction process and reduce resource overhead.

[0014] In a possible design scheme, the method provided in the first aspect may further include: in the process of re-authenticating the terminal device with the access and mobility management network element, the terminal device obtains a fourth key. The fourth key is used for security protection of communication between the terminal device and the access and mobility management network element, and is used to replace the first key. In this way, the root key in the re-authentication process can be updated.

[0015] Optionally, the method provided in the first aspect may further include: the terminal device generates a fifth key using a fourth key and a third parameter set. The fifth key is used for security protection of communication between the terminal device and the first access network device. The third parameter set includes an access type identification code of the terminal device. The terminal device generates a sixth key using a fourth key and a fourth parameter set. The sixth key is used for security protection of communication between the terminal device and the second access network device, and the fourth parameter set is used to make the sixth key different from the fifth key. In this way, on the one hand, the update of the key in the re-authentication process between the terminal device and the access and mobility management network element can be realized, and security can be further improved. On the other hand, the terminal device generates a key for security protection of communication between the terminal device and the first access network device and a key for security protection of communication between the terminal device and the second access network device according to a preset rule. When the access and mobility management network element uses the same rule as the terminal device to calculate the key, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent.

[0016] Furthermore, the terminal device generates the fifth key using the fourth key and the third parameter set, which may include: when the re-authentication process is initiated by the first access network device, the terminal device generates the fifth key using the fourth key and the third parameter set. In this way, key update in the re-authentication process can be achieved.

[0017] Further, the fourth parameter set includes a second parameter, wherein the second parameter is used to indicate that the terminal device performs dual access, or the second parameter is used to indicate that the terminal device performs satellite access, or the second parameter is an identifier of the second access network device, or the second parameter includes an uplink non-access stratum NAS count value for the second access network device, or the second parameter is determined according to a predefined counter or random number. In this way, by introducing the second parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0018] Optionally, the method provided in the first aspect may further include: when the terminal device initiates a re-authentication process through the second access network device, the terminal device uses the fourth key and the fifth parameter set to generate a seventh key, the seventh key is used for security protection of communication between the terminal device and the second access network device, and the fifth parameter set includes the access type identification code of the terminal device. The terminal device uses the fourth key and the sixth parameter set to generate an eighth key. Among them, the eighth key is used for security protection of communication between the terminal device and the first access network device, and the sixth parameter set is used to make the eighth key different from the seventh key. In this way, on the one hand, the update of the key in the re-authentication process between the terminal device and the access and mobility management network element can be realized, and the security can be further improved. On the other hand, the terminal device generates a key for security protection of communication between the terminal device and the first access network device and a key for security protection of communication between the terminal device and the second access network device according to a preset rule. When the access and mobility management network element uses the same rule as the terminal device to calculate the key, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent.

[0019] Further, the sixth parameter set includes a third parameter, wherein the third parameter is used to indicate that the terminal device performs dual access, or the third parameter is used to indicate that the terminal device performs satellite access, or the third parameter is an identifier of the second access network device, or the third parameter includes an uplink non-access stratum NAS count value for the second access network device, or the third parameter is determined according to a predefined counter or random number. In this way, by introducing the third parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0020] In a possible design solution, the method provided in the first aspect may further include: the terminal device sends a first registration request message to the second access network device. The first registration request message is used to request registration with the network.

[0021] In a second aspect, a communication method is provided. The communication method includes: in a process in which a terminal device communicates with a network through a first access network device, an access and mobility management network element uses a first key and a first parameter set to generate a second key, the second key is used for security protection of communication between the terminal device and the first access network device, the first key is used for security protection of communication between the terminal device and the access and mobility management network element, and the first parameter set includes an access type identification code of the terminal device. In a process in which a terminal device communicates with a network through a second access network device, the access and mobility management network element uses the first key and the second parameter set to generate a third key, the third key is used for security protection of communication between the terminal device and the second access network device, and the second parameter set is used to make the third key different from the second key. The access and mobility management network element sends the third key to the second access network device.

[0022] Based on the communication method provided in the second aspect, in the process of a terminal device communicating through different access network devices, the access and mobility management network element generates a security key between the terminal device and the first access network device according to the first key and the first parameter set, i.e., the first key, and generates a security key between the terminal device and the second access network device according to the first key and the second parameter set, i.e., the third key. It can be seen that the generation of the second key and the third key both depend on the first key. In this way, the dependence of the third key on the second key can be avoided. That is to say, the security key between the terminal device and the second access network device can be independent of the security key between the terminal device and the first access network device, so that the method can be applied to more scenarios.

[0023] In addition, since the first key can be calculated by the access and mobility management network element, that is, the first key does not rely on the communication between the first access network device and the second access network device, therefore, when there is no communication interface between the first access network device and the second access network device or the communication interface between the first access network device and the second access network device cannot communicate, secure isolation between the first access network device and the second access network device can still be achieved.

[0024] For example, in one possible design, the Xn interface between the first access network device and the second access network device does not exist, or the Xn interface between the first access network device and the second access network device cannot be used for communication. Since the first key can be obtained by the access and mobility management network element, that is, the generation of the first key does not depend on the Xn connection between the first access network device and the second access network device, in this way, when the Xn interface between the first access network device and the second access network device does not exist or the Xn interface cannot be used for communication, the security isolation between the first access network device and the second access network device can still be achieved.

[0025] In a possible design, the second parameter set includes a first parameter, wherein the first parameter is used to indicate that the terminal device performs dual access, or the first parameter is used to indicate that the terminal device performs satellite access, or the first parameter is an identifier of the second access network device, or the first parameter includes an uplink non-access stratum NAS count value for the second access network device, or the first parameter is determined based on a predefined counter or random number. In this way, by introducing the first parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of generating the key.

[0026] In one possible design scheme, the process of the terminal device communicating with the network through the first access network device is the process of the terminal device registering with the network through the first access network device, and the process of the terminal device communicating with the network through the second access network device is the process of the terminal device registering with the network through the second access network device.

[0027] In a possible design scheme, the access and mobility management network element generates a second key using a first key and a first parameter set, which may include: the access and mobility management network element inputs the first key and the first parameter set into a key generation function to obtain the second key. The access and mobility management network element generates a third key using the first key and the second parameter set, which includes: the access and mobility management network element inputs the first key and the second parameter set into a key generation function to obtain the third key. In this way, a key generation function can be used to generate a key, and an existing key generation function can be used to reduce the complexity of the key generation process between the terminal device and the access network device.

[0028] In a possible design scheme, the method provided in the second aspect may further include: the access and mobility management network element sends a security mode command to the terminal device. The security mode command includes information for indicating the first parameter. In this way, the access and mobility management network element can indicate the first parameter set, which can ensure that the terminal device and the access and mobility management network element generate different keys for different accesses, and at the same time ensure that under the same access mode, the access and mobility management network element and the terminal device use the same first parameter set to generate the same key for communication. In addition, multiplexing the security mode command to indicate the first parameter can reduce the interaction process and reduce resource overhead.

[0029] In a possible design scheme, the method provided in the second aspect further includes: in the process of re-authentication of the terminal device, the terminal device obtains a fourth key. The fourth key is used for security protection of communication between the terminal device and the access and mobility management network element, and is used to replace the first key. In this way, the root key in the re-authentication process can be updated.

[0030] Optionally, the method provided in the second aspect further includes: the access and mobility management network element generates a fifth key using the fourth key and the third parameter set. The fifth key is used for security protection of communication between the terminal device and the first access network device. The first parameter set includes the access type identification code of the terminal device. The access and mobility management network element generates a sixth key using the fourth key and the fourth parameter set. The sixth key is used for security protection of communication between the terminal device and the second access network device, and the fourth parameter set is used to make the sixth key different from the fifth key. The access and mobility management network element sends information about the fifth key and information about the sixth key. In this way, on the one hand, the key update in the re-authentication process between the terminal device and the access and mobility management network element can be realized, further improving security. On the other hand, the terminal device generates a key for security protection of communication between the terminal device and the first access network device and a key for security protection of communication between the terminal device and the second access network device according to a preset rule. When the access and mobility management network element calculates the key using the same rule as the terminal device, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent. Further, the access and mobility management network element generates the fifth key using the fourth key and the third parameter set, which may include: when the terminal device initiates the re-authentication process through the first access network device, the access and mobility management network element generates the fifth key using the fourth key and the third parameter set. In this way, key update in the re-authentication process can be achieved.

[0031] Further, the fourth parameter set includes a second parameter, wherein the second parameter is used to indicate that the terminal device performs dual access, or the second parameter is used to indicate that the terminal device performs satellite access, or the second parameter is an identifier of the second access network device, or the second parameter includes an uplink non-access stratum NAS count value for the second access network device, or the second parameter is determined according to a predefined counter or random number. In this way, by introducing the second parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0032] Optionally, the method provided in the second aspect may further include: when the terminal device initiates a re-authentication process through the second access network device, the access and mobility management network element generates a seventh key using the fourth key and the fifth parameter set, the seventh key is used for security protection of communication between the terminal device and the second access network device, and the fifth parameter set includes the access type identification code of the terminal device. The access and mobility management network element generates an eighth key using the fourth key and the sixth parameter set. Among them, the eighth key is used for security protection of communication between the terminal device and the first access network device, and the sixth parameter set is used to make the eighth key different from the seventh key. The access and mobility management network element sends information about the seventh key and information about the eighth key. In this way, on the one hand, the key update in the re-authentication process between the terminal device and the access and mobility management network element can be realized, and security can be further improved. On the other hand, the terminal device generates a key for security protection of communication between the terminal device and the first access network device and a key for security protection of communication between the terminal device and the second access network device according to a preset rule. When the access and mobility management network element uses the same rule as the terminal device to calculate the key, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent.

[0033] Further, the sixth parameter set includes a third parameter, wherein the third parameter is used to indicate that the terminal device performs dual access, or the third parameter is used to indicate that the terminal device performs satellite access, or the third parameter is an identifier of the second access network device, or the third parameter includes an uplink non-access stratum NAS count value for the second access network device, or the third parameter is determined according to a predefined counter or random number. In this way, by introducing the third parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0034] In a possible design solution, the method provided in the second aspect may further include: the access and mobility management network element receives a second registration request from the second access network device, wherein the second registration request is used to request that the terminal be registered with the network.

[0035] Regarding the technical effects of the method provided in the second aspect, reference can be made to the technical effects of the method provided in the first aspect, and no further details will be given here.

[0036] In a third aspect, a communication method is provided. The communication method includes: a second access network device receives a first registration request from a terminal device. The first registration request is used to request registration to a network. In response to the first registration request, the second access network device sends a second registration request to an access and mobility management network element. The second registration request is used to request registration of the terminal to the network. The second access network device receives information about a third key. The third key is determined by the access and mobility management network element in response to the second registration request message. The third key is used for security protection of communication between the terminal device and the second access network device.

[0037] Regarding the technical effects of the method provided in the third aspect, reference can be made to the technical effects of the method provided in the first aspect, and no further details will be given here.

[0038] In a fourth aspect, a communication method is provided. The communication method includes: in the process of re-authentication between a terminal device and an access and mobility management network element, the terminal device obtains a ninth key. The ninth key is used for security protection of communication between the terminal device and the access and mobility management network element. The terminal device generates a tenth key using the ninth key and the seventh parameter set. The tenth key is used for security protection of communication between the terminal device and a third access network device. The seventh parameter set includes an access type identification code of the terminal device. The terminal device generates an eleventh key using the ninth key and the eighth parameter set. The fourth access network device is different from the third access network device, and the eleventh key is used for security protection of communication between the terminal device and the fourth access network device. The eighth parameter set is used to make the eleventh key different from the tenth key.

[0039] Based on the method provided in the fourth aspect, in the process of re-authentication between the terminal device and the access and mobility management network element, the terminal device can generate the tenth key and the eleventh key based on the ninth key. It can be seen that the generation of the tenth key and the eleventh key both depend on the ninth key. In this way, the dependence of the eleventh key on the tenth key can be avoided, that is, the security key between the terminal device and the fourth access network device can be independent of the security key between the terminal device and the third access network device.

[0040] In addition, since the ninth key can be calculated by the terminal device, that is, the ninth key does not rely on the communication between the third access network device and the fourth access network device, therefore, when there is no communication interface between the third access network device and the fourth access network device or the communication interface between the third access network device and the fourth access network device cannot communicate, the security isolation between the third access network device and the fourth access network device in the re-authentication process can still be achieved.

[0041] For example, in one possible design, the Xn interface between the third access network device and the fourth access network device does not exist, or the Xn interface between the third access network device and the fourth access network device cannot be used for communication. Since the ninth key can be calculated by the terminal device, that is, the generation of the ninth key does not depend on the Xn connection between the third access network device and the fourth access network device, in this way, when there is no Xn interface between the third access network device and the fourth access network device or the Xn interface cannot be used for communication, the security isolation between the third access network device and the fourth access network device in the re-authentication process can still be achieved.

[0042] In this way, the key update in the re-authentication process between the terminal device and the access and mobility management network element can be achieved, thereby achieving secure isolation between the terminal device and different access network devices in the re-authentication process and improving security.

[0043] In addition, the terminal device generates a key for security protection of communication between the terminal device and the first access network device, and a key for security protection of communication between the terminal device and the second access network device according to preset rules. When the access and mobility management network element uses the same rules as the terminal device to calculate the key, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent.

[0044] In one possible design scheme, the eighth parameter set includes a fourth parameter, wherein the fourth parameter is used to indicate that the terminal device requests dual access, or the fourth parameter is used to indicate that the terminal device performs satellite access, or the fourth parameter is an identifier of a fourth access network device, or the fourth parameter includes an uplink non-access stratum NAS count value for the fourth access network device, or the fourth parameter is determined based on a predefined counter or random number.

[0045] In this way, by introducing the fourth parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0046] In a fifth aspect, a communication method is provided. The communication method includes: in the process of re-authentication between the terminal device and the access and mobility management network element, the access and mobility management network element obtains a ninth key. Among them, the ninth key is used for security protection of communication between the terminal device and the access and mobility management network element. The access and mobility management network element generates a tenth key using the ninth key and the seventh parameter set. Among them, the tenth key is used for security protection of communication between the terminal device and the third access network device. The seventh parameter set includes an access type identification code of the terminal device. The access and mobility management network element generates an eleventh key using the ninth key and the eighth parameter set. The fourth access network device is different from the third access network device, and the eleventh key is used for security protection of communication between the terminal device and the fourth access network device. The eighth parameter set is used to make the eleventh key different from the tenth key. The access and mobility management network element sends information about the tenth key and information about the eleventh key.

[0047] In one possible design scheme, the eighth parameter set includes a fourth parameter, wherein the fourth parameter is used to indicate that the terminal device requests dual access, or the fourth parameter is used to indicate that the terminal device performs satellite access, or the fourth parameter is an identifier of a fourth access network device, or the fourth parameter includes an uplink non-access stratum NAS count value for the fourth access network device, or the fourth parameter is determined based on a predefined counter or random number.

[0048] Regarding the technical effects of the method provided in the fifth aspect, reference can be made to the technical effects of the method provided in the fourth aspect, and no further details will be given here.

[0049] In a sixth aspect, a communication device is provided, which is used to execute the communication method described in any one of the implementation modes of the first aspect to the fifth aspect.

[0050] In the present application, the communication device described in the sixth aspect may be the terminal device described in the first aspect or any one of the fourth aspects, or the access and mobility management network element described in the second aspect or any one of the fifth aspects, or the second access network device described in any one of the fourth aspect, or a chip (system) or other parts or components that can be set in the terminal device, access and mobility management network element or second access network device, or a device including the terminal device, access and mobility management network element or second access network device.

[0051] It should be understood that the communication device described in the sixth aspect includes a module, unit, or means corresponding to the communication method described in any one of the first to fifth aspects, and the module, unit, or means can be implemented by hardware, software, or by hardware executing the corresponding software. The hardware or software includes one or more modules or units for executing the functions involved in the above-mentioned communication method.

[0052] In a seventh aspect, a communication device is provided, including: a processor, the processor being configured to execute the communication method described in any possible implementation manner in the first to fifth aspects.

[0053] In a possible design solution, the communication device described in the seventh aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the seventh aspect to communicate with other communication devices.

[0054] In a possible design scheme, the communication device described in the seventh aspect may also include a memory. The memory may be integrated with the processor or may be separately provided. The memory may be used to store the computer program and / or data involved in the communication method described in any one of the first to fifth aspects.

[0055] In the present application, the communication device described in the seventh aspect may be the terminal device described in the first aspect or any one of the fourth aspects, or the access and mobility management network element described in the second aspect or any one of the fifth aspects, or the second access network device described in any one of the fourth aspect, or a chip (system) or other parts or components that can be set in the terminal device, access and mobility management network element or second access network device, or a device including the terminal device, access and mobility management network element or second access network device.

[0056] In an eighth aspect, a communication device is provided, comprising: a processor, the processor being coupled to a memory, the processor being configured to execute a computer program stored in the memory, so that the communication device executes the communication method described in any possible implementation manner in the first to fifth aspects.

[0057] In a possible design solution, the communication device described in the eighth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the eighth aspect to communicate with other communication devices.

[0058] In the present application, the communication device described in the eighth aspect may be the terminal device described in the first aspect or any one of the fourth aspects, or the access and mobility management network element described in the second aspect or any one of the fifth aspects, or the second access network device described in any one of the fourth aspect, or a chip (system) or other parts or components that can be set in the terminal device, access and mobility management network element or second access network device, or a device including the terminal device, access and mobility management network element or second access network device.

[0059] In the ninth aspect, a communication device is provided, comprising: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the communication device executes the communication method described in any one of the implementation methods of the first to fifth aspects.

[0060] In a possible design scheme, the communication device described in the ninth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the ninth aspect to communicate with other communication devices.

[0061] In the present application, the communication device described in the ninth aspect may be the terminal device described in the first aspect or any one of the fourth aspects, or the access and mobility management network element described in the second aspect or any one of the fifth aspects, or the second access network device described in any one of the fourth aspect, or a chip (system) or other parts or components that can be set in the terminal device, access and mobility management network element or second access network device, or a device including the terminal device, access and mobility management network element or second access network device.

[0062] In a tenth aspect, a communication device is provided, comprising: a processor; the processor is used to couple with a memory, and after reading a computer program in the memory, execute a communication method as described in any one of the implementation methods in the first to fifth aspects according to the computer program.

[0063] In a possible design solution, the communication device described in the tenth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the tenth aspect to communicate with other communication devices.

[0064] In the present application, the communication device described in the tenth aspect may be the terminal device described in the first aspect or any one of the fourth aspects, or the access and mobility management network element described in the second aspect or any one of the fifth aspects, or the second access network device described in any one of the fourth aspect, or a chip (system) or other parts or components that can be set in the terminal device, access and mobility management network element or second access network device, or a device including the terminal device, access and mobility management network element or second access network device.

[0065] In an eleventh aspect, a processor is provided, wherein the processor is used to execute the communication method described in any possible implementation manner of the first aspect to the fifth aspect.

[0066] In a twelfth aspect, a communication system is provided, which includes one or more terminal devices and multiple access network devices.

[0067] In a thirteenth aspect, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer executes the communication method described in any possible implementation manner in the first to fifth aspects.

[0068] In a fourteenth aspect, a computer program product is provided, comprising a computer program or instructions, which, when executed on a computer, enables the computer to execute the communication method described in any possible implementation of aspects one to five.

[0069] In addition, the technical effects of the communication devices described in the sixth to fourteenth aspects above can refer to the technical effects of the communication methods described in the first to fifth aspects above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A schematic diagram of the core network architecture provided for an embodiment of the present application;

[0071] Figure 2 A schematic diagram of a dual connection architecture provided in an embodiment of the present application;

[0072] Figure 3 Schematic diagram of the security key calculation principle in the dual access mode provided in the embodiment of the present application Figure 1 ;

[0073] Figure 4 A schematic diagram of a process for registering a terminal device to an auxiliary access network device provided in an embodiment of the present application;

[0074] Figure 5 A flow chart of a communication system provided in an embodiment of the present application;

[0075] Figure 6 Schematic diagram of the communication method provided in the embodiment of the present application Figure 1 ;

[0076] Figure 7 Schematic diagram of the security key calculation principle in the dual access mode provided in the embodiment of the present application Figure 2 ;

[0077] Figure 8 Schematic diagram of the communication method provided in the embodiment of the present application Figure 2 ;

[0078] Fig. 9 A schematic diagram of the structure of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0079] To facilitate understanding, the technical terms involved in the embodiments of the present application are first introduced below.

[0080] 1. Fifth generation (5G) mobile communication system (referred to as 5G system (5G system, 5GS)):

[0081] Figure 1 Figure 5 is a schematic diagram of the 5GS architecture. Figure 1 As shown, 5GS includes: access network (AN) and core network (CN), and may also include: terminal devices.

[0082] CN may include access and mobility management function (core access and mobility management function, AMF) network element (also referred to as access and mobility management network element), user plane function (user plane function, UPF) network element (referred to as user plane network element), session management function (session management function, SMF) network element (referred to as session management network element), authentication server function (authentication server function, AUSF) network element, network data analysis function (network data analytics function, NWDAF) network element (referred to as network data analysis network element), network exposure function (network exposure function, NEF) network element, network function storage function (network exposure function Repository Function, NRF) network element, policy control function (policy control function, PCF) network element (referred to as policy control network element), unified data management (unified data management, UDM) network element (referred to as data management network element), application function (application function, AF) network element or service communication proxy (service communication proxy, SCP) network element, etc.

[0083] It should be noted that Figure 1 Some examples of network elements or entities in a 5G network are only given as examples. The 5G network may also include a unified data repository (UDR) network element, a network slice selection function (NSSF) network element, a charging function (CHF) network element, etc. Figure 1The network elements or entities not shown in the figure are not specifically limited in the embodiments of the present application.

[0084] Among them, Figure 1 As shown, the terminal device accesses the 5G network through the AN device, and the terminal device communicates with the AMF network element through the N1 interface (referred to as N1); the RAN device communicates with the AMF network element through the N2 interface (referred to as N2); the RAN device communicates with the UPF network element through the N3 interface (referred to as N3); the SMF network element communicates with the UPF network element through the N4 interface (referred to as N4), and the UPF network element accesses the data network (DN) through the N6 interface (referred to as N6). In addition, Figure 1 The control plane functions shown in the figure, such as AUSF network element, AMF network element, SMF network element, NEF network element, NRF network element, PCF network element, UDM network element, UDR network element, AF network element, NWDAF network element or SCP network element, interact with each other using service-oriented interfaces. For example, the service-oriented interface provided by the AUSF network element is Nausf; the service-oriented interface provided by the AMF network element is Namf; the service-oriented interface provided by the SMF network element is Nsmf; the service-oriented interface provided by the NEF network element is Nnef; the service-oriented interface provided by the NRF network element is Nnrf; the service-oriented interface provided by the PCF network element is Npcf; the service-oriented interface provided by the UDM network element is Nudm; and the service-oriented interface provided by the AF network element is Naf. In addition, the service-oriented interface provided by the UDR network element to the outside is Nudr; the service-oriented interface provided by the NSSF network element to the outside is Nnssf; the service-oriented interface provided by the CHF network element to the outside is Nchf; the relevant function description and interface description can refer to the 5G system architecture (5G system architecture) diagram in the TS23.501 standard, which will not be repeated here.

[0085] The following is an exemplary description of the functions of each part or network element involved in the above network architecture in the 5G network.

[0086] (1) The terminal device may be a terminal with transceiver functions, or a chip or chip system that can be set in the terminal. The terminal device may also be called user equipment (UE), access terminal, subscriber unit, user station, mobile station (MS), mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent or user device. The terminal in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, a vehicle-mounted terminal, a road side unit (RSU) with terminal function, etc. The terminal of the present application may also be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into the vehicle as one or more components or units.

[0087] (2) The AN device is used to implement access-related functions. It can provide network access functions for authorized terminals in a specific area and can use transmission tunnels of different qualities according to the level of the terminal, business requirements, etc. The AN device forwards control signals and user data between the terminal device and the CN. The AN device in the present application may be a radio access network (RAN) device. The RAN device can manage wireless resources, provide access services to terminal devices, and then complete the forwarding of control signals and terminal data between the terminal and the core network. The RAN device can also be understood as a base station in a traditional network. For example, it can be responsible for wireless resource management, quality of service (QoS) management, data compression and encryption and other functions on the air interface side.

[0088] RAN devices can be devices in a wireless network. RAN devices can also be called wireless RAN devices or network devices or wireless network nodes. At present, some examples of RAN devices are: the Next Generation Node B (gNB) in the 5G system, the transmission reception point (TRP), the evolved Node B (eNB) in the long term evolution (LTE) system, the radio network controller (RNC), the Node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (e.g., home evolved NodeB, or home Node B, HNB), the base band unit (BBU), or the wireless fidelity (Wifi) access point (AP), etc. In a network structure, the network device may include a centralized unit (CU) node, a distributed unit (DU) node, or a RAN device including a CU node and a DU node. The RAN device may also be a wireless backhaul device, an in-vehicle device, a wearable device, a network device in a future 5G network, or a network device in a future evolved PLMN network, etc. In the third generation (3rd generation, 3G) system, it is called a Node B, etc.

[0089] (3) The mobile management network element belongs to the core network element and is mainly responsible for the signaling processing part, such as access control, mobility management, attachment and detachment, and gateway selection. When the mobile management network element provides services for the session of the terminal device, it will provide storage resources of the control plane for the session to store the session identifier, the SMF network element identifier associated with the session identifier, etc. In the 5G communication system, the mobile management network element can be an access and mobility management network element. In future communication systems, the mobile management network element can still be an AMF network element, or it can have other names, which are not limited in this application.

[0090] (4) The user plane network element is used for packet routing and forwarding, quality of service (QoS) processing of user plane data, etc. In the 5G communication system, the network element or entity corresponding to the user plane network element may be a user plane function (UPF) network element in the 5G network architecture. In future communication systems, the user plane network element may still be a UPF network element, or the user plane network element may have other names, which is not limited in the embodiments of the present application.

[0091] (5) Data network refers to the operator network that provides data transmission services to terminals, such as IMS (IP Multi-media Service) and the Internet.

[0092] The terminal accesses the data network by establishing a PDD session between the terminal to the RAN device to the UPF network element to the DN network element.

[0093] 2. Root key refers to the key used for security protection of communication between terminal devices and access and mobility management network elements. Based on the root key, the key used for security protection of communication between terminal devices and access network devices can be calculated. For example, in a 5G communication system, the root key can be K AMF .

[0094] 3. Dual connectivity (DC) mode: refers to a mode in which a terminal device can be connected to two access network devices at the same time and provided with services by the two access network devices. In the dual connectivity mode, one of the two access network devices connected to the terminal device at the same time can be called the master access network device (master-RAN) and the other access network device can be called the secondary access network device (secondary-RAN). Figure 2Taking the communication shown as an example, the terminal device can be connected to the first access network device and the second access network device at the same time. Then, one of the first access network device and the second access network device is the main access network device, and the other access network device is the auxiliary access network device. It can be understood that both the first access network device and the second access network device access the DN through the core network.

[0095] In the dual connection mode, the security keys used for communication between the terminal device and different access network devices are different to achieve security isolation. Figure 2 For example, if the terminal device is connected to the first access network device and the second access network device respectively, then the key used for security protection of communication between the first access network device and the terminal device is different from the key used for security protection of communication between the second access network device and the terminal device. Among them, the security key between the terminal device and one of the dual-connected access network devices can be calculated by the access network device based on the root key. On this basis, the access network device calculates the security key between the terminal device and the other access network device based on the obtained security key and sends it to the other access network device.

[0096] For a terminal device, a security key between the terminal device and one of the dual-connected access network devices can be calculated by the terminal device based on the root key. On this basis, the terminal device calculates a security key between the terminal device and the other access network device based on the obtained security key.

[0097] For ease of understanding, the following uses the first access network device and the second access network device as an example to illustrate the calculation principle of the security key between the terminal device and different access network devices. Assume that the security key 1 between the first access network device and the terminal device can be calculated based on the root key. Then, if Figure 3 As shown in (a) in the figure, a device for calculating a key, such as a terminal device or an access network device, can input a root key and a parameter set 1 corresponding to the terminal device into a key derivation function (KDF), so that a security key 1 between the first access network device and the terminal device can be obtained. For the specific implementation principle of the security key between the first access network device and the terminal device, please refer to the relevant introduction in TS 33.501.

[0098] The security key 2 between the second access network device and the terminal device is calculated based on the security key 1 between the first access network device and the terminal device. Figure 3As shown in (b) in FIG. 1 , a device for calculating a key, such as a terminal device or an access network device, can input parameter set 2 and security key 1 into a key generation function, so that a security key 2 between the auxiliary access device and the terminal device can be obtained. For the implementation principle of the security key between the second access network device and the terminal device, please refer to the relevant introduction in TS 33.501.

[0099] Among them, parameter set 1 may include a first type identification code, and the first type identification code is used to indicate that the access type of the terminal device is a third generation partnership project (3GPP) access. Among them, the first type identification code may be "0x01". In addition, parameter set 1 may also include its fixed code (such as "0x6E"), etc. After parameter set 1 is constructed into a string, a key generation function is input. For the specific implementation principle, please refer to the relevant introduction in A.9 of technical standard TS 33.501; parameter set 2 may include counter 1. In addition, parameter set 2 may also include a fixed code ("0x79"), etc. After parameter set 2 is constructed into a string, a key generation function is input. For the implementation principle of parameter set 2, please refer to the relevant introduction in A.16 of technical standard TS 33.501. The key generation function uses the key generation function defined in TS 33.501, which will not be repeated here. It should be understood that if the first access network device is the main access network device and the second access network device is the auxiliary access network device, the security key 1 may also be referred to as K MN , security key 2 can also be called K SN , Counter 1 can also be called SN counter.

[0100] For ease of understanding, the following uses the first access network device as the primary access network device and the second access network device as the secondary access network device as an example to illustrate the generation process of the security key. In the dual access mode, both the AMF and the terminal device can generate security keys between different access network devices and the terminal device, such as Figure 3 The security key between the main access network device and the terminal device is calculated according to the related introduction of (a). The auxiliary access network device is added through the main access network device, that is, the main access network device calculates the security key between the auxiliary access network device and the terminal device, and then sends the security key to the auxiliary access network device. Among them, the main access network device can calculate the security key between the auxiliary access network device and the terminal device based on the security key between the main access network device and the terminal device. In addition, the terminal device can also calculate the security key between the auxiliary access network device and the terminal device based on the security key between the main access network device and the terminal device. In this way, the security key between the main access network device and the terminal device, and the security key between the auxiliary access network device and the terminal device can be isolated from each other.

[0101] It can be understood that the principle of the access and mobility management network element generating the security key between the main access network device and the terminal device can refer to Figure 3 (a) in the relevant introduction; the principle of the main access network device generating the security key between the auxiliary access network device and the terminal device can refer to Figure 3 The introduction related to (b) in the above will not be repeated here.

[0102] In summary, there is a dependency relationship between the terminal device and different access network devices. For example, there is a dependency relationship between the security key between the terminal device and the first access network device and the security key between the terminal device and the second access network device. Therefore, how to make the security key between the terminal device and the second access network device independent of the security key between the terminal device and the first access network device is an urgent problem to be solved.

[0103] The following example illustrates the process of adding an auxiliary access network device to a primary access network device.

[0104] like Figure 4 As shown, the process of adding an auxiliary access network device to a primary access network device includes:

[0105] S401, a radio resource control (RRC) connection is established between the terminal device and the primary access network device.

[0106] The implementation principle of S401 can be referred to the existing technology and will not be described in detail here.

[0107] S402: The primary access network device sends a first request message to the secondary access network device. Correspondingly, the secondary access network device receives the first request message from the primary access network device.

[0108] The first request message is used to instruct to add an auxiliary access network device or to modify an auxiliary access network device.

[0109] The first request message includes a key used for security protection of communication between the terminal device and the auxiliary access network device (ie, a security key between the terminal device and the auxiliary access network device).

[0110] It is understandable that the security capability of the terminal device and the security policies of the terminal device. The first request message may also be referred to as a secondary access network device addition or modification request (SN Addition / ModificationRequest).

[0111] S403: The auxiliary access network device determines an algorithm for integrity protection and an algorithm for confidentiality protection.

[0112] S404: The auxiliary access network device sends a first confirmation message to the primary access network device. Correspondingly, the access network device receives the first confirmation message from the auxiliary access network device.

[0113] The first confirmation message is used to indicate that the auxiliary access network device is added successfully or modified successfully. The first confirmation message includes the algorithm for integrity protection and the algorithm for confidentiality protection confirmed by the auxiliary access network device.

[0114] S405, the primary access network device sends an RRC connection configuration (RRC ConnectionReconfiguration) message to the terminal device. Correspondingly, the terminal device receives the RRC connection configuration message from the primary access network device.

[0115] The RRC connection configuration message includes a secondary access network device counter (SN counter), an algorithm for integrity protection and an algorithm for confidentiality protection determined by the secondary access network device.

[0116] S406, the terminal device sends an RRC connection reconfiguration complete message to the primary access network device. Correspondingly, the primary access network device receives the RRC connection reconfiguration complete message from the terminal device.

[0117] The RRC connection configuration complete message is used to indicate that the RRC connection between the terminal device and the secondary access network device has been successfully established.

[0118] S407, the secondary access network device sends a secondary access network configuration complete (SNReconfiguration Complete) message to the primary access network device. Correspondingly, the primary access network device receives the secondary access network configuration complete message from the secondary access network device.

[0119] The auxiliary access network configuration completion message is used to indicate that the auxiliary access network device has completed configuration.

[0120] S408: The terminal device generates a security key for the auxiliary access network device according to the SN counter and the security key corresponding to the primary access network device.

[0121] S409, the terminal device activates confidentiality and integrity protection.

[0122] The terminal device may activate confidentiality and integrity protection according to the confidentiality protection algorithm and the integrity protection algorithm.

[0123] The implementation principle of S409 can refer to the principle of activating password and integrity protection of terminal devices in the prior art, which will not be repeated here.

[0124] S410, the auxiliary access network device activates confidentiality and integrity protection.

[0125] The implementation principle of S410 may refer to the principle of activation password and integrity protection of auxiliary access network device in the prior art, which will not be described in detail here.

[0126] S411, the terminal device accesses the network through the auxiliary access network device.

[0127] The implementation principle of S411 may refer to the implementation principle of a terminal device accessing a network through an access network device in the prior art, and will not be described in detail here.

[0128] However, the above Figure 4 In the provided solution, the primary access network device and the secondary access network device can communicate with each other, such as through the Xn interface. If there is no communication interface between the two access network devices or the communication interface between the two access network devices cannot communicate, such as when there is no Xn interface between the two access network devices (such as in satellite communication scenarios) or the Xn interface cannot communicate, then the two access network devices cannot communicate with each other. Figure 4 The method provided for transferring security keys, for example, the security keys of auxiliary access network devices cannot be used Figure 4 The method shown is obtained, resulting in failure to achieve secure isolation between the first access network device and the second access network device.

[0129] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0130] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as wireless fidelity (WiFi) systems, vehicle to everything (V2X) communication systems, device-to-device (D2D) communication systems, Internet of Vehicles communication systems, 4th generation (4G) mobile communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, fifth generation (5G) mobile communication systems, such as new radio (NR) systems, and future communication systems, such as sixth generation (6G) mobile communication systems.

[0131] The present application will present various aspects, embodiments or features around a system that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0132] In addition, in the embodiments of the present application, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0133] In the embodiments of the present application, "information", "signal", "message", "channel" and "signaling" may be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are consistent. "of", "corresponding, relevant" and "corresponding" may be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0134] In the embodiments of the present application, sometimes a subscript such as W1 may be mistakenly written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are consistent.

[0135] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0136] To facilitate understanding of the embodiments of the present application, first Figure 5 The communication system shown in the example is used to describe in detail the communication system applicable to the embodiment of the present application. Figure 5 A schematic diagram of the architecture of a communication system applicable to the communication method provided in an embodiment of the present application.

[0137] like Figure 5 As shown, the communication system can be applicable to the above-mentioned 5GS, including: a terminal device 501, a first access network device 502a, a second access network device 502b, and an access and mobility management network element 503.

[0138] The terminal device may be one or more, such as a first terminal device, a second terminal device, a third terminal device, etc. The terminal device may be a terminal with transceiver functions, or may be a chip or chip system provided in the terminal. The terminal device may also be referred to as user equipment (UE), access terminal, subscriber unit (subscriberunit), subscriber station, mobile station (MS), mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The terminal device in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal, a computer with a wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a smart home device (for example, a refrigerator, a television, an air conditioner, an electric meter, etc.), an intelligent robot, a robotic arm, a workshop equipment, a wireless terminal in unmanned driving, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in remote medical care, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, a vehicle-mounted terminal, a roadside unit with a terminal function, and a wireless terminal in a smart city. unit, RSU), etc., flying equipment (for example, intelligent robots, hot air balloons, drones, airplanes), etc. The terminal device of the present application may also be an on-board module, on-board module, on-board component, on-board chip or on-board unit that is built into the vehicle as one or more components or units. The terminal device may also be other devices with terminal functions. For example, the terminal device may also be a device that serves as a terminal function in D2D communication. The embodiments of the present application do not limit the device form of the terminal device, which may be a terminal device; or it may be a device that can support the terminal device to implement the function, such as a chip system. The device may be installed in the terminal device or used in combination with the terminal device.In the embodiment of the present application, the chip system may be composed of a chip, or may include a chip and other discrete devices.

[0139] The first access network device and the second access network device may both be referred to as access network devices. The access network device may be a device with wireless transceiver functions, or may be a chip or chip system provided on the device, located in the access network (AN) of the communication system, to provide access services to the terminal. For example, the access network device may be referred to as a radio access network device (RAN), which may specifically be a next generation mobile communication system, such as a 6G access network device, such as a 6G base station, or in the next generation mobile communication system, the access network device may also have other naming methods, which are all covered within the scope of protection of the embodiments of the present application, and the present application does not impose any limitation on this. Alternatively, the access network device may also include 5G, such as a gNB in ​​a new radio (NR) system, or one or a group of antenna panels (including multiple antenna panels) of a base station in 5G, or a network node constituting a gNB, a transmission point (TRP or transmission point, TP) or a transmission measurement function (TMF), such as a central unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU), an RSU with a base station function, or a wired access gateway, or a core network element of 5G. Alternatively, the access network device may also include: an access point (AP) in a wireless fidelity (WiFi) system, a wireless relay node, a wireless backhaul node, various forms of macro base stations, micro base stations (also called small stations), relay stations, access points, wearable devices, vehicle-mounted devices, etc. Among them, CU and DU can be set separately, or can also be included in the same network element, such as a baseband unit (BBU). RU can be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU) or a remote radio head (RRH). It can be understood that the network device can be a CU node, or a DU node, or a device including a CU node and a DU node. In addition, CU can be divided into a network device in the access network RAN, and CU can also be divided into a network device in the core network CN, which is not limited here.In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, CU, CU-CP, CU-UP, DU and RU are described as examples in this application. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application may be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0140] In the embodiments of the present application, the form of the network device is not limited. The device for implementing the function of the network device can be a network device; it can also be a device that can support the network device to implement the function, such as a chip system. The device can be installed in the network device or used in conjunction with the network device. It is understandable that Figure 5 The provided communication system may also include more terminal devices ( Figure 5 ), and / or more access network devices ( Figure 5 ), and / or more access and mobility management network elements ( Figure 5 In addition, Figure 5 Other network devices may also be included, which will not be described here.

[0141] It should be noted that the communication method provided in the embodiment of the present application can be applied to Figure 5 The specific implementation between the terminal device, the first access network device, the second access network device and the access and mobility management network element shown can refer to the following method embodiments, which will not be repeated here.

[0142] It should be pointed out that the solutions in the embodiments of the present application can also be applied to other communication systems, and the corresponding names can also be replaced by the names of corresponding functions in other communication systems.

[0143] It should be understood that Figure 5 This is a simplified schematic diagram for ease of understanding only. The communication system may also include other network devices and / or other terminal devices. Figure 5 Not drawn in.

[0144] The following will be combined Figure 6-Figure 8 The communication method provided in the embodiment of the present application is described in detail.

[0145] For example, Figure 6 Schematic diagram of the communication method provided in the embodiment of the present application Figure 1This communication method can be applied to Figure 5 The communication between the nodes shown.

[0146] like Figure 6 As shown, the communication method includes the following steps:

[0147] S601, in a process in which a terminal device communicates with a network through a first access network device, the terminal device generates a second key using a first key and a first parameter set.

[0148] The first key is used for security protection of communication between the terminal device and the access and mobility management network element. For example, the first key may be K AMF The second key is used for security protection of communication between the terminal device and the first access network device, and the first parameter set includes an access type identification code of the terminal device.

[0149] The first key may be calculated by the terminal device. For the principle of calculating the first key by the terminal device, reference may be made to the relevant introduction in the existing standards, which will not be repeated here.

[0150] The network may refer to a communication network, such as a public land mobile network (PLMN), etc., and the type of the network is not limited here. It should be understood that the network in the embodiment of the present application may include a core network.

[0151] Among them, the process of the terminal device communicating with the network through the first access network device is the process of the terminal device registering to the network through the first access network device.

[0152] In one possible design scheme, the process of the terminal device registering to the network through the first access network device can be triggered by the process of the following design 1. For the specific implementation, please refer to the relevant introduction of the following design 1, which will not be repeated here.

[0153] For the implementation principle of the first parameter set, please refer to the relevant introduction of parameter set 1, which will not be repeated here.

[0154] The terminal device generates the second key using the first key and the first parameter set, which may include: the terminal device inputs the first key and the first parameter set into a key generation function to obtain the second key. For the principle of generating the second key, please refer to the relevant introduction of generating the security key 1, which will not be repeated here.

[0155] S602: In a process in which a terminal device communicates with a network through a first access network device, an access and mobility management network element generates a second key using a first key and a first parameter set.

[0156] The access and mobility management network element uses the first key and the first parameter set to generate the second key, which may include: the access and mobility management network element inputs the first key and the first parameter set into a key generation function to obtain the second key.

[0157] Regarding the principle of generating the second key in S602, please refer to the relevant introduction of generating security key 1, which will not be repeated here.

[0158] It can be understood that the key generation function in S602 is the same as the key generation function in S601.

[0159] S603: In the process of the terminal device communicating with the network through the second access network device, the access and mobility management network element generates a third key using the first key and the second parameter set.

[0160] The third key is used for security protection of communication between the terminal device and the second access network device, and the second parameter set is used to make the third key different from the second key.

[0161] For example, the first key may be K AMF .

[0162] The first key may be calculated by the access and mobility management network element. For the principle of the access and mobility management network element calculating the first key, reference may be made to the relevant introduction in the existing standards and will not be repeated here.

[0163] The process of the terminal device communicating with the network through the second access network device is the process of the terminal device registering with the network through the second access network device.

[0164] In one possible design scheme, the process of the terminal device registering to the network through the second access network device can be triggered by the process of the following design 2. For the specific implementation, please refer to the relevant introduction of the following design 2, which will not be repeated here.

[0165] In one possible design, the second parameter set includes a first parameter. The first parameter is used to indicate that the terminal device performs dual access, or the first parameter is used to indicate that the terminal device performs satellite access, or the first parameter is an identifier of the second access network device, or the first parameter includes an uplink non-access stratum (NAS) count value for the second access network device, or the first parameter is determined according to a predefined counter or a random number.

[0166] In this way, by introducing the first parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0167] Optionally, the second parameter set may further include other parameters, such as at least some parameters in the first parameter set, such as a type identification code and / or a fixed code.

[0168] For the type identification code, please refer to the above introduction about the first type identification code. It should be understood that Figure 7 The information of the input function in the principle shown may also include other information, such as the fixed code "0x79", which will not be repeated here.

[0169] It should be understood that the second parameter set here also includes at least some of the parameters in the first parameter set is only for example. In actual implementation, the second parameter set may also include other possible parameters in addition to the parameters in the first parameter set, as long as the third key generated according to the first key and the second parameter set can be different from the second key. It will not be repeated here.

[0170] like Figure 7 As shown, the access and mobility management network element generates a third key using the first key and the second parameter set, which may include: the access and mobility management network element inputs the first key and the second parameter set into a key generation function to obtain the third key.

[0171] In this way, the key generation function between the second access device and the terminal device can follow the key generation function between the first access network device and the terminal device, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0172] The parameters in the second parameter set may be input into the key generation function in the form of a character string, that is, the second parameter set is a character string consisting of a plurality of parameters.

[0173] S604: The access and mobility management network element sends a third key to the second access network device. Correspondingly, the second access network device receives the third key from the access and mobility management network element.

[0174] S605, in the process of the terminal device communicating with the network through the second access network device, the terminal device generates a third key using the first key and the second parameter set.

[0175] The terminal device generates a third key using the first key and the second parameter set, including: the terminal device inputs the first key and the second parameter set into a key generation function to obtain the third key.

[0176] Regarding the principle of the terminal device using the first key and the second parameter set to generate the third key, please refer to the relevant introduction of the access and mobility management network element using the first key and the second parameter set to generate the third key in S603, which will not be repeated here.

[0177] Optionally, Figure 6 The provided method may further include S606.

[0178] S606: The access and mobility management network element sends first information to the terminal device. Correspondingly, the terminal device receives the first information from the access and mobility management network element.

[0179] The first information includes information for indicating the first parameter.

[0180] The first information is carried in a security mode command (security mode command, SMC). In this way, the security mode command is reused to indicate the first parameter, which can reduce the interaction process and reduce resource overhead.

[0181] It should be understood that the first information here is carried in the security mode command only for example, and the first information may also be other possible information besides the security mode command, which will not be repeated here.

[0182] In this way, the first parameter set can be indicated by the access and mobility management network element, which can ensure that the terminal device and the access and mobility management network element generate different keys for different accesses, while ensuring that under the same access mode, the access and mobility management network element and the terminal device use the same first parameter set to generate the same key for communication.

[0183] It should be understood that S606 may be executed before S605.

[0184] Optionally, Figure 6 The provided method may also include step 6.01.

[0185] Step 6.01: The access and mobility management network element sends a security mode command to the terminal device. Correspondingly, the terminal device receives the security mode command from the access and mobility management network element.

[0186] In a possible design scheme, if the first parameter is used to instruct the terminal device to perform dual access, or the first parameter is used to instruct the terminal device to perform satellite access, or the first parameter is an identifier of the second access network device, or the first parameter includes an uplink NAS count value for the second access network device, then the security mode command can be used to establish a secure channel between the terminal device and the access and mobility management network element. In this case, the implementation principle of the security mode command can refer to the relevant introduction in Section 6.7.2 of protocol version TS 33.501.

[0187] In this case, the execution order of S606 and S605 is not limited. For example, S605 may be executed before S606, S605 may be executed after S606, or S606 may be executed in parallel with S605.

[0188] In another possible design, if the first parameter is determined according to a predefined counter or a random number, the security mode command is used to establish a secure channel between the terminal device and the access and mobility management network element, and the security mode command includes information indicating the first parameter, such as the first information. In this case, if the first information is the security mode command, S606 is the same step as step 6.01.

[0189] In this case, step 6.01 is performed before S605.

[0190] In addition, it should be understood that in the embodiment of the present application, the order of any one of S601 to S603 and S605 is not limited, and the execution order of S604 can be after S603, which will not be repeated here.

[0191] It should be understood that in the embodiment of the present application, the process of the terminal device registering with the network through the access network device can be triggered by a registration request message (registration Request) sent by the terminal device to the access network device.

[0192] Design 1, S608-1, the terminal device sends a registration request message #1 to the second access network device. Correspondingly, the second access network device receives the registration request message #1 from the terminal device.

[0193] Among them, the registration request message #1 is used to register with the network. The registration request message #1 may include the identifier of the terminal device, for example, the 5G-globally unique temporary UE identity (GUTI). The implementation principle of the registration request message #1 can refer to the implementation principle of the registration request message in the existing technology, which will not be repeated here.

[0194] S608-2, the second access network device sends a registration request message #2 to the access and mobility management network element according to the registration request message #1. Correspondingly, the access and mobility management network element receives the registration request message #2 from the second access network device.

[0195] The registration request message #2 includes the information in the registration request message #1 and information indicating that the access type (accesstype) is 3GPP access.

[0196] Registration request message #2 may be used to request that the terminal device be registered to the network.

[0197] It should be understood that the access and mobility management network element can use the 5G-GUTI to determine the first key.

[0198] In this case, S603 may be a step performed after the access and mobility management network element responds to the registration request message #2.

[0199] In one possible design, Figure 6 The provided method may further include S608 - 3 .

[0200] S608-3, the access and mobility management network element sends the second key information to the first access network device. Correspondingly, the first access network device receives the second key information from the access and mobility management network element.

[0201] Design 2, S608-4, the terminal device sends a registration request message #3, ie, a first registration request message, to the second access network device. Correspondingly, the second access network device receives the registration request message #3 from the terminal device.

[0202] Among them, the registration request message #3 is used to register with the network. The registration request message #3 may include the identifier of the terminal device, for example, 5G-GUTI. The implementation principle of the registration request message #3 can refer to the implementation principle of the registration request message in the prior art, which will not be repeated here.

[0203] S608-5, the second access network device sends a registration request message #4, ie, a second registration request message, to the access and mobility management network element according to the registration request message #3. Accordingly, the access and mobility management network element receives the registration request message #4 from the second access network device.

[0204] The registration request message #4 includes the information in the registration request message #3 and information indicating that the access type is 3GPP access.

[0205] Registration request message #4 may be used to request that the terminal device be registered to the network.

[0206] In this case, S603 may be a step performed after the access and mobility management network element responds to the registration request message #4.

[0207] In some possible designs, after executing S601 to S605, the access and mobility management network element may trigger a re-authentication process according to local policies. For example, when the terminal device moves or switches, the access and mobility management network element may trigger a re-authentication process. As another example, the access and mobility management network element may trigger a re-authentication process according to a preset period. Among them, the implementation principle of the access and mobility management network element initiating a re-authentication process according to local policies can refer to the relevant introduction in the existing technology, which will not be repeated here. In this case, one of the following two designs may be referred to to re-determine the security key between the first access network device and the terminal device, and the security key between the second access network device and the terminal device.

[0208] Design 3: For the security key between the access network device (i.e., the first access network device) and the terminal device for the first authentication, the calculation method of S601 and S602 is used; for the security key between the access network device other than the first authentication (i.e., the second access network device) and the terminal device, the calculation method of S601 and S602 is used. Figure 6 The calculation is performed in the manner of S603 and S605. The following is further described in conjunction with steps 6.11 to 6.19.

[0209] Step 6.11: During the process of re-authenticating the terminal device with the access and mobility management network element, the terminal device obtains the fourth key.

[0210] The fourth key is used for security protection of communication between the terminal device and the access and mobility management network element, and is used to replace the first key.

[0211] In this way, the root key can be updated in the re-authentication process.

[0212] The first key is K AMF In the case of a key, the fourth key may be the updated K AMF Key.

[0213] For the implementation principle of the fourth key, please refer to the relevant introduction of the first key, which will not be repeated here.

[0214] In step 6.12, the terminal device generates a fifth key using the fourth key and the third parameter set.

[0215] The fifth key is used for security protection of communication between the terminal device and the first access network device.

[0216] For the implementation principle of the third parameter set, reference may be made to the relevant introduction to the first parameter set in S601 , and for the implementation principle of the fifth key, reference may be made to the relevant introduction to the second key in S601 .

[0217] In step 6.12, the terminal device may input the fourth key and the third parameter set into a key generation function to obtain a fifth key. The implementation principle of step 6.12 may refer to the relevant introduction of S601, which will not be repeated here.

[0218] In step 6.13, the terminal device generates a sixth key using the fourth key and the fourth parameter set.

[0219] The sixth key is used for security protection of communication between the terminal device and the second access network device.

[0220] Further, the fourth parameter set includes a second parameter. The second parameter is used to indicate that the terminal device performs dual access, or the second parameter is used to indicate that the terminal device performs satellite access, or the second parameter is an identifier of the second access network device, or the second parameter includes an uplink NAS count value for the second access network device, and the second parameter is determined according to a predefined counter or a random number.

[0221] For the implementation principle of the second parameter, please refer to the relevant introduction of the first parameter. For the implementation principle of the fourth parameter set, please refer to the implementation principle of the second parameter set, which will not be repeated here.

[0222] In this way, by introducing a second parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0223] In the embodiment of the present application, the terminal device may input the fourth key and the fourth parameter set into the key generation function to obtain the sixth key. The implementation principle of the sixth key may refer to the implementation principle of the third key. The implementation principle of determining the sixth key in step 6.13 may refer to the relevant introduction of determining the third key in S605, which will not be repeated here.

[0224] Step 6.14: During the process of re-authenticating the terminal device and the access and mobility management network element, the access and mobility management network element obtains a fourth key.

[0225] For the introduction of the fourth key, please refer to the relevant introduction of the fourth key in step 6.11. For the principle of the access and mobility management network element obtaining the fourth key, please refer to the relevant introduction of the terminal device obtaining the fourth key in step 6.11, which will not be repeated here.

[0226] Step 6.15: The access and mobility management network element generates a fifth key using the fourth key and the third parameter set.

[0227] The fifth key is used for security protection of communication between the terminal device and the first access network device.

[0228] For the implementation principle of the third parameter set, please refer to the relevant introduction of the first parameter set in step 6.12. For the implementation principle of the fifth key, please refer to the relevant introduction of the second key in step 6.12. For the implementation principle of step 6.15, please refer to the relevant introduction of S602. No further details will be given here.

[0229] Step 6.16: The access and mobility management network element generates a sixth key using the fourth key and the fourth parameter set.

[0230] The fourth parameter set includes the second parameter. The fourth parameter set is used to make the sixth key different from the fifth key.

[0231] For the implementation principle of the second parameter, please refer to the relevant introduction in step 6.13. For the implementation principle of the fourth parameter set, please refer to the relevant introduction in step 6.13, which will not be repeated here.

[0232] For the implementation principle of step 6.16, please refer to the relevant introduction of S603, which will not be repeated here.

[0233] Step 6.17: The access and mobility management network element sends information about the fifth key and information about the sixth key.

[0234] The fifth key information and the sixth key information may include the second information and the third information, wherein the second information includes the fifth key information and the third information includes the sixth key information.

[0235] The above step 6.17 may include: the access and mobility management network element sends the second information to the first access network device.

[0236] The access and mobility management network element sends third information to the second access network device.

[0237] It is understandable that the second information and the third information can also be used to indicate that the context of the terminal device has been modified, and the second information and the third information can also be called context modification messages. The second information and the third information can be carried in the same message or in different messages.

[0238] Choose a place, Figure 6 The provided method may further include: the second access network device receives the fifth key information and the sixth key information. The first access network device receives the fifth key information and the sixth key information.

[0239] Or, optionally, in the case where the fifth key information and the sixth key information include the second information and the third information, Figure 6 The provided method may further include: the first access network device receiving second information from the access and mobility management network element. The second access network device receiving third information from the access and mobility management network element.

[0240] In this way, on the one hand, the key update in the re-authentication process between the terminal device and the access and mobility management network element can be achieved, further improving security.

[0241] On the other hand, the terminal device generates a key for security protection of communication between the terminal device and the first access network device, and a key for security protection of communication between the terminal device and the second access network device according to preset rules. When the access and mobility management network element uses the same rules as the terminal device to calculate the key, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent.

[0242] also, Figure 6 The provided method may also include step 6.18.

[0243] Step 6.18: The terminal device and the access and mobility management network element complete the security mode command process based on the fifth key and the sixth key.

[0244] For the implementation principle of step 6.18, please refer to the relevant introduction in step 6.01, which will not be repeated here.

[0245] also, Figure 6 The provided method may further include step 6.19.

[0246] Step 6.19: The access and mobility management network element may still send information indicating the second parameter to the terminal device. Correspondingly, the terminal device may receive information indicating the second parameter from the access and mobility management network element.

[0247] For the implementation principle of step 6.19, please refer to the relevant introduction of S606, which will not be repeated here.

[0248] Design 4: The security key between the access network device and the terminal device used for re-authentication is calculated using the calculation method of S601 and S602; the security key between the access network device other than the access network device used for re-authentication and the terminal device is calculated using Figure 6 Calculated in the same way as S603 and S605.

[0249] Scenario 1: The terminal device initiates a re-authentication process with the access and mobility management network element through the first access network device.

[0250] In this scenario, the implementation principle of Design 4 can refer to the relevant introduction in Design 3. The difference is that in this scenario:

[0251] Step 6.12 includes: when the terminal device initiates a re-authentication procedure with the access and mobility management network element through the first access network device, the terminal device generates a fifth key using the fourth key and the third parameter set.

[0252] Step 6.15 includes: when the terminal device initiates a re-authentication process with the access and mobility management network element through the first access network device, the access and mobility management network element generates a fifth key using the fourth key and the third parameter set.

[0253] Scenario 2: The terminal device initiates a re-authentication process with the access and mobility management network element through the second access network device. In this scenario, Figure 6 The provided method may also include steps 6.21 to 6.29.

[0254] Step 6.21: During the process of the terminal device reauthenticating with the access and mobility management network element, the terminal device obtains a fourth key.

[0255] For the implementation principle of the fourth key, please refer to the relevant introduction in step 6.11. For the implementation of the terminal device obtaining the fourth key in step 6.21, please refer to the relevant introduction in step 6.11, which will not be repeated here.

[0256] Step 6.22: When the terminal device initiates a re-authentication procedure with the access and mobility management network element through the second access network device, the terminal device generates a seventh key using the fourth key and the fifth parameter set.

[0257] The seventh key is used for security protection of communication between the terminal device and the second access network device.

[0258] For the implementation principle of the seventh key, please refer to the relevant introduction of the first key. For the implementation principle of the fifth parameter set, please refer to the implementation principle of the first parameter set. The relevant introduction of the implementation principle S601 of the terminal device using the fourth key and the fifth parameter set to generate the seventh key in step 6.22 will not be repeated here.

[0259] In step 6.23, the terminal device generates an eighth key using the fourth key and the sixth parameter set.

[0260] The eighth key is used for security protection of communication between the terminal device and the first access network device.

[0261] Further, the sixth parameter set includes a third parameter. The third parameter is used to instruct the terminal device to perform dual access, or the third parameter is used to instruct the terminal device to perform satellite access, or the third parameter is an identifier of the first access network device, or the third parameter includes an uplink NAS count value for the first access network device, and the third parameter is determined according to a predefined counter or a random number.

[0262] In this way, by introducing a third parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0263] For the implementation principle of the third parameter, please refer to the relevant introduction of the first parameter. For the implementation principle of the third parameter set, please refer to the implementation principle of the first parameter set, which will not be repeated here.

[0264] For the implementation principle of the eighth key, reference may be made to the implementation principle of the third key. For the implementation principle of step 6.23, reference may be made to the relevant introduction on determining the third key in S605, which will not be repeated here.

[0265] Step 6.24: During the re-authentication process between the terminal device and the access and mobility management network element, the access and mobility management network element obtains a fourth key.

[0266] For the implementation principle of the fourth key, please refer to the relevant introduction of step 6.21. For the principle of the access and mobility management network element obtaining the fourth key in step 6.24, please refer to the relevant introduction of step 6.14, which will not be repeated here.

[0267] Step 6.25: When the terminal device initiates a re-authentication process with the access and mobility management network element through the second access network device, the access and mobility management network element generates a seventh key using the fourth key and the fifth parameter set.

[0268] The seventh key is used for security protection of communication between the terminal device and the second access network device.

[0269] For the implementation principle of the fifth parameter set and the seventh key, please refer to the relevant introduction of step 6.22.

[0270] For the implementation principle of step 6.25, please refer to the relevant introduction of S601, which will not be repeated here.

[0271] Step 6.26: The access and mobility management network element generates an eighth key using the fourth key and the sixth parameter set.

[0272] The eighth key is used for security protection of communication between the terminal device and the first access network device. The sixth parameter set is used to make the eighth key different from the seventh key.

[0273] The sixth parameter set includes the third parameter. For the implementation of the third parameter, the sixth parameter set and the eighth key, please refer to the relevant introduction of step 6.26, and for the implementation principle of step 6.26, please refer to the relevant introduction of S603, which will not be repeated here.

[0274] Step 6.27: The access and mobility management network element sends the seventh key information and the eighth key information.

[0275] The information of the seventh key and the information of the eighth key may include fourth information and fifth information, wherein the fourth information is used to indicate the seventh key, and the fifth information is used to indicate the eighth key.

[0276] The above step 6.27 may include: the access and mobility management network element sends fifth information to the first access network device. The access and mobility management network element sends fourth information to the second access network device.

[0277] It is understandable that the fourth information and the fifth information can also be used to indicate that the context of the terminal device has been modified, and the fourth information and the fifth information can also be called context modification messages. The fourth information and the fifth information can be carried in the same message or in different messages.

[0278] Optionally, Figure 6 The provided method may further include: the second access network device receiving seventh key information and eighth key information from an access and mobility management network element.

[0279] Or, optionally, in the case where the seventh key information and the eighth key information may include the fourth information and the fifth information, Figure 6 The provided method may further include: the first access network device receiving fifth information from the access and mobility management function network element. The second access network device receiving fourth information from the access and mobility management function network element.

[0280] In this way, on the one hand, the key update in the re-authentication process between the terminal device and the access and mobility management network element can be realized, further improving security. On the other hand, the terminal device generates a key for security protection of communication between the terminal device and the first access network device and a key for security protection of communication between the terminal device and the second access network device according to a preset rule. When the access and mobility management network element calculates the key using the same rule as the terminal device, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent.

[0281] also, Figure 6 The provided method can also include step 6.28.

[0282] Step 6.28: The terminal device and the access and mobility management network element complete the security mode command process based on the seventh key and the eighth key.

[0283] For the implementation principle of step 6.28, please refer to the relevant introduction in step 6.01, which will not be repeated here.

[0284] also, Figure 6 The provided method may further include step 6.29.

[0285] Step 6.29: The access and mobility management network element may still send information indicating the third parameter to the terminal device. Correspondingly, the terminal device may receive information indicating the third parameter from the access and mobility management network element.

[0286] For the implementation principle of step 6.29, please refer to the relevant introduction of S606, which will not be repeated here.

[0287] It should be understood that the steps of the above Design 3 or Design 4 can be performed in each re-authentication process between the terminal device and the access and mobility management network element, that is, the process of the above Design 3 or Design 4 can be performed once or multiple times.

[0288] based on Figure 6 The provided communication method generates a security key between a terminal device and a first access network device according to a first key and a first parameter set, i.e., a first key, and generates a security key between a terminal device and a second access network device according to the first key and a second parameter set, i.e., a third key. It can be seen that the generation of the second key and the third key both depend on the first key. In this way, the dependence of the third key on the second key can be avoided. In other words, the security key between the terminal device and the second access network device can be independent of the security key between the terminal device and the first access network device, so that the method can be applied to more scenarios, i.e., the applicability is improved.

[0289] In some possible designs, there is no communication interface between the first access network device and the second access network device, or the communication interface between the first access network device and the second access network device cannot communicate.

[0290] Since the first key can be calculated by the terminal device, that is, the first key does not rely on the communication between the first access network device and the second access network device, in this way, when there is no communication interface between the first access network device and the second access network device or the communication interface between the first access network device and the second access network device cannot communicate, security isolation between the first access network device and the second access network device can still be achieved.

[0291] For example, the Xn interface between the first access network device and the second access network device does not exist, or the Xn interface between the first access network device and the second access network device cannot be used for communication. Since the first key can be calculated by the terminal device, that is, the generation of the first key does not depend on the Xn connection between the first access network device and the second access network device, in this way, when the Xn interface between the first access network device and the second access network device does not exist or the Xn interface cannot be used for communication, the security isolation between the first access network device and the second access network device can still be achieved.

[0292] Understandable, Figure 6 The key generation function in different steps of the provided method is the same. The implementation of the key generation function can refer to the above Figure 4 The key generation function in the provided method will not be described in detail here.

[0293] In some scenarios, the first access network device may also be understood as a primary access network device in the initial authentication process, and the second access network device may also be understood as a secondary access network device in the initial authentication process.

[0294] In some embodiments, the access and mobility management network element may trigger a re-authentication process between the terminal device and the access and mobility management network element according to a local policy. For example, when the terminal device moves or switches, the access and mobility management network element may trigger a re-authentication process. For another example, the access and mobility management network element may trigger a re-authentication process according to a preset period. In this case, the terminal device may determine the security key between different access network devices and the terminal device according to a predetermined rule. Figure 8 The present invention describes a communication method in a re-authentication process between a terminal device and an access and mobility management network element.

[0295] like Figure 8 As shown, the communication method includes:

[0296] S800: The terminal device communicates with the network through at least two access network devices.

[0297] Among them, the at least two access network devices may include a third access network device and a fourth access network device.

[0298] Scenario 1: In the case where the third access network device is the access network device for dual connection of the terminal device and is the access network device that initiates the first authentication process, the third access network device is taken as the first access network device as a reference, and the fourth access network device may be the second access network device.

[0299] Scenario 2: Among the access network devices for which the third access network device performs dual connection with the terminal device, the access network device initiates the re-authentication process.

[0300] Scenario 2.1: The access network device that initiates the re-authentication process, that is, the third access network device may be the access network device that the terminal device initiates the initial authentication process, such as Figure 6 The first access network device in the provided method; the fourth access network device can be the above Figure 6 The second access network in the provided method is transposed.

[0301] Scenario 2.2: The access network device that initiates the re-authentication process, i.e., the third access network device, may be the above-mentioned Figure 6 The second access network device in the provided method. The fourth access network device may be the above Figure 6 The first access network device in the provided method.

[0302] The terminal device communicates with the network through at least two access network devices, and the terminal device registers with the network through at least two access network devices. For the relevant introduction of S800, please refer to Figure 6 The relevant introduction of S601 to S606 in the provided method will not be repeated here.

[0303] S801, the terminal device initiates a re-authentication process with the access and mobility management network element.

[0304] The implementation principle of the terminal device initiating the re-authentication process can be referred to the relevant introduction in the existing technology, which will not be repeated here.

[0305] S802: The terminal device obtains a ninth key.

[0306] It should be understood that S802 may be performed when the terminal device initiates a re-authentication procedure with the access and mobility management network element.

[0307] Among them, the ninth key is used for security protection of communication between the terminal device and the access and mobility management network element.

[0308] For the implementation of the ninth key, please refer to the relevant introduction of the fourth key. For the implementation principle of S802, please refer to the relevant introduction of step 6.11 in design 3 or step 6.21 in scenario 2 of design 4, which will not be repeated here.

[0309] S803: The terminal device generates a tenth key using the ninth key and the seventh parameter set.

[0310] The tenth key is used for security protection of communication between the terminal device and the third access network device.

[0311] In the case where the third access network device is as shown in situation 1, the implementation principle of the tenth key can be referred to Figure 5 The relevant introduction of the fifth key in Design 3 of the provided method and the implementation principle of S803 can be referred to Figure 6 The introduction to step 6.12 in Design 3 of the provided method will not be repeated here.

[0312] In case 2.1, the implementation principle of the tenth key can be referred to Figure 6 For the relevant introduction of the fifth key in Design 4 of the provided method and the implementation principle of S803, please refer to the relevant introduction of step 6.12 in Scenario 1 of Design 4, which will not be repeated here.

[0313] In situation 2.2, the implementation principle of the tenth key can refer to the relevant introduction of the seventh key, and the implementation principle of S803 can refer to the relevant introduction of step 6.22 in scenario 2 of design 4, which will not be repeated here.

[0314] S804: The terminal device generates an eleventh key using the ninth key and the eighth parameter set.

[0315] The eleventh key is used for security protection of communication between the terminal device and the fourth access network device. The fourth access network device is different from the third access network device. For example, in a dual connection scenario, the fourth access network device is an access network device other than the third access network device among the access network devices for dual connection of the terminal device. The eighth parameter set is used to make the eleventh key different from the tenth key.

[0316] In one possible design, the eighth parameter set includes a fourth parameter, wherein the fourth parameter is used to indicate that the terminal device requests dual access, or the fourth parameter is used to indicate that the terminal device performs satellite access, or the fourth parameter is an identifier of a fourth access network device, or the fourth parameter includes an uplink NAS count value for the fourth access network device, or the fourth parameter is determined according to a predefined counter or a random number.

[0317] In this way, by introducing the fourth parameter, the key between the terminal device and the second access network device can be different from the key between the terminal device and the first access network device, and the other parameters in the first parameter set can use the parameters in the existing standard, thereby reducing the complexity of the key generation process between the terminal device and the access network device.

[0318] In case 1, the implementation principle of the eleventh key can refer to the sixth key, and the relevant introduction of S804 can refer to the relevant introduction of step 6.13, which will not be repeated here.

[0319] In the case of scenario 2.1, the implementation principle of the eleventh key can refer to the relevant introduction of the sixth key, and the relevant introduction of S804 can refer to the relevant introduction of step 6.13, which will not be repeated here.

[0320] In case 2.2, the implementation principle of the eleventh key can refer to the relevant introduction of the eighth key, and the implementation principle of S804 can refer to the relevant introduction of step 6.23 in scenario 2 of design 4, which will not be repeated here.

[0321] S805: The access and mobility management network element obtains a ninth key.

[0322] It should be understood that S805 may be performed when the terminal device initiates a re-authentication procedure with the access and mobility management network element.

[0323] Among them, the ninth key is used for security protection of communication between the terminal device and the access and mobility management network element.

[0324] For the implementation of the ninth key, please refer to the relevant introduction in S802, which will not be repeated here.

[0325] In case 1 and case 2.1, the implementation principle of S805 can be referred to the relevant introduction of step 6.14 in design 3, which will not be repeated here.

[0326] In case 2.2, the implementation principle of S805 can be found in the relevant introduction of step 6.24 in design 4, which will not be repeated here.

[0327] For the implementation principle of S805, please refer to the relevant introduction of step 6.14 or step 6.24, which will not be repeated here.

[0328] S806: The access and mobility management network element generates a tenth key using the ninth key and the seventh parameter set.

[0329] In scenario 1, the implementation principle of the tenth key may refer to the relevant introduction of the fifth key, and the implementation principle of S806 may refer to the relevant introduction of step 6.15, which will not be repeated here.

[0330] In situation 2.1, the implementation principle of the tenth key can refer to the relevant introduction of the fifth key, and the implementation principle of S806 can refer to the relevant introduction of step 6.15 in scenario 1 of design 4, which will not be repeated here.

[0331] In situation 2.2, the implementation principle of the tenth key can refer to the relevant introduction of the seventh key, and the implementation principle of S806 can refer to the relevant introduction of step 6.25 in scenario 2 of design 4, which will not be repeated here.

[0332] S807: The access and mobility management network element generates an eleventh key using the ninth key and the eighth parameter set.

[0333] In case 1, the implementation principle of the eleventh key can be referred to Figure 6 For the introduction of the sixth key in the provided method, please refer to S807 Figure 6 The relevant introduction of step 6.16 in the provided method will not be repeated here.

[0334] In case 2.1, the implementation principle of the eleventh key can be referred to Figure 6 For the introduction of the sixth key in the provided method, please refer to S807 Figure 6 The relevant introduction of step 6.16 in the provided method will not be repeated here.

[0335] In case 2.2, the implementation principle of the eleventh key can refer to Figure 6 For the introduction of the eighth key in the provided method, the implementation principle of S807 can be referred to Figure 6 The introduction to step 6.26 in Design 4 of the provided method will not be repeated here.

[0336] S808, the access and mobility management network element sends information about the tenth key and information about the eleventh key. The third access network device receives the information about the tenth key. The fourth access network device receives the information about the eleventh key.

[0337] In the case of scenario 1 and scenario 2.1, the implementation principle of S808 can be referred to the relevant introduction of step 6.17, which will not be repeated here.

[0338] In the case of scenario 2.2, the implementation principle of S808 can be referred to the relevant introduction of step 6.27, which will not be repeated here.

[0339] Understandable, Figure 7 The provided method may further include S809.

[0340] S809, the terminal device and the access and mobility management network element complete the security mode command process based on the tenth key and the eleventh key.

[0341] In case 1 and case 2.1, the implementation principle of S809 can refer to the relevant introduction of step 6.18; in case 2.2, the implementation principle of S809 can refer to the relevant introduction of step 6.28, which will not be repeated here.

[0342] based on Figure 8 The methods provided,

[0343] In the process of re-authentication between the terminal device and the access and mobility management network element, the terminal device can generate the tenth key and the eleventh key based on the ninth key. It can be seen that the generation of the tenth key and the eleventh key depends on the ninth key. In this way, the dependence of the eleventh key on the tenth key can be avoided, that is, the security key between the terminal device and the fourth access network device can be independent of the security key between the terminal device and the third access network device.

[0344] In addition, since the ninth key can be calculated by the terminal device, that is, the ninth key does not rely on the communication between the third access network device and the fourth access network device, therefore, when there is no communication interface between the third access network device and the fourth access network device or the communication interface between the third access network device and the fourth access network device cannot communicate, the security isolation between the third access network device and the fourth access network device in the re-authentication process can still be achieved.

[0345] For example, in one possible design, the Xn interface between the third access network device and the fourth access network device does not exist, or the Xn interface between the third access network device and the fourth access network device cannot be used for communication. Since the ninth key can be calculated by the terminal device, that is, the generation of the ninth key does not depend on the Xn connection between the third access network device and the fourth access network device, in this way, when there is no Xn interface between the third access network device and the fourth access network device or the Xn interface cannot be used for communication, the security isolation between the third access network device and the fourth access network device in the re-authentication process can still be achieved.

[0346] In addition, the terminal device generates a key for security protection of communication between the terminal device and the first access network device, and a key for security protection of communication between the terminal device and the second access network device according to preset rules. When the access and mobility management network element uses the same rules as the terminal device to calculate the key, it can ensure that the key between the terminal device and the first access network device is consistent, and the key between the terminal device and the second access network device is consistent.

[0347] It should be understood that Figure 8 The key generation function used in different steps of the provided method is the same. The implementation of the key generation function can refer to the above Figure 4The key generation function in the provided method will not be described in detail here.

[0348] Combination of the above Figure 6-Figure 8 The communication method provided in the embodiment of the present application is described in detail. The following describes a communication device for executing the communication method provided in the embodiment of the present application. The communication device can be used to execute the above Figure 6 ,or Figure 8 In the method embodiment, the function of the terminal, the first access network device, the second access network device or the access and mobility management network element, or the communication device includes a function for performing the above Figure 6 ,or Figure 8 In the method embodiment, the communication device can be used to perform the functions of the terminal, the first access network device, the second access network device or the access and mobility management network element. Figure 8 The communication device includes a function for executing Figure 8 A unit (or module) that implements the functions of a terminal device, a third access network device, a fourth access network device or an access and mobility management network element.

[0349] It is understandable that, in order to realize the above functions, the communication device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0350] The embodiment of the present application can divide the functional modules of the communication device according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or software functional module.

[0351] For example, Fig. 9 The structure diagram of the communication device provided in the embodiment of the present application. The communication device may be a terminal device or a network device, or a chip (system) or other parts or components that can be set in the terminal device or the network device. Fig. 9As shown, the communication device 900 may include a processor 901. Optionally, the communication device 900 may also include a memory 902 and / or a transceiver 903. The processor 901 is coupled with the memory 902 and the transceiver 903, such as being connected via a communication bus.

[0352] Combine the following Fig. 9 The components of the communication device 900 are described in detail:

[0353] The processor 901 is the control center of the communication device 900, and may be a processor or a general term for multiple processing elements. For example, the processor 901 is one or more central processing units (CPUs), or may be application specific integrated circuits (ASICs), or may be configured to implement one or more integrated circuits of the embodiments of the present application, such as one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs).

[0354] Optionally, the processor 901 may perform various functions of the communication device 900 by running or executing a software program stored in the memory 902 and calling data stored in the memory 902 .

[0355] In a specific implementation, as an embodiment, the processor 901 may include one or more CPUs, such as Fig. 9 CPU0 and CPU1 are shown in FIG.

[0356] In a specific implementation, as an embodiment, the communication device 900 may also include multiple processors, such as Fig. 9 901 and processor 904 are shown in FIG. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0357] The memory 902 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 901. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0358] Optionally, the memory 902 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 902 may be integrated with the processor 901, or may exist independently and be communicated to the processor 901 through the interface circuit ( Fig. 9 (not shown) is coupled to the processor 901, which is not specifically limited in the embodiment of the present application.

[0359] The transceiver 903 is used for communication with other communication devices. For example, if the communication device 900 is a terminal device, the transceiver 903 can be used to communicate with a network device, or with another terminal device. For another example, if the communication device 900 is a network device, the transceiver 903 can be used to communicate with a terminal device, or with another network device.

[0360] Optionally, the transceiver 903 may include a receiver and a transmitter ( Fig. 9 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0361] Optionally, the transceiver 903 may be integrated with the processor 901, or may exist independently and communicate with the processor 901 through the interface circuit ( Fig. 9 (not shown) is coupled to the processor 901, which is not specifically limited in the embodiment of the present application.

[0362] It should be noted that Fig. 9 The structure of the communication device 900 shown in the figure does not constitute a limitation on the communication device. The actual communication device may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0363] In addition, the technical effects of the communication device 900 can refer to the technical effects of the communication method described in the above method embodiment, and will not be repeated here.

[0364] It should be understood that the processor in the embodiment of the present application may be a CPU, and the processor may also be other general-purpose processors, DSPs, ASICs, FPGAs or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0365] It should also be understood that the memory in the embodiment of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory. Among them, the non-volatile memory can be a ROM, a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (erasable PROM, EPROM), an EEPROM or a flash memory. The volatile memory can be a RAM, which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (doubledata rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus RAM, DR RAM).

[0366] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0367] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0368] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0369] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0370] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0371] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0372] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0373] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0374] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0375] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0376] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: The method comprises: In a process in which a terminal device communicates with a network through a first access network device, an access and mobility management network element generates a second key using a first key and a first parameter set, wherein the second key is used for security protection of communication between the terminal device and the first access network device, the first key is used for security protection of communication between the terminal device and the access and mobility management network element, and the first parameter set includes an access type identification code of the terminal device; In a process in which a terminal device communicates with a network through a second access network device, the access and mobility management network element generates a third key using the first key and the second parameter set, the third key being used for security protection of communication between the terminal device and the second access network device, and the second parameter set being used to make the third key different from the second key; The access and mobility management network element sends the third key to the second access network device.

2. The method according to claim 1, characterized in that The second parameter set includes the first parameter, wherein: The first parameter is used to instruct the terminal device to perform dual access, or, The first parameter is used to instruct the terminal device to perform satellite access, or, The first parameter is an identifier of the second access network device, or, The first parameter includes an uplink non-access stratum NAS count value for the second access network device, or, The first parameter is determined according to a predefined counter or a random number.

3. The method according to claim 1 or 2, characterized in that: The process of the terminal device communicating with the network through the first access network device is the process of the terminal device registering with the network through the first access network device, and the process of the terminal device communicating with the network through the second access network device is the process of the terminal device registering with the network through the second access network device.

4. The method according to any one of claims 1 to 3, characterized in that The access and mobility management network element generates a second key using the first key and the first parameter set, including: The access and mobility management network element inputs the first key and the first parameter set into a key generation function to obtain the second key; The access and mobility management network element generates a third key using the first key and the second parameter set, including: The access and mobility management network element inputs the first key and the second parameter set into the key generation function to obtain the third key.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: The access and mobility management network element sends a security mode command to the terminal device; wherein the security mode command includes information for indicating the first parameter.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: In the process of re-authentication of the terminal device, the terminal device obtains a fourth key; wherein the fourth key is used for security protection of communication between the terminal device and the access and mobility management network element, and is used to replace the first key.

7. The method according to claim 6, characterized in that The method further comprises: The access and mobility management network element generates a fifth key using the fourth key and the third parameter set; wherein the fifth key is used for security protection of communication between the terminal device and the first access network device; and the first parameter set includes an access type identification code of the terminal device; The access and mobility management network element generates a sixth key using the fourth key and the fourth parameter set; wherein the sixth key is used for security protection of communication between the terminal device and the second access network device, and the fourth parameter set is used to make the sixth key different from the fifth key; The access and mobility management network element sends the fifth key information and the sixth key information.

8. The method according to claim 7, characterized in that The access and mobility management network element generates a fifth key using the fourth key and the third parameter set, including: In a case where the terminal device initiates a re-authentication procedure through the first access network device, the access and mobility management network element generates a fifth key using the fourth key and the third parameter set.

9. The method according to claim 7 or 8, characterized in that: The fourth parameter set includes the second parameter, wherein: The second parameter is used to instruct the terminal device to perform dual access, or, The second parameter is used to instruct the terminal device to perform satellite access, or, The second parameter is an identifier of the second access network device, or, The second parameter includes an uplink non-access stratum NAS count value for the second access network device, or, The second parameter is determined according to a predefined counter or a random number.

10. The method according to claim 6, characterized in that The method further comprises: In a case where the terminal device initiates a re-authentication process through the second access network device, the access and mobility management network element generates a seventh key using a fourth key and a fifth parameter set, the seventh key being used for security protection of communication between the terminal device and the second access network device, the fifth parameter set including an access type identification code of the terminal device; The access and mobility management network element generates an eighth key using the fourth key and the sixth parameter set; wherein the eighth key is used for security protection of communication between the terminal device and the first access network device, and the sixth parameter set is used to make the eighth key different from the seventh key; The access and mobility management network element sends the seventh key information and the eighth key information.

11. The method according to claim 10, characterized in that The sixth parameter set includes the third parameter, wherein: The third parameter is used to instruct the terminal device to perform dual access, or, The third parameter is used to instruct the terminal device to perform satellite access, or, The third parameter is an identifier of the second access network device, or, The third parameter includes an uplink non-access stratum NAS count value for the second access network device, or, The third parameter is determined according to a predefined counter or a random number.

12. A communication method, characterized in that: The method comprises: In a process of communicating with a network through a first access network device, a terminal device generates a second key using a first key and a first parameter set, wherein the second key is used for security protection of communication between the terminal device and the first access network device, the first key is used for security protection of communication between the terminal device and an access and mobility management network element, and the first parameter set includes an access type identification code of the terminal device; In the process of communicating with the network through the second access network device, the terminal device uses the first key and the second parameter set to generate a third key, the third key is used for security protection of communication between the terminal device and the second access network device, and the second parameter set is used to make the third key different from the second key.

13. The method according to claim 12, characterized in that The second parameter set includes the first parameter, wherein: The first parameter is used to instruct the terminal device to perform dual access, or, The first parameter is used to instruct the terminal device to perform satellite access, or, The first parameter is an identifier of the second access network device, or, The first parameter includes an uplink non-access stratum NAS count value for the second access network device, or, The first parameter is determined according to a predefined counter or a random number.

14. The method according to claim 12 or 13, characterized in that The process of communicating with the network through the first access network device is the process of registering to the network through the first access network device, and the process of communicating with the network through the second access network device is the process of registering to the network through the second access network device.

15. The method according to any one of claims 12 to 14, characterized in that: The terminal device generates a second key using the first key and the first parameter set, including: The terminal device inputs the first key and the first parameter set into a key generation function to obtain the second key; The terminal device generates a third key using the first key and the second parameter set, including: The terminal device inputs the first key and the second parameter set into the key generation function to obtain the third key.

16. The method according to any one of claims 12 to 15, characterized in that: The method further comprises: The terminal device receives a security mode command from the access and mobility management network element; wherein the security mode command includes information for indicating the first parameter.

17. The method according to any one of claims 12 to 16, characterized in that: The method further comprises: During the process of re-authentication between the terminal device and the access and mobility management network element, the terminal device obtains a fourth key; wherein the fourth key is used for security protection of communication between the terminal device and the access and mobility management network element, and is used to replace the first key.

18. The method according to claim 17, characterized in that The method further comprises: The terminal device generates a fifth key using the fourth key and the third parameter set; wherein the fifth key is used for security protection of communication between the terminal device and the first access network device; the third parameter set includes an access type identification code of the terminal device; The terminal device generates a sixth key using the fourth key and a fourth parameter set; wherein the sixth key is used for security protection of communication between the terminal device and the second access network device, and the second parameter set is used to make the sixth key different from the fifth key.

19. The method according to claim 18, characterized in that The terminal device generates a fifth key using the fourth key and the third parameter set, including: When a re-authentication process is initiated by the first access network device, the terminal device generates a fifth key using the fourth key and the third parameter set.

20. The method according to claim 18 or 19, characterized in that The fourth parameter set includes the second parameter, wherein: The second parameter is used to instruct the terminal device to perform dual access, or, The second parameter is used to instruct the terminal device to perform satellite access, or, The second parameter is an identifier of the second access network device, or, The second parameter includes an uplink non-access stratum NAS count value for the second access network device, or, The second parameter is determined according to a predefined counter or a random number.

21. The method according to claim 17, characterized in that The method further comprises: In a case where the terminal device initiates a re-authentication process through the second access network device, the terminal device generates a seventh key using the fourth key and the fifth parameter set, the seventh key being used for security protection of communication between the terminal device and the second access network device, and the fifth parameter set including an access type identification code of the terminal device; The terminal device generates an eighth key using the fourth key and the sixth parameter set; wherein the eighth key is used for security protection of communication between the terminal device and the first access network device, and the sixth parameter set is used to make the eighth key different from the seventh key.

22. The method according to claim 21, characterized in that The sixth parameter set includes the third parameter, wherein: The third parameter is used to instruct the terminal device to perform dual access, or, The third parameter is used to instruct the terminal device to perform satellite access, or, The third parameter is an identifier of the second access network device, or, The third parameter includes an uplink non-access stratum NAS count value for the second access network device, or, The third parameter is determined according to a predefined counter or a random number.

23. A communication method, characterized in that: The method comprises: In a process of reauthenticating a terminal device with an access and mobility management network element, the terminal device obtains a ninth key; wherein the ninth key is used for security protection of communication between the terminal device and the access and mobility management network element; The terminal device generates a tenth key using the ninth key and the seventh parameter set; wherein the tenth key is used for security protection of communication between the terminal device and a third access network device; the seventh parameter set includes an access type identification code of the terminal device; The terminal device uses the ninth key and the eighth parameter set to generate an eleventh key; the fourth access network device is different from the third access network device, and the eleventh key is used for security protection of communication between the terminal device and the fourth access network device; the eighth parameter set is used to make the eleventh key different from the tenth key.

24. The method according to claim 23, characterized in that The eighth parameter set includes the fourth parameter, wherein: The fourth parameter is used to indicate that the terminal device requests dual access, or, The fourth parameter is used to instruct the terminal device to perform satellite access, or, The fourth parameter is an identifier of the fourth access network device, or, The fourth parameter includes an uplink non-access stratum NAS count value for the fourth access network device, or, The fourth parameter is determined according to a predefined counter or a random number.

25. A communication method, characterized in that: The method comprises: In a process of reauthenticating the terminal device and the access and mobility management network element, the access and mobility management network element obtains a ninth key; wherein the ninth key is used for security protection of communication between the terminal device and the access and mobility management network element; The access and mobility management network element generates a tenth key using the ninth key and the seventh parameter set; wherein the tenth key is used for security protection of communication between the terminal device and the third access network device; the seventh parameter set includes an access type identification code of the terminal device; The access and mobility management network element generates an eleventh key using the ninth key and the eighth parameter set; the fourth access network device is different from the third access network device, and the eleventh key is used for security protection of communication between the terminal device and the fourth access network device; the eighth parameter set is used to make the eleventh key different from the tenth key; The access and mobility management network element sends the information of the tenth key and the information of the eleventh key.

26. The method according to claim 25, characterized in that The eighth parameter set includes the fourth parameter, wherein: The fourth parameter is used to indicate that the terminal device requests dual access, or, The fourth parameter is used to instruct the terminal device to perform satellite access, or, The fourth parameter is an identifier of the fourth access network device, or, The fourth parameter includes an uplink non-access stratum NAS count value for the fourth access network device, or, The fourth parameter is determined according to a predefined counter or a random number.

27. A communication device, characterized in that: The communication device is used to execute the communication method according to any one of claims 1 to 26.

28. A communication device, characterized in that: include: a processor coupled to the memory; The processor is configured to execute a computer program stored in the memory so that the communication device executes the communication method according to any one of claims 1 to 26.

29. A communication device, characterized in that: include: processor and interface circuit; wherein, The interface circuit is used to receive code instructions and transmit them to the processor; The processor is configured to execute the code instructions to perform the method according to any one of claims 1-26.

30. A communication device, characterized in that: The communication device includes a processor and a transceiver, the transceiver is used for information exchange between the communication device and other communication devices, and the processor executes program instructions to perform the communication method according to any one of claims 1-26.

31. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a computer program or an instruction. When the computer program or the instruction is executed on a computer, the computer is caused to execute the communication method according to any one of claims 1 to 26.

32. A computer program product, characterized in that The computer program product comprises: a computer program or instructions, and when the computer program or instructions are executed on a computer, the computer is caused to execute the communication method according to any one of claims 1 to 26.

Images