Terminal authentication method and device, terminal and equipment

Abstract

The invention provides a terminal authentication method and device, a terminal and equipment. The method comprises the following steps: a terminal receives a registration token sent by network side equipment; the network side equipment is deployed in a core network or a satellite; and the terminal sends the registration token to a first network element deployed on the satellite, and executes an authentication and / or registration operation on the satellite based on the registration token. According to the embodiment of the invention, the satellite or the core network generates the registration token and sends the registration token to the terminal, and the terminal provides the registration token to the satellite, so that the satellite uses the registration token to authenticate and / or register the terminal. The scheme is suitable for a data storage and forwarding scene for satellite processing, and can ensure secure data transmission in the satellite storage and forwarding scene.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a terminal authentication method, device, terminal and equipment. Background Art

[0002] Non-Terrestrial Network (NTN) allows base stations to be deployed on satellites and supports a communication mode called Store and Forward (S&F). S&F is used for satellite communication services that allow a certain degree of communication delay, such as some IoT applications.

[0003] In the prior art, satellite store-and-forward refers to a complete data transmission between the user equipment (UE), the satellite and the core network, which is divided into two phases in time: Phase 1: the service connection between the UE and the satellite; Phase 2: the feeder link between the core network and the satellite. These two phases are executed at different times. The execution order of phase 1 and phase 2 is different depending on whether the data interaction between the UE and the core network is upload or download.

[0004] Since the core network and UE need to perform multiple real-time interactions to complete the relevant security process during the current security authentication and security establishment process, this mechanism cannot be directly applied to satellite storage and forwarding scenarios, and cannot guarantee the secure transmission of data in satellite storage and forwarding scenarios. Summary of the invention

[0005] The purpose of this application is to provide a terminal authentication method, device, terminal and equipment, which solves the problem that the current security mechanism cannot guarantee the secure transmission of data in a satellite storage and forwarding scenario.

[0006] An embodiment of the present application provides a terminal authentication method, including:

[0007] The terminal receives a registration token sent by a network-side device; the network-side device is deployed in a core network or a satellite;

[0008] The terminal sends the registration token to a first network element deployed on the satellite, and performs authentication and / or registration operations on the satellite based on the registration token.

[0009] Optionally, before receiving the registration token sent by the network side device, the method further includes:

[0010] An authentication and / or registration operation is performed on the network side device based on the terminal authentication vector.

[0011] Optionally, the receiving a registration token sent by the network side device includes:

[0012] When the authentication and / or registration operation based on the terminal authentication vector on the network side device is completed, a registration token sent by the network side device is received and the registration token is stored; wherein the registration token includes a terminal registration context.

[0013] Optionally, sending the registration token to a first network element deployed on the satellite includes:

[0014] A registration request message is sent to a first network element deployed on the satellite, where the registration request message carries the registration token.

[0015] Optionally, after performing an authentication and / or registration operation on the satellite based on the registration token, the method further includes:

[0016] receiving an updated registration token sent by the first network element, wherein the updated registration token includes an updated terminal registration context;

[0017] The updated registration token is stored.

[0018] An embodiment of the present application provides a terminal authentication method, including:

[0019] The first network element deployed on the satellite receives the registration token sent by the terminal;

[0020] The first network element authenticates and / or registers the terminal based on the registration token.

[0021] Optionally, before receiving the registration token sent by the terminal, the method further includes:

[0022] Receiving a terminal authentication vector sent by a unified data management entity (UDM) of the core network;

[0023] The terminal is authenticated and / or registered based on the terminal authentication vector.

[0024] Optionally, before receiving the registration token sent by the terminal, the method further includes:

[0025] Obtaining the registration token;

[0026] The registration token is sent to the terminal.

[0027] Optionally, the obtaining the registration token includes:

[0028] The first network element sends a first token generation request message to a key management function (KMF) deployed on the satellite, wherein the first token generation request message includes a terminal registration context data structure, wherein the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite; the KMF deployed on the satellite is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0029] The first network element receives a first response message sent by the KMF deployed on the satellite, where the first response message includes the registration token.

[0030] Optionally, after sending the registration token to the terminal, the method includes:

[0031] Sending a terminal registration status report and / or a terminal registration context to a second network element of the core network.

[0032] Optionally, after receiving the registration token sent by the terminal, include:

[0033] The first network element sends a token verification request message to the KMF deployed on the satellite, wherein the token verification request message includes the registration token; the KMF deployed on the satellite is used to decrypt the registration token using a token decryption key, and verify the registration token using a token verification key to obtain a terminal registration context;

[0034] The first network element receives a terminal registration context sent by a KMF deployed on the satellite;

[0035] The first network element authenticates and / or registers the terminal using the terminal registration context.

[0036] Optionally, the KMF deployed on the satellite is used to store the token generation key and the token verification key; the token generation key and the token verification key are sent by the KMF of the core network.

[0037] Optionally, after authenticating and / or registering the terminal based on the registration token, the method further includes:

[0038] Obtaining an updated registration token, wherein the updated registration token includes an updated terminal registration context;

[0039] The updated registration token is sent to the terminal.

[0040] An embodiment of the present application provides a terminal authentication method, including:

[0041] The second network element of the core network obtains a registration token;

[0042] The second network element of the core network sends the registration token to the terminal.

[0043] Optionally, before obtaining the registration token, the method further includes:

[0044] The terminal is authenticated and / or registered based on the terminal authentication vector.

[0045] Optionally, obtaining a registration token includes:

[0046] The second network element of the core network sends a second token generation request message to the KMF of the core network, where the second token generation request message includes a terminal registration context data structure, where the terminal registration context data structure is generated based on the relevant information required for the terminal to access the satellite device; the KMF of the core network is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0047] The second network element of the core network receives a second response message sent by the KMF of the core network, where the second response message includes the registration token.

[0048] Optionally, the KMF of the core network is further used to: send a token generation key and a token verification key to the KMF deployed on the satellite.

[0049] Optionally, the method further includes:

[0050] Receive a terminal registration status report and / or a terminal registration context sent by a first network element deployed on a satellite.

[0051] An embodiment of the present application provides a terminal, including: a memory, a transceiver, and a processor:

[0052] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0053] Receiving a registration token sent by a network side device; the network side device is deployed in a core network or a satellite;

[0054] The registration token is sent to a first network element deployed on the satellite, and an authentication and / or registration operation is performed on the satellite based on the registration token.

[0055] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0056] An authentication and / or registration operation is performed on the network side device based on the terminal authentication vector.

[0057] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0058] When the authentication and / or registration operation based on the terminal authentication vector on the network side device is completed, a registration token sent by the network side device is received and the registration token is stored; wherein the registration token includes a terminal registration context.

[0059] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0060] A registration request message is sent to a first network element deployed on the satellite, where the registration request message carries the registration token.

[0061] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0062] receiving an updated registration token sent by the first network element, wherein the updated registration token includes an updated terminal registration context;

[0063] The updated registration token is stored.

[0064] An embodiment of the present application provides a satellite device, including: a memory, a transceiver, and a processor:

[0065] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0066] Receive the registration token sent by the terminal;

[0067] The terminal is authenticated and / or registered based on the registration token.

[0068] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0069] Receiving the terminal authentication vector sent by the unified data management entity UDM of the core network;

[0070] The terminal is authenticated and / or registered based on the terminal authentication vector.

[0071] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0072] Obtaining the registration token;

[0073] The registration token is sent to the terminal.

[0074] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0075] Sending a first token generation request message to a key management function KMF deployed on the satellite, wherein the first token generation request message includes a terminal registration context data structure, wherein the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite; the KMF deployed on the satellite is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0076] A first response message sent by a KMF deployed on the satellite is received, where the first response message includes the registration token.

[0077] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0078] Sending a terminal registration status report and / or a terminal registration context to a second network element of the core network.

[0079] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0080] Sending a token verification request message to the KMF deployed on the satellite, wherein the token verification request message includes the registration token; the KMF deployed on the satellite is used to decrypt the registration token using a token decryption key, and verify the registration token using a token verification key to obtain a terminal registration context;

[0081] Receiving a terminal registration context sent by a KMF deployed on the satellite;

[0082] The terminal is authenticated and / or registered using the terminal registration context.

[0083] Optionally, the KMF deployed on the satellite is used to store the token generation key and the token verification key; the token generation key and the token verification key are sent by the KMF of the core network.

[0084] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0085] Obtaining an updated registration token, wherein the updated registration token includes an updated terminal registration context;

[0086] The updated registration token is sent to the terminal.

[0087] An embodiment of the present application provides a core network device, including: a memory, a transceiver, and a processor:

[0088] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0089] Get a registration token;

[0090] The registration token is sent to the terminal.

[0091] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0092] The terminal is authenticated and / or registered based on the terminal authentication vector.

[0093] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0094] Sending a second token generation request message to the KMF of the core network, wherein the second token generation request message includes a terminal registration context data structure, wherein the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite device; the KMF of the core network is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0095] Receive a second response message sent by the KMF of the core network, where the second response message includes the registration token.

[0096] Optionally, the KMF of the core network is further used to: send a token generation key and a token verification key to the KMF deployed on the satellite.

[0097] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0098] Receive a terminal registration status report and / or a terminal registration context sent by a first network element deployed on a satellite.

[0099] An embodiment of the present application provides an authentication device for a terminal, including:

[0100] A first receiving unit is used to receive a registration token sent by a network side device; the network side device is deployed in a core network or a satellite;

[0101] The first sending unit is used to send the registration token to a first network element deployed on the satellite, and perform authentication and / or registration operations on the satellite based on the registration token.

[0102] An embodiment of the present application provides an authentication device for a terminal, including:

[0103] A second receiving unit, configured to receive a registration token sent by a terminal;

[0104] The first processing unit is configured to authenticate and / or register the terminal based on the registration token.

[0105] An embodiment of the present application provides an authentication device for a terminal, including:

[0106] A first acquisition unit, used to acquire a registration token;

[0107] The second sending unit is used to send the registration token to the terminal.

[0108] An embodiment of the present application provides a processor-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the terminal authentication method described above are implemented.

[0109] The beneficial effects of the above technical solution of the present application are:

[0110] In an embodiment of the present application, a satellite or a core network generates a registration token and sends it to a terminal, and the terminal provides the registration token to the satellite, so that the satellite uses the registration token to authenticate and / or register the terminal. This solution is applicable to data storage and forwarding scenarios processed by satellites, and can ensure secure data transmission in satellite storage and forwarding scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0111] Figure 1 A schematic diagram showing a flow chart of a terminal authentication method according to an embodiment of the present application;

[0112] Figure 2 A schematic diagram showing the authentication architecture of a satellite storage and forwarding system according to an embodiment of the present application;

[0113] Figure 3 A second flowchart of the terminal authentication method according to an embodiment of the present application is shown;

[0114] Figure 4 A third flowchart of the terminal authentication method according to an embodiment of the present application is shown;

[0115] Figure 5 A fourth flowchart of the terminal authentication method according to an embodiment of the present application;

[0116] Figure 6 A fifth flowchart of the terminal authentication method according to an embodiment of the present application is shown;

[0117] Figure 7 A sixth flowchart of the terminal authentication method according to an embodiment of the present application;

[0118] Figure 8One of the structural schematic diagrams showing the authentication device of the terminal in the embodiment of the present application;

[0119] Fig. 9 A second structural diagram showing an authentication device of a terminal according to an embodiment of the present application;

[0120] Fig.10 A third structural diagram showing an authentication device of a terminal according to an embodiment of the present application;

[0121] Fig.11 A schematic diagram showing the structure of a terminal according to an embodiment of the present application;

[0122] Fig.12 A schematic diagram showing the structure of a satellite device according to an embodiment of the present application;

[0123] Fig.13 A schematic diagram showing the structure of a core network device according to an embodiment of the present application. DETAILED DESCRIPTION

[0124] In order to make the technical problems, technical solutions and advantages to be solved by the application clearer, the following will be described in detail in conjunction with the accompanying drawings and specific embodiments. In the following description, specific details such as specific configurations and components are provided only to help fully understand the embodiments of the application. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the application. In addition, for clarity and brevity, the description of known functions and structures has been omitted.

[0125] It should be understood that the references to "one embodiment" or "an embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present application. Therefore, the references to "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0126] In the various embodiments of the present application, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0127] In the embodiments of the present application, the term "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0128] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0129] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0130] The embodiments of the present application provide a terminal authentication method, apparatus, terminal and device to solve the problem that the current security mechanism cannot guarantee the secure transmission of data in a satellite storage and forwarding scenario.

[0131] Among them, the method and the device are based on the same application concept. Since the method and the device solve the problem in a similar principle, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0132] like Figure 1 As shown, an embodiment of the present application provides a terminal authentication method, which is applied to a terminal and specifically includes the following steps:

[0133] Step 101: A terminal receives a registration token sent by a network-side device; the network-side device is deployed in a core network or a satellite.

[0134] In this embodiment, the network side device can be a core network element or a network element on a satellite. For example: the network side device is the AMF of the core network or the security network element of the core network, and the security network element of the core network can be a security anchor function (SEAF) and / or an authentication service function (AUSF). Alternatively, the network side device is an AMF deployed on a satellite (referred to as S-AMF here) or a security network element of a satellite, and the security network element of the satellite can be the SEAF and / or AUSF of the satellite (referred to as S-SEAF and / or S-AUSF). It should be noted that the AMF of the core network or the security network element of the core network can be deployed independently or jointly; the AMF of the satellite or the security network element of the satellite can be deployed independently or jointly, and there is no limitation here.

[0135] The registration token may be generated by a network element on the satellite or a core network element, and the registration token may be used to authenticate and / or register the terminal. After the network-side device obtains the registration token, it sends the registration token to the terminal.

[0136] Step 102: The terminal sends the registration token to a first network element deployed on the satellite, and performs authentication and / or registration operations on the satellite based on the registration token.

[0137] When the terminal is within the coverage of the satellite, the terminal sends the registration token to the satellite, and the first network element deployed on the satellite registers and / or authenticates the terminal based on the registration token.

[0138] It should be noted that the registration token described in the embodiments of the present application may also be called an authentication token or other names, which are not specifically limited here.

[0139] Optionally, when the terminal is within the coverage of the satellite, the terminal establishes a connection with the satellite, and after the connection is established, the terminal sends the registration token to the first network element. The terminal establishing a connection with the satellite means that the terminal can communicate with the satellite, that is, the terminal and the satellite can transmit messages to each other. The connection between the terminal and the satellite can be a Radio Resource Control (RRC) connection. In this application, it is not limited whether the RRC connection is completely established, for example: it is not limited whether the RRC connection is completely established, and it is not limited whether the security connection is completely established.

[0140] In an embodiment of the present application, a satellite or a core network generates a registration token and sends it to a terminal. After the terminal establishes a connection with the satellite, the terminal provides the registration token to the satellite, so that the satellite uses the registration token to authenticate and / or register the terminal. This solution is applicable to data storage and forwarding scenarios processed by satellites, and can ensure secure data transmission in satellite storage and forwarding scenarios.

[0141] The satellite storage and forwarding system authentication architecture of the present application embodiment is as follows Figure 2 As shown, satellite store-and-forward is a complete data transmission between UE, satellite and core network, which is divided into two stages in time: Stage 1: Service connection between UE and satellite; Stage 2: Feeder connection between core network and satellite. These two stages are executed at different times. The terminal includes: multiple global user identity cards (Multi-USIM, MUSIM). The satellite equipment includes a satellite base station (S-gNB) and a feeder module. The satellite is connected to the ground core network through the NTN gateway. The ground core network equipment includes UDM, AMF / SEAF / AUSF, and UDM can provide AMF / SEAF / AUSF with authentication vectors for authenticating UE.

[0142] This application sets up a new network element in the core network: KMF, such as Figure 2As shown, the UDM, AMF / SEAF / AUSF and KMF of the core network are connected; new network elements are set on the satellite: S-KMF, lightweight S-AMF and / or security network elements (such as S-SEAF and / or S-AUSF) that can authenticate UE, such as Figure 2 As shown, the satellite's S-AMF and / or security network element, S-KMF, S-gNB, and Feeder modules are connected. The KMF of the core network is responsible for providing the S-KMF on the satellite with the token generation key for generating the UE registration token and the token resolution key for resolving the token. The S-KMF on the satellite receives, stores, and uses the token generation key and token resolution key from the KMF of the core network.

[0143] After the satellite successfully authenticates the UE, the security material (such as the security context) required for the next authentication of the UE and the related content (UE context) for enabling the UE to access the satellite are stored in a security token (i.e., the registration token), which is protected by confidentiality and integrity. The registration token is provided to the UE for storage. The UE cannot parse or modify the registration token. The next time the UE accesses the satellite, the UE provides the registration token to the satellite. The satellite uses the token parsing key to decrypt and verify the registration token, thereby restoring the UE context that allows the UE to access the satellite. The satellite then uses the security material in the security context in the UE context to authenticate the UE and establish corresponding communication security, and uses other content in the context to enable the UE to correctly access the satellite.

[0144] As an optional embodiment, before receiving the registration token sent by the network side device, the method further includes:

[0145] An authentication and / or registration operation is performed on the network side device based on the terminal authentication vector.

[0146] In this embodiment, after the terminal establishes a connection with the network side device, the network side device can authenticate and / or register the terminal based on the authentication vector. Taking the case where the network side device is a network element on a satellite, the UDM of the core network provides the authentication vector for authenticating the UE to the AMF / SEAF / AUSF located in the core network, and the AMF / SEAF / AUSF of the core network further provides the authentication vector to the S-AMF / S-SEAF / S-AUSF located in the satellite. S-AMF / S-SEAF / S-AUSF stores the authentication vector for authenticating the UE. When the UE is within the coverage of the satellite, the UE establishes a connection with the satellite. S-AMF / S-SEAF / S-AUSF uses the UE authentication vector to authenticate the UE and completes the UE registration process.

[0147] Taking the network side device as a core network element as an example, UDM provides the authentication vector for authenticating the UE to the AMF / SEAF / AUSF located in the core network. When the UE establishes a connection with the core network via satellite, the AMF / SEAF / AUSF uses the UE authentication vector to authenticate the UE and complete the UE registration process.

[0148] In this embodiment, the terminal establishing a connection with the network side device means that the terminal can communicate with the network side device, for example, the terminal and the satellite or terrestrial core network can transmit messages to each other. The connection between the terminal and the network side device can be an RRC connection. In this application, it is not limited whether the RRC connection is completely established, for example, it is not limited whether the RRC connection is completely established, and it is not limited whether the security connection is completely established.

[0149] Optionally, the receiving a registration token sent by the network side device includes:

[0150] When the authentication and / or registration operation based on the terminal authentication vector on the network side device is completed, a registration token sent by the network side device is received and the registration token is stored; wherein the registration token includes a terminal registration context.

[0151] In this embodiment, after the network side device authenticates and / or registers the terminal based on the authentication vector, the obtained registration token can be sent to the terminal. The terminal stores the registration token and sends the registration token to the satellite when accessing the satellite next time. The satellite can obtain the terminal registration context by decrypting the registration token. The satellite authenticates and / or registers the terminal based on the terminal registration context.

[0152] Optionally, the registration token can be generated by a network element on the satellite or by a core network element. Take the generation of the registration token by S-KMF on the satellite as an example: after S-AMF completes the authentication and / or registration of the terminal based on the authentication vector, S-AMF constructs a UE registration context data structure with various information (including security information) required for the next UE to access the satellite, which also includes information such as the generation information and validity period of the UE registration context provided by S-AMF; then a UE registration token generation request is sent to S-KMF, and the request includes: UE registration context data structure; S-KMF generates a registration token based on the information in the request, and uses its stored confidentiality protection key to provide confidentiality protection for the registration token, and uses the integrity protection key to provide integrity protection for the registration token; then the generated registration token is returned to S-AMF, and S-AMF sends the registration token to the terminal.

[0153] Take the generation of the registration token by the KMF of the core network as an example: after the AMF of the core network completes the authentication and / or registration of the terminal based on the authentication vector, the AMF of the core network constructs a UE registration context data structure with various information (including security information) required for the next UE to access the satellite, which also includes the generation information and validity period of the UE registration context provided by the AMF; then sends a UE registration token generation request to the KMF, and the request includes: UE registration context data structure. The KMF of the core network uses its stored confidentiality protection key to provide confidentiality protection for the token, and uses the integrity protection key to provide integrity protection for the token; the KMF of the core network returns the generated registration token to the AMF, and the AMF sends the registration token to the terminal.

[0154] As an optional embodiment, sending the registration token to the first network element deployed on the satellite includes: sending a registration request message to the first network element deployed on the satellite, wherein the registration request message carries the registration token.

[0155] Taking the example that the first network element is S-AMF, when the terminal is within the coverage of the satellite, the terminal establishes a connection with the satellite, and the terminal provides its previously stored registration token to S-AMF in the registration request message. S-AMF sends a token verification request to S-KMF, and the request includes the registration token; S-KMF decrypts the token using the token decryption key, and verifies the token using the token verification key, thereby obtaining the UE registration context; and then returns the UE registration context to S-AMF through the token verification response. S-AMF uses the UE registration context returned by S-KMF to construct a UE registration context (including a security context) that can authenticate the UE and implement UE access. S-AMF uses the constructed UE registration context to continue to complete subsequent UE authentication and UE access operations.

[0156] Optionally, after performing an authentication and / or registration operation on the satellite based on the registration token, the method further includes:

[0157] Receive an updated registration token sent by the first network element, where the updated registration token includes an updated terminal registration context; and store the updated registration token.

[0158] In this embodiment, after the satellite authenticates and / or registers the terminal, if it is decided to update the registration token, a new registration token can be generated and the updated registration token can be sent to the terminal. The terminal stores the updated registration token and completes the authentication and / or registration based on the updated registration token when accessing the satellite next time.

[0159] Taking the first network element being S-AMF as an example, if S-AMF decides to generate a new UE registration token, S-AMF constructs a variety of information (including security information) that the UE needs to use the next time it accesses the satellite into a UE registration context data structure, which also includes information such as the generation information and validity period of the UE registration context provided by S-AMF; S-AMF sends a UE registration token generation request to S-KMF, and the request includes: UE registration context data structure. S-KMF uses its stored confidentiality protection key to provide confidentiality protection for the token, and uses the integrity protection key to provide integrity protection for the token; and then returns the generated updated registration token to S-AMF through the UE registration token generation response. S-AMF provides the updated registration token to the UE, and the UE stores the updated registration token.

[0160] The satellite store-and-forward authentication process of the present application is described below through specific embodiments.

[0161] As an optional embodiment, taking the network element deployed on the satellite to generate a registration token as an example, Figure 3 As shown, including:

[0162] Step 30: The KMF in the core network provides the key material for generating the UE registration token and verifying the UE registration token to the S-KMF in the satellite. The key material may include: an encryption key and a corresponding decryption key for implementing token confidentiality protection, an integrity protection key and a corresponding integrity verification key for implementing token integrity protection. The cryptographic algorithm for implementing token security may be a cryptographic algorithm based on an asymmetric key or a cryptographic algorithm based on a symmetric key.

[0163] Step 31: UDM provides the authentication vector of the authenticated UE to the AMF / SEAF / AUSF located in the core network, and further to the S-AMF / S-SEAF / S-AUSF located in the satellite.

[0164] Step 32: S-AMF / S-SEAF / S-AUSF stores the authentication vector used to authenticate the UE.

[0165] Step 33: When the UE is within the coverage of the satellite, the UE establishes a connection with the satellite.

[0166] Step 34: S-AMF / S-SEAF / S-AUSF authenticates the UE using the UE authentication vector and completes the UE registration process.

[0167] Step 35: S-AMF constructs a UE registration context data structure with various information (including security information) required for the next UE to access the satellite. The UE registration context data structure also includes information such as the generation information and validity period of the UE registration context provided by S-AMF. S-AMF sends a UE registration token generation request to S-KMF, which includes: UE registration context data structure.

[0168] Step 36: S-KMF uses its stored confidentiality protection key to provide confidentiality protection for the token and uses the integrity protection key to provide integrity protection for the token; then returns the generated UE registration token to S-AMF through the UE registration token generation response.

[0169] Step 37: S-AMF provides the registration token to the UE, which stores the token.

[0170] Step 38: The UE and the satellite exchange data and end the connection.

[0171] Optionally, step 39: S-AMF sends UE registration status report and / or UE registration context to AMF.

[0172] Optionally, step 310: AMF stores the UE registration context and updates the UE registration status to the UDM.

[0173] Optionally, step 311: S-AMF deletes the locally stored UE registration context.

[0174] As another optional embodiment, taking the core network element generating a registration token as an example, Figure 4 As shown, including:

[0175] Step 40: The KMF in the core network provides the key material for generating the UE authentication token and verifying the UE authentication token to the S-KMF in the satellite. The key material may include: an encryption key and a corresponding decryption key for implementing token confidentiality protection, an integrity protection key and a corresponding integrity verification key for implementing token integrity protection. The cryptographic algorithm for implementing token security may be a cryptographic algorithm based on an asymmetric key or a cryptographic algorithm based on a symmetric key.

[0176] Step 41: UDM provides the authentication vector for authenticating the UE to the AMF / SEAF / AUSF located in the core network.

[0177] Step 42: After the UE establishes a connection with the core network via satellite, the AMF / SEAF / AUSF authenticates the UE using the UE authentication vector and completes the UE registration process.

[0178] Step 43: AMF constructs a UE registration context data structure with various information (including security information) required for the next UE to access the satellite. The UE registration context data structure also includes information such as the generation information and validity period of the UE registration context provided by AMF. AMF sends a UE registration token generation request to KMF, which includes: UE registration context data structure.

[0179] Step 44: KMF uses its stored confidentiality protection key to provide confidentiality protection for the token and uses its integrity protection key to provide integrity protection for the token; and returns the generated UE registration token to AMF through the UE registration token generation response.

[0180] Step 45: AMF provides the UE registration token to the UE, and the UE stores the token.

[0181] After the UE obtains the registration token, the authentication and / or registration process on the satellite is implemented based on the registration token. As an optional embodiment, the authentication and / or registration process based on the registration token is as follows: Figure 5 As shown, including:

[0182] Step 50: The KMF in the core network provides the key material for generating the UE authentication token and verifying the UE authentication token to the S-KMF in the satellite. The key material may include: an encryption key and a corresponding decryption key for implementing token confidentiality protection, an integrity protection key and a corresponding integrity verification key for implementing token integrity protection. The cryptographic algorithm for implementing token security may be a cryptographic algorithm based on an asymmetric key or a cryptographic algorithm based on a symmetric key.

[0183] Step 51: When the UE is within the coverage of the satellite, the UE establishes a connection with the satellite.

[0184] Step 52: The UE provides its previously stored UE registration token to the S-AMF in the registration request.

[0185] Step 53: S-AMF sends a token verification request to S-KMF, which includes: UE registration token.

[0186] Step 54: S-KMF decrypts the token using the token decryption key and verifies the token using the token verification key to obtain the UE registration context; then returns the UE registration context to S-AMF through the token verification response.

[0187] Step 55: S-AMF uses the UE registration context returned by S-KMF to build a UE registration context (including security context) that can authenticate the UE and enable UE access.

[0188] Step 56: S-AMF uses the constructed UE registration context to continue to complete subsequent UE authentication and UE access operations.

[0189] Step 57: If S-AMF decides to generate a new UE registration token, S-AMF constructs a UE registration context data structure with various information (including security information) that the UE needs to use to access the satellite next time, which also includes the generation information and validity period of the UE registration context provided by S-AMF; then sends a UE registration token generation request to S-KMF, which includes: UE registration context data structure.

[0190] Step 58: S-KMF uses its stored confidentiality protection key to provide confidentiality protection for the token and uses the integrity protection key to provide integrity protection for the token; then returns the generated UE registration token to S-AMF through the UE registration token generation response.

[0191] Step 59: S-AMF provides the registration token to the UE, and the UE stores the token.

[0192] Step 510: The UE and the satellite exchange data and then terminate the connection.

[0193] Optionally, step 511: S-AMF sends a UE registration status report and / or UE registration context to AMF.

[0194] Optionally, step 512: AMF stores the UE registration context and updates the UE registration status to the UDM.

[0195] Optionally, step 513: S-AMF deletes the UE registration context and its registration token.

[0196] The embodiments of the present application propose the concept of UE registration token for satellite S&F scenarios. The UE registration token is generated by the satellite or core network element and saved by the UE; when in use, the UE provides the registration token to the satellite, and the satellite uses its stored key to decrypt and verify the token; the satellite uses the content stored in the token to build a UE context, and uses the UE context to complete the authentication and access process with the UE. The UE access network process of the present application can be performed without the participation of the core network, and the satellite can authenticate the UE and allow it to access the satellite without having to store any UE information.

[0197] In an embodiment of the present application, a satellite or a core network generates a registration token and sends it to a terminal. The terminal provides the registration token to the satellite, so that the satellite uses the registration token to authenticate and / or register the terminal. This solution is suitable for data storage and forwarding scenarios processed by satellites. The satellite has some core network functions and can complete the authentication and establishment of secure connections originally performed by the terrestrial core network, and can ensure the secure transmission of data in satellite storage and forwarding scenarios. The terminal access to the satellite in this solution can be done without the participation of the core network, and the satellite can authenticate the terminal without storing relevant information of the terminal.

[0198] like Figure 6 As shown, an embodiment of the present application further provides a terminal authentication method, which is applied to a satellite device, and the satellite device may be a first network element deployed on a satellite. The method includes:

[0199] Step 601: A first network element deployed on a satellite receives a registration token sent by a terminal;

[0200] Step 602: The first network element authenticates and / or registers the terminal based on the registration token.

[0201] In this embodiment, the first network element deployed on the satellite may be an S-AMF and / or a security network element (such as S-SEAF and / or S-AUSF) newly set on the satellite. When the terminal is within the coverage of the satellite, the terminal establishes a connection with the satellite, and after the connection is established, the terminal sends the registration token to the satellite, and the first network element on the satellite registers and / or authenticates the terminal based on the registration token.

[0202] In an embodiment of the present application, after establishing a connection with a satellite, the terminal provides the registration token to the satellite, and the satellite uses the registration token to authenticate and / or register the terminal. This solution is applicable to data storage and forwarding scenarios for satellite processing, and can ensure secure data transmission in satellite storage and forwarding scenarios.

[0203] As an optional embodiment, before receiving the registration token sent by the terminal, the method further includes:

[0204] Receive a terminal authentication vector sent by a unified data management entity UDM of a core network; and authenticate and / or register the terminal based on the terminal authentication vector.

[0205] In this embodiment, after the terminal establishes a connection with the satellite, the satellite can authenticate and / or register the terminal based on the authentication vector. The UDM of the core network provides the authentication vector for authenticating the UE to the AMF / SEAF / AUSF located in the core network, and the AMF / SEAF / AUSF of the core network further provides the authentication vector to the S-AMF / S-SEAF / S-AUSF located in the satellite. The S-AMF / S-SEAF / S-AUSF stores the authentication vector for authenticating the UE. When the UE is within the coverage of the satellite, the UE establishes a connection with the satellite. The S-AMF / S-SEAF / S-AUSF uses the UE authentication vector to authenticate the UE and completes the UE registration process.

[0206] Optionally, before receiving the registration token sent by the terminal, the method further includes: acquiring the registration token; and sending the registration token to the terminal.

[0207] Optionally, the obtaining the registration token includes:

[0208] The first network element sends a first token generation request message to the key management function KMF deployed on the satellite, the first token generation request message includes a terminal registration context data structure, the terminal registration context data structure is generated based on the relevant information required for the terminal to access the satellite; the KMF deployed on the satellite is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token; the first network element receives a first response message sent by the KMF deployed on the satellite, the first response message includes the registration token.

[0209] In this embodiment, the registration token is generated by a network element on the satellite. After the satellite authenticates and / or registers the terminal based on the authentication vector, the obtained registration token can be sent to the terminal. The terminal stores the registration token and sends the registration token to the satellite when accessing the satellite next time. The satellite can obtain the terminal registration context by decrypting the registration token, and the satellite authenticates and / or registers the terminal based on the terminal registration context.

[0210] Taking the S-KMF on the satellite generating the registration token as an example, the first network element is S-AMF: after S-AMF completes the authentication and / or registration of the terminal based on the authentication vector, S-AMF constructs a variety of information (including security information) required for the next UE to access the satellite into a UE registration context data structure, which also includes the generation information and validity period of the UE registration context provided by S-AMF; then sends a first token generation request message to S-KMF, and the request message includes: UE registration context data structure; S-KMF generates a registration token according to the information in the request, and uses its stored confidentiality protection key to provide confidentiality protection for the registration token, and uses the integrity protection key to provide integrity protection for the registration token; then uses the first response message to return the generated registration token to S-AMF, and S-AMF sends the registration token to the terminal.

[0211] Optionally, after sending the registration token to the terminal, the method includes: sending a terminal registration status report and / or a terminal registration context to a second network element of a core network.

[0212] In this embodiment, the second network element of the core network may be the AMF / SEAF / AUSF of the core network. After receiving the registration token sent by the satellite, the terminal performs data interaction and terminates the connection after the interaction is completed. The S-AMF may send a UE registration status report and / or a UE registration context to the AMF of the core network so that the AMF of the core network updates the UE registration status and / or the UE registration context.

[0213] As an optional embodiment, after receiving the registration token sent by the terminal, the method includes:

[0214] The first network element sends a token verification request message to the KMF deployed on the satellite, wherein the token verification request message includes the registration token; the KMF deployed on the satellite is used to decrypt the registration token using a token decryption key, and to verify the registration token using a token verification key to obtain a terminal registration context; the first network element receives the terminal registration context sent by the KMF deployed on the satellite; the first network element uses the terminal registration context to authenticate and / or register the terminal.

[0215] Optionally, the KMF deployed on the satellite is used to store the token generation key and the token verification key; the token generation key and the token verification key are sent by the KMF of the core network.

[0216] In this embodiment, taking the first network element being S-AMF as an example, when the terminal is within the coverage of the satellite, the terminal establishes a connection with the satellite, and the terminal provides its previously stored registration token to S-AMF in the registration request message. S-AMF sends a token verification request to S-KMF, and the request includes the registration token; S-KMF decrypts the token using the token decryption key, and verifies the token using the token verification key, thereby obtaining the UE registration context; and then returns the UE registration context to S-AMF through the token verification response. S-AMF uses the UE registration context returned by S-KMF to construct a UE registration context (including a security context) that can authenticate the UE and implement UE access. S-AMF uses the constructed UE registration context to continue to complete subsequent UE authentication and UE access operations.

[0217] As an optional embodiment, after authenticating and / or registering the terminal based on the registration token, the method further includes:

[0218] An updated registration token is obtained, wherein the updated registration token includes an updated terminal registration context; and the updated registration token is sent to the terminal.

[0219] In this embodiment, after the satellite authenticates and / or registers the terminal, if it is decided to update the registration token, a new registration token can be generated and the updated registration token can be sent to the terminal. The terminal stores the updated registration token and completes the authentication and / or registration based on the updated registration token when accessing the satellite next time.

[0220] Taking the example that the first network element of the satellite is S-AMF, if S-AMF decides to generate a new UE registration token, S-AMF constructs a UE registration context data structure with various information (including security information) that the UE needs to use next time to access the satellite, which also includes the generation information and validity period of the UE registration context provided by S-AMF; S-AMF sends a UE registration token generation request to S-KMF, and the request includes: UE registration context data structure. S-KMF uses its stored confidentiality protection key to provide confidentiality protection for the token, and uses the integrity protection key to provide integrity protection for the token; then the generated updated registration token is returned to S-AMF through the UE registration token generation response. S-AMF provides the updated registration token to the UE, and the UE stores the updated registration token.

[0221] In an embodiment of the present application, after the terminal establishes a connection with the satellite, the terminal provides the registration token to the satellite, so that the satellite uses the registration token to authenticate and / or register the terminal. This solution is suitable for data storage and forwarding scenarios processed by satellites. The satellite has some core network functions and can complete the authentication and establishment of secure connections originally performed by the terrestrial core network, and can ensure the secure transmission of data in satellite storage and forwarding scenarios. The terminal access to the satellite in this solution can be done without the participation of the core network, and the satellite can authenticate the terminal without storing relevant information of the terminal.

[0222] like Figure 7 As shown, the embodiment of the present application also provides a terminal authentication method, which is applied to a core network device, and the core network device may be a second network element of the core network. The method includes:

[0223] Step 701: The second network element of the core network obtains a registration token;

[0224] Step 702: The second network element of the core network sends the registration token to the terminal.

[0225] In this embodiment, the second network element of the core network may be AMF / SEAF / AUSF. The registration token of the terminal may be provided by the core network element. After the terminal receives the registration token provided by the core network element, when the terminal is within the coverage of the satellite, the terminal establishes a connection with the satellite. After the connection is established, the terminal sends the registration token to the satellite, and the satellite registers and / or authenticates the terminal based on the registration token.

[0226] Optionally, before acquiring the registration token, the method further includes: authenticating and / or registering the terminal based on a terminal authentication vector.

[0227] In this embodiment, after the terminal establishes a connection with the core network, the core network can authenticate and / or register the terminal based on the authentication vector. Specifically, UDM provides the authentication vector for authenticating the UE to the AMF / SEAF / AUSF of the core network. When the UE establishes a connection with the core network via a satellite, the AMF / SEAF / AUSF uses the UE authentication vector to authenticate the UE and complete the UE registration process.

[0228] As an optional embodiment, the obtaining of the registration token includes:

[0229] The second network element of the core network sends a second token generation request message to the KMF of the core network, and the second token generation request message includes a terminal registration context data structure, and the terminal registration context data structure is generated based on the relevant information required for the terminal to access the satellite device; the KMF of the core network is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token; the second network element of the core network receives a second response message sent by the KMF of the core network, and the second response message includes the registration token.

[0230] The KMF of the core network is also used to send a token generation key and a token verification key to the KMF deployed on the satellite.

[0231] In this embodiment, the generation of the registration token by the KMF of the core network is taken as an example: after the second network element of the core network (here the second network element is the core network AMF as an example) completes the authentication and / or registration of the terminal based on the authentication vector, the AMF of the core network constructs a variety of information (including security information) required for the next UE to access the satellite into a UE registration context data structure, which also includes the generation information and validity period of the UE registration context provided by the AMF; then sends a UE registration token generation request to the KMF, and the request includes: UE registration context data structure. The KMF of the core network uses its stored confidentiality protection key to provide confidentiality protection for the token, and uses the integrity protection key to provide integrity protection for the token; the KMF of the core network returns the generated registration token to the AMF, and the AMF sends the registration token to the terminal.

[0232] Optionally, the method further includes: receiving a terminal registration status report and / or a terminal registration context sent by a first network element deployed on the satellite.

[0233] In this embodiment, after receiving the registration token sent by the satellite, the terminal performs data interaction and terminates the connection after the interaction is completed. The first network element deployed on the satellite (such as S-AMF) can send a UE registration status report and / or UE registration context to the AMF of the core network, and the AMF of the core network updates the UE registration status and / or UE registration context.

[0234] In an embodiment of the present application, the core network generates a registration token and sends it to the terminal. The terminal provides the registration token to the satellite, so that the satellite uses the registration token to authenticate and / or register the terminal. This solution is suitable for data storage and forwarding scenarios processed by satellites. The satellite has some core network functions and can complete the authentication and establishment of secure connections originally performed by the terrestrial core network, and can ensure the secure transmission of data in satellite storage and forwarding scenarios. The terminal access to the satellite in this solution can be done without the participation of the core network, and the satellite can authenticate the terminal without storing relevant information of the terminal.

[0235] The above embodiment introduces the authentication method of the terminal of the present application. The following embodiment will further illustrate the corresponding device in conjunction with the accompanying drawings.

[0236] Specifically, Figure 8 As shown, the embodiment of the present application provides a terminal authentication device 800, which is applied to the terminal, including:

[0237] The first receiving unit 810 is used to receive a registration token sent by a network side device; the network side device is deployed in a core network or a satellite;

[0238] The first sending unit 820 is configured to send the registration token to a first network element deployed on the satellite, and perform authentication and / or registration operations on the satellite based on the registration token.

[0239] Optionally, the device further comprises:

[0240] The second processing unit is configured to perform authentication and / or registration operations on the network side device based on the terminal authentication vector.

[0241] Optionally, the first receiving unit is specifically configured to:

[0242] When the authentication and / or registration operation based on the terminal authentication vector on the network side device is completed, a registration token sent by the network side device is received and the registration token is stored; wherein the registration token includes a terminal registration context.

[0243] Optionally, the first sending unit is specifically configured to:

[0244] A registration request message is sent to a first network element deployed on the satellite, where the registration request message carries the registration token.

[0245] Optionally, the device further comprises:

[0246] a third receiving unit, configured to receive an updated registration token sent by the first network element, wherein the updated registration token includes an updated terminal registration context;

[0247] A storage unit is used to store the updated registration token.

[0248] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the terminal, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0249] Specifically, Fig. 9 As shown, an embodiment of the present application provides a terminal authentication device 900, which is applied to a satellite device. The satellite device may be a first network element deployed on a satellite. The device includes:

[0250] The second receiving unit 910 is used to receive a registration token sent by the terminal;

[0251] The first processing unit 920 is configured to authenticate and / or register the terminal based on the registration token.

[0252] Optionally, the device further comprises:

[0253] A fourth receiving unit, configured to receive a terminal authentication vector sent by a unified data management entity UDM of a core network;

[0254] The third processing unit is configured to authenticate and / or register the terminal based on the terminal authentication vector.

[0255] Optionally, the device further comprises:

[0256] A second acquisition unit, used to acquire the registration token;

[0257] The third sending unit is used to send the registration token to the terminal.

[0258] Optionally, the second acquiring unit is specifically configured to:

[0259] Sending a first token generation request message to a key management function KMF deployed on the satellite, wherein the first token generation request message includes a terminal registration context data structure, wherein the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite; the KMF deployed on the satellite is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0260] A first response message sent by a KMF deployed on the satellite is received, where the first response message includes the registration token.

[0261] Optionally, the device further comprises:

[0262] The fourth sending unit is used to send the terminal registration status report and / or the terminal registration context to the second network element of the core network.

[0263] Optionally, the device further comprises:

[0264] a fifth sending unit, configured to send a token verification request message to the KMF deployed on the satellite, wherein the token verification request message includes the registration token; the KMF deployed on the satellite is configured to decrypt the registration token using a token decryption key, and verify the registration token using a token verification key, to obtain a terminal registration context;

[0265] a fifth receiving unit, configured to receive a terminal registration context sent by the KMF of the satellite;

[0266] The fourth processing unit is configured to authenticate and / or register the terminal using the terminal registration context.

[0267] Optionally, the KMF deployed on the satellite is used to store the token generation key and the token verification key; the token generation key and the token verification key are sent by the KMF of the core network.

[0268] Optionally, the device further comprises:

[0269] A third acquisition unit, configured to acquire an updated registration token, wherein the updated registration token includes an updated terminal registration context;

[0270] A sixth sending unit is used to send the updated registration token to the terminal.

[0271] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment applied to satellite equipment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0272] Specifically, Fig.10 As shown, an embodiment of the present application provides an authentication device 1000 for a terminal, which is applied to a core network device, and the core network device may be a second network element of the core network. The device includes:

[0273] A first acquisition unit 1010 is used to acquire a registration token;

[0274] The second sending unit 1020 is configured to send the registration token to the terminal.

[0275] Optionally, the device further comprises:

[0276] The fifth processing unit is configured to authenticate and / or register the terminal based on the terminal authentication vector.

[0277] Optionally, the first acquiring unit is specifically used for:

[0278] The second network element of the core network sends a second token generation request message to the KMF of the core network, where the second token generation request message includes a terminal registration context data structure, where the terminal registration context data structure is generated based on the relevant information required for the terminal to access the satellite device; the KMF of the core network is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0279] The second network element of the core network receives a second response message sent by the KMF of the core network, where the second response message includes the registration token.

[0280] Optionally, the KMF of the core network is further used to: send a token generation key and a token verification key to the KMF deployed on the satellite.

[0281] Optionally, the device further comprises:

[0282] The sixth receiving unit is configured to receive a terminal registration status report and / or a terminal registration context sent by a first network element deployed on a satellite.

[0283] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the core network equipment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0284] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0285] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0286] like Fig.11 As shown, an embodiment of the present application further provides a terminal, including: a memory 1120, a transceiver 1100, and a processor 1110; wherein the memory 1120 is used to store a computer program; the transceiver 1100 is used to receive and send data under the control of the processor 1110; the processor 1110 is used to read the computer program in the memory and perform the following operations:

[0287] Receiving a registration token sent by a network side device; the network side device is deployed in a core network or a satellite;

[0288] The registration token is sent to a first network element deployed on the satellite, and an authentication and / or registration operation is performed on the satellite based on the registration token.

[0289] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0290] An authentication and / or registration operation is performed on the network side device based on the terminal authentication vector.

[0291] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0292] When the authentication and / or registration operation based on the terminal authentication vector on the network side device is completed, a registration token sent by the network side device is received and the registration token is stored; wherein the registration token includes a terminal registration context.

[0293] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0294] A registration request message is sent to a first network element deployed on the satellite, where the registration request message carries the registration token.

[0295] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0296] receiving an updated registration token sent by the first network element, wherein the updated registration token includes an updated terminal registration context;

[0297] The updated registration token is stored.

[0298] Among them, Fig.11 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1110 and various circuits of memory represented by memory 1120 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1100 may be a plurality of components, namely, a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. For different user devices, the user interface 1130 may also be an interface capable of externally and internally connecting required devices, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0299] The processor 1110 is responsible for managing the bus architecture and general processing, and the memory 1120 can store data used by the processor 1110 when performing operations.

[0300] Optionally, the processor 1110 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD), and the processor may also adopt a multi-core architecture.

[0301] The processor calls the computer program stored in the memory to execute any of the methods provided in the embodiments of the present application according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0302] It should be noted here that the above-mentioned terminal provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the terminal, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0303] like Fig.12 As shown, an embodiment of the present application further provides a satellite device, including: a memory 1220, a transceiver 1200, and a processor 1210; wherein the memory 1220 is used to store a computer program; the transceiver 1200 is used to receive and send data under the control of the processor 1210; the processor 1210 is used to read the computer program in the memory and perform the following operations:

[0304] Receive the registration token sent by the terminal;

[0305] The terminal is authenticated and / or registered based on the registration token.

[0306] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0307] Receiving the terminal authentication vector sent by the unified data management entity UDM of the core network;

[0308] The terminal is authenticated and / or registered based on the terminal authentication vector.

[0309] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0310] Obtaining the registration token;

[0311] The registration token is sent to the terminal.

[0312] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0313] Sending a first token generation request message to a key management function KMF deployed on the satellite, wherein the first token generation request message includes a terminal registration context data structure, wherein the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite; the KMF deployed on the satellite is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0314] A first response message sent by a KMF deployed on the satellite is received, where the first response message includes the registration token.

[0315] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0316] Sending a terminal registration status report and / or a terminal registration context to a second network element of the core network.

[0317] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0318] Sending a token verification request message to the KMF deployed on the satellite, wherein the token verification request message includes the registration token; the KMF deployed on the satellite is used to decrypt the registration token using a token decryption key, and verify the registration token using a token verification key to obtain a terminal registration context;

[0319] Receiving a terminal registration context sent by a KMF deployed on the satellite;

[0320] The terminal is authenticated and / or registered using the terminal registration context.

[0321] Optionally, the KMF deployed on the satellite is used to store the token generation key and the token verification key; the token generation key and the token verification key are sent by the KMF of the core network.

[0322] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0323] Obtaining an updated registration token, wherein the updated registration token includes an updated terminal registration context;

[0324] The updated registration token is sent to the terminal.

[0325] Among them, Fig.12 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1210 and memory represented by memory 1220. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1200 may be a plurality of components, namely including a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1210 is responsible for managing the bus architecture and general processing, and the memory 1220 may store data used by the processor 1210 when performing operations.

[0326] The processor 1210 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0327] It should be noted here that the above-mentioned satellite equipment provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the satellite equipment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0328] like Fig.13 As shown, an embodiment of the present application further provides a core network device, including: a memory 1320, a transceiver 1300, and a processor 1310; wherein the memory 1320 is used to store a computer program; the transceiver 1300 is used to receive and send data under the control of the processor 1310; the processor 1310 is used to read the computer program in the memory and perform the following operations:

[0329] Get a registration token;

[0330] The registration token is sent to the terminal.

[0331] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0332] The terminal is authenticated and / or registered based on the terminal authentication vector.

[0333] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0334] Sending a second token generation request message to the KMF of the core network, wherein the second token generation request message includes a terminal registration context data structure, wherein the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite device; the KMF of the core network is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token;

[0335] Receive a second response message sent by the KMF of the core network, where the second response message includes the registration token.

[0336] Optionally, the KMF of the core network is further used to: send a token generation key and a token verification key to the KMF deployed on the satellite.

[0337] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0338] Receive a terminal registration status report and / or a terminal registration context sent by a first network element deployed on a satellite.

[0339] Among them, Fig.13 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1310 and memory represented by memory 1320. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1300 may be a plurality of components, namely including a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1310 is responsible for managing the bus architecture and general processing, and the memory 1320 may store data used by the processor 1310 when performing operations.

[0340] The processor 1310 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0341] It should be noted here that the above-mentioned core network device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the core network device, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0342] In addition, a specific embodiment of the present application further provides a processor-readable storage medium on which a computer program is stored, wherein the program, when executed by the processor, implements the steps of the authentication method of the terminal as described above, and can achieve the same technical effect, and to avoid repetition, it is not repeated here. The readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0343] It should be noted that the technical solution provided in the embodiment of the present application can be applicable to a variety of systems, especially 5G systems. For example, the applicable system can be a global system of mobile communication (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) general packet radio service (GPRS) system, a long term evolution (LTE) system, a LTE frequency division duplex (FDD) system, a LTE time division duplex (TDD) system, an advanced long term evolution (LTE-A) system, a universal mobile telecommunication system (UMTS), a world-wide interoperability for microwave access (WiMAX) system, a 5G new radio (NR) system, etc. These various systems include terminal equipment and network equipment. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0344] The terminal device involved in the embodiment of the present application may be a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE). A wireless terminal device can communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or a "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges language and / or data with a wireless access network. For example, personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs) and other devices. The wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal device, an access terminal device, a user terminal device, a user agent, and a user device, but is not limited in the embodiments of the present application.

[0345] The network device involved in the embodiment of the present application may be a base station, which may include multiple cells providing services for the terminal. Depending on the specific application scenario, the base station may also be called an access point, or may be a device in the access network that communicates with the wireless terminal device through one or more sectors on the air interface, or other names. The network device may be used to interchange received air frames with Internet Protocol (IP) packets, and serve as a router between the wireless terminal device and the rest of the access network, wherein the rest of the access network may include an Internet Protocol (IP) communication network. The network device may also coordinate the attribute management of the air interface. For example, the network device involved in the embodiments of the present application may be a network device (Base Transceiver Station, BTS) in the Global System for Mobile communications (Global System for Mobile communications, GSM) or Code Division Multiple Access (Code Division Multiple Access, CDMA), or a network device (NodeB) in Wide-band Code Division Multiple Access (WCDMA), or an evolutionary network device (evolutional Node B, eNB or e-NodeB) in the long term evolution (long term evolution, LTE) system, a 5G base station (gNB) in the 5G network architecture (next generation system), or a home evolved Node B (Home evolved Node B, HeNB), a relay node, a home base station (femto), a pico base station (pico), etc., which is not limited in the embodiments of the present application. In some network structures, the network device may include a centralized unit (CU) node and a distributed unit (DU) node, and the centralized unit and the distributed unit may also be arranged geographically separately.

[0346] Network devices and terminal devices can each use one or more antennas for multiple-input multiple-output (MIMO) transmission. MIMO transmission can be single-user MIMO (SU-MIMO) or multi-user MIMO (MU-MIMO). Depending on the form and number of antenna combinations, MIMO transmission can be 2D-MIMO, 3D-MIMO, FD-MIMO or massive-MIMO, or it can be diversity transmission, precoded transmission or beamforming transmission, etc.

[0347] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0348] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing a process or multiple processes in the flowchart and / or a box or multiple boxes in the block diagram.

[0349] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0350] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are performed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0351] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A terminal authentication method, characterized in that: include: The terminal receives the registration token sent by the network side device; The network side equipment is deployed in the core network or satellite; The terminal sends the registration token to a first network element deployed on the satellite, and performs authentication and / or registration operations on the satellite based on the registration token.

2. The method according to claim 1, characterized in that Before receiving the registration token sent by the network side device, the method further includes: An authentication and / or registration operation is performed on the network side device based on the terminal authentication vector.

3. The method according to claim 2, characterized in that The receiving a registration token sent by the network side device includes: When the authentication and / or registration operation based on the terminal authentication vector on the network side device is completed, a registration token sent by the network side device is received and the registration token is stored; wherein the registration token includes a terminal registration context.

4. The method according to claim 1, characterized in that: The sending the registration token to the first network element deployed on the satellite includes: A registration request message is sent to a first network element deployed on the satellite, where the registration request message carries the registration token.

5. The method according to claim 1, characterized in that After performing an authentication and / or registration operation on the satellite based on the registration token, the method further comprises: receiving an updated registration token sent by the first network element, wherein the updated registration token includes an updated terminal registration context; The updated registration token is stored.

6. A terminal authentication method, characterized in that: include: The first network element deployed on the satellite receives the registration token sent by the terminal; The first network element authenticates and / or registers the terminal based on the registration token.

7. The method according to claim 6, characterized in that Before receiving the registration token sent by the terminal, the method further includes: Receiving the terminal authentication vector sent by the unified data management entity UDM of the core network; The terminal is authenticated and / or registered based on the terminal authentication vector.

8. The method according to claim 6, characterized in that Before receiving the registration token sent by the terminal, the method further includes: Obtaining the registration token; The registration token is sent to the terminal.

9. The method according to claim 8, characterized in that The obtaining of the registration token comprises: The first network element sends a first token generation request message to a key management function KMF deployed on the satellite, where the first token generation request message includes a terminal registration context data structure, where the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite; the KMF deployed on the satellite is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token; The first network element receives a first response message sent by the KMF deployed on the satellite, where the first response message includes the registration token.

10. The method according to claim 8, characterized in that After sending the registration token to the terminal, the method includes: Sending a terminal registration status report and / or a terminal registration context to a second network element of the core network.

11. The method according to claim 6, characterized in that After receiving the registration token sent by the terminal, including: The first network element sends a token verification request message to the KMF deployed on the satellite, wherein the token verification request message includes the registration token; the KMF deployed on the satellite is used to decrypt the registration token using a token decryption key, and verify the registration token using a token verification key to obtain a terminal registration context; The first network element receives a terminal registration context sent by a KMF deployed on the satellite; The first network element authenticates and / or registers the terminal using the terminal registration context.

12. The method according to claim 11, characterized in that The KMF deployed on the satellite is used to store the token generation key and the token verification key; the token generation key and the token verification key are sent by the KMF of the core network.

13. The method according to claim 6, characterized in that After authenticating and / or registering the terminal based on the registration token, the method further comprises: Obtaining an updated registration token, wherein the updated registration token includes an updated terminal registration context; The updated registration token is sent to the terminal.

14. A terminal authentication method, characterized in that: include: The second network element of the core network obtains a registration token; The second network element of the core network sends the registration token to the terminal.

15. The method according to claim 14, characterized in that Before obtaining the registration token, the method further includes: The terminal is authenticated and / or registered based on the terminal authentication vector.

16. The method according to claim 14, characterized in that The step of obtaining a registration token includes: The second network element of the core network sends a second token generation request message to the KMF of the core network, where the second token generation request message includes a terminal registration context data structure, where the terminal registration context data structure is generated based on the relevant information required for the terminal to access the satellite device; the KMF of the core network is used to perform confidentiality protection and integrity protection on the terminal registration context data structure, and generate the registration token; The second network element of the core network receives a second response message sent by the KMF of the core network, where the second response message includes the registration token.

17. The method according to claim 16, characterized in that The KMF of the core network is further used to send a token generation key and a token verification key to the KMF deployed on the satellite.

18. The method according to claim 14, characterized in that The method further comprises: A terminal registration status report and / or a terminal registration context sent by a first network element deployed on a satellite is received.

19. A terminal, characterized in that: include: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Receive the registration token sent by the network side device; The network side equipment is deployed in the core network or satellite; The registration token is sent to a first network element deployed on the satellite, and an authentication and / or registration operation is performed on the satellite based on the registration token.

20. The terminal according to claim 19, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: An authentication and / or registration operation is performed on the network side device based on the terminal authentication vector.

21. The terminal according to claim 20, characterized in that: The processor is configured to read the computer program in the memory and perform the following operations: When the authentication and / or registration operation based on the terminal authentication vector on the network side device is completed, a registration token sent by the network side device is received and the registration token is stored; wherein the registration token includes a terminal registration context.

22. The terminal according to claim 19, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: A registration request message is sent to a first network element deployed on the satellite, where the registration request message carries the registration token.

23. The terminal according to claim 19, characterized in that: The processor is configured to read the computer program in the memory and perform the following operations: receiving an updated registration token sent by the first network element, wherein the updated registration token includes an updated terminal registration context; The updated registration token is stored.

24. A satellite device, characterized in that: include: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Receive the registration token sent by the terminal; The terminal is authenticated and / or registered based on the registration token.

25. The device according to claim 24, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Receiving the terminal authentication vector sent by the unified data management entity UDM of the core network; The terminal is authenticated and / or registered based on the terminal authentication vector.

26. The device according to claim 24, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Obtaining the registration token; The registration token is sent to the terminal.

27. The device according to claim 26, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Sending a first token generation request message to a key management function KMF deployed on the satellite, wherein the first token generation request message includes a terminal registration context data structure, wherein the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite; The KMF deployed on the satellite is used to perform confidentiality protection and integrity protection on the terminal registration context data structure and generate the registration token; A first response message sent by a KMF deployed on the satellite is received, where the first response message includes the registration token.

28. The device according to claim 26, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Sending a terminal registration status report and / or a terminal registration context to a second network element of the core network.

29. The device according to claim 24, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Sending a token verification request message to the KMF deployed on the satellite, wherein the token verification request message includes the registration token; The KMF deployed on the satellite is used to decrypt the registration token using a token decryption key, and verify the registration token using a token verification key to obtain a terminal registration context; Receiving a terminal registration context sent by a KMF deployed on the satellite; The terminal is authenticated and / or registered using the terminal registration context.

30. The device according to claim 29, characterized in that The KMF deployed on the satellite is used to store the token generation key and the token verification key; the token generation key and the token verification key are sent by the KMF of the core network.

31. The device according to claim 24, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Obtaining an updated registration token, wherein the updated registration token includes an updated terminal registration context; The updated registration token is sent to the terminal.

32. A core network device, characterized in that: include: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Get a registration token; The registration token is sent to the terminal.

33. The device according to claim 32, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: The terminal is authenticated and / or registered based on the terminal authentication vector.

34. The device according to claim 32, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Sending a second token generation request message to the KMF of the core network, where the second token generation request message includes a terminal registration context data structure, where the terminal registration context data structure is generated based on relevant information required for the terminal to access the satellite device; The KMF of the core network is used to perform confidentiality protection and integrity protection on the terminal registration context data structure and generate the registration token; Receive a second response message sent by the KMF of the core network, where the second response message includes the registration token.

35. The device according to claim 34, characterized in that The KMF of the core network is further used to send a token generation key and a token verification key to the KMF deployed on the satellite.

36. The device according to claim 32, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: A terminal registration status report and / or a terminal registration context sent by a first network element deployed on a satellite is received.

37. A terminal authentication device, characterized in that: include: A first receiving unit, configured to receive a registration token sent by a network side device; The network side equipment is deployed in the core network or satellite; The first sending unit is used to send the registration token to a first network element deployed on the satellite, and perform authentication and / or registration operations on the satellite based on the registration token.

38. A terminal authentication device, characterized in that: include: A second receiving unit, configured to receive a registration token sent by a terminal; The first processing unit is configured to authenticate and / or register the terminal based on the registration token.

39. A terminal authentication device, characterized in that: include: A first acquisition unit, used to acquire a registration token; The second sending unit is used to send the registration token to the terminal.

40. A processor-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the terminal authentication method as described in any one of claims 1 to 5, or implements the steps of the terminal authentication method as described in any one of claims 6 to 13, or implements the steps of the terminal authentication method as described in any one of claims 14 to 18.

Images