Paging access method, device and equipment

Abstract

Disclosed are a paging access method, apparatus and device, relating to the technical field of communications, in which a first terminal device receives a paging message from a core network device, the paging message carrying group key indication information, and then the first terminal device sends a first authentication request message to the core network device, the first authentication request message comprises a terminal identifier of the first terminal device, the terminal identifier is encrypted according to first information, the first information comprises a group key indicated by the group key indication information, and the core network authenticates the first terminal device based on the first authentication message. Based on this, in the paging access process of the terminal device, the terminal identifier of the terminal device can be encrypted by using the group key, the security of the terminal identifier in the transmission process is ensured, and in the encryption process of the terminal identifier, the calculation complexity is reduced, the processing overhead is reduced, and the overall power consumption in the paging access process is reduced.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a paging access method, device and equipment. Background Art

[0002] At present, in the process of paging terminal equipment by network equipment, the protection mechanism for the terminal identification document (ID) is to encrypt and decrypt the terminal identification using an asymmetric key, such as using different keys in the encryption process and the decryption process of the terminal identification. Specifically, the user equipment (UE) side uses a temporary key to encrypt and transmit its own ID as an anonymous identity, and the unified data management unit (UDM) calls the subscription identifier de-concealing function (SIDF) module to complete the decryption of the user permanent identification (SUPI). Based on SUPI, UDM selects the corresponding authentication method according to the local policy and sends a message to the user equipment side. After calculation, the user equipment sends an authentication response (Authentication Response) message to UDM, carrying the corresponding SUPI, authentication timestamp, authentication type, service network name and other information. UDM confirms and stores the above received message content and authentication results. The encryption and decryption process based on this mechanism has high computational complexity, large processing overhead and high power consumption. Summary of the invention

[0003] The present application provides a paging access method, apparatus and device, which can use a group key to encrypt the terminal identification of a terminal device, thereby ensuring the security of the terminal identification during transmission, while reducing the complexity of the terminal identification encryption and decryption process and the signaling overhead.

[0004] In order to achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, a paging access method is provided, which is applied to a first terminal device. The method may include:

[0006] First, the first terminal device receives a paging message from a core network device, wherein the paging message carries group key indication information, and the group key indication information is for at least one terminal device, and the at least one terminal device includes the first terminal device. This step is mainly used to receive a paging message sent by a core network device and obtain the group key indication information in the paging message; wherein the group key indication information can indicate a corresponding group key, and the same group key can be sent to one or more terminal devices.

[0007] Then, the first terminal device sends a first authentication request message to the core network device. The first authentication request message includes the terminal identifier of the first terminal device. The terminal identifier is encrypted based on the first information. The first information includes the identifier of the group key indicated by the group key indication information. This step is mainly used when the first terminal device randomly accesses the core network. The first terminal device sends an authentication request message to the core network device. The terminal identifier in the authentication request message needs to be encrypted. The terminal identifier is encrypted using the group key indicated by the group key indication information. Among them, the group key indication information is used to indicate the group key in the process of the core network device sending a paging message. The same group key can correspond to one or more group key indication information. The first information is used when the first terminal device sends the first authentication request message. The first information may include the group key.

[0008] Exemplarily, the above-mentioned first terminal device may include a terminal and a tag, specifically, including a device without energy storage and independent signal generation, such as a backscatter transmission device with this characteristic; including a device with energy storage but without independent signal generation, such as a backscatter transmission device with this characteristic, wherein the use of stored energy may include amplifying the reflected signal; and also including a device with energy storage and independent signal generation, such as an active wireless radio frequency (RF) component for transmission.

[0009] As a possible implementation, the first authentication request message includes a first identifier, and the first identifier includes one or more of the following: a group key identifier, an inventory identifier corresponding to the group key, a group identifier information, a mask information, an inventory identifier, an event identifier, and a group key identifier index. Based on this, in the process of authenticating the terminal device, in the first authentication request message sent by the terminal device to the core network device, the first identifier can be a group key identifier or an inventory identifier corresponding to the group key identifier, a group identifier information, a mask information, an inventory identifier, an event identifier, and a group key identifier index, wherein the group key identifier can directly indicate the corresponding group key for the core network device to decrypt the first authentication request message, and the inventory identifier can indicate the storage location of the group key so that the core network device can obtain the group key to decrypt the first authentication request message.

[0010] As a possible implementation, the above-mentioned group key indication information may include one or more of the following: group identification information, mask information, inventory identification, event identification, and group key identification index. Based on this, during the paging process of the terminal device, the core network device sends a paging message to one or more terminal devices, and the group key indication information carried in the paging message may include group identification information, mask information, inventory identification, event identification, and group key identification index, wherein the group identification information, mask information, inventory identification, event identification, and group key identification index may directly or indirectly indicate the corresponding group key to the terminal device, so that the terminal device uses the group key to encrypt the terminal identification.

[0011] As a possible implementation, the first information may further include a random number. The random number may be used as a parameter in the encryption process when the terminal identifier is encrypted using the group key to improve the security of the terminal identifier during transmission. Accordingly, the first authentication request message includes the random number. The random number is used as a parameter when the terminal identifier is encrypted using the group key when sending the first authentication request message.

[0012] As a possible implementation, sending the first authentication request message to the core network device may include: sending the first authentication request message to the core network device through the first network device. Based on this, the first terminal device may directly send the first authentication request information to the core network device so that the core network device authenticates the first terminal device. At the same time, the first terminal device may also send the first authentication request message to the core network device through the first network device so that the core network device authenticates the first terminal device.

[0013] Specifically, as a possible implementation method, the above-mentioned sending of the first authentication request message to the core network device through the first network device may include: sending the first authentication request message and the second authentication request message to the first network device, sending a third message to the core network device through the first network device, the third message including one or more authentication request information, and the multiple authentication request information including the first authentication request message and the second authentication request message. Based on this, the terminal device sends the authentication request message to the core network device through the first network device, which may be one or more terminal devices sending one or more authentication request information to the first network device, the first network device may send one or more authentication request information to the core network device separately, the multiple authentication request information may come from one or more terminal devices, or one or more authentication request information may be sent to the core network device together as a third message, and the third message may be one or more, so that the core network device authenticates one or more terminal devices.

[0014] As a possible implementation, the first authentication request message and the second authentication request message do not include the first identifier, and the third message includes the first identifier. Based on this, when the authentication request message sent by the first terminal device to the first network device does not include the first identifier, the first network device can add the corresponding first identifier to the authentication request message to indicate the group key used for encrypting the terminal identifier in the authentication request message sent by the first network device.

[0015] As a possible implementation, before sending the first authentication request message to the core network device, the method may further include: accessing the core network device according to the paging message. Based on this, after receiving the paging message, the first terminal device may access the core network device by means of 2-step random access or 4-step random access, and then send an authentication request message to the core network device.

[0016] As a possible implementation, the method may further include: encrypting the target data using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device, and sending the encrypted target data to the core network device. Based on this, data transmission can be performed between the core network device and the terminal device, and during the data transmission process, the target data can be encrypted using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device to ensure the security of the data during the transmission process.

[0017] In a second aspect, a paging access method is provided, which is applied to a core network device. The method may include:

[0018] First, in response to the first service request, the core network device sends a paging message to the first terminal device, the paging message carries group key indication information, and the group key indication information is for at least one terminal device, and the at least one terminal device includes the first terminal device. This step is mainly used for the core network device to send a paging message to one or more terminal devices when receiving the first service request, the paging message includes group key indication information, wherein the group key indication information can indicate the corresponding group key, and the same group key can be sent to one or more terminal devices.

[0019] Then, a first authentication request message from the first terminal device is received, the first authentication request message includes a terminal identifier of the first terminal device, the terminal identifier is encrypted according to the first information, and the first information includes an identifier of the group key indicated by the group key indication information. This step is mainly used for the core network device to obtain the first authentication request information sent by the first terminal device, and the first authentication request message includes the first information indicating the group key.

[0020] Finally, the first terminal device is authenticated according to the first authentication request message. This step is mainly used for the core network device to obtain the first information in the first authentication request message, decrypt the terminal identifier of the first terminal device according to the first information, obtain the terminal identifier of the first terminal device, and authenticate the first terminal device based on the terminal identifier.

[0021] As a possible implementation, the above-mentioned authentication of the first terminal device according to the first authentication request message may include: decrypting the first authentication request message to obtain the terminal identification of the first terminal device; authenticating the terminal identification of the first terminal device. Based on this, the core network device may decrypt the terminal identification of the first terminal device by the group key indicated by the first information in the first authentication request message, authenticate the first terminal device based on the decrypted terminal identification, and obtain an authentication result.

[0022] As a possible implementation, the first authentication request message includes a first identifier, and the first identifier includes one or more of the following: a group key identifier, an inventory identifier corresponding to the group key, a group identifier information, a mask information, an inventory identifier, an event identifier, and a group key identifier index. Based on this, in the process of authenticating the terminal device, in the first authentication request message received by the core network device, the first identifier may be a group key identifier or an inventory identifier corresponding to the group key identifier, wherein the group key identifier may directly indicate the corresponding group key for the core network device to decrypt the first authentication request message, and the inventory identifier may indicate the storage location of the group key so that the core network device can obtain the group key to decrypt the first authentication request message.

[0023] As a possible implementation, the group key indication information includes one or more of the following: group identification information, mask information, inventory identification, event identification, and group key identification index. Based on this, during the paging process of the terminal device, the core network device sends a paging message to one or more terminal devices, and the group key indication information carried in the paging message may include group identification information, mask information, inventory identification, event identification, and group key identification index, wherein the group identification information, mask information, inventory identification, event identification, and group key identification index may directly or indirectly indicate the corresponding group key to the terminal device, so that the terminal device uses the group key to encrypt the terminal identification and send it to the core network device.

[0024] As a possible implementation, the first information may further include a random number. The random number may be used as a parameter in the decryption process when the terminal identifier is decrypted using the group key to improve the security of the terminal identifier during transmission. Accordingly, the first authentication request message may include a random number. The random number is used as a parameter when the terminal identifier is decrypted using the group key when receiving the first authentication request information.

[0025] As a possible implementation, the above-mentioned receiving the first authentication request message from the first terminal device may include: receiving the first authentication request message forwarded by the first terminal device through the first network device. Based on this, the core network device can directly receive the first authentication request message sent by the terminal device and authenticate the first terminal device. At the same time, the core network device can also receive the first authentication request message sent by the first terminal device through the first network device and authenticate the first terminal device.

[0026] As a possible implementation method, the above-mentioned receiving the first authentication request message forwarded by the first terminal device through the first network device includes: receiving a third message through the first network device, the third message includes one or more authentication request messages, and the multiple authentication request messages include a first authentication request message and a second authentication request message. Based on this, the core network device receives the third message through the first network device, which may be that the first terminal device sends one or more authentication request information to the first network device, and the first network device may send one or more authentication request information sent by the terminal device to the core network device, and the multiple authentication request information may come from multiple terminal devices. Then, the core network device authenticates one or more terminal devices based on the received third message.

[0027] As a possible implementation, after the core network device sends a paging message to the first terminal device, the method may further include: responding to the random access request of the first terminal device, allowing the first terminal device to access the core network device. Based on this, after sending the paging message, the core network device may allow the terminal device to access the core network device by responding to the 2-step random access or 4-step random access, and then receiving the authentication request message sent by the terminal device.

[0028] As a possible implementation, after the first terminal device passes authentication, the method may further include: receiving target data from the first terminal device; decrypting the target data using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device. Based on this, when the core network device and the terminal device pass authentication and data transmission can be performed, the target data can be encrypted during the data transmission process using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device to ensure the security of the data during the transmission process.

[0029] According to a third aspect, an electronic device is provided, which may include:

[0030] A transceiver, used for sending and receiving signals;

[0031] a memory for storing computer program instructions;

[0032] A processor is used to execute computer program instructions to support an electronic device to implement a method in any possible implementation manner of the first aspect and the second aspect.

[0033] In a fourth aspect, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processing circuit, a method in any possible implementation of the first aspect and the second aspect is implemented.

[0034] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute a method in any possible implementation of the first aspect and the second aspect.

[0035] In a sixth aspect, a chip system is provided, which includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions; when the computer program instructions are executed by the processing circuit, a method in any possible implementation manner of the first aspect and the second aspect is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of an authentication method for a terminal device provided for related technology;

[0037] Figure 2 A schematic diagram of an application scenario of a paging access method provided in an embodiment of the present application;

[0038] Figure 3 A schematic diagram b of an application scenario of a paging access method provided in an embodiment of the present application;

[0039] Figure 4A schematic diagram c of an application scenario of a paging access method provided in an embodiment of the present application;

[0040] Figure 5 A schematic diagram d of an application scenario of a paging access method provided in an embodiment of the present application;

[0041] Figure 6 A schematic diagram e of an application scenario of a paging access method provided in an embodiment of the present application;

[0042] Figure 7 A schematic diagram of a process flow of a paging access method provided in an embodiment of the present application;

[0043] Figure 8 A schematic diagram b of a process of a paging access method provided in an embodiment of the present application;

[0044] Fig. 9 A schematic diagram c of a process of a paging access method provided in an embodiment of the present application;

[0045] Fig.10 A schematic diagram of a paging access method provided in an embodiment of the present application

[0046] Fig.11 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The technical solution in the embodiment of the present application will be described below in conjunction with the drawings in the embodiment of the present application. Among them, in the description of the embodiment of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in a wireless communication system, communication devices can use air interface resources for wireless communication. Among them, the communication equipment may include network equipment and terminal equipment, and the network equipment may also be referred to as network side equipment. Air interface resources may include at least one of time domain resources, frequency domain resources, code resources and space resources. In the embodiment of the present application, at least one can also be described as one or more, and multiple can be two, three, four or more, which is not limited by the present application.

[0048] In the following, the terms "first", "second", etc. are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. For example, if the described object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields", and the "first" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the described object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of described objects is not limited by the ordinal number, and can be one or more. Taking the "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes can be the same or different. For example, if the described object is a "device", the "first device" and the "second device" can be the same type of device or different types of devices. For another example, if the described object is "information", the "first information" and the "second information" can be information of the same content or information of different contents. In summary, the use of prefixes such as ordinal numbers to distinguish the described objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and no unnecessary limitation should be constituted due to the use of such prefixes.

[0049] Furthermore, in the embodiments of the present application, "connection" may be a direct connection or an indirect connection; in addition, it may refer to an electrical connection or a communication connection; for example, the connection between two electrical components A and B may refer to a direct connection between A and B, or may refer to an indirect connection between A and B through other electrical components or connecting media, or may refer to an indirect connection between A and B through other communication devices or communication media, as long as communication between A and B can be achieved.

[0050] For ease of understanding, the relevant technical terms involved in the embodiments of the present application are first explained below.

[0051] 1. Terminal device: It can be a device with wireless transceiver function, which can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal device can be a user equipment (UE), wherein the UE includes a handheld device, a vehicle-mounted device, a wearable device or a computing device with wireless communication function. Exemplarily, the UE can be a mobile phone, a tablet computer or a computer with wireless transceiver function. The terminal device can also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. In the embodiment of the present application, the device for realizing the function of the terminal can be a terminal; it can also be a device that can support the terminal to realize the function, such as a chip system, which can be installed in the terminal. In the embodiment of the present application, the chip system can be composed of a chip, or it can include a chip and other discrete devices. In the technical solution provided in the embodiments of the present application, the device for implementing the functions of the terminal is a terminal, and the terminal is a UE as an example to describe the technical solution provided in the embodiments of the present application.

[0052] 2. Core network equipment: It is a network element device that performs core switching or call routing functions. Its main function is to control the entire call signaling and bearer establishment. It provides user connection, user management, and service bearer, and provides an interface to the external network as a bearer network. The establishment of user connection includes functions such as mobility management (MM), call management, switching / routing, and recording notification (combined with intelligent network services to complete the connection relationship to the intelligent network peripheral equipment). User management includes user description, QoS (additional description of user service QoS), user communication records (Accounting), dialogue with the intelligent network platform to provide a virtual home environment, and security (the authentication center provides corresponding security measures, including security management of mobile services and security processing of external network access). The bearer connection (Access to) includes the external public switched telephone network (PSTN), external circuit data network and packet data network, wide area network and local area network, as well as the mobile's own SMS server, etc. The basic services that the core network can provide include mobile office, e-commerce, communication, entertainment services, travel and location-based services, telemetry services (Telemetry) - simple messaging services (monitoring and control), etc.

[0053] 3. Network equipment: It can be any device with wireless transceiver function. Including but not limited to: evolved base station (E-UTRAN NodeB or e-NodeB or eNB) in LTE, base station (gNodeB or gNB) or transmission / reception point (TRP) in 5G or new wireless (new radio, NR) access technology, base station of subsequent evolution of 3GPP, access node in WiFi system, wireless relay node, wireless backhaul node, etc. The base station can be: macro base station, micro base station, micro-micro base station, small station, wireless controller, centralized unit (centralized unit, CU), and / distributed unit (distributed unit, DU) in the o access network (CRAN) scenario. The network device can also be a server, wearable device, or vehicle-mounted device, etc. The following is an example of a network device being a base station. The multiple network devices can be base stations of the same type or different types. The base station can communicate with the terminal device or communicate with the terminal device through a relay station. The terminal device can communicate with multiple base stations of different technologies. For example, the terminal device can communicate with a base station supporting an LTE network and a base station supporting a 5G network. It can also support dual connections with base stations of an LTE network and base stations of a 5G network.

[0054] The network equipment involved in the embodiments of the present application may include a base station (BS), which may be a device deployed in a wireless access network that can communicate wirelessly with a terminal. Among them, the base station may have multiple forms, such as a macro base station, a micro base station, a relay station, and an access point. Exemplarily, the base station involved in the embodiments of the present application may be a base station in 5G or a base station in long-term evolution (LTE), wherein the base station in 5G may also be referred to as a transmission reception point (TRP) or gNB. In the embodiments of the present application, the device for implementing the function of the network device may be a network device; it may also be a device that can support the network device to implement the function, such as a chip system, which may be installed in the network device. In the technical solution provided in the embodiments of the present application, the device for implementing the function of the network device is a network device, and the network device is a base station as an example to describe the technical solution provided in the embodiments of the present application.

[0055] The technical solution provided in the embodiment of the present application can be applied to wireless communication between communication devices. Wireless communication between communication devices may include: wireless communication between network devices and terminals, wireless communication between network devices and network devices, and wireless communication between terminals and terminals. Specifically, uplink and downlink transmission can be performed between network devices and terminal devices via a cellular link (Uu link). Among them, in the embodiment of the present application, the term "wireless communication" can also be referred to as "communication", and the term "communication" can also be described as "data transmission", "information transmission" or "transmission".

[0056] In one possible implementation, the terminal device may communicate with the core network device through the network device.

[0057] 4. Electronic tag: An electronic tag can also be called a terminal or device. The tag type can be divided into three types: active, passive, and semi-active, or it can be divided into passive tag, semi-passive tag, and active tag. The passive tag and semi-passive tag here use a communication method based on backscatter, and the active tag uses a technology that actively generates a carrier. The types of tags can be classified based on whether the communication method is based on reflection, or based on the ability to store energy or not, or based on the ability of combining the two. In the current standards, three types of terminals or devices have been preliminarily defined in the discussion on artificial intelligence & internet of things (AIOT), which are also applicable to the application, including: devices without energy storage and independent signal generation, such as devices with backscatter transmission with this characteristic, such as device A; or, devices with energy storage but without independent signal generation, such as devices with backscatter transmission with this characteristic, such as device B, where the use of stored energy may include amplification of reflected signals; or, devices with energy storage and independent signal generation, such as active wireless radio frequency (RF) components for transmission, such as device C.

[0058] 5. Reader / writer: It can be a handheld or fixed device that reads (and sometimes writes) tag information. It can also be understood as a device that communicates with tags. It can be in the form of a terminal, a base station, or a device with reading and writing functions. It can also be an IAB node or a relay node. The reader / writer helper / excitation source involved in the embodiments of the present application can be a terminal, or a base station or a small station. The device has only downlink communication with the tag, and has uplink and downlink data transmission with the reader / writer, which may be through an air interface or a wired connection.

[0059] 6. Inventory: The process in which the reader triggers multiple tags to complete reporting is called the inventory process.

[0060] 7. Inventory flag: It can be implemented by software or hardware capacitor to implement a flag with two states (two states A / B or 0 / 1). A tag can contain at least one inventory flag, and the tag determines whether to respond to the reader's instructions based on it. The reader can select the tag with the inventory flag A to access the network or the tag with the flag B to access the network.

[0061] The following is a brief description of the main network elements in the 5G network system involved in the embodiments of the present application.

[0062] 1. User equipment (UE). 2. Radio access network (R)AN), hereinafter referred to as RAN, corresponding to access network equipment. For example, RAN can be NB, eNB, gNB, ng-eNB, or any other access network equipment. 3. Access and mobility management function (AMF). 4. Application function (AF): used for data routing affected by applications, access network open function network elements, interaction with the policy framework for policy control, etc. 5. Unified data management (UDM): used for processing UE identification, access authentication, registration and mobility management, etc. 6. Authentication server function (AUSF). It can be understood that the above-mentioned network elements or functions can be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (for example, a cloud platform).

[0063] With the increasing application of 5G NR communication machine-type communication (MTC) and Internet of Things (IoT) communication, the number of IoT device connections is increasing day by day. Therefore, the industry's demand for reducing the cost and power consumption of IoT devices is becoming stronger and stronger. In the 4G era, 3GPP introduced the narrowband Internet of Things (NB-IoT) system. However, NB-IoT terminals also require overall external (battery) power supply and have the ability to generate local high-frequency local oscillator carriers. Therefore, this type of terminal can only reach milliwatts of power consumption. However, with the evolution and development of 5G IoT, the demand for supporting lower power consumption terminals in 5G networks is increasing. Radio frequency identification (RFID) technology provides a good technical reference in the direction of low power consumption and can support microwatts of power consumption. Radio frequency identification (RFID) terminals (tags) use low-precision, low-power medium- and low-frequency ring oscillators or completely no local oscillators to receive downlink signals. When the tag is working, the energy and carrier of the communication come from the reader and writer, and the communication is based on the reflected carrier.

[0064] In view of the advantage of RFID communication technology in low power consumption, 5G ambient powered Internet of Things (Ambient IoT) came into being. In order to meet the ultra-low power consumption requirements, the terminal devices in Ambient IoT also use low-precision, low-power medium-low frequency ring oscillators or completely no local oscillator to receive downlink signals. This reception method can further reduce the power consumption of downlink reception of terminal devices. For such low-power reception methods, only amplitude detection such as envelope detection can be performed, because only low-precision ring oscillators cannot guarantee accurate demodulation of signal phase information. Existing RFID terminals have low cost, low design complexity, poor coverage, and limited adaptability. During the research process of 5G Ambient IoT, coverage enhancement design is carried out, and corresponding problems will also arise.

[0065] In the related art, the authentication process of the terminal device is shown in Figure 1 , which shows a flowchart of a terminal device authentication method provided by the related art, firstly performing terminal identification (identity document, ID) decryption, and then performing authentication, specifically, as Figure 1 As shown, the method may include:

[0066] S1: The terminal connects to the network and initiates a registration request to the core network through the NAS layer. The registration request message may carry a temporary terminal device identifier (5G Globally Unique Temporary Identifier, 5G-GUTI) or a user hidden identifier (subscription concealed identifier, SUCI) or a user permanent identifier (subscription permanent identifier, SUPI) according to the actual status of the UE.

[0067] S2.AMF initiates an initial authentication request. The authentication request includes (SUCI / SUPI, SNN). When a valid 5G-GUTI is received, the corresponding SUPI should be placed in the backward request message. If SUCI is received, the SUCI is placed directly in the request message. The message also includes information such as the media access control protocol (MAC), which is used by the core network to determine the legitimacy of the SUCI.

[0068] S3. Authentication server function (AUSF), carrying: SUCI / SUPI, SNN, event: check SNN, check whether AMF is authorized to use the serving network. If the check is passed, AUSF sends a message to UDM / ARPF to request authentication data. If the check is not authorized, it returns "serving network not authorized" to AMF.

[0069] S4.UDM sets Bit "0" (high bit, AMF separation bit) of AMF to 1, carries: authentication quaternary group, SUPI, and then performs the following processing:

[0070] 4a.UDM calls SIDF module to complete SUCI->SUPI decryption.

[0071] It should be noted that in this process, the UE side only transmits its own ID with an anonymous identity and encrypted with a temporary key, but it cannot prove that the UE has the legal identity of the corresponding SUPI. The home network can only complete the legality verification of the UE identity in the following step 17.

[0072] 4b. Check whether the security capabilities carried by the UE are valid or acceptable.

[0073] 4c.UDM is based on SUPI and selects the corresponding authentication method according to local policy.

[0074] 4d. Generate a random number (RAND) and obtain the user's current SQN.

[0075] 4e. Generate 5G HE AV (RAND, AUTN, XRES*, KAUSF).

[0076] S5.UDM sends a message to AUSF, carrying 5G HE AV. If SUCI is included in the message received in the previous step, the restored SUPI is placed in the message and the authentication method is selected according to the user's contract information.

[0077] S6.AUSF performs the following steps:

[0078] 6a. Calculate XRES*, store XRES* and the corresponding SUPI or SUCI, and generate KSEAF.

[0079] 6b. Generate 5G SE AV (RAND, AUTN, HXRES*).

[0080] S7.AUSF sends a message to AMF, carrying 5G SE AV (RAND, AUTN, HXRES*).

[0081] S8.AMF saves HXRES*.

[0082] S9.AMF sends an Authentication Request message to the UE, carrying RAND, AUTN, ngKSI and ABBA. ABBA (anti-bidding down between architectures parameter) is used to prevent network downgrade attacks.

[0083] S10.USIM calculates XMAC through RAND and AUTN, and then compares it with the MAC in AUTN. If the two are consistent, proceed to the next step. Otherwise, the UE side fails to authenticate the network side and sends an Authentication Failure message to AMF / SEAF.

[0084] S11. The USIM determines whether the SQN in the AUTN is within the correct range. If the result is correct, the UE is considered to have successfully completed the authentication of the network. Otherwise, the UE and the network are considered to have failed to authenticate the SQN and return a Synchronisation Failure to the AMF / SEAF.

[0085] S12. The UE side performs the following processing: verifying AUTN, deriving RES, secret keys (CK, IK), and calculating RES*.

[0086] 12a. USIM calculates RES and returns RES, CK, IK to ME.

[0087] 12b.ME uses RES to calculate RES*, and RES* is calculated using KDF, taking the lower 128 bits.

[0088] S13.UE sends an Authentication Response message to AMF, carrying RES*.

[0089] S14.AMF calculates HRES* from the received RES* and compares it with the locally stored HXRES*. If the two are equal, it is considered that the service network has successfully authenticated the UE. Otherwise, it is considered that the authentication has failed and an Authentication Failure message is returned to the AUSF.

[0090] S15.AMF sends a message to AUSF, carrying RES*.

[0091] S16.AUSF confirms whether the 5G AV corresponding to the received RES* is expired.

[0092] S17.AUSF compares RES* with the locally stored XRES* to see if they are consistent. If they are consistent, it is determined that the home network has successfully authenticated the UE. Otherwise, it is considered that the authentication has failed and Authentication Failure is returned to UDM.

[0093] S18.AUSF sends a message to UDM, carrying SUPI, authentication timestamp, authentication type (such as EAP or 5G-AKA), and service network name.

[0094] S19.UDM saves the authentication result, specifically storing the message content and authentication result received above.

[0095] It should be noted that some variables in the above steps do not have full names and only represent intermediate parameters.

[0096] In the above-mentioned terminal device authentication method, there is no transmission of group services in the related technology, so there is no security protection scheme for group services. The encryption and decryption of UE identification uses an asymmetric key method, which has a complex calculation process and high overhead, with a specific overhead of 400 to 500 bits. The existing terminal identification protection mechanism uses asymmetric key encryption and decryption, which has a complex calculation process and high overhead, and does not meet the low power consumption requirements of the terminal.

[0097] In order to solve the above problems, an embodiment of the present application provides a paging access method, in which a first terminal device receives a paging message from a core network device, the paging message carries group key indication information, and then the first terminal device sends a first authentication request message to the core network device, the first authentication request message includes a terminal identifier of the first terminal device, the terminal identifier is encrypted according to the first information, the first information includes a group key indicated by the group key indication information, and based on the first authentication message, the core network authenticates the first terminal device. In this way, during the process of paging access by the terminal device, the terminal identifier of the terminal device can be encrypted using a group key to ensure the security of the terminal identifier during the transmission process, and the computational complexity and processing overhead of the encryption process of the terminal identifier can be reduced, and the overall power consumption of the paging access process can be reduced.

[0098] The following will describe in detail the paging access method provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0099] In the embodiment of the present application, the terminal device may include but is not limited to electronic tags, smart phones (including folding screen phones and non-folding screen phones), netbooks, tablet computers, smart watches, smart bracelets, phone watches, smart cameras, PDAs, personal computers (PCs), robots, personal digital assistants (PDAs), portable multimedia players (PMPs), augmented reality (AR) / virtual reality (VR) devices, smart home devices, televisions, projection devices, or somatosensory game consoles in human-computer interaction scenarios, etc. The embedded devices described in the embodiment of the present application may include but are not limited to printers, copiers, fax machines, biochemical analyzers, blood analyzers, switches, routers, industrial computers, drones, automated teller machines (ATMs), etc. The embodiment of the present application does not specifically limit the specific functions and types of the devices including the controller.

[0100] Exemplarily, the embodiments of the present application can be used for air interface transmission between an electronic tag and a reader / writer. The form of the reader / writer is not limited, and it can be a base station, a terminal, or a relay node accessing an integrated access and backhaul (IAB) node. The UE can also be located within the coverage provided by the reader / writer. When the reader / writer is a terminal, the communication between the reader / writer and the UE can be regarded as transmission between terminals. When the reader / writer is a base station, the communication between the reader / writer and the UE is a uu interface, that is, air interface communication. The following figures respectively illustrate that the base station and the UE (tag) are connected through uu; the UE is connected to the IAB node through uu, and the IAB node is connected to the base station through uu; and the access point and the tag are connected through sidelink.

[0101] Specifically, refer to Figure 2 , which shows a schematic diagram of an application scenario of a paging access method provided in an embodiment of the present application, such as Figure 2 As shown, the application scenario of the embodiment of the present application may be between a base station and an electronic tag.

[0102] refer to Figure 3 , which shows a schematic diagram b of an application scenario of a paging access method provided in an embodiment of the present application, such as Figure 3 As shown, the application scenario of the embodiment of the present application may be between a terminal device and an electronic tag.

[0103] refer to Figure 4 , which shows a schematic diagram c of an application scenario of a paging access method provided in an embodiment of the present application, such as Figure 4As shown, the application scenario of the embodiment of the present application may be between a base station and an electronic tag, specifically, the base station is connected to an IAB node, and the IAB node is connected to the electronic tag.

[0104] Optionally, a split architecture is also supported, see Figure 5 , which shows a schematic diagram d of an application scenario of a paging access method provided in an embodiment of the present application, such as Figure 5 As shown: The application scenario of the embodiment of the present application can be that the tag (i.e. the above-mentioned electronic tag) has only an uplink connection with the reader (such as a base station), and the tag has only a downlink connection with the UE or the excitation source (helper). The dotted line indicates the provision of carrier or energy, and the solid line indicates the data transmission connection.

[0105] refer to Figure 6 , which shows a schematic diagram of an application scenario of a paging access method provided in an embodiment of the present application, such as Figure 6 As shown: The application scenario of the embodiment of the present application can be that the tag (i.e. the above-mentioned electronic tag) has only a downlink connection with the reader (such as a base station), and the tag has only an uplink connection with the UE or the excitation source (helper). The dotted line indicates the provision of carrier or energy, and the solid line indicates the data transmission connection.

[0106] The present invention is mainly applied to 5G NR (New Radio) or 6G systems. The present invention can also be applied to other communication systems, such as Long Term Evolution LTE (Long Term Evolution), Code Division Multiple Access CDMA (Code Division Multiple Access), WIFI, etc., as long as there are access network units (such as gNB) and multiple terminals in the communication system. There is a terminal within the coverage of a gNB, sending an uplink signal to the gNB, and / or receiving a downlink signal sent by the gNB. Other terminals may be within the coverage of the gNB or may not be within the coverage of the gNB.

[0107] In some embodiments, see Figure 7 , which shows a flow chart a of a paging access method provided by an embodiment of the present application, such as Figure 7 As shown, the method may include:

[0108] S701: The access and mobility management AMF receives a first service request message (inventory) from the AF, wherein the service request message may indicate the service type, information of the UE terminal device (or terminal) or device or ATIO device or a group of UEs, and the area in which the service is executed, etc.

[0109] In some examples, the tag management function (TMF) receives a second service request message (inventory) from the AF. The service request message may indicate the service type, the information of the UE terminal device (or terminal) or device or ATIO device or a group of UEs, and the area where the service is executed. It should be noted that the AMF involved in the embodiment of the present application is only an example and can be replaced by TMF or other network elements, and no limitation is made here.

[0110] In some examples, the first service request may indicate one or more service types, and the terminal devices are grouped according to different service types. That is, one service request may correspond to one or more terminal devices, and a connection may be established with one or more terminal devices in response to the first service request.

[0111] In some scenarios, the message sent by the base station can also be replaced by the message sent by the terminal. In other words, the method involved in the embodiment of the present application can also be applied between the terminal and the electronic tag (terminal).

[0112] S702: AMF sends a first paging message paging to the interrogator or reader or base station (BS) or gNB, carrying mask, inventory ID, group identifier, group index, etc.

[0113] In some examples, the first paging message includes at least one information such as group identification information, mask information, inventory or event identification, and group key identification index.

[0114] In some examples, the first paging message may also include a second random number, which is sent to the base station or gNB through the first paging message, and the second random number is used to encrypt the terminal identifier together with the group key.

[0115] Specifically, in some embodiments, the group identification information is used to determine the UE that is paged by a group, the UE identification is used to determine the UE, and the mask information can also be used to indicate a group of UEs. The specific indication method is that when part or all of the information carried in the mask is consistent with the information stored in the terminal, the terminal is considered to be paged, that is, at least one terminal can be paged in this way. The inventory or event identification is used to identify an inventory event or identify a session or represent a service. The group key identification index is used to indicate the key required for the terminal to encrypt or securely operate the terminal identification. Specifically, it can be a group key identification for each (per) public land mobile network (PLMN) PLMN, or a group key identification for each service type, such as an inventory service group identification, a read service group identification. That is, in addition to the group key identification, the PLMN identification or service type identification may not be carried.

[0116] S703: The base station sends a second paging message paging to the terminal, carrying mask, inventory ID, group identifier, groupindex, etc.

[0117] In some examples, the second paging message includes at least one information such as group identification information, mask information, group key identification index, etc. The meaning of the information is the same as above and will not be repeated here. The second paging message is used to page at least one terminal device to access the network.

[0118] In some examples, the second paging message may also include a second random number, wherein the second random number is sent to the terminal device through the first paging message, and the second random number is used to encrypt the terminal identifier together with the group key.

[0119] In some examples, the first paging message and / or the second paging message may be in the form of a multicast or groupcast message. When the first paging message and / or the second paging message is in the form of a multicast or groupcast message, it may include paging identification information or may not include paging identification information.

[0120] S704: The paged terminal initiates random access. The random access process may use 4-step random access or 2-step random access.

[0121] Specifically, in some examples, if it is a 4-step random access, the terminal first sends a preamble code, and after receiving the random access response sent by the base station, the terminal sends a message and waits to receive the message sent by the base station to the terminal. For details, please refer to 3GPP protocol 38.321 or 36.321 protocol.

[0122] In some examples, if it is a two-step random access, the terminal can send a random access request message, and then receive a response message sent by the base station. The random access process is completed. Specifically, the two-step random access can use the time slot aloha method. Other methods can also be used. Among them, the access timing used for random access can be an access timing of a fixed time unit in the time domain, or a variable access timing. In the case of a variable timing, the access timing can be a timing triggered by a special signaling, that is, when the special signaling is received, a time domain resource for terminal access is triggered.

[0123] S705: After completing access, the terminal sends a message authentication request message to the core network.

[0124] The authentication request message in this article may also be referred to as other messages, and the specific name remains unchanged, that is, the authentication mentioned in the embodiment may be an optional behavior. Only the tag identifier may be encrypted, and the core network does not need to authenticate the tag.

[0125] The terminal sends an authentication request message to the core network through the network device. In some examples, the authentication request message includes a terminal identifier, and optionally a random number and a group key identifier, and the UE ID is encrypted or protected using the group key indicated in the paging message.

[0126] In some examples, if a random number is included, the random number can also be used as one of the parameters when encrypting the terminal identifier. The authentication request message is sent to the core network AMF via the base station. The random number can be a first random number generated by the terminal device itself, or a second random number indicated by a paging message. The first random number and the second random number are both used to encrypt the terminal identifier in conjunction with the group key.

[0127] S706: The authentication request message includes an encrypted ID and / or a group identifier, a random number (a first and / or a second random number). Specifically, the authentication request message includes a terminal identifier, and optionally includes a random number and a group key identifier. The terminal identifier is encrypted or protected using the group key indicated in the paging message. If a random number is included, the random number can also be used as one of the parameters when encrypting the ID. If a group key identifier is carried, the identifier is used to indicate to the core network which group key is used to protect this ID. The message is sent to the core network AMF via the base station.

[0128] When the authentication request message does not carry a group key identifier, the base station may also carry a group key identifier and / or an inventory identifier when sending the authentication request or ID transmission, to indicate to the core network which key the user ID uses for security protection. Optionally, when the base station sends multiple terminal identification information to the core network together, it may also indicate the key information to the core network through a group key identifier and / or an inventory identifier. That is, it is used to indicate the key used for encryption of multiple terminal identifications.

[0129] Regardless of whether the terminal sends the authentication request carrying the key identifier, the base station may also carry the group key identifier and / or inventory identifier when sending the authentication request or ID transmission, which is used to instruct the core network which key to use for security protection of the user ID.

[0130] In some examples, the authentication request information may also include a random number, wherein the random number may be a first random number generated by the terminal device itself, or a second random number indicated by a paging message, and both the first random number and the second random number are used to encrypt the terminal identifier in conjunction with the group key.

[0131] The optional encrypted UE ID may not need to use a random number, so the first or second random number may not be transmitted.

[0132] S707: The core network receives ID information from the terminal and can determine which key is used to protect the received terminal ID through the group key identifier sent by the UE, or the group key identifier and / or inventory identifier sent by the base station, and then decrypt the ID information.

[0133] In some examples, the AMF may also send the encrypted UE ID and key information to the core network data management unit UDM for decryption.

[0134] S708: After the core network obtains the correct UE ID, if the authentication is successful, data transmission can be performed.

[0135] S709: When transmitting data with each UE, the UE-specific root key can be used to encrypt the transmitted data and possibly protect its integrity. The root key here refers to a key unique to each terminal. When the root key is used to encrypt data, the key derived from the root key can also be used for encryption.

[0136] Based on this, in group services, the paged terminal identity is protected based on the group key, rather than the traditional terminal-specific key protection. This can achieve group terminal access while avoiding increasing computational complexity. The key used for the terminal identity is determined based on the alignment of the group identity with the network side, which can achieve encryption of the user identity with low complexity and low signaling overhead, thereby ensuring the privacy and security of the user identity.

[0137] In some embodiments, see Figure 8 , which shows a flow chart b of another paging access method provided in an embodiment of the present application, such as Figure 8 As shown, the method may include:

[0138] S801: Access and mobility management AMF receives the first service request (inventory) from the application (AF), which may indicate the service type, information of the UE terminal device (or terminal) or device or ATIO device or a group of UEs, and the area where the service is executed, etc.

[0139] In some examples, the tag management function (TMF) receives a second service request message (inventory) from the AF, wherein the service request message may indicate the service type, information of a UE terminal device (or terminal) or device or ATIO device or a group of UEs, and an area where the service is performed.

[0140] S802: AMF sends a first paging message Paging to the base station (Interrogator or Reader or base station), and the first paging message includes mask, inventory ID, group read / group write & key ID, group identification information, mask information, inventory or event identification, at least one UE identification information, group key identification index, and at least one information such as NAS data or NAS container or other data carrying form. The group key identification index or key ID here is the key used to encrypt the network storage NAS data contained in the paging message. Optionally, the key may be the same as the group key of the first embodiment or may be different. The NAS data is NAS data sent to at least one terminal being paged. NAS data can be understood as data carried by NAS messages or NAS layers. When the key may be different from the group key of the first embodiment, the paging message may include two group key identifications, one for decrypting data and one for encrypting UE identification.

[0141] In some examples, the NAS data may not be carried in the first paging message, but may be carried in a separate signaling, but may be sent to the terminal together with the paging message.

[0142] S803: The base station sends a second paging message Paging to the terminal. The second paging message includes mask, inventory ID, group read / group write & key ID, group identification information, mask information, at least one UE identification information, group key identification index, and at least one information such as NAS data or NAS container or other data carrying form. The NAS data or data is NAS data or data sent to at least one terminal being paged. NAS data can be understood as data carried by NAS messages or NAS layers.

[0143] In some examples, the NAS data may not be carried in the second paging message, but may be carried in a separate signaling message, but may be sent to the terminal together with the second paging message.

[0144] In some examples, the data may not be carried by NAS or RRC messages, but may be carried by PDCP / RLC / MAC layer, but the data packet may be sent to the terminal together with the second paging message. Therefore, the data packet may also be encrypted or securely protected by the key indexed by the group key identifier.

[0145] The optional second paging may also include a third random number for encrypting the data portion. The third random number may be the same as or different from the first or second random number.

[0146] S804: After receiving the second paging message, the terminal determines whether it is the paged terminal, and if so, it can decrypt the encrypted data using the indicated group key and initiate a random access process, for which reference can be made to the first embodiment.

[0147] S805: After completing random access, the terminal sends data to the base station, such as UL NAS (ID+data), which may be a response to the paging received data. The sent data may be encrypted or integrity protected based on the terminal's own unique root key or a derived key of the root key or continue to use the group key to encrypt the sent data, or may be encrypted based on the indication of the base station or core network in the paging message using one of the above keys.

[0148] S806: After the terminal completes random access, it sends data to the core network element through the base station. For example, UL NAS (ID+data), the data may be a response to the paging reception data. The sent data may be encrypted or integrity protected based on the terminal's own unique root key or the derived key of the root key or continue to use the group key to encrypt the sent data, or may continue to use the group key to encrypt the sent data based on the indication of the base station or the core network in the paging message.

[0149] S807: After the terminal completes random access, it sends data to the application through the base station and the core network element. For example, ULNAS (ID+data), the data may be a response to the paging reception data. The sent data may be encrypted or integrity protected based on the terminal's own unique root key or the derived key of the root key, or may be encrypted using the group key based on the indication of the base station or the core network in the paging message.

[0150] Based on this, existing service data can only be encrypted after the terminal is connected and security is activated. During the paging process, the data sent to a group of terminals can be encrypted and protected using the group key, without waiting for the terminal to be connected and encrypted and sent separately according to the terminal-specific key, avoiding the situation where a single UE-specific key is used for encryption and sent separately, which greatly increases the signaling overhead. The data sent by a group of terminal devices can be encrypted and protected using the same group key to reduce signaling overhead and improve transmission efficiency. When performing group service transmission, the security protection of service data based on the group key ensures the security of the service data and avoids the problem that the group data on the network side cannot be encrypted and decrypted using the UE-specific key.

[0151] As an example, see Fig. 9 , which shows a flowchart c of another paging access method provided by an embodiment of the present application, such as Fig. 9 As shown, the paging access method provided in the embodiment of the present application may include:

[0152] S901: A first terminal device receives a paging message from a core network device, wherein the paging message carries group key indication information, and the group key indication information is for at least one terminal device, and the at least one terminal device includes the first terminal device.

[0153] It should be noted that the first terminal device receives the paging message sent by the core network device and obtains the group key indication information in the paging message; wherein the group key indication information may indicate the corresponding group key, and the same group key may be sent to one or more terminal devices. The same group key may be used for a group of terminal devices executing the same service type, and there may be one or more terminal devices executing the same service type.

[0154] Exemplarily, the above-mentioned first terminal device may include a terminal and a tag, specifically, including a device without energy storage and independent signal generation, such as a backscatter transmission device with this characteristic; including a device with energy storage but without independent signal generation, such as a backscatter transmission device with this characteristic, wherein the use of stored energy may include amplifying the reflected signal; and also including a device with energy storage and independent signal generation, such as an active wireless radio frequency (RF) component for transmission.

[0155] As an example, the above group key indication information may include one or more of the following: group identification information, mask information, inventory identification, event identification, and group key identification index.

[0156] It should be noted that, during the paging process of the terminal device, the core network device sends a paging message to one or more terminal devices, and the group key indication information carried in the paging message may include one or more of the group identification information, mask information, inventory identification, event identification, and group key identification index, wherein the group identification information, mask information, inventory identification, event identification, and group key identification index can directly or indirectly indicate the corresponding group key to the terminal device, so that the terminal device uses the group key to encrypt the terminal identification during the authentication request and data transmission process.

[0157] Specifically, the group identification information is used to determine a group of UEs to be paged, the UE identification is used to determine the UE, and the mask information can also be used to indicate a group of UEs. The specific indication method is that when part or all of the information carried in the mask is consistent with the information stored in the terminal, the terminal is considered to be paged. In this way, at least one terminal can be paged. The inventory identification or event identification is used to identify an inventory event or a session or a service.

[0158] As an example, before sending the first authentication request message to the core network device, the method may further include:

[0159] Access the core network device based on the paging message.

[0160] It should be noted that after receiving the paging message, the first terminal device determines the key indication information in the paging message, encrypts the terminal identifier of the first terminal device according to the key indication information, and then sends an authentication request message to the core network device, and can access the core network device through 2-step random access or 4-step random access.

[0161] As an example, the core network device may also indicate to the terminal device whether the terminal identifier needs to be encrypted. When the core network device indicates to the terminal device that the terminal identifier does not need to be encrypted, the terminal identifier may be sent directly.

[0162] S902: The first terminal device sends a first authentication request message to the core network device. The first authentication request message includes a terminal identifier of the first terminal device. The terminal identifier is encrypted based on first information. The first information includes an identifier of a group key indicated by group key indication information.

[0163] It should be noted that when the first terminal device randomly accesses the core network, the first terminal device sends an authentication request message to the core network device. The terminal identifier in the authentication request message needs to be encrypted, and the terminal identifier is encrypted using the group key indicated by the group key indication information. Among them, the group key indication information is used to indicate the group key in the process of the core network device sending a paging message. Since the group key indication information indicates the group key through different dimensions such as group identification information, mask information, inventory identification, event identification, group key identification index, etc., the same group key can correspond to one or more group key indication information. The first information is used when the first terminal device sends a first authentication request message, and the first information may include the group key.

[0164] As an example, the first authentication request message includes a first identifier, which includes one or more of the following: a group key identifier, an inventory identifier corresponding to the group key, group identifier information, mask information, an inventory identifier, an event identifier, and a group key identifier index.

[0165] It should be noted that, during the authentication process of the terminal device, in the first authentication request information sent by the terminal device to the core network device, the first identifier can be a group key identifier or an inventory identifier corresponding to the group key identifier, wherein the group key identifier can directly indicate the corresponding group key for the core network device to decrypt the first authentication request information, and the inventory identifier can indicate the storage location of the group key so that the core network device can obtain the group key to decrypt the first authentication request information.

[0166] As an example, the first information may also include a random number. The random number may be used as a parameter in the encryption process when the terminal identifier is encrypted using the group key to improve the security of the terminal identifier during transmission. Accordingly, the first authentication request message includes the random number. The random number is used as a parameter when the terminal identifier is encrypted using the group key when sending the first authentication request message.

[0167] As an example, the random number may be a first random number generated by the terminal device itself, or a second random number indicated by a paging message, and both the first random number and the second random number are used to cooperate with the group key to encrypt the terminal identifier. As an example, sending a first authentication request message to a core network device may include:

[0168] A first authentication request message is sent to a core network device through a first network device.

[0169] It should be noted that the first terminal device can directly send the first authentication request information to the core network device so that the core network device authenticates the first terminal device. At the same time, the first terminal device can also send the first authentication request message to the core network device through the first network device so that the core network device authenticates the first terminal device.

[0170] As an example, the sending of the first authentication request message to the core network device through the first network device may include:

[0171] A first authentication request message and a second authentication request message are sent to a first network device, and a third message is sent to a core network device through the first network device, wherein the third message includes one or more authentication request information, and the multiple authentication request information include the first authentication request message and the second authentication request message.

[0172] It should be noted that the terminal device sends an authentication request message to the core network device through the first network device. One or more terminal devices may send one or more authentication request messages to the first network device. The first network device may send one or more authentication request messages to the core network device separately. The multiple authentication request messages may come from one or more terminal devices. One or more authentication request messages may also be sent to the core network device together as a third message. The third message may be one or more, so that the core network device can authenticate one or more terminal devices.

[0173] As an example, the first authentication request message and the second authentication request message do not include the first identifier, and the third message includes the first identifier.

[0174] As an example, the first authentication request message, the second authentication request message and the third message all include a first identifier, and the specific identifier value included in the first identifier may be different.

[0175] It should be noted that, when the first authentication request message and the second authentication request message sent by the first terminal device to the first network device do not include the first identifier, the first network device can add the corresponding first identifier in the authentication request message to indicate the group key used for encrypting the terminal identifier in the authentication request message sent by the first network device, and send the first authentication request message, the second authentication request message and the first identifier as a third message to the core network device.

[0176] As an example, the above method may further include:

[0177] The target data is encrypted using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device, and the encrypted target data is sent to the core network device.

[0178] It should be noted that data transmission can be carried out between the core network device, the first network device and the terminal device, the terminal device can transmit data with the first network device, and the data can also be transmitted between the first network device and the core network device. During the data transmission process, the target data can be encrypted by the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device or the derived key of the root key to ensure the security of the data during the transmission process.

[0179] As an example, see Fig.10 , which shows a flowchart of another paging access method provided by an embodiment of the present application, such as Fig.10 As shown, the paging access method provided in the embodiment of the present application may include:

[0180] S1001: In response to a first service request, a core network device sends a paging message to a first terminal device. The paging message carries group key indication information. The group key indication information is for at least one terminal device, and the at least one terminal device includes the first terminal device.

[0181] It should be noted that, when the core network device receives the first service request, the core network device can send a paging message to one or more terminal devices, and the paging message includes group key indication information, wherein the group key indication information can indicate the corresponding group key, and the same group key can be sent to one or more terminal devices.

[0182] As an example, the above group key indication information includes one or more of the following: group identification information, mask information, inventory identification, event identification, and group key identification index.

[0183] It should be noted that, during the paging process of the terminal device, the core network device sends a paging message to one or more terminal devices. The group key indication information carried in the paging message may include group identification information, mask information, inventory identification, event identification, and group key identification index. Among them, the group identification information, mask information, inventory identification, event identification, and group key identification index can directly or indirectly indicate the corresponding group key to the terminal device, so that the terminal device uses the group key to encrypt the terminal identification and send it to the core network device.

[0184] S1002: Receive a first authentication request message from a first terminal device, where the first authentication request message includes a terminal identifier of the first terminal device, where the terminal identifier is encrypted based on first information, and where the first information includes an identifier of a group key indicated by group key indication information.

[0185] It should be noted that the core network device obtains the first authentication request information sent by the first terminal device, and the first authentication request message includes first information indicating the group key.

[0186] As an example, the receiving of the first authentication request message from the first terminal device may include:

[0187] A first authentication request message is received, which is forwarded by the first terminal device through the first network device.

[0188] It should be noted that the core network device can directly receive the first authentication request information sent by the terminal device and authenticate the first terminal device. At the same time, the core network device can also receive the first authentication request message sent by the first terminal device through the first network device, decrypt the terminal identifier of the first terminal device according to the first information in the first authentication request message, and obtain the decrypted terminal identifier.

[0189] As an example, after the terminal identification of the first terminal device is decrypted, the first terminal device is authenticated based on the decrypted terminal identification.

[0190] As an example, the above-mentioned receiving the first authentication request message forwarded by the first terminal device through the first network device includes:

[0191] A third message is received through the first network device, where the third message includes one or more authentication request messages, where the multiple authentication request messages include a first authentication request message and a second authentication request message.

[0192] As an example, the third message may be an interface message between the base station and the core network, such as an NG-AP interface or other interface, which is not limited here. It can be understood that the third message may be one or more, and part or all of the one or more third messages may be interface messages between the base station and the core network. The specific interface type is the same as above and will not be repeated here.

[0193] It should be noted that the core network device receives the third message through the first network device. The third message may be one or more messages. The third message may include the first terminal device sending one or more authentication request messages to the first network device. The first network device may send one or more authentication request messages sent by the terminal device to the core network device. The multiple authentication request messages may come from multiple terminal devices. Then, the core network device decrypts the terminal identifier in one or more messages based on the received third message.

[0194] As an example, the core network device may also decrypt at least one received terminal identifier based on the first information or the first identifier or the inventory identifier or the group key identifier in the third message. The first information may be in the authentication request information sent by the terminal, or may be added by the first network device when sending the authentication request information.

[0195] As an example, after the terminal identification of at least one terminal device is decrypted, the first terminal device is authenticated based on the decrypted terminal identification.

[0196] S1003: Authenticate the first terminal device according to the first authentication request message.

[0197] It should be noted that the core network device obtains the first information in the first authentication request message, and decrypts the terminal identification of the first terminal device according to the first information to obtain the terminal identification of the first terminal device.

[0198] As an example, after obtaining the terminal identification of the first terminal device, the first terminal device may be authenticated based on the terminal identification.

[0199] As an example, the authenticating the first terminal device according to the first authentication request message may include:

[0200] Decrypting the first authentication request message to obtain a terminal identifier of the first terminal device;

[0201] The terminal identification of the first terminal device is authenticated.

[0202] It should be noted that the core network device can decrypt the terminal identification of the first terminal device by using the group key indicated by the first information in the first authentication request message.

[0203] As an example, after obtaining the terminal identification of the first terminal device, the first terminal device may be authenticated based on the decrypted terminal identification to obtain an authentication result.

[0204] As an example, the first authentication request message includes a first identifier, which includes one or more of the following: a group key identifier, an inventory identifier corresponding to the group key, group identifier information, mask information, an inventory identifier, an event identifier, and a group key identifier index.

[0205] It should be noted that, during the authentication process of the terminal device, in the first authentication request information received by the core network device, the first identifier may be a group key identifier or an inventory identifier corresponding to the group key identifier, wherein the group key identifier may directly indicate the corresponding group key for the core network device to decrypt the first authentication request information, and the inventory identifier may indicate the storage location of the group key so that the core network device can obtain the group key to decrypt the first authentication request information.

[0206] As an example, the first information may also include a random number. The random number may be used as a parameter in the decryption process when the terminal identifier is decrypted using the group key to improve the security of the terminal identifier during transmission. Correspondingly, the first authentication request message may include a random number. The random number is used as a parameter when the terminal identifier is decrypted using the group key when receiving the first authentication request information. The random number may be a first random number generated by the terminal device itself, or a second random number indicated by a paging message, and both the first random number and the second random number are used to encrypt the terminal identifier in conjunction with the group key.

[0207] As an example, after the core network device sends a paging message to the first terminal device, the method may further include:

[0208] Respond to the random access request of the first terminal device, and allow the first terminal device to access the core network device.

[0209] It should be noted that after sending a paging message, the core network device can allow the terminal device to access the core network device by responding to a 2-step random access or a 4-step random access, and then receive an authentication request message sent by the terminal device.

[0210] As an example, after the first terminal device passes the authentication, the method may further include:

[0211] receiving target data from a first terminal device;

[0212] Decrypt the target data using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device.

[0213] It should be noted that when the core network device and the terminal device are authenticated and data transmission can be carried out, the target data can be decrypted by the group key indicated by the core network device or the first network device or the root key or the derived key of the root key corresponding to the first terminal device during the data transmission process to obtain the decrypted target data.

[0214] As an example, see Fig.11 , which shows a hardware structure diagram of an electronic device provided in an embodiment of the present application, such as Fig.11 As shown, the electronic device 110 may include: a transceiver 1101, a memory 1102 and a processor 1103; each component is coupled together through a bus system 1104. It can be understood that the bus system 1104 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1104 may also include a power bus, a control bus and a status signal bus. Among them, the transceiver 1101 is used to receive and send signals during the process of sending and receiving information with other external network elements; the memory 1102 is used to store a computer program that can be run on the processor 1103; the processor 1103 is used to execute the paging access method in any of the aforementioned possible implementations when running the computer program.

[0215] The embodiment of the present application provides a computer storage medium, which stores a vibration prompt program, and when the vibration prompt program is executed by at least one processor, the steps of the paging access method in any of the above possible implementations are implemented. The storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0216] An embodiment of the present application provides a computer program product including instructions. When the computer program product is executed on a computer, the computer is enabled to execute the paging access method in any possible implementation manner as described above.

[0217] An embodiment of the present application provides a chip system, which includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions; when the computer program instructions are executed by the processing circuit, a paging access method as in any possible implementation manner described above is implemented.

[0218] It should be understood that the various schemes of the embodiments of the present application can be used in reasonable combination, and the explanations or descriptions of the various terms appearing in the embodiments can be mutually referenced or explained in the various embodiments, without limitation.

[0219] It should also be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0220] It is understandable that, in order to implement the functions of any of the above-mentioned embodiments, the controller or resource allocation simulation device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0221] The embodiments of the present application can divide the functional modules of the controller or resource allocation simulation device with controller resource allocation capability. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0222] It should also be understood that each module in the controller or resource allocation simulation device can be implemented in software and / or hardware form, and there is no specific limitation on this. In other words, the electronic device is presented in the form of functional modules. The "module" here can refer to a specific application integrated circuit ASIC, a circuit, a processor and a memory that executes one or more software or firmware programs, an integrated logic circuit, and / or other devices that can provide the above functions.

[0223] In an optional manner, when data transmission is implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is implemented in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disk (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0224] The steps of the method or algorithm described in conjunction with the embodiments of the present application can be implemented in a hardware manner, or can be implemented by a processor executing a software instruction. The software instruction can be composed of corresponding software modules, and the software module can be stored in a RAM, a flash memory, a ROM, an EPROM, an EEPROM, a register, a hard disk, a mobile hard disk, a CD-ROM or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a controller or a resource allocation simulation device. Of course, the processor and the storage medium can also exist as discrete components.

[0225] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

Claims

1. A paging access method, characterized in that: Applied to a first terminal device, the method includes: receiving a paging message from a core network device, where the paging message carries group key indication information, where the group key indication information is for at least one terminal device, where the at least one terminal device includes the first terminal device; The first terminal device sends a first authentication request message to the core network device, where the first authentication request message includes a terminal identifier of the first terminal device, where the terminal identifier is encrypted based on first information, and the first information includes an identifier of a group key indicated by the group key indication information.

2. The method according to claim 1, characterized in that The first authentication request message includes a first identifier, which includes one or more of the following: the group key identifier, an inventory identifier corresponding to the group key, group identifier information, mask information, an inventory identifier, an event identifier, and a group key identifier index.

3. The method according to claim 1 or 2, characterized in that: The group key indication information includes one or more of the following: group identification information, mask information, inventory identification, event identification, and group key identification index.

4. The method according to any one of claims 1 to 3, characterized in that The first information also includes a random number.

5. The method according to any one of claims 1 to 4, characterized in that The first authentication request message includes the random number.

6. The method according to any one of claims 1 to 5, characterized in that The sending a first authentication request message to the core network device includes: The first authentication request message is sent to the core network device through the first network device.

7. The method according to claim 6, characterized in that The sending the first authentication request message to the core network device through the first network device includes: The first authentication request message and the second authentication request message are sent to the first network device, and a third message is sent to the core network device through the first network device, wherein the third message includes the one or more authentication request information, and the multiple authentication request information include the first authentication request message and the second authentication request message.

8. The method according to claim 7, characterized in that The first authentication request message and the second authentication request message do not include the first identifier, and the third message includes the first identifier.

9. The method according to any one of claims 1 to 8, characterized in that Before sending the first authentication request message to the core network device, the method further includes: Access the core network device according to the paging message.

10. The method according to any one of claims 1 to 9, characterized in that The method further comprises: The target data is encrypted using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device, and the encrypted target data is sent to the core network device.

11. A paging access method, characterized in that: Applied to a core network device, the method comprises: In response to the first service request, the core network device sends a paging message to the first terminal device, where the paging message carries group key indication information, where the group key indication information is for at least one terminal device, and the at least one terminal device includes the first terminal device; receiving a first authentication request message from the first terminal device, the first authentication request message including a terminal identifier of the first terminal device, the terminal identifier being encrypted according to first information, the first information including an identifier of the group key indicated by the group key indication information; Authenticate the first terminal device according to the first authentication request message.

12. The method according to claim 11, characterized in that The authenticating the first terminal device according to the first authentication request message includes: Decrypting the first authentication request message to obtain a terminal identifier of the first terminal device; Authenticate the terminal identification of the first terminal device.

13. The method according to claim 11 or 12, characterized in that: The first authentication request message includes a first identifier, which includes one or more of the following: the group key identifier, an inventory identifier corresponding to the group key, group identifier information, mask information, an inventory identifier, an event identifier, and a group key identifier index.

14. The method according to any one of claims 11 to 13, characterized in that The group key indication information includes one or more of the following: group identification information, mask information, inventory identification, event identification, and group key identification index.

15. The method according to any one of claims 11 to 14, characterized in that The first information also includes a random number.

16. The method according to any one of claims 11 to 15, characterized in that The first authentication request message includes the random number.

17. The method according to any one of claims 11 to 16, characterized in that: The receiving a first authentication request message from the first terminal device includes: Receive the first authentication request message forwarded by the first terminal device through the first network device.

18. The method according to any one of claims 11 to 17, characterized in that The receiving the first authentication request message forwarded by the first terminal device through the first network device includes: A third message is received through the first network device, where the third message includes one or more authentication request messages, where the multiple authentication request messages include the first authentication request message and the second authentication request message.

19. The method according to claims 11-18, characterized in that After the core network device sends a paging message to the first terminal device, the method further includes: In response to the random access request of the first terminal device, the first terminal device is allowed to access the core network device.

20. The method according to claims 11-19, characterized in that After the first terminal device passes authentication, the method further includes: receiving target data from the first terminal device; The target data is decrypted using the group key indicated by the core network device or the first network device or the root key corresponding to the first terminal device.

21. An electronic device, characterized in that: The electronic device comprises: A transceiver, used for sending and receiving signals; a memory for storing computer program instructions; A processor, configured to execute the computer program instructions to support the electronic device to implement the method as described in any one of claims 1-10 or 11-20.

22. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by the processing circuit, the method according to any one of claims 1-10 or 11-20 is implemented.

23. A computer program product comprising instructions, characterized in that When the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 10 or 11 to 20.

24. A chip system, characterized in that: The chip system includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions; when the computer program instructions are executed by the processing circuit, the method as described in any one of claims 1-10 or 11-20 is implemented.

Images