Communication method and communication device

Abstract

The invention provides a communication method and a communication device, and the method comprises the steps that a terminal device sends a registration request message which is used for requesting to register to a network, and under the condition that authentication between the terminal device and the network is passed, the terminal device and a network element activate a security context which is used for protecting secure communication between the terminal device and the network element. And under the condition that the operation requester requests to execute the first operation on the terminal equipment, executing the first operation by skipping the NAS SMC process or transmitting the operation instruction type in executing the NAS SMC process. According to the technical scheme of the invention, under the condition of ensuring secure communication, the whole service process is simplified, the processing complexity is reduced, and the processing time delay is reduced.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a communication method and a communication device. Background Art

[0002] In the environmental Internet of Things, terminal devices (e.g., tags) are not equipped with or rely on power devices such as batteries, but instead obtain energy from the environment, such as solar energy, radio frequency, wind energy, water energy, or tidal energy. The terminal devices support data perception, transmission, and distributed computing.

[0003] For example, when the server performs an operation on the tag (e.g., an inventory operation, a read operation, a write operation, or an invalidation operation), an instruction can be sent through the core network. Currently, in order to achieve secure communication between the tag and the core network element, a relatively complex interaction process is required, resulting in relatively high power consumption. Therefore, how to reduce power consumption is an issue that needs to be considered at present. Summary of the invention

[0004] The present application provides a communication method and a communication device, which can reduce power consumption and simplify processing complexity.

[0005] In a first aspect, a communication method is provided, which can be executed by a terminal device, such as a mobile phone, a car, a drone, a wearable device, etc., or a chip or circuit of the terminal device. In addition, the terminal device can also be called a user device, so the method can be executed by the user device, or a chip or circuit in the user device. This application does not make specific restrictions on this.

[0006] The method includes: a terminal device sends a registration request message, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; when the terminal device passes the authentication of the network, the terminal device activates a security context, and the security context is used to protect secure communications between the terminal device and a network element; the terminal device performs an integrity check on a first message from the network element according to the security context, and the first message is used to request execution of a first operation on the terminal device; when the integrity check passes, the terminal device executes the first operation.

[0007] Optionally, the method also includes: the terminal device receives a first message from the network element. The present application does not specifically limit the timing when the terminal device receives the first message. For example, the terminal device may receive the first message after activating the security context or before activating the security context.

[0008] Optionally, the registration request message also includes the security capabilities of the terminal device. Optionally, the security capabilities of the terminal device can also be obtained from the operation requester or the unified data management network element. This acquisition method is transmitted through a secure interface, which can not only reduce the air interface overhead between the terminal device and the network element, but also avoid the interaction failure caused by malicious tampering by an attacker when the terminal device reports the security capabilities of the terminal device through the air interface, thereby ensuring the security of network communications. In this application, the security capabilities of the terminal device are used to determine the security algorithm in the security context.

[0009] Optionally, before the terminal device activates the security context, the method further includes: the terminal device determines whether to generate the security context. For example, the terminal device determines whether to generate the security context according to the operation instruction type of the first operation instruction; or the terminal device determines whether to generate the security context according to the type of the terminal device.

[0010] Optionally, before the terminal device activates the security context, the method further includes: the terminal device determines whether to activate the security context. For example, the terminal device determines whether to activate the security context according to the operation instruction type of the first operation instruction.

[0011] Exemplarily, the operation instruction type may indicate one or more of an inventory operation, a read operation, a write operation, an invalidation operation or other operations. Optionally, the operation instruction type may be carried in the first message, or the operation instruction type may not be carried in the first message. In this case, the operation instruction type and the first message may be sent simultaneously or separately, and this application does not limit this.

[0012] Optionally, the first message itself may also indicate the first operation, in which case the first message may not carry the operation instruction type of the first operation. For example, the first message may be a read operation request message, which is used to read data from a storage area of ​​a terminal device or to collect data from a terminal device, in which case the read operation request message may not carry the operation instruction type of the read operation.

[0013] Based on the above scheme, by adding the judgment logic of whether to generate a security context and whether to activate the security context, the generation and / or activation of unnecessary security contexts can be avoided, the computing and storage overhead of the terminal device can be reduced, the limited storage resources of the terminal device can be avoided from being occupied, and the power consumption of the terminal device can be reduced. It should be understood that the generation of a security context and the activation of a security context are related, so one can be selected when judging. For example, after judging whether to generate a security context, it is also necessary to activate the security context; for example, if the security context is judged to be activated, it means that the security context needs to be generated before the security context is activated, so the judgment of generating a security context and activating a security context can be equivalent, that is, the judgment of whether to generate a security context and the judgment of whether to activate the security context in this application can replace each other, or exist at the same time.

[0014] It should be noted that the present application does not specifically limit the timing of activating the security context by the terminal device. For example, the terminal device may immediately generate and activate the security context if the network authentication is passed; or, the terminal device may first generate the security context if the network authentication is passed, and then activate the security context after receiving the first message; or, the terminal device may not generate the security context if the network authentication is passed, and then generate and activate the security context after receiving the first message.

[0015] According to the solution provided in the present application, when the terminal device passes the authentication of the network, the security context is activated. The terminal device can then perform an integrity check on the first message from the network side that indicates the execution of the first operation based on the security context to determine whether the first message has been maliciously tampered with, and execute the first operation while the first message is securely protected. On the one hand, this technical solution can ensure secure communication between the terminal device and the network element. On the other hand, by decoupling the NAS SMC process from the activation of the security context, that is, there is no need to execute the NASSMC process after the terminal device authenticates the network, the number of information interactions between the terminal device and the network element is reduced. Compared with the prior art, in which the terminal device and the core network element sequentially execute the authentication process, trigger the NAS SMC process, and the service execution process, this implementation method can execute the first operation while ensuring the security of network communications, simplify the entire service process, reduce processing complexity, and reduce processing latency.

[0016] In combination with the first aspect, in certain implementations of the first aspect, the terminal device activates the security context, including: the terminal device skips the NAS SMC process and activates the security context according to the capabilities of the terminal device and / or the type of the terminal device, that is, the terminal device determines to activate the security context when the terminal device passes the authentication of the network according to the capabilities of the terminal device and / or the type of the terminal device.

[0017] Exemplarily, the type of terminal device includes a tag type, such as an active tag, a passive tag, or a semi-passive tag. In the case where the type of terminal device is a passive tag, the terminal device skips the NAS SMC process and activates the security context. This is because for terminal devices of passive tag type, the storage and computing capabilities are weak and the cost is relatively low. They may support an integrity security protection algorithm and / or a confidentiality security protection algorithm. Therefore, the terminal device and the network element can uniquely determine the security algorithm used to activate the security context, and the two do not need to negotiate the security algorithm through the NAS SMC process. That is, the NAS SMC process can be skipped, and the corresponding context for integrity security protection and / or the corresponding context for confidentiality security protection can be activated according to a confidentiality protection algorithm and / or an integrity protection algorithm supported by the terminal device of passive tag type.

[0018] Exemplarily, the capabilities of the terminal device are used to indicate the confidentiality protection algorithm and / or integrity protection algorithm supported by the terminal device. When the capabilities of the terminal device indicate that the terminal device supports a confidentiality protection algorithm and / or an integrity protection algorithm, at this time, the terminal device and the network element can uniquely determine the security algorithm used to activate the security context, and there is no need to negotiate the security algorithm through the NAS SMC process. In this case, the terminal device skips the NAS SMC process and activates the security context.

[0019] Based on the above solution, the terminal device can choose to skip the NAS SMC process according to the terminal device capabilities and / or the type of the terminal device, and activate the security context if the authentication is successful. This implementation method can simplify the entire service process, reduce processing complexity, and reduce processing delay by omitting the NAS SMC process while ensuring the security of network communications.

[0020] In combination with the first aspect, in some implementations of the first aspect, the terminal device activates the security context, including: in response to an EAP-success message and / or an authentication request message received by the terminal device in the authentication process, the terminal device activates the security context.

[0021] Exemplarily, the EAP-success message is used to indicate that the network has successfully authenticated the terminal device. That is, after the terminal device sends the registration request message, the message received is an EAP-success message, indicating that the network has successfully authenticated the terminal device. In response to the EAP-success message, the security context is activated when it is determined that the terminal device has successfully authenticated the network.

[0022] Exemplarily, the authentication request message includes an authentication vector on the network side, which is used by the terminal device to authenticate the network. That is, the terminal device receives the authentication request message after sending the registration request message, authenticates the network according to the authentication vector carried in the authentication request message, and activates the security context when the terminal device successfully authenticates the network.

[0023] Based on the above scheme, after receiving the EAP-success message and / or the authentication request message, the terminal device activates the security context when it is determined that the network has successfully authenticated the terminal device and / or the terminal device has successfully authenticated the network, thereby ensuring the secure interaction of information between the terminal device and the network.

[0024] In combination with the first aspect, in certain implementations of the first aspect, the terminal device activates the security context, including: the terminal device activates the security context according to a locally configured security algorithm, the security algorithm includes an integrity security algorithm and / or a confidentiality security algorithm, that is, the terminal device can uniquely determine the security algorithm used to activate the security context according to a confidentiality protection algorithm and / or an integrity security algorithm locally configured by the terminal device, without the need to negotiate the security algorithm through the NAS SMC process, and thus the security context can be activated when it is determined that the terminal device has passed the authentication of the network.

[0025] Exemplarily, the security algorithm locally configured by the terminal device includes a confidentiality protection algorithm (e.g., the ZUC confidentiality security protection algorithm) and / or an integrity protection algorithm (e.g., the SNOW integrity security protection algorithm), then the terminal device can activate the security context according to the ZUC confidentiality security protection algorithm and / or the SNOW integrity security protection algorithm.

[0026] Based on the above solution, since the locally configured security algorithm includes a confidentiality protection algorithm and / or an integrity protection algorithm, the terminal device can uniquely determine the security algorithm used to activate the security context, so there is no need to negotiate the security algorithm through the NAS SMC process, thereby reducing the interaction process between the terminal device and the network element, simplifying the processing complexity, and reducing the processing delay.

[0027] In combination with the first aspect, in some implementations of the first aspect, the terminal device activates the security context, including: the terminal device activates the security context according to a received registration acceptance message or a first message, where the registration acceptance message is used to accept a registration request from the terminal device.

[0028] Optionally, the registration acceptance message may be a first message, in which case the registration acceptance message may carry an operation instruction type instructing the terminal device to perform a first operation.

[0029] Exemplarily, the message received by the terminal device after sending the registration request message is a registration acceptance message, indicating that the network accepts the registration request of the terminal device. In response to the registration acceptance message, the security context is activated when the terminal device passes the authentication of the network.

[0030] Exemplarily, the terminal device activates the security context according to the security algorithm indicated by the security algorithm identifier carried in the registration acceptance message, and the security algorithm includes an integrity security algorithm and / or a confidentiality security algorithm. For example, the registration acceptance message carries a confidentiality protection algorithm identifier (for example, the confidentiality security protection algorithm identifier is used to indicate the ZUC confidentiality security protection algorithm) and / or an integrity protection algorithm identifier (for example, the integrity security protection algorithm identifier is used to indicate the SNOW integrity security protection algorithm), which means that the terminal device and the network element can uniquely determine the security algorithm used to activate the security context without negotiating the security algorithm through the NAS SMC process. Therefore, the terminal device can activate the security context according to the ZUC confidentiality security protection algorithm and / or the SNOW integrity security protection algorithm if the terminal device passes the authentication of the network.

[0031] Based on the above scheme, since the registration acceptance message carries a confidentiality protection algorithm identifier and / or an integrity protection algorithm identifier, the terminal device can uniquely determine the security algorithm used to activate the security context, so there is no need to negotiate the security algorithm through the NAS SMC process, thereby reducing the interaction process between the terminal device and the network element, simplifying the processing complexity, and reducing the processing delay.

[0032] In combination with the first aspect, in some implementations of the first aspect, the terminal device activates the security context, including: the terminal device activates the security context according to the operation instruction type of the first operation.

[0033] Exemplarily, when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the terminal device determines to activate the security context.

[0034] Optionally, when the operation instruction type indicates an inventory operation, the terminal device determines not to activate the security context.

[0035] Based on the above scheme, whether to activate the security context is determined based on whether the first operation indicated by the operation instruction type is a read operation, a write operation, or an invalidation operation, thereby avoiding unnecessary generation and / or activation of the security context for the inventory operation, which can reduce the computing and storage overhead of the terminal device, avoid the storage resources of the terminal device from being occupied, and reduce the power consumption of the terminal device.

[0036] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the terminal device determines whether to decrypt the first message according to the operation instruction type of the first operation.

[0037] Exemplarily, when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the terminal device determines not to decrypt the first message.

[0038] Exemplarily, when the operation instruction type indicates a write operation, the terminal device determines to decrypt the first data ciphertext carried in the first message, wherein the first data ciphertext is obtained by encrypting the first data, and the first data is data to be written into the storage area of ​​the terminal device.

[0039] Based on the above scheme, the operation instruction type is associated with whether the first message is decrypted, and then whether to decrypt the first message is determined according to the operation instruction type, so as to avoid the terminal device performing unnecessary decryption calculations or decryption operations when determining an inventory operation, a read operation, or an invalidation operation, thereby reducing the computing overhead and power consumption of the terminal device.

[0040] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the terminal device determines whether to perform security protection on the second message based on the operation instruction type of the first operation, the security protection includes integrity security protection and / or confidentiality security protection, and the second message is used to indicate whether the first operation is executed successfully; the terminal device sends the second message to the network element.

[0041] In combination with the first aspect, in certain implementations of the first aspect, the terminal device determines whether to perform security protection on the second message based on the operation instruction type of the first operation, including: when the operation instruction type indicates an inventory operation, the terminal device determines not to perform integrity security protection on the second message; when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the terminal device determines to perform integrity security protection on the second message.

[0042] In combination with the first aspect, in certain implementations of the first aspect, the terminal device determines whether to perform security protection on the second message based on the operation instruction type of the first operation, including: when the operation instruction type indicates an inventory operation, a write operation, or an invalidation operation, the terminal device determines not to perform confidentiality and security protection on the second message. This is because when the first operation is an inventory operation, a write operation, or an invalidation operation, the corresponding second message sent by the terminal device to the network element can be regarded as a response message to the first message, which is used to indicate whether the terminal device performs the first operation or whether the first operation is successfully performed. At this time, the second message may not carry parameters that require confidentiality and security protection, and there is no need to perform confidentiality and security protection on the second message. Optionally, in this case, the second message may not be sent.

[0043] Exemplarily, when the operation instruction type indicates a read operation, the terminal device determines to perform confidentiality security protection on the second data to obtain a second data ciphertext, wherein the second data is data read from a storage area of ​​the terminal device or data collected by the terminal device, and the second data ciphertext is carried in the second message.

[0044] Optionally, when the first message is a registration acceptance message, the second message may be a registration completion message. For example, the registration acceptance message may carry information for updating terminal device parameters, where the terminal device parameters may be slice information or closed access group information. Further, after updating the terminal device parameters, the terminal device may send a registration completion message to the network element.

[0045] It should be understood that in order to ensure the security of network communications, the terminal device performs integrity protection on the second message.

[0046] Based on the above scheme, the operation instruction type is associated with whether the second message is to be protected for confidentiality, and then whether the second message is to be protected for confidentiality is determined according to the operation instruction type. This avoids the terminal device performing unnecessary confidentiality security protection when determining inventory operations, write operations, or invalid operations, thereby reducing the computing overhead and power consumption of the terminal device.

[0047] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: the terminal device determines whether to delete the security context based on the type of the terminal device, specifically including one or more of the following: when the type of the terminal device is an active tag or a semi-passive tag, the terminal device determines not to delete the security context; when the type of the terminal device is a passive tag, the terminal device determines to delete the security context.

[0048] Based on the above solution, by adding the judgment logic of whether to delete the security context, it is avoided that the security context is not deleted or saved when the terminal device type is a passive tag, thereby reducing the computing and storage overhead of the terminal device, avoiding the limited storage resources of the terminal device from being occupied, and reducing the power consumption of the terminal device.

[0049] In the second aspect, a communication method is provided, which can be executed by a network element, or can also be executed by a chip or circuit for a network element, and this application does not limit this. For the convenience of description, the following is an example of execution by a network element. It should be understood that when the TMF is set independently, the method may be executed by the TMF and other network elements (such as AMF). This application does not limit this.

[0050] The method includes: receiving a registration request message from a terminal device, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; activating a security context when authentication of the terminal device is successful, the security context is used to protect secure communications between the terminal device and a network element; performing integrity security protection on a first message based on the security context, the first message is used to request a first operation to be performed on the terminal device; and sending the first message to the terminal device.

[0051] Optionally, before activating the security context, the method further includes: determining whether to generate a security context. For example, determining whether to generate a security context based on the operation instruction type of the first operation instruction; or determining whether to generate a security context based on the type of the terminal device.

[0052] Optionally, before activating the security context, the method further includes: determining whether to activate the security context. For example, determining whether to activate the security context according to the operation instruction type of the first operation instruction.

[0053] Based on the above solution, by adding the judgment logic of whether to generate a security context and whether to activate the security context, unnecessary generation and / or activation of the security context can be avoided, the computing and storage overhead can be reduced, the storage resources can be avoided from being occupied, and the power consumption can be reduced.

[0054] It should be noted that the present application does not specifically limit the timing of activating the security context. For example, the security context may be generated and activated immediately when the terminal device is authenticated; or, the security context may be generated first when the terminal device is authenticated, and then activated after receiving the service request message from the operation requester; or, the security context may not be generated when the terminal device is authenticated, and then the security context may be generated and activated after receiving the second service request message.

[0055] According to the solution provided in the present application, when the network authenticates the terminal device, the security context is activated, and then it can be determined that the first message to be sent is integrity-secured. On the one hand, it can ensure secure communication between the terminal device and the network element. On the other hand, the NAS SMC process is decoupled from the activation of the security context, that is, the NAS SMC process does not need to be executed after the network authenticates the terminal device. This can reduce the number of information exchanges between the terminal device and the network element, simplify the processing flow of the entire service process, and reduce processing complexity and processing delay.

[0056] In combination with the second aspect, in certain implementations of the second aspect, the security capabilities of the terminal device are used to determine a security algorithm in a security context, and the method also includes: obtaining the security capabilities of the terminal device from the operation requester; or, obtaining the security capabilities of the terminal device from the terminal device; or, obtaining the security capabilities of the terminal device from a unified data management network element.

[0057] It should be understood that the security capabilities of the terminal device obtained from the operation requester or the unified data management network element are transmitted through a security-protected interface, which can not only reduce the air interface overhead between the terminal device and the network element, but also avoid the interaction failure caused by malicious tampering by an attacker when the terminal device reports the security capabilities of the terminal device through the air interface, thereby ensuring the security of network communications.

[0058] In combination with the second aspect, in certain implementations of the second aspect, activating the security context includes: skipping the NAS SMC process and activating the security context according to the capabilities of the terminal device and / or the type of the terminal device.

[0059] In combination with the second aspect, in certain implementations of the second aspect, the NASSMC process is skipped and the security context is activated according to the type of the terminal device, including: when the type of the terminal device is a passive tag, the NAS SMC process is skipped and the security context is activated.

[0060] In combination with the second aspect, in certain implementations of the second aspect, based on the capabilities of the terminal device, the NASSMC process is skipped and the security context is activated, including: when the capabilities of the terminal device indicate that the terminal device supports a confidentiality protection algorithm and / or an integrity protection algorithm, the NAS SMC process is skipped and the security context is activated.

[0061] In conjunction with the second aspect, in some implementations of the second aspect, activating the security context includes: activating the security context according to a locally configured security algorithm, the security algorithm including an integrity security algorithm and / or a confidentiality security algorithm;

[0062] In combination with the second aspect, in some implementations of the second aspect, activating the security context includes: activating the security context according to an operation instruction type of the first operation.

[0063] In combination with the second aspect, in certain implementations of the second aspect, the security context is activated according to the operation instruction type of the first operation, including one or more of the following: activating the security context when the operation instruction type indicates a read operation; activating the security context when the operation instruction type indicates a write operation; activating the security context when the operation instruction type indicates an invalidation operation.

[0064] In combination with the second aspect, in some implementations of the second aspect, the method further includes: determining whether to perform confidentiality security protection on the first message according to an operation instruction type of the first operation.

[0065] In combination with the second aspect, in certain implementations of the second aspect, determining whether to perform confidentiality and security protection on the first message is determined based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, determining that confidentiality and security protection is not performed on the first message; when the operation instruction type indicates a read operation, determining that confidentiality and security protection is not performed on the first message; when the operation instruction type indicates an invalidation operation, determining that confidentiality and security protection is not performed on the first message; when the operation instruction type indicates a write operation, determining that confidentiality and security protection is performed on the first data, and obtaining a first data ciphertext, the first data being data to be written to a storage area of ​​the terminal device, and the first message including the first data ciphertext.

[0066] In combination with the second aspect, in certain implementations of the second aspect, the method also includes: receiving a second message from the terminal device, the second message being used to indicate whether the first operation is executed successfully; determining whether to perform security protection (integrity check and / or decryption) on the second message based on the operation instruction type of the first operation.

[0067] In combination with the second aspect, in certain implementations of the second aspect, determining whether to perform an integrity check on the second message is based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, determining that an integrity check is to be performed on the second message; when the operation instruction type indicates an inventory operation, determining that an integrity check is not to be performed on the second message.

[0068] In combination with the second aspect, in certain implementations of the second aspect, determining whether to decrypt the second message is based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates a read operation, determining to decrypt the second data ciphertext carried in the second message to obtain the second data, wherein the second data is data read from a storage area of ​​the terminal device or data collected by the terminal device; when the operation instruction type indicates a write operation, determining not to decrypt the second message; when the operation instruction type indicates an invalidation operation, determining not to decrypt the second message; when the operation instruction type indicates an inventory operation, determining not to decrypt the second message.

[0069] In combination with the second aspect, in certain implementations of the second aspect, the method also includes: determining whether to delete the security context based on the type of the terminal device, specifically including one or more of the following: when the type of the terminal device is an active tag or a semi-passive tag, determining not to delete the security context; when the type of the terminal device is a passive tag, determining to delete the security context.

[0070] Based on the above solution, by determining the judgment logic for deleting the security context, the computing and storage overhead of the network element can be reduced, the power consumption of the network element can be reduced, and the network side can be guaranteed to provide services for more terminal devices and avoid network congestion.

[0071] In combination with the second aspect, in some implementations of the second aspect, the method further includes: receiving a service request message from an operation requester, the service request message being used to request execution of a first operation on a terminal device, and sending a first service response message to the operation requester according to an operation instruction type of the first operation, comprising one or more of the following: when the operation instruction type indicates an inventory operation, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device; when the operation instruction type indicates a read operation, and the integrity check and / or decryption of the second message passes, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device and second data, wherein the second data is obtained by decrypting a ciphertext of the second data, and the second data is data read from a storage area of ​​the terminal device or collected by the terminal device; when the operation instruction type indicates a write operation, and the integrity check of the second message passes, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device; when the operation instruction type indicates an invalidation operation, and the integrity check of the second message passes, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device.

[0072] In combination with the second aspect, in certain implementations of the second aspect, the method also includes: receiving a service request message from an operation requester, the service request message being used to request execution of a first operation on a terminal device, and sending a second service response message to the operation requester according to the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates a read operation and the integrity check of the second message fails and / or the decryption of the second message fails, the second service response message is used to indicate that the execution of the first operation failed; when the operation instruction type indicates a write operation and the integrity check of the second message fails, the second service response message is used to indicate that the execution of the first operation failed; when the operation instruction type indicates an invalid operation and the integrity check of the second message fails, the second service response message is used to indicate that the execution of the first operation failed.

[0073] In combination with the second aspect, in certain implementations of the second aspect, the method also includes: receiving a service request message from an operation requester, the service request message is used to request to perform a first operation on a terminal device, and if authentication of the terminal device fails, sending a third service response message to the operation requester, the third service response message is used to indicate that execution of the first operation has failed.

[0074] The beneficial effects of the above-mentioned second aspect and some implementation methods of the second aspect can be referred to the relevant description of the first aspect, which will not be repeated here.

[0075] In a third aspect, a communication method is provided, which can be executed by an operation requester (such as an AF), or can also be executed by a chip or circuit for the operation requester, which is not limited in this application. For ease of description, the following description is taken as an example of execution by the operation requester.

[0076] The method includes: the operation requester sends a service request message to a network element, the service request message is used to request to perform a first operation on a terminal device, and the service request message includes the security capability of the terminal device; the operation requester receives a service response message from the network element, and the service response message is used to indicate whether the first operation is successfully executed.

[0077] Optionally, the service request message also includes an operation instruction type, where the operation instruction type is used to indicate the first operation.

[0078] Optionally, the service request message itself may also indicate the first operation, in which case the service request message may not carry the operation instruction type of the first operation. For example, the service request message may be a read operation request message, which is used to read data from a storage area of ​​a terminal device or to collect data from a terminal device, in which case the read operation request message may not carry the operation instruction type of the read operation.

[0079] Exemplarily, the service request message also includes one or more of an identification of the terminal device, an operation instruction type, and first data, wherein the operation instruction type is used to indicate a first operation, the security capability of the terminal device is used to indicate one or more integrity security protection algorithms and / or confidentiality security protection algorithms supported by the terminal device, and the first data is data to be written to a storage area of ​​the terminal device.

[0080] Based on the above scheme, the operation requester can obtain services such as reading, writing, inventorying or invalidation by sending a service request message to the network element to request to perform the first operation on the terminal device. It should be understood that the security capabilities of the terminal device obtained by the network element from the operation requester are transmitted through a secure interface, which can reduce the air interface overhead between the terminal device and the network element, and at the same time, avoid the interaction failure caused by malicious tampering by an attacker when the terminal device reports the security capabilities of the terminal device through the air interface, including ensuring the security of network communications.

[0081] In combination with the third aspect, in certain implementations of the third aspect, when the operation instruction type indicates an inventory operation, the service response message includes an identification of the terminal device; or, when the operation instruction type indicates a read operation, the service response message includes an identification of the terminal device and second data, and the second data is data read from a storage area of ​​the terminal device or collected by the terminal device; or, when the operation instruction type indicates a write operation, the service response message includes an identification of the terminal device; or, when the operation instruction type indicates an invalidation operation, the service response message includes an identification of the terminal device.

[0082] In combination with the third aspect, in certain implementations of the third aspect, when the network element fails to authenticate the terminal device, the service response message is used to indicate that the first operation has failed.

[0083] In combination with the third aspect, in certain implementations of the third aspect, the service response message includes a failure reason value, and the failure reason value is used to indicate that the authentication of the terminal device fails.

[0084] The beneficial effects of the third aspect and certain implementation methods of the third aspect can be referred to the relevant description of the first aspect, which will not be repeated here.

[0085] In a fourth aspect, a communication method is provided, which can be executed by a terminal device, such as a mobile phone, a car, a drone, a wearable device, etc., or a chip or circuit of the terminal device. In addition, the terminal device can also be called a user device, so the method can be executed by the user device, or a chip or circuit in the user device. This application does not make specific limitations on this.

[0086] The method includes: a terminal device sends a registration request message, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; the terminal device receives a first message from a network element, the first message is used to request execution of a first operation on the terminal device; the terminal device determines whether to activate a security context based on an operation instruction type of the first operation, and the security context is used to protect secure communications between the terminal device and the network element.

[0087] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device determines whether to activate the security context based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, the terminal device determines not to activate the security context; when the operation instruction type indicates a read operation, the terminal device determines to activate the security context; when the operation instruction type indicates a write operation, the terminal device determines to activate the security context; when the operation instruction type indicates an invalidation operation, the terminal device determines to activate the security context.

[0088] It should be noted that the activation security context in this application can be replaced by the generation of a security context.

[0089] Exemplarily, the operation instruction type may indicate one or more of an inventory operation, a read operation, a write operation, an invalidation operation or other operations. Optionally, the operation instruction type may be carried in the first message, or the operation instruction type may not be carried in the first message. In this case, the operation instruction type and the first message may be sent simultaneously or separately, and this application does not limit this.

[0090] Exemplarily, the first message itself may also indicate the first operation, in which case the first message may not carry the operation instruction type of the first operation. For example, the first message may be a read operation request message for reading data in a storage area of ​​a terminal device or data collected by the terminal device, in which case the read operation request message may not carry the operation instruction type of the read operation.

[0091] In combination with the fourth aspect, in certain implementations of the fourth aspect, when it is determined that the security context is activated, the terminal device performs integrity check and / or decryption on the first message based on the security context; when the integrity check and / or decryption passes, the terminal device performs the first operation according to the operation instruction type.

[0092] In combination with the fourth aspect, in certain implementations of the fourth aspect, when it is determined that the security context is not to be activated, the terminal device does not perform integrity check and / or decryption on the first message; the terminal device performs the first operation according to the operation instruction type; or, the terminal device discards the first message, that is, the terminal device may not perform the first operation.

[0093] It should be understood that when the terminal device determines to activate the security context, the terminal device can perform integrity verification and / or decryption on the received first message based on the activated security context; when the terminal device determines not to activate the security context, the terminal device does not need to perform integrity verification and decryption on the first message.

[0094] In combination with the fourth aspect, in certain implementations of the fourth aspect, after activating the security context, the terminal device determines whether to perform integrity verification and / or decryption on the first message.

[0095] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device determines whether to perform integrity check and / or decrypt the first message, including: the terminal device determines whether to perform integrity check and / or decrypt the first message based on the operation instruction type of the first operation.

[0096] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device determines whether to perform an integrity check on the first message based on the operation instruction type, including one or more of the following: when the operation instruction type is an inventory operation, the terminal device determines not to perform an integrity check on the first message; when the operation instruction type is a read operation, the terminal device determines to perform an integrity check on the first message; when the operation instruction type is a write operation, the terminal device determines to perform an integrity check on the first message; when the operation instruction type is an invalidation operation, the terminal device determines to perform an integrity check on the first message.

[0097] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device determines whether to decrypt the first message based on the operation instruction type, including one or more of the following: when the operation instruction type is an inventory operation, the terminal device determines not to decrypt the first message; when the operation instruction type is a read operation, the terminal device determines not to decrypt the first message; when the operation instruction type is a write operation, the terminal device determines to decrypt the first data ciphertext carried in the first message to obtain the first data, wherein the first data is data to be written to the storage area of ​​the terminal device; when the operation instruction type is an invalidation operation, the terminal device determines not to decrypt the first message.

[0098] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device determines whether to activate the security context based on the operation instruction type of the first operation, including: the terminal device determines to activate the corresponding security context for integrity security protection and / or the corresponding security context for confidentiality security protection based on the operation instruction type.

[0099] Exemplarily, when the operation instruction type indicates an inventory operation, the terminal device determines not to activate the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection, that is, the terminal device does not need to generate a security context; when the operation instruction type indicates a read operation or an invalidation operation, the terminal device determines to activate the corresponding security context for integrity security protection; when the operation instruction type indicates a write operation, the terminal device determines to activate the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection.

[0100] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device sends a second message to the network element, and the second message is used to indicate whether the first operation is executed successfully; wherein, when the operation instruction type is a read operation, the second message includes a second data ciphertext, and the second data ciphertext is obtained by encrypting the second data, and the second data is data read from a storage area of ​​the terminal device or collected by the terminal device.

[0101] Optionally, when the operation instruction type is an inventory operation, the terminal device may not send the second message. At this time, the core network sends the terminal device identifier to the operation requester, and the terminal device identifier can be obtained from the registration request message.

[0102] In combination with the fourth aspect, in certain implementations of the fourth aspect, before the terminal device sends the second message to the network element, the method also includes: the terminal device determines whether to perform security protection on the second message based on the type of operation instruction, and the security protection includes confidentiality security protection and / or integrity security protection.

[0103] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device determines whether to perform security protection on the second message based on the operation instruction type, including one or more of the following: when the operation instruction type is an inventory operation, the terminal device determines not to perform integrity security protection on the second message; when the operation instruction type is a read operation, the terminal device determines to perform integrity security protection on the second message; when the operation instruction type is a write operation, the terminal device determines to perform integrity security protection on the second message; when the operation instruction type is an invalidation operation, the terminal device determines to perform integrity security protection on the second message.

[0104] In combination with the fourth aspect, in certain implementations of the fourth aspect, the terminal device determines whether to perform security protection on the second message based on the operation instruction type, including one or more of the following: when the operation instruction type is an inventory operation, the terminal device determines not to perform confidentiality security protection on the second data; when the operation instruction type is a read operation, the terminal device determines to perform confidentiality security protection on the second message; when the operation instruction type is a write operation, the terminal device determines not to perform confidentiality security protection on the second message; when the operation instruction type is an invalidation operation, the terminal device determines not to perform confidentiality security protection on the second message.

[0105] In combination with the fourth aspect, in certain implementations of the fourth aspect, the method also includes: determining whether to delete the security context based on the type of the terminal device, specifically including one or more of the following: when the type of the terminal device is an active tag or a semi-passive tag, determining not to delete the security context; when the type of the terminal device is a passive tag, determining to delete the security context.

[0106] Exemplarily, the first message may be a registration acceptance message, and the second message may be a registration completion message; or, the first message may be a NAS SMC message, and the second message may be a NAS SMP message.

[0107] The beneficial effects of the fourth aspect and certain implementation methods of the fourth aspect can be referred to the relevant description of the first aspect, and will not be repeated here.

[0108] In the fifth aspect, a communication method is provided, which can be executed by a network element, or can also be executed by a chip or circuit for a network element, and the present application does not limit this. For the convenience of description, the following is an example of execution by a network element. It should be understood that when the TMF is set independently, the method may be executed by the TMF and other network elements (such as AMF). This application does not limit this.

[0109] The method includes: receiving a registration request message from a terminal device, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; determining whether to activate a security context based on an operation instruction type of a first operation, the security context is used to protect secure communications between the terminal device and a network element; if it is determined that the security context is activated, performing security protection on a first message to be sent based on the security context, the first message is used to request execution of a first operation on the terminal device; sending the first message to the terminal device; or, if it is determined that the security context is not activated, sending the first message to the terminal device.

[0110] Optionally, the first message includes an operation instruction type, where the operation instruction type is used to indicate the first operation.

[0111] In combination with the fifth aspect, in certain implementations of the fifth aspect, whether to activate the security context is determined based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, determining not to activate the security context; when the operation instruction type indicates a read operation, determining to activate the security context; when the operation instruction type indicates a write operation, determining to activate the security context; when the operation instruction type indicates an invalidation operation, determining to activate the security context.

[0112] In combination with the fifth aspect, in certain implementations of the fifth aspect, a service request message is received from an operation requester, and the service request message is used to request to perform a first operation on a terminal device; a service response message is sent to the operation requester, and the service response message is used to indicate whether the first operation is performed successfully.

[0113] Optionally, the service request message includes an operation instruction type, where the operation instruction type is used to indicate the first operation.

[0114] In combination with the fifth aspect, in certain implementations of the fifth aspect, after the security context is activated, it is determined whether to perform security protection on the first message.

[0115] In combination with the fifth aspect, in certain implementations of the fifth aspect, determining whether to activate the security context is based on the operation instruction type of the first operation, including: determining to activate the corresponding security context for integrity security protection and / or the corresponding security context for confidentiality security protection based on the operation instruction type.

[0116] Exemplarily, when the operation instruction type indicates an inventory operation, it is determined not to activate the security context corresponding to the integrity security protection and the security context corresponding to the confidentiality security protection, that is, there is no need to generate a security context; when the operation instruction type indicates a read operation or an invalidation operation, it is determined to activate the security context corresponding to the integrity security protection; when the operation instruction type indicates a write operation, it is determined to activate the security context corresponding to the integrity security protection and the security context corresponding to the confidentiality security protection.

[0117] In combination with the fifth aspect, in certain implementations of the fifth aspect, the security capabilities of the terminal device are used to determine the security algorithm in the security context, and the method also includes: obtaining the security capabilities of the terminal device from the operation requester; or, obtaining the security capabilities of the terminal device from the terminal device; or, obtaining the security capabilities of the terminal device from a unified data management network element.

[0118] In combination with the fifth aspect, in certain implementations of the fifth aspect, determining whether to perform security protection on the first message includes: the terminal device determines whether to perform security protection on the first message based on the operation instruction type of the first operation.

[0119] In combination with the fifth aspect, in certain implementations of the fifth aspect, determining whether to perform security protection on the first message is based on the operation instruction type, including one or more of the following: when the operation instruction type is an inventory operation, determining that integrity security protection is not performed on the first message; when the operation instruction type is a read operation, determining that integrity security protection is performed on the first message; when the operation instruction type is a write operation, determining that integrity security protection is performed on the first message; when the operation instruction type is an invalidation operation, determining that integrity security protection is performed on the first message.

[0120] In combination with the fifth aspect, in certain implementations of the fifth aspect, determining whether to perform security protection on the first message is based on the operation instruction type, including one or more of the following: when the operation instruction type is an inventory operation, determining that confidentiality security protection is not performed on the first message; when the operation instruction type is a read operation, determining that confidentiality security protection is not performed on the first message; when the operation instruction type is a write operation, determining that confidentiality security protection is performed on the first data to obtain a first data ciphertext, wherein the first data ciphertext is carried in the first message, and the first data is data to be written to a storage area of ​​the terminal device; when the operation instruction type is an invalidation operation, determining that confidentiality security protection is not performed on the first message.

[0121] In combination with the fifth aspect, in certain implementations of the fifth aspect, before sending the first message to the terminal device, the method also includes: determining whether to send the first message to the terminal device based on the type of the terminal device; when the type of the terminal device is a tag type, determining to send the first message to the terminal device.

[0122] In combination with the fifth aspect, in certain implementations of the fifth aspect, before sending the first message to the terminal device, the method also includes: determining whether to send the first message to the terminal device based on the business type corresponding to the first operation; and determining to send the first message to the terminal device when the business type corresponding to the first operation is a label service.

[0123] In combination with the fifth aspect, in certain implementations of the fifth aspect, before sending a service response message to the operation requester, the method also includes: receiving a second message from the terminal device, the second message being used to indicate whether the first operation is successfully executed; wherein, when the operation instruction type is a read operation, the second message includes a second data ciphertext, the second data ciphertext is obtained by encrypting the second data, and the second data is data read from a storage area of ​​the terminal device or collected by the terminal device.

[0124] In combination with the fifth aspect, in certain implementations of the fifth aspect, whether to perform integrity verification and / or decryption on the second message is determined based on the type of operation instruction.

[0125] In combination with the fifth aspect, in certain implementations of the fifth aspect, whether to perform integrity verification and / or decrypt the second message is determined based on the operation instruction type, specifically including one or more of the following: when the operation instruction type is an inventory operation, determining not to perform integrity verification on the second message; when the operation instruction type is a read operation, determining to perform integrity verification on the second message; when the operation instruction type is a write operation, determining to perform integrity verification on the second message; when the operation instruction type is an invalidation operation, determining to perform integrity verification on the second message.

[0126] In combination with the fifth aspect, in certain implementations of the fifth aspect, whether to perform integrity check and / or decrypt the second message is determined based on the operation instruction type, specifically including one or more of the following: when the operation instruction type is a read operation, determining to decrypt the second data ciphertext to obtain the second data; when the operation instruction type is an inventory or write operation or an invalidation operation, determining not to decrypt the second message.

[0127] In combination with the fifth aspect, in certain implementations of the fifth aspect, whether to delete the security context is determined based on the type of the terminal device, specifically including one or more of the following: when the type of the terminal device is an active tag or a semi-passive tag, determining not to delete the security context; when the type of the terminal device is a passive tag, determining to delete the security context.

[0128] In combination with the fifth aspect, in certain implementations of the fifth aspect, sending a service response message to the operation requester includes: sending a service response message to the operation requester according to the operation instruction type, specifically including one or more of the following: when the operation instruction type indicates an inventory operation and the integrity check of the second message passes, the service response message is used to indicate that the first operation is successfully executed, and the service response message includes the identification of the terminal device; when the operation instruction type indicates a read operation and the integrity check of the second message passes, the service response message is used to indicate that the first operation is successfully executed, and the service response message includes the identification of the terminal device and the second data, wherein the second data is obtained by decrypting the ciphertext of the second data, and the second data is data read from the storage area of ​​the terminal device or collected by the terminal device; when the operation instruction type indicates a write operation and the integrity check of the second message passes, the service response message is used to indicate that the first operation is successfully executed, and the service response message includes the identification of the terminal device; when the operation instruction type indicates an invalidation operation and the integrity check of the second message passes, the service response message is used to indicate that the first operation is successfully executed, and the service response message includes the identification of the terminal device.

[0129] In combination with the fifth aspect, in certain implementations of the fifth aspect, sending a service response message to the operation requester includes: sending a service response message to the operation requester according to the operation instruction type, specifically including one or more of the following: when the operation instruction type indicates a read operation and the integrity check of the second message fails and / or the decryption of the second message fails, the service response message is used to indicate that the first operation failed; when the operation instruction type indicates a write operation and the integrity check of the second message fails, the service response message is used to indicate that the first operation failed; when the operation instruction type indicates an invalid operation and the integrity check of the second message fails, the service response message is used to indicate that the first operation failed; when the operation instruction type indicates an inventory operation and the integrity check of the second message fails, the service response message is used to indicate that the first operation failed.

[0130] In conjunction with the fifth aspect, in some implementations of the fifth aspect, when the authentication of the terminal device fails, the service response message is used to indicate that the first operation fails. Optionally, the service response message carries a failure reason value, which is used to indicate that the authentication of the terminal device fails.

[0131] Exemplarily, the first message may be a registration acceptance message, and the second message may be a registration completion message; or, the first message may be a NAS SMC message, and the second message may be a NAS SMP message.

[0132] The beneficial effects of the fifth aspect and certain implementation methods of the fifth aspect can be referred to the relevant description of the second aspect, which will not be repeated here.

[0133] In a sixth aspect, a communication method is provided, which can be executed by a terminal device, or can also be executed by a chip or circuit used for a terminal device, which is not limited in this application. For ease of description, the following description is taken as an example of execution by a terminal device.

[0134] The method includes: a terminal device sends a registration request message, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; the terminal device receives a first message from a network element, the first message is used to instruct execution of a first operation on the terminal device, and the first message is a NAS SMC message; the terminal device activates a security context according to the NAS SMC message, and the security context is used to protect secure communications between the terminal device and the network element; the terminal device performs integrity verification and / or decryption on the first message from the network element according to the security context; after the integrity verification and / or decryption, the terminal device executes the first operation.

[0135] Optionally, the method further includes: performing an authentication process between the terminal device and the network. For example, when the network successfully authenticates the terminal device, a first message is sent to the terminal device, and correspondingly, the terminal device receives the first message from the network device.

[0136] According to the solution provided in the present application, the first operation is performed on the terminal device through the NAS SMC message instruction, that is, the NAS SMC process is used to perform the service execution, which reduces the number of information interactions between the terminal device and the network element. Compared with the prior art, the terminal device and the network element sequentially execute the authentication process, trigger the NAS SMC process, and the service execution process. This implementation method can execute the first operation while ensuring the security of network communications, simplify the processing flow of the entire service process, and reduce the processing complexity and processing delay.

[0137] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device activates the security context according to the NAS SMC message, including: the terminal device activates the security context according to the operation instruction type of the first operation.

[0138] In combination with the sixth aspect, in certain implementations of the sixth aspect, before the terminal device activates the security context according to the operation instruction type of the first operation, the method also includes: the terminal device determines whether to activate the security context according to the operation instruction type of the first operation.

[0139] It should be understood that generating a security context and activating a security context are related, so one can choose to execute one when judging. For example, after judging that a security context is generated, activating the security context also needs to be executed; for example, judging that a security context is activated means that a security context needs to be generated before activating the security context, so the judgment of generating a security context and activating the security context can be equivalent, that is, the judgment of whether to generate a security context and the judgment of whether to activate the security context in this application can replace each other, or exist at the same time.

[0140] Based on the above solution, by adding the judgment logic of whether to activate the security context and avoiding unnecessary generation and / or activation of the security context, the computing and storage overhead of the terminal device can be reduced, the limited storage resources of the terminal device can be avoided from being occupied, and the power consumption of the terminal device can be reduced.

[0141] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device determines whether to activate the security context based on the operation instruction type of the first operation, including: when the operation instruction type indicates an inventory operation, the terminal device determines not to activate the security context; when the operation instruction type indicates a read operation, the terminal device determines to activate the security context; when the operation instruction type indicates a write operation, the terminal device determines to activate the security context; when the operation instruction type indicates an invalidation operation, the terminal device determines to activate the security context.

[0142] Based on the above scheme, whether to activate the security context is determined based on whether the first operation indicated by the operation instruction type is a read operation, a write operation, or an invalidation operation, thereby avoiding unnecessary generation and / or activation of the security context for the inventory operation, which can reduce the computing and storage overhead of the terminal device, avoid the storage resources of the terminal device from being occupied, and reduce the power consumption of the terminal device.

[0143] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device activates a security context according to the operation instruction type of the first operation, including: when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the terminal device activates the corresponding security context for integrity security protection; when the operation instruction type indicates a write operation, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection.

[0144] In combination with the sixth aspect, in certain implementations of the sixth aspect, the method further includes: the terminal device activates the security context according to the type of the terminal device.

[0145] In combination with the sixth aspect, in certain implementations of the sixth aspect, before the terminal device activates the security context according to the type of the terminal device, the method also includes: the terminal device determines whether to activate the security context according to the type of the terminal device.

[0146] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device determines whether to activate the security context based on the type of the terminal device, including: when the type of the terminal device is an active tag or a semi-passive tag, the terminal device determines to activate the security context; when the type of the terminal device is a passive tag, the terminal device activates the security context according to the operation instruction type of the first operation.

[0147] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device activates a security context according to the type of the terminal device, including: when the type of the terminal device is an active tag or a semi-passive tag, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection; when the type of the terminal device is a passive tag and the operation instruction type of the first operation indicates an inventory operation, a read operation, or an invalidation operation, the terminal device activates the corresponding security context for integrity security protection; when the type of the terminal device is a passive tag and the operation instruction type of the first operation indicates a write operation, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection.

[0148] In combination with the sixth aspect, in certain implementations of the sixth aspect, before the terminal device performs integrity check and / or decryption on the first message from the network element according to the security context, the method also includes: the terminal device determines whether to perform integrity check and / or decryption on the first message according to the operation instruction type of the first operation.

[0149] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device determines whether to perform an integrity check on the first message based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, the terminal device determines not to perform an integrity check on the first message; when the operation instruction type indicates a read operation, the terminal device determines to perform an integrity check on the first message; when the operation instruction type indicates an invalid operation, the terminal device determines to perform an integrity check on the first message; when the operation instruction type indicates a write operation, the terminal device determines to perform an integrity check on the first message.

[0150] Based on the above scheme, the operation instruction type is associated with whether the integrity check of the first message is performed, and then whether to perform an integrity check on the first message is determined according to the operation instruction type, thereby avoiding the terminal device from performing unnecessary integrity check operations when determining the inventory operation, which can reduce the computing overhead and power consumption of the terminal device.

[0151] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device determines whether to decrypt the first message based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, the terminal device determines not to decrypt the first message; when the operation instruction type indicates a read operation, the terminal device determines not to decrypt the first message; when the operation instruction type indicates an invalidation operation, the terminal device determines not to decrypt the first message; when the operation instruction type indicates a write operation, the terminal device determines to decrypt the first data ciphertext carried in the first message to obtain the first data, where the first data is data to be written into the storage area of ​​the terminal device.

[0152] Based on the above scheme, the operation instruction type is associated with whether the first message is decrypted, and then whether to decrypt the first message is determined according to the operation instruction type, so as to avoid the terminal device performing unnecessary decryption calculations or decryption operations when determining an inventory operation, a read operation, or an invalidation operation, thereby reducing the computing overhead and power consumption of the terminal device.

[0153] In combination with the sixth aspect, in certain implementations of the sixth aspect, the method also includes: the terminal device determines whether to perform security protection on the second message based on the operation instruction type of the first operation, the security protection includes integrity security protection and / or confidentiality security protection, the second message is used to indicate whether the first operation is executed successfully, and the second message is a NAS SMP message; the terminal device sends the second message to the network element.

[0154] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device determines whether to perform security protection on the second message based on the operation instruction type, including one or more of the following: when the operation instruction type indicates an inventory operation, the terminal device determines not to perform integrity security protection on the second message; when the operation instruction type indicates a read operation, the terminal device determines to perform integrity security protection on the second data; when the operation instruction type indicates a write operation, the terminal device determines to perform integrity security protection on the second message; when the operation instruction type indicates an invalidation operation, the terminal device determines to perform integrity security protection on the second message.

[0155] Based on the above scheme, the operation instruction type is associated with whether the second message is to be protected in terms of integrity and security, and then whether the second message is to be protected in terms of integrity and security is determined based on the operation instruction type. This avoids the terminal device performing unnecessary integrity and security protection when determining an inventory operation, thereby reducing the computing overhead and power consumption of the terminal device.

[0156] In combination with the sixth aspect, in certain implementations of the sixth aspect, the terminal device determines whether to perform security protection on the second message based on the operation instruction type, including one or more of the following: when the operation instruction type indicates an inventory operation, the terminal device determines not to perform confidentiality security protection on the second message; when the operation instruction type indicates a read operation, the terminal device determines to perform confidentiality security protection on the second data and obtains a second data ciphertext, where the second data is data in a storage area of ​​the terminal device or data collected by the terminal device, and the second data ciphertext is carried in the second message; when the operation instruction type indicates a write operation, the terminal device determines not to perform confidentiality security protection on the second message; when the operation instruction type indicates an invalidation operation, the terminal device determines not to perform confidentiality security protection on the second message.

[0157] Based on the above scheme, the operation instruction type is associated with whether the second message is to be protected for confidentiality, and then whether the second message is to be protected for confidentiality is determined according to the operation instruction type. This avoids the terminal device performing unnecessary confidentiality security protection when determining inventory operations, write operations, or invalid operations, thereby reducing the computing overhead and power consumption of the terminal device.

[0158] In combination with the sixth aspect, in certain implementations of the sixth aspect, the method also includes: the terminal device determines whether to delete the security context based on the type of the terminal device, specifically including one or more of the following: when the type of the terminal device is an active tag or a semi-passive tag, the terminal device determines not to delete the security context; when the type of the terminal device is a passive tag, the terminal device determines to delete the security context.

[0159] Based on the above solution, by adding the judgment logic of whether to delete the security context, it is avoided that the security context is not deleted or saved when the terminal device type is a passive tag, thereby reducing the computing and storage overhead of the terminal device, avoiding the limited storage resources of the terminal device from being occupied, and reducing the power consumption of the terminal device.

[0160] In the seventh aspect, a communication method is provided, which can be executed by a network element, or can also be executed by a chip or circuit for a network element, and the present application does not limit this. For the convenience of description, the following is an example of execution by a network element. It should be understood that when the TMF is set independently, the method may be executed by the TMF and other network elements (such as AMF). This application does not limit this.

[0161] The method includes: receiving a registration request message from a terminal device, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; activating a security context, the security context is used to protect secure communications between the terminal device and a network element; performing security protection on a first message according to the security context, the security protection includes integrity security protection and / or confidentiality security protection, the first message is used to instruct execution of a first operation on the terminal device, and the first message is a NAS SMC message; and sending the first message after security protection to the terminal device.

[0162] Optionally, the method further includes: performing an authentication process between the terminal device and the network. For example, when the network successfully authenticates the terminal device, activating the security context and sending a first message with security protection to the terminal device. In other words, the NAS SMC message is a message with security protection.

[0163] According to the solution provided in the present application, the first operation is performed on the terminal device through the NAS SMC message instruction, that is, the NAS SMC process is used to perform the service execution, which reduces the number of information interactions between the terminal device and the network element. Compared with the prior art, the terminal device and the network element sequentially execute the authentication process, trigger the NAS SMC process, and the service execution process. This implementation method can execute the first operation while ensuring the security of network communications, simplify the processing flow of the entire service process, and reduce the processing complexity and processing delay.

[0164] In combination with the seventh aspect, in certain implementations of the seventh aspect, the security capabilities of the terminal device are used to determine the security algorithm in the security context, and the method also includes: obtaining the security capabilities of the terminal device from the operation requester; or, obtaining the security capabilities of the terminal device from the terminal device; or, obtaining the security capabilities of the terminal device from a unified data management network element.

[0165] In combination with the seventh aspect, in certain implementations of the seventh aspect, activating the security context includes: activating the security context according to the operation instruction type of the first operation and / or the type of the terminal device.

[0166] In combination with the seventh aspect, in certain implementations of the seventh aspect, before activating the security context based on the operation instruction type of the first operation and / or the type of the terminal device, the method also includes: determining whether to activate the security context based on the operation instruction type of the first operation and / or the type of the terminal device.

[0167] In combination with the seventh aspect, in certain implementations of the seventh aspect, determining whether to activate the security context is based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, determining not to activate the security context; when the operation instruction type indicates a read operation, determining to activate the security context; when the operation instruction type indicates a write operation, determining to activate the security context; when the operation instruction type indicates an invalidation operation, determining to activate the security context.

[0168] In combination with the seventh aspect, in certain implementations of the seventh aspect, determining whether to activate the security context is based on the type of the terminal device, including one or more of the following: when the type of the terminal device is an active tag or a semi-passive tag, determining to activate the security context; when the type of the terminal device is a passive tag, activating the security context according to the operation instruction type of the first operation.

[0169] In combination with the seventh aspect, in certain implementations of the seventh aspect, the security context is activated according to the operation instruction type of the first operation and / or the type of the terminal device, including: activating the corresponding security context for integrity security protection and / or the corresponding security context for confidentiality security protection according to the operation instruction type of the first operation and / or the type of the terminal device.

[0170] In combination with the seventh aspect, in certain implementations of the seventh aspect, a corresponding security context for integrity security protection and / or a corresponding security context for confidentiality security protection are activated according to the operation instruction type of the first operation, including: when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the terminal device activates the corresponding security context for integrity security protection; when the operation instruction type indicates a write operation, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection.

[0171] In combination with the seventh aspect, in certain implementations of the seventh aspect, the corresponding security context for integrity security protection and / or the corresponding security context for confidentiality security protection are activated according to the type of terminal device, including: when the type of the terminal device is an active tag or a semi-passive tag, the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection are activated; when the type of the terminal device is a passive tag and the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the corresponding security context for integrity security protection is activated; when the type of the terminal device is a passive tag and the operation instruction type indicates a write operation, the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection are activated.

[0172] In combination with the seventh aspect, in certain implementations of the seventh aspect, before performing security protection on the first message according to the security context, the method also includes: determining whether to perform security protection on the first message according to an operation instruction type of the first operation.

[0173] In combination with the seventh aspect, in certain implementations of the seventh aspect, determining whether to perform security protection on the first message is based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, determining that integrity security protection is not performed on the first message; when the operation instruction type indicates a read operation, determining that integrity security protection is performed on the first message; when the operation instruction type indicates an invalidation operation, determining that integrity security protection is performed on the first message; when the operation instruction type indicates a write operation, determining that integrity security protection is performed on the first message.

[0174] In combination with the seventh aspect, in certain implementations of the seventh aspect, determining whether to perform security protection on the first message is based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, determining that confidentiality security protection is not performed on the first message; when the operation instruction type indicates a read operation, determining that confidentiality security protection is not performed on the first message; when the operation instruction type indicates an invalidation operation, determining that confidentiality security protection is not performed on the first message; when the operation instruction type indicates a write operation, determining that confidentiality security protection is performed on the first data, and obtaining a first data ciphertext, the first data being data to be written to a storage area of ​​the terminal device, and the first data ciphertext is carried in the first message.

[0175] In combination with the seventh aspect, in certain implementations of the seventh aspect, the method further includes: receiving a second message from the terminal device, the second message being used to indicate whether the first operation is successfully executed, and the second message being a NAS SMP message.

[0176] In combination with the seventh aspect, in certain implementations of the seventh aspect, the method further includes: determining whether to perform integrity verification and / or decryption on the second message based on an operation instruction type of the first operation.

[0177] In combination with the seventh aspect, in certain implementations of the seventh aspect, determining whether to perform an integrity check on the second message is based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, determining not to perform an integrity check on the second message; when the operation instruction type indicates a read operation, determining to perform an integrity check on the second message; when the operation instruction type indicates an invalid operation, determining to perform an integrity check on the second message; when the operation instruction type indicates a write operation, determining to perform an integrity check on the second message.

[0178] In combination with the seventh aspect, in certain implementations of the seventh aspect, determining whether to decrypt the second message is based on the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates a read operation, determining to decrypt the second data ciphertext carried in the second message to obtain the second data, where the second data is data in a storage area of ​​the terminal device or data collected by the terminal device; when the operation instruction type indicates a write operation, determining not to decrypt the second message; when the operation instruction type indicates an invalidation operation, determining not to decrypt the second message; when the operation instruction type indicates an inventory operation, determining not to decrypt the second message.

[0179] In combination with the seventh aspect, in certain implementations of the seventh aspect, the method also includes: determining whether to delete the security context based on the type of the terminal device, specifically including one or more of the following: when the type of the terminal device is an active tag or a semi-passive tag, determining not to delete the security context; when the type of the terminal device is a passive tag, determining to delete the security context.

[0180] In combination with the seventh aspect, in certain implementations of the seventh aspect, the method also includes: receiving a service request message from an operation requester, the service request message being used to request execution of a first operation on a terminal device; sending a service response message to the operation requester according to the operation instruction type of the first operation, comprising one or more of the following: when the operation instruction type indicates an inventory operation, the service response message includes an identifier of the terminal device; when the operation instruction type indicates a read operation, the service response message includes an identifier of the terminal device and second data, the second data being data read from a storage area of ​​the terminal device or collected by the terminal device; when the operation instruction type indicates a write operation, the service response message includes an identifier of the terminal device; when the operation instruction type indicates an invalid operation, the service response message is used to indicate that the first operation is successfully executed, and the service response message includes the identifier of the terminal device.

[0181] In combination with the seventh aspect, in some implementations of the seventh aspect, the method also includes: receiving a service request message from an operation requester, the service request message being used to request execution of a first operation on a terminal device, and sending a first service response message to the operation requester according to an operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates an inventory operation, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device; when the operation instruction type indicates a read operation and the integrity check and / or decryption of the second message passes, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device and second data, wherein the second data is obtained by decrypting a ciphertext of the second data, and the second data is data read from a storage area of ​​the terminal device or collected by the terminal device; when the operation instruction type indicates a write operation and the integrity check of the second message passes, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device; when the operation instruction type indicates an invalidation operation and the integrity check of the second message passes, the first service response message is used to indicate that the first operation is successfully executed, and the first service response message includes an identifier of the terminal device.

[0182] In combination with the seventh aspect, in certain implementations of the seventh aspect, the method also includes: receiving a service request message from an operation requester, the service request message being used to request execution of a first operation on a terminal device, and sending a second service response message to the operation requester according to the operation instruction type of the first operation, including one or more of the following: when the operation instruction type indicates a read operation and the integrity check of the second message fails and / or the decryption of the second message fails, the second service response message is used to indicate that the execution of the first operation failed; when the operation instruction type indicates a write operation and the integrity check of the second message fails, the second service response message is used to indicate that the execution of the first operation failed; when the operation instruction type indicates an invalid operation and the integrity check of the second message fails, the second service response message is used to indicate that the execution of the first operation failed.

[0183] In conjunction with the seventh aspect, in some implementations of the seventh aspect, the method further includes: receiving a service request message from an operation requester, the service request message being used to request execution of a first operation on a terminal device, and sending a third service response message to the operation requester when the authentication of the terminal device fails, the third service response message being used to indicate that the execution of the first operation fails. Optionally, the third service response message carries a failure reason value, which is used to indicate that the authentication of the terminal device fails.

[0184] The beneficial effects of the seventh aspect and certain implementation methods of the seventh aspect can be referred to the relevant description of the sixth aspect, which will not be repeated here.

[0185] In an eighth aspect, a communication device is provided. The device includes: a transceiver unit, configured to send a registration request message to a network, the registration request message is used to request registration to a network, and the registration request message includes an identifier of a terminal device; a processing unit, configured to activate a security context when the terminal device passes the authentication of the network, the security context is used to protect the secure communication between the terminal device and the network; the processing unit is further configured to perform an integrity check on a first message from a network element according to the security context, the first message is used to request execution of a first operation on the terminal device; and the processing unit is further configured to execute the first operation when the integrity check passes.

[0186] The transceiver unit can perform the reception and transmission processing in the aforementioned first aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned first aspect.

[0187] In a ninth aspect, a communication device is provided. The device includes: a transceiver unit, configured to receive a registration request message from a terminal device, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; a processing unit, configured to activate a security context when the terminal device is authenticated, the security context is used to protect secure communication between the terminal device and a network element; the processing unit is further configured to perform integrity security protection on a first message according to the security context, the first message is used to request a first operation to be performed on the terminal device; and the transceiver unit is further configured to send the first message to the terminal device.

[0188] The transceiver unit can perform the reception and transmission processing in the aforementioned second aspect, and the processing unit can perform other processing except reception and transmission in the aforementioned second aspect.

[0189] In a tenth aspect, a communication device is provided. The device includes: a transceiver unit, configured to send a service request message to a network element, the service request message is used to request to perform a first operation on a terminal device, and the service request message includes the security capability of the terminal device; the transceiver unit is also configured to receive a service response message from the network element, the service response message is used to indicate whether the first operation is successfully performed.

[0190] The transceiver unit can perform the receiving and sending processing in the third aspect, and the processing unit can perform other processing except receiving and sending in the third aspect.

[0191] In an eleventh aspect, a communication device is provided. The device includes: a transceiver unit, configured to send a registration request message to a network element, the registration request message is used to request registration to the network, and the registration request message includes an identifier of a terminal device; the transceiver unit is further configured to receive a first message from the network element, the first message is used to request execution of a first operation on the terminal device; and a processing unit is configured to determine whether to activate a security context according to an operation instruction type of the first operation, the security context is used to protect secure communication between the terminal device and the network element.

[0192] The transceiver unit can perform the receiving and sending processing in the fourth aspect, and the processing unit can perform other processing except receiving and sending in the fourth aspect.

[0193] In a twelfth aspect, a communication device is provided. The device includes: a transceiver unit, configured to receive a registration request message from a terminal device, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; a processing unit, configured to determine whether to activate a security context according to an operation instruction type of a first operation, the security context is used to protect secure communication between the terminal device and a network element; the processing unit is further configured to, if it is determined that the security context is activated, perform security protection on a first message to be sent according to the security context, the first message is used to request execution of a first operation on the terminal device; and the transceiver unit is further configured to send the first message to the terminal device; or, if it is determined that the security context is not activated, the transceiver unit is further configured to send the first message to the terminal device.

[0194] The transceiver unit can perform the receiving and sending processing in the fifth aspect, and the processing unit can perform other processing except receiving and sending in the fifth aspect.

[0195] In the thirteenth aspect, a communication device is provided. The device includes: a transceiver unit, which is used to send a registration request message to a network element, the registration request message is used to request registration to the network, and the registration request message includes an identifier of a terminal device; the transceiver unit is also used to receive a first message from the network element, the first message is used to instruct to perform a first operation on the terminal device, and the first message is a NAS SMC message; a processing unit is used to activate a security context according to the NAS SMC message, and the security context is used to protect the secure communication between the terminal device and the network element; the processing unit is also used to perform integrity check and / or decryption on the first message from the network element according to the security context; the processing unit is also used for the terminal device to perform the first operation after the integrity check and / or decryption.

[0196] The transceiver unit can perform the receiving and sending processing in the aforementioned sixth aspect, and the processing unit can perform other processing except receiving and sending in the aforementioned sixth aspect.

[0197] In a fourteenth aspect, a communication device is provided. The device includes: a transceiver unit, which is used to receive a registration request message from a terminal device, the registration request message is used to request registration to a network, and the registration request message includes an identifier of the terminal device; a processing unit, which is used to activate a security context, and the security context is used to protect secure communications between the terminal device and a network element; the processing unit is also used to perform security protection on a first message according to the security context, the security protection includes integrity security protection and / or confidentiality security protection, the first message is used to indicate the execution of a first operation on the terminal device, and the first message is a NASSMC message; the transceiver unit is also used to send the first message after security protection to the terminal device;.

[0198] The transceiver unit can perform the receiving and sending processing in the aforementioned sixth aspect, and the processing unit can perform other processing except receiving and sending in the aforementioned sixth aspect.

[0199] In a fifteenth aspect, a communication device is provided, comprising a processor, the processor being coupled to a memory, the memory being used to store a computer program, the processor being used to call and run the computer program from the memory, so that the communication device executes the method in the above-mentioned first to third aspects and any possible implementation thereof, or the communication device executes the method in the above-mentioned third to fifth aspects and any possible implementation thereof.

[0200] Optionally, the number of the processors is one or more, and the number of the memories is one or more.

[0201] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0202] Optionally, the communication device further comprises a transceiver.

[0203] In the sixteenth aspect, a communication system is provided, including a terminal device, a network element and / or an operation requester, wherein the terminal device is used to execute the method in the above-mentioned first aspect or fourth aspect or sixth aspect and any possible implementation thereof, the network element is used to execute the method in the above-mentioned second aspect or fifth aspect or seventh aspect and any possible implementation thereof, and the operation requester is used to execute the method in the above-mentioned third aspect and any possible implementation thereof.

[0204] In the seventeenth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program or code, and when the computer program or code is run on a computer, the computer executes the method in the above-mentioned first to third aspects and any possible implementation thereof, or the computer executes the method in the above-mentioned fourth to sixth aspects and any possible implementation thereof.

[0205] In the eighteenth aspect, a chip is provided, comprising at least one processor, wherein the at least one processor is coupled to a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that a terminal device equipped with the chip system executes the method in the first aspect, the fourth aspect, or the sixth aspect and any possible implementation thereof, or a core network element equipped with the chip system executes the method in the second aspect, the fifth aspect, or the seventh aspect and any possible implementation thereof, or an operation requester equipped with the chip system executes the method in the third aspect and any possible implementation thereof.

[0206] The chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0207] In the nineteenth aspect, a computer program product is provided, comprising: a computer program code, which, when executed, executes the method in the above-mentioned first to fifth aspects and any possible implementation manner thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0208] Figure 1 is a schematic diagram of the structure of a network architecture 100 applicable to an embodiment of the present application;

[0209] Figure 2 is a schematic diagram of the structure of a network architecture 200 applicable to an embodiment of the present application;

[0210] Figure 3 is a flow chart of a service triggering and executing method 300;

[0211] Figure 4 is a flow chart of a communication method 400 provided in an embodiment of the present application;

[0212] Figure 5 is a flow chart of a communication method 500 provided in an embodiment of the present application;

[0213] Figure 6 is a flow chart of a communication method 600 provided in an embodiment of the present application;

[0214] Figure 7 is a flow chart of a communication method 700 provided in an embodiment of the present application;

[0215] Figure 8 is a schematic diagram of the structure of a communication device 1000 provided in an embodiment of the present application;

[0216] Fig. 9 is a schematic diagram of the structure of a communication device 2000 provided in an embodiment of the present application;

[0217] Fig.10 It is a schematic diagram of the structure of the chip system 3000 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0218] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0219] The technical solution provided in this application can be applied to various communication systems, such as: new radio (NR) system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, etc. The technical solution provided in this application can also be applied to device to device (D2D) communication, vehicle to everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of things (IoT) communication system or other communication systems.

[0220] In the communication system, the part operated by the operator can be called a public land mobile network (PLMN), or an operator network, etc. PLMN is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNO) provide mobile broadband access services to users. The PLMN described in the embodiment of the present application may specifically be a network that meets the requirements of the third generation partnership project (3GPP) standards, referred to as a 3GPP network. 3GPP networks generally include but are not limited to fifth-generation mobile communication (5th-generation, 5G) networks, fourth-generation mobile communication (4th-generation, 4G) networks, and other future communication systems, such as (6th-generation, 6G) networks, etc.

[0221] For the convenience of description, the embodiments of the present application will be described using PLMN or 5G network as an example.

[0222] Figure 11 is a schematic diagram of the structure of the network architecture 100 applicable to the embodiment of the present application. Figure 1 As shown, the network architecture is an ambient IoT (A-IoT) architecture, and A-IoT can also be called a passive IoT (P-IoT). The network architecture includes a terminal device 110, a core network element 120, and an operation requester 130. Optionally, the network architecture also includes a reader.

[0223] Below, each network node included in the environmental Internet of Things architecture 200 is briefly described.

[0224] 1. Terminal device 110

[0225] The terminal device 110 itself is not equipped with or does not rely on power devices such as batteries. It can obtain energy through environmental environments such as radio, solar energy, radio frequency, light energy, wind energy, water energy, thermal energy, kinetic energy or tidal energy to support data perception, transmission and distributed computing. This application does not limit the way it obtains energy.

[0226] For example, the terminal device 110 may be in the form of a tag or other terminal forms. The present application does not limit the form and name of the terminal device. For details, please refer to the following Figure 2 Relevant description of the terminal device part. For ease of explanation, the embodiment of the present application takes the terminal device 110 as a tag as an example for explanation. It should be understood that the tag includes a passive tag, a semi-passive tag and an active tag. Among them, the passive tag can be called a type A device, which is characterized by no energy storage and inability to generate signals independently; the semi-passive tag can be called a type B device, which is characterized by a certain amount of energy storage for reflecting signals and inability to generate signals independently; the active tag can be called a type C device, which is characterized by energy storage and can generate signals independently, such as including active radio frequency components for transmission.

[0227] 2. Core network element 120

[0228] The core network element 120 may be a core network element in a 5G network. For details, see below. Figure 2 For example, the core network element may be an access and mobility management function (AMF), which is responsible for access control and mobility management of the terminal device 110 to the operator network, such as mobile state management, allocation of temporary user identities, authentication and authorization of users, etc.

[0229] 3. Operation requester 130

[0230] The operation requester 130 can be understood as a device that sends an operation instruction type, including but not limited to: a server, a passive Internet of Things server P-IoT server, an application function (AF), a network function (NF) or other devices that send operation instructions. Exemplarily, the operation requester 130 can correspond to a certain type of user, and this type of user can include an enterprise, a tenant, a third party or a company, and this application is not limited to this. Among them, the operation requester 130 corresponding to a certain type of user can be understood as the operation requester 130 belongs to this type of user and is managed by this type of user.

[0231] When the operation requester 130 performs an operation on the terminal device 110, the operation instruction type may be sent through the core network element 120, and the operation instruction type includes but is not limited to: inventory operation, read operation, write operation, invalidation operation, etc. Optionally, the core network element 120 may send the operation instruction type to the terminal device through a reader.

[0232] In one example, the operation requester 130 may send the operation instruction type to the terminal device 110 through the control plane channel. Exemplarily, the operation requester 130 sends the operation instruction type to the core network element 120, and then the core network element 120 sends the operation instruction type to the terminal device 110. At this time, the server may be an NF, AF, an application server (AS) or a passive Internet of Things application function (P-IoT AF). Among them, the control plane device may be an AMF, NEF, SMF, PCF, UDM, network slice, or standalone non-public network (SNPN) authentication and authorization function (Network Slice-specific and SNPN Authentication and Authorization Function, NSSAAF).

[0233] 4. Reader

[0234] The reader can interact with the terminal device 110 through radio frequency signals or wireless signals. In one example, when the terminal device 110 enters the effective identification range of the reader, the terminal device 110 receives the radio frequency signal sent by the reader, and sends the information stored in the chip by means of energy obtained by the induced current (corresponding to a passive tag); in another example, the terminal device 110 stores part of the electric energy through solar energy or other means, and can actively send a signal of a certain frequency (corresponding to a semi-passive or active tag), and after the reader receives and decodes the signal, it sends the data to the central information system for processing.

[0235] Exemplarily, the reader can be an access network device, such as a base station, a pole station, a micro base station, a macro station, an integrated access and backhaul (IAB) node, etc. This application does not limit the form and name of the reader. Optionally, the reader can also be a terminal device, such as a mobile phone, an IoT device, a handheld reader, etc. At this time, the operation requester 130 can send instructions to the reader through the user plane device and the access network device (such as RAN), requesting to perform one or more of the inventory operation (or inventory operation), read operation, write operation, and invalidation operation. For ease of explanation, the embodiment of the present application is described as an example in which the reader is a base station (such as gNB). At this time, the reader has the function of performing at least one of the following operations on the terminal device 110: inventory operation (or inventory operation), read operation, write operation, invalidation operation (or deactivation operation), etc.

[0236] The following is a brief description of the above operations.

[0237] (1) Inventory operation, that is, taking inventory of the existing terminal devices, can also be understood as obtaining the identification information of the terminal devices. The identification of the terminal device can be assigned by the enterprise or by the operator. For example, the identification of the terminal device can be a globally unique code (such as an Electronic Product Code (EPC)) or a temporary identification. In the inventory process, the operation requester 130 can send an inventory instruction, and the inventory instruction can include at least one of the identification range, reader identification, and location information of the terminal device. After receiving the inventory instruction, the reader or core network element 120 takes inventory of the terminal device 110 according to the inventory instruction, and sends the identification information of the terminal device to the operation requester 130. Alternatively, the operation requester 130 transmits the inventory instruction to the terminal device 110 through the reader or the core network network element 120, and the terminal device 110 knows that it is an inventory operation based on the content of the instruction, and then sends the identification information of the terminal device 110 to the operation requester 130 through the reader or the core network network element 120. Alternatively, the terminal device 110 sends the identification information of the terminal device 110 to the core network network element 120 through the reader, and the core network network element 120 forwards the identification information of the terminal device 110 to the operation requester 130.

[0238] (2) Read operation, i.e., reading data from the terminal device 110. The terminal device 110 may have a storage function, and its storage area may store data. If the operation requester 130 sends a read instruction, the reader or the core network element 120 performs a read operation on the terminal device 110 according to the read instruction, reads data from the storage area of ​​the terminal device 110, and sends the data to the operation requester 130.

[0239] (3) Write operation, that is, writing data to the terminal device 110. If the operation requester 130 sends a write instruction, and the write instruction includes data #1, the reader or core network element 120 performs a write operation on the terminal device 110 according to the write instruction, and writes data #1 into the storage area of ​​the terminal device 110.

[0240] (4) Invalidation operation, that is, the terminal device 110 can be invalidated or deactivated. If the operation requester 130 can send an invalidation instruction, and the invalidation instruction includes the identifier of the terminal device 110 (i.e., the identifier of the terminal device 110 that is desired to be deactivated or invalidated), the reader or the core network element 120 performs an invalidation operation on the terminal device 110 according to the invalidation instruction. After the operation is completed, the terminal device 110 is invalidated or deactivated, which means that the terminal device 110 can no longer be counted or other operations can be performed. In other words, after the terminal device 110 is invalidated or deactivated, the reader cannot obtain the information of the invalid terminal device 110, nor can it exchange messages with the invalid terminal device 110.

[0241] It should be understood that the above Figure 1 The network architecture 100 shown is only an example given for ease of understanding. The network architecture applicable to the embodiments of the present application is not limited thereto. Any network architecture that can implement the functions of the above-mentioned network elements is applicable to the embodiments of the present application.

[0242] Figure 2 2 is a schematic diagram of a network architecture 200 applicable to an embodiment of the present application, and takes a 5G network architecture based on a service-based architecture SBA in a non-roaming scenario defined in the 3GPP standardization process as an example for explanation. Figure 2 As shown in FIG. 1 , the network architecture includes three parts, namely: a terminal device part, a data network (DN) part and an operator network PLMN part. The functions of the network elements of each part are briefly described below.

[0243] (1) The terminal equipment part may include UE 210, which may also be referred to as user equipment (UE). UE 210 in the present application is a device with wireless transceiver functions, which may communicate with one or more core network (CN) devices via an access network device (or may also be referred to as an access device) in a radio access network (RAN) 220. UE 210 may also be referred to as an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent or user device, etc. UE 210 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on the water (e.g., ships, etc.); it may also be deployed in the air (e.g., on airplanes, balloons and satellites, etc.). UE 210 may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. Alternatively, UE 210 may also be a handheld device with wireless communication function, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, an unmanned aerial vehicle (UAV) device or a terminal in the Internet of Things or the Internet of Vehicles, a terminal in any form in a 5G network and future networks, a relay user device or a terminal in a future evolved 6G network, etc. Among them, the relay user device may be, for example, a 5G residential gateway (RG). For example, UE 210 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. Alternatively, UE 210 may also be a terminal device such as a logical entity, a smart device (such as a mobile phone), a smart terminal, or a communication device such as a server, a gateway, a base station, a controller, or an Internet of Things device (such as a tag, see Figure 1 110 shown), sensors, electric meters, water meters and other IoT devices. The present application embodiment does not limit the type or category of terminal devices. For ease of explanation, the present application will be described later using UE or tag to represent terminal devices as an example.

[0244] (2) The data network portion may include a data network DN 240, which may also be referred to as a packet data network (PDN), which is usually a network located outside the operator network, such as a third-party network. In some implementations, the DN may also be deployed by the operator, that is, the DN is part of the PLMN. This application does not restrict whether the DN belongs to the PLMN. A variety of services may be deployed on the DN 240, which may provide data and / or voice services to the UE 210.

[0245] (3) The PLMN part of the operator network may include but is not limited to the (radio) access network ((R)AN) 120 and the core network (CN). UE 210 may establish a connection with the operator network through an interface (such as N1, etc.) provided by the operator network and use data and / or voice services provided by the operator network. UE 210 may also access DN 240 through the operator network and use operator services deployed on DN 240 and / or services provided by a third party.

[0246] (R)AN 220 can be regarded as a sub-network of the operator network, and is an implementation system between the service node in the operator network and UE 210. To access the operator network, UE 210 first passes through (R)AN 220, and then can connect to the service node of the operator network through (R)AN 220. The access network device (RAN device) in the embodiment of the present application is a device that provides wireless communication functions for UE 210, and can also be called a network device. The RAN device includes but is not limited to: the next generation node base station (gNB) in the 5G system, the evolved node B (eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (for example, home evolved node B, or home node B, HNB), the base band unit (BBU), the transmission point (TRP), the transmitting point (TP), the small base station device (pico), the mobile switching center, or the network device in the future network. In the system using different wireless access technologies, the name of the device with the access network device function may be different. For the convenience of description, in all the embodiments of the present application, the above-mentioned device that provides wireless communication functions for UE 210 is collectively referred to as the access network device or RAN or AN for short. It should be understood that this document does not limit the specific type of access network equipment.

[0247] The CN part may include but is not limited to the following network functions (NF): user plane function (UPF) 230, network exposure function (NEF) 231, network function repository function (NRF) 232, policy control function (PCF) 233, unified data management function (UDM) 234, unified data repository function (UDR) 235, application function (AF) 236, authentication server function (AUSF) 237, access and mobility management function (AMF) 238, session management function (SMF) 239.

[0248] The following is a brief description of the NF functions included in CN.

[0249] 1. UPF 230 is a gateway provided by the operator. It is the gateway for the operator network to communicate with DN 240. It is mainly responsible for packet routing and transmission, packet detection, service usage reporting, quality of service (QoS) processing, legal monitoring, uplink packet detection, downlink packet storage, etc. UPF 230 can also be called user plane equipment. It can receive user data from DN 240 and transmit it to UE 210 through (R)AN 220; UPF 230 can also receive user data from UE210 through (R)AN 220 and forward it to DN 240. The transmission resources and scheduling functions in UPF 230 that provide services for UE 210 are managed and controlled by SMF 239.

[0250] 2. NEF 231 is a control plane function provided by the operator, which mainly enables third parties to use the services provided by the network, supports the network to open its capabilities, event and data analysis, provide PLMN security configuration information from external applications, and convert the interactive information inside and outside the PLMN. NEF 231 can also be called a network opening device, which can provide Nnef services.

[0251] 3. NRF 232 is a control plane function provided by the operator, which can be used to maintain real-time information of network functions and services in the network. For example, it supports network service discovery, maintains the services supported by the NF profile of the NF instance, supports service discovery of the service communication proxy (SCP), maintains the SCP profile of the SCP instance, sends notifications about newly registered, unregistered, and updated NFs and SCPs, and maintains the health status of NF and SCP operations.

[0252] 4. PCF 233 is a control plane function provided by the operator. It supports a unified policy framework to govern network behavior, provide policy rules to other control functions, and contract information related to policy decisions.

[0253] 5. UDM 234 is a control plane function provided by the operator, which is responsible for storing the subscriber permanent identifier (SUPI) of the subscriber in the operator's network, the generic public subscription identifier (GPSI) of the subscriber, the credential and other information, which can be used for authentication and authorization of UE 210 to access the operator's network. Among them, SUPI will be encrypted during transmission, and the encrypted SUPI is called a hidden user subscription identifier (SUCI). UDM 234 can also be called a unified data management device, a unified data management network element, a data management device, a unified data management entity, etc.

[0254] 6. UDR 235 is a control plane function provided by the operator, which provides the functions of storing and obtaining subscription data for UDM, storing and obtaining policy data for PCF, storing and obtaining the user's NF group ID information, etc. UDR 235 can also be called user database equipment, user database entity, user database network element, etc. Among them, the user database mainly includes the following functions: access functions of subscription data, policy data, application data and other types of data.

[0255] 7. AF 236 is a control plane function provided by the operator. It mainly provides corresponding services by interacting with other NFs in the PLMN, such as providing roaming UE with visit network selection information, guiding the routing of data flows, accessing NEF 231, etc. AF can be deployed by the operator inside the PLMN or outside the operator network.

[0256] 8. AUSF 237 is a control plane function provided by the operator, and is usually used for primary authentication, i.e., authentication between UE 210 (subscriber) and the operator network. After receiving the authentication request initiated by the subscriber, AUSF 237 can authenticate and / or authorize the subscriber through the authentication information and / or authorization information stored in UDM 234, or generate the authentication and / or authorization information of the subscriber through UDM 234. AUSF 237 can feed back the authentication information and / or authorization information to the subscriber.

[0257] 9. AMF 238 is a control plane network function provided by the operator network, responsible for access control and mobility management of UE 210 accessing the operator network, including, for example, mobility state management, allocation of user temporary identity, authentication and authorization of users, etc. Exemplarily, AMF 238 may also be referred to as access and mobility management equipment, access and mobility management function entity, access and mobility management function network element, mobile management equipment, mobile management network element, mobile management entity, etc., and may provide Namf services.

[0258] 10. SMF 239 is a control plane network function provided by the operator network, responsible for managing the protocol data unit PDU session of UE 210. The terminal device transmits PDU to each other with DN 240 through the PDU session. SMF 239 is responsible for establishing, maintaining and deleting PDU sessions. SMF 239 includes session management (such as session establishment, modification and release, including tunnel maintenance between user plane function UPF230 and (R)AN 220), selection and control of UPF 230, service and session continuity (SSC) mode selection, roaming and other session-related functions. SMF 239 can also be called a session management device, which can provide Nsmf services.

[0259] It is understandable that the above network elements or functions can be physical entities in hardware devices, software instances running on dedicated hardware, or virtualized functions instantiated on a shared platform (e.g., a cloud platform). In short, a NF can be implemented by hardware or software.

[0260] It should be understood that the above naming is only defined for the convenience of distinguishing different functions and should not constitute any limitation to this application. This application does not exclude the possibility of using other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may use the terminology in 5G, or may use other names.

[0261] Figure 2Where Nnef, Nnrf, Npcf, Nudm, Nudr, Naf, Nausf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. For example, the meaning of the above interface serial numbers can be found in the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers. It should be noted that, Figure 2 The interface name between the various network functions in the system architecture is only an example. In a specific implementation, the interface name of the system architecture may also be other names, which are not limited in this application. In addition, the name of the message (or signaling) transmitted between the above-mentioned network elements is only an example and does not constitute any limitation on the function of the message itself.

[0262] For the convenience of explanation, in the embodiments of the present application, the network functions (such as NEF 231, ..., SMF239) are collectively referred to as NFs, that is, the NFs described later in the embodiments of the present application can be replaced by any network function. Figure 2 Only some network functions are schematically described. The NF described below is not limited to Figure 2 The network functions shown in .

[0263] It should be understood that the above-mentioned network architecture 200 applied to the embodiment of the present application is only a network architecture described from the perspective of a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present application. Figure 2 The AMF, SMF, UPF, NEF, AUSF, NRF, PCF, and UDM shown in the figure can be understood as network elements used to implement different functions in the core network, for example, they can be combined into network slices as needed. These core network network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the above network elements.

[0264] Based on the above Figure 1 and Figure 2 The network architecture is combined with Figure 3 Taking the terminal device 110 as UE (or tag), the core network element 120 as AMF, the reader as gNB, and the operation request method 130 as AF as an example, a brief description is given on the service triggering and execution method. For the incomplete parts, please refer to the existing protocol.

[0265] Figure 3 It is a flow chart of the service triggering and execution method. Figure 3 As shown, the method 300 includes the following multiple steps, and the parts not described in detail can refer to the existing protocols.

[0266] S301, AF sends a service request message to AMF, and correspondingly, AMF receives the service request message from AF.

[0267] The service request message may be a Service Request message, which is used to request to perform operation #1 on the UE. The service request message may include an operation instruction type (e.g., action or command) and a UE ID range. The operation instruction type is used to indicate that the current AF requests to perform operation #1 on the UE, including but not limited to: inventory operation, read operation, write operation, and invalidation operation. The interpretation of the specific operation can refer to the relevant description above. Optionally, when the operation instruction type indicates a write operation (or, operation #1 is a write operation), the service request message also includes data #1 (data1) to represent the data to be written into the UE storage area. The UE identification group is used to indicate the group to which the UE belongs, which may include one or more UEs, so the AF can request to perform operation #1 on one or more UEs. In other words, the UE identification group may be a collection of single UE identifications, or a filter for UE matching (e.g., MASK, a possible implementation method is a field containing wildcards). For example, when MASK is 123***, the UE identification is a 6-bit identification that conforms to the beginning of 123, and this application does not limit this.

[0268] Exemplarily, the AF may send a service request message to the AMF through the NEF to request to perform operation #1 on the UE. For example, the AF sends a service request message #1 to the NEF, and the NEF sends a service request message #2 to the AMF, wherein the service request message #1 and the service request message #2 may be the same or different, for example, the source address carried in the service request message #1 is used for the AF, and the destination address is used to indicate the NEF, and the source address carried in the service request message #2 is used for the NEF, and the destination address is used to indicate the AMF.

[0269] S302, AMF sends an N2 message to gNB, and correspondingly, gNB receives the N2 message from AMF.

[0270] Exemplarily, the N2 message may be an N2 message, and the N2 message includes a random access indication and a MASK. The random access indication is used to trigger the gNB to initiate an incentive to the UE so that the UE accesses the network.

[0271] S303, the gNB sends a selection command message to the UE, and correspondingly, the UE receives the selection command message from the gNB.

[0272] Exemplarily, the selection command message includes a UE identifier or a UE identifier group, which is used to trigger the target UE to access the network. For example, when the selection command message includes a MASK of 123***, it indicates that the target UE that matches the 6-digit identifier starting with 123 accesses the network.

[0273] S304: The UE establishes a connection with the gNB.

[0274] Exemplarily, the UE randomly accesses the network, that is, the UE establishes a communication connection with the gNB.

[0275] S305, the UE sends a request message to the AMF, and correspondingly, the AMF receives the request message from the UE.

[0276] The request message is used to request to obtain a service. The request message may include UE identification information (eg, UEID) and UE security capabilities, wherein the UE security capabilities are used to indicate one or more security algorithms supported by the UE, including confidentiality security algorithms and / or integrity security algorithms.

[0277] Exemplarily, the integrity security algorithm includes one or more of the following: AES integrity security protection algorithm, SNOW integrity security protection algorithm, ZUC integrity security protection algorithm, or null integrity security protection algorithm, and the confidentiality protection algorithm includes one or more of the following: ZUC confidentiality security protection algorithm, AES confidentiality security protection algorithm, SNOW confidentiality security protection algorithm, or null integrity security protection algorithm. For example, the UE security capability is used to indicate that the integrity security algorithms supported by the UE are: SNOW integrity security protection algorithm and ZUC integrity security protection algorithm, and the confidentiality security algorithms supported by the UE are: ZUC confidentiality security protection algorithm.

[0278] Optionally, the UE may send a request message to the AMF through the gNB. For example, the UE sends a request message #1 to the gNB, and then the gNB sends a request message #2 to the AMF. The request message #1 and the request message #2 are used to obtain the requested service from the network. The request message #1 and the request message #2 carry the UE ID and the security algorithms supported by the UE, such as the SNOW integrity security protection algorithm, the ZUC integrity security protection algorithm, and the ZUC confidentiality security protection algorithm. For ease of understanding and description, the request message is taken as a registration request message as an example. It should be understood that the registration request message is used to request registration with the network.

[0279] S306: The UE and the network perform authentication.

[0280] Exemplarily, AMF triggers the authentication process for UE. The authentication methods include but are not limited to: 5G Authentication and Key Agreement (5G-AKA) authentication method, Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA') authentication method. For example, AMF sends authentication request #1 to AUSF, AUSF sends authentication request #2 to UDM, authentication request #1 and authentication request #2 are used to request authentication of UE, UDM generates an authentication vector and sends authentication response #1 to AUSF, AUSF sends authentication response #2 to AMF, authentication response #1 and authentication response #2 include authentication vectors, such as authentication vectors of 5G-AKA or authentication vectors of EAP-AKA'. Taking the authentication vector of EAP-AKA' as an example, AMF sends an EAP Request / AKA′-Challenge message to the UE through a NAS message. After the UE completes the authentication of the network, it sends an EAP-Response / AKA'-Challenge message to the AMF through a NAS message. The AMF then sends a Nausf_UE Authentication_Authenticate Request message to the AUSF, carrying the EAP-Response / AKA'-Challenge message. The AUSF verifies the EAP-Response / AKA'-Challenge message. If the verification is successful, the authentication of the UE is completed, and EAP Success is sent to the UE through the AMF to indicate that the authentication is successful. For the specific authentication implementation method, please refer to the relevant description of the existing protocol TS 33.501.

[0281] S307, AMF configures a priority list of algorithms allowed to be used.

[0282] Exemplarily, the configuration may be dynamically configured (configured) by the network management device or platform through signaling or messages, or it may be pre-configured (pre-configured), for example, by pre-saving the corresponding code, table or other methods that can be used to indicate the algorithm priority list in the AMF, and the present application does not limit its implementation method. For example, the network management device or platform configures the AMF with an allowed algorithm priority list including an integrity security algorithm priority list and / or a confidentiality security algorithm priority list. The configuration may be pre-configured, or the AMF may send a request message to the network management device or platform in step S307 to obtain the algorithm priority list, and then the network management device or platform configures the AMF based on the request message, and the present application does not limit this.

[0283] For example, the algorithm priorities in the integrity security algorithm priority list are from high to low: AES integrity security protection algorithm, SNOW integrity security protection algorithm, ZUC integrity security protection algorithm, and empty integrity security protection algorithm; the algorithm priorities in the confidentiality security algorithm priority list are from high to low: ZUC confidentiality security protection algorithm, AES confidentiality security protection algorithm, SNOW confidentiality security protection algorithm, and empty integrity security protection algorithm.

[0284] It should be understood that the security algorithms included in the integrity security algorithm priority list and / or confidentiality security algorithm priority list provided above, and the corresponding algorithm priority rankings are merely examples given for ease of understanding and are not limited in this application.

[0285] It should be noted that the present application does not limit the time of occurrence of the above-mentioned step S307, and step S307 may occur at any time before step S308, such as before step S301, or after step S305, etc.

[0286] S308: AMF selects an integrity security protection algorithm and / or a confidentiality security protection algorithm according to the UE security capabilities and the algorithm priority list.

[0287] Exemplarily, based on the UE security capabilities carried in the above step S305 and the algorithm priority list configured by AMF in S307, the integrity security protection algorithm and confidentiality security protection algorithm selected by AMF are: SNOW integrity security protection algorithm and ZUC confidentiality security protection algorithm, respectively.

[0288] It should be understood that after the authentication process in step S306, the UE and the AMF side usually generate or obtain a new NAS layer key (e.g., K AMF ), where the NAS layer key (e.g. K AMF The NAS SMC process is activated by triggering the NAS SMC process, which corresponds to the following steps S309 and S310. It should be noted that the NAS SMC process is used to notify the UE of the selected integrity security protection algorithm and confidentiality security protection algorithm on the one hand, and to activate the NAS layer key on the other hand.

[0289] S309, AMF sends a NAS SMC message to the UE, and correspondingly, the UE receives the NAS SMC message from the AMF.

[0290] Exemplarily, the NAS SMC message includes but is not limited to: the integrity security protection algorithm identifier and / or confidentiality security protection algorithm identifier selected by the AMF in step S308, ngKSI, replayed UE security capabilities, and MAC#1. The integrity security protection algorithm identifier is used to identify the SNOW integrity security protection algorithm selected in step S308, and the confidentiality security protection algorithm identifier is used to identify the ZUC confidentiality security protection algorithm selected in step S308. ngKSI is used to identify the NAS layer key K AMF This is because the UE may store multiple NAS security contexts, and ngKSI is used to identify a specific NAS security context. The replayed UE security capabilities are used to verify whether the UE security capabilities have been tampered with, that is, to prevent downgrade attacks. For example, the AMF uses the SNOW integrity security protection algorithm selected by the AMF to perform integrity security protection on the NAS SMC message. After the NAS SMC message is integrity protected, the calculation result of the integrity security protection can be recorded as MAC#1, which is carried in the NAS SMC message for the UE to perform integrity verification on the received NAS SMC message.

[0291] It should be understood that the input parameters for AMF to calculate MAC#1 include: bearer identifier, direction parameter, counter value (counter) and information elements in the NAS SMC message. Among them, the bearer identifier is used to distinguish different bearers. For example, in a 3GPP connection, the bearer identifier can be "0x01"; in a non-3GPP connection, the bearer identifier can be "0x02". The direction parameter is used to distinguish whether the NAS SMC message is an uplink message or a downlink message. For example, in an uplink message, the direction parameter takes a value of 0; in a downlink message, the direction parameter takes a value of 1. The value of the counter is used as a freshness parameter to prevent replay attacks.

[0292] Exemplarily, the NAS security context stored in the above-mentioned UE includes: one or more of: a key identifier, a UE security capability, an uplink and downlink NAS count value, a confidentiality security protection key, an integrity security protection key, a selected integrity security protection algorithm identifier, and a confidentiality security protection algorithm identifier.

[0293] It can be understood that integrity security protection can be achieved by physical means or cryptographic methods to ensure that information is not tampered with or modified without authorization during generation, transmission, storage, and thereafter. There are many ways to perform integrity security protection on information through cryptographic methods, such as using a one-way function (such as a hash function Hash), using a symmetric key (integrity protection key) and a message as input parameters to generate a MAC to achieve integrity security protection of the message. Exemplarily, integrity security protection can refer to integrity protection of the message to be sent according to the selected integrity security protection algorithm and integrity security protection key. For example, the integrity protection key can be a NAS integrity key (NAS Integrity Key, Knasint). Knasint is used to perform integrity security protection on the message to be sent. Exemplarily, Knasint can be a UE-granular key, and the input key for deriving Knasint is Kamf, and the input parameters include a constant used to calculate Knasint and an integrity security protection algorithm identifier. Similarly, confidentiality security protection can refer to encrypting the message to be sent according to the selected confidentiality security protection algorithm and confidentiality security protection key. For example, the confidentiality security protection key may be Knasenc, which is used to perform confidentiality security protection on the message to be sent. Exemplarily, Knasenc may be a UE-granular key, the input key for deriving Knasenc is Kamf, and the input parameters include a constant for marking the calculation of Knasenc and a confidentiality security protection algorithm identifier.

[0294] Further, the UE performs an integrity check on the received NAS SMC message. For example, the UE calculates MAC#2 based on the SNOW integrity security protection algorithm carried in the NAS SMC message. The specific calculation method can refer to the calculation method of MAC#1 mentioned above. Then, the UE compares MAC#1 with the MAC#1 value carried in the NAS SMC message. If the two are the same, it can be considered that the integrity check has passed; otherwise, the integrity check has failed. If the integrity check is successful, the UE saves the integrity security protection algorithm and confidentiality security protection algorithm carried in the NAS SMC message as part of the NAS security context, and uses the NAS security context to perform security protection on subsequent NAS messages (such as the NAS SMP message in step S310).

[0295] S310, the UE sends a NAS SMP message to the AMF, and correspondingly, the AMF receives the NAS SMP message from the UE.

[0296] Among them, the NAS SMP message includes MAC#2.

[0297] S311, AMF sends a registration acceptance message to the UE, and correspondingly, the UE receives a registration acceptance message from the AMF.

[0298] Exemplarily, in response to the NAS SMP message, or according to the UE information (such as authorization information, configuration information, etc.) received from other network elements, the AMF sends a registration acceptance message to the UE. Optionally, the registration acceptance message carries information for updating UE parameters, where the UE parameters may be slice information or closed access group information, etc. Further optionally, after updating the UE parameters, the UE may send a registration completion message to the AMF (not shown in the figure).

[0299] It should be noted that the above step S311 can be executed before step S312 or after step S313, and this application does not impose any restrictions on this.

[0300] Further, with respect to the operation instruction type carried in the service request message of step S301 above, the AMF requests to perform operation #1 on the UE, and executes the following step S312.

[0301] S312, AMF sends a NAS message to the UE, and correspondingly, the UE receives the NAS message from the AMF.

[0302] The NAS message carries an operation instruction type, which is used to instruct to perform operation #1 on the UE.

[0303] It should be understood that, based on the above NAS SMC process, the NAS message is an integrity-protected NAS message. For example, the AMF performs integrity security protection on the NAS message according to the integrity security protection algorithm selected in step S308. Optionally, when the operation instruction type indicates a write operation, the AMF performs confidentiality security protection on the data #1 in the NAS message according to the confidentiality security protection algorithm selected in step S308. Correspondingly, the UE performs an integrity check on the NAS message, and if the integrity check of the NAS message is successful, further optionally, if the decryption is successful, the UE performs operation #1.

[0304] In one example, when the operation instruction type indicates a write operation, the NAS message includes the data ciphertext #1 carried in step S301, which is used to request the UE to write the data #1 into the storage area of ​​the UE. Correspondingly, when the UE passes the integrity check of the NAS message and successfully decrypts the data ciphertext #1, the UE obtains the data #1 and writes the data #1 into the storage area of ​​the UE. For example, the UE can perform a decryption calculation or a decryption operation on the data ciphertext #1 according to the NAS confidentiality key (e.g., Knasenc) in the NAS security context to obtain the data plaintext, i.e., data #1.

[0305] In another example, when the operation instruction type indicates a read operation, the NAS message is used to request to read the data stored or collected by the UE. Correspondingly, when the UE passes the integrity check of the NAS message, the data #2 stored or collected by the UE is carried in the NAS response message in step S313 and sent to the AMF. It should be noted that the NAS response message is integrity-protected and confidentiality-protected. For example, the UE uses the integrity security key and confidentiality security key in the NAS security context to perform integrity security protection and confidentiality security protection on the NAS response message and the carried data #2, respectively.

[0306] In another example, when the operation instruction type indicates a failure operation, it is used to indicate that the UE is failed or deactivated, which means that the UE shall no longer be inventoried or other operations shall be performed. That is, after the UE fails or is deactivated, the AF or AMF cannot obtain the information of the UE (such as UE ID) or interact with the UE.

[0307] In another example, when the operation instruction type indicates an inventory operation, the information used to indicate the inventory of the UE, or to obtain the identification information of the UE. For example, the UE sends the identification information of the UE to the AMF according to the operation instruction type, and the identification information of the UE can be carried in the NAS response message in step S313. Optionally, the AMF can carry the UE ID obtained in step S305 in the service response message in step S314 and send it to the AF according to the operation instruction type.

[0308] S313, the UE sends a NAS response message to the AMF, and correspondingly, the AMF receives the NAS response message from the UE.

[0309] The NAS response message is used to indicate the completion status of operation #1.

[0310] S314, AMF sends a service response message to AF, and correspondingly, AF receives a service response message from AMF.

[0311] The service response message may be a service response message, which is used to indicate the completion of operation #1. The service response message includes a UE ID. Optionally, when the operation instruction type indicates a read operation, the service response message also includes data #2.

[0312] It should be noted that the above process of UE requesting registration service from AMF is only an example given for easy understanding. This application is also applicable to processes such as UE requesting service update, deregistering service, service discovery, service authorization, service status subscription / status notification, etc.

[0313] In summary, the above method 300 supports the provision of passive IoT services, that is, it describes the process of AF triggering the execution of operations on UE. In this implementation, after the authentication process (see step S306) and the NAS SMC process (see steps S309-S310) are completed, the operation instructions between UE and AMF begin to be executed, that is, steps S312 and S313 are executed after completing steps S306, S309-S310, and the overall processing flow is relatively complicated, resulting in excessive power consumption and increased delay in AF obtaining services.

[0314] In view of this, the present application provides a communication method and a communication device, which activate the security context when the authentication between the terminal device and the network is passed, simplify the overall processing flow, reduce processing complexity and latency, and reduce power consumption.

[0315] In order to facilitate understanding of the embodiments of the present application, the following points are explained:

[0316] First, in this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0317] Second, in this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of this application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c. Where a, b and c can be single or multiple, respectively.

[0318] Third, in the present application, "first", "second" and various numerical numbers (e.g., #1, #2, etc.) indicate distinctions made for ease of description and are not used to limit the scope of the embodiments of the present application. For example, to distinguish between different messages, etc., rather than to describe a specific order or sequence. It should be understood that the objects described in this way can be interchanged where appropriate so as to be able to describe solutions other than the embodiments of the present application.

[0319] Fourth, in this application, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatuses.

[0320] Fifth, in this application, "used for indication" may include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used for indicating A, it may include that the indication information directly indicates A or indirectly indicates A, but it does not mean that the indication information must carry A.

[0321] The indication method involved in the embodiments of the present application should be understood to include various methods that can enable the party to be indicated to know the information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The present application does not limit the specific sending method.

[0322] The "indication information" in the embodiments of the present application may be an explicit indication, i.e., directly indicated by signaling, or obtained by combining other rules or other parameters or by deduction according to the parameters indicated by the signaling. It may also be an implicit indication, i.e., obtained by combining other rules or other parameters or by deduction according to a rule or relationship. The present application does not make any specific limitation on this.

[0323] Sixth, in this application, "protocol" may refer to a standard protocol in the field of communications, such as 5G protocol, NR protocol, and related protocols used in future communication systems, which are not limited in this application. "Predefined" may include pre-definition. For example, protocol definition. "Preconfiguration" can be implemented by pre-saving corresponding codes, tables, or other methods that can be used to indicate relevant information in the device, and this application does not limit its specific implementation method.

[0324] Seventh, in this application, "storage" may refer to storage in one or more memories. The one or more memories may be separately set or integrated in an encoder or decoder, a processor, or a communication device. The one or more memories may also be partially separately set and partially integrated in a decoder, a processor, or a communication device. The type of memory may be any form of storage medium, which is not limited in this application.

[0325] Eighth, in this application, "communication" can also be described as "data transmission", "information transmission", "data processing", etc. "Transmission" includes "sending" and "receiving".

[0326] The communication method provided in the embodiment of the present application will be described in detail below with reference to the accompanying drawings, which can be applied to the above Figure 1 or Figure 2 In the communication system shown.

[0327] Figure 4 4 is a flow chart of a communication method 400 provided in an embodiment of the present application. Figure 4 As shown, the terminal device, the core network element and the operation requester interact as the execution subjects. The method includes one or more of the following steps. For the parts not described in detail, reference can be made to the existing protocols.

[0328] S401, the operation requesting party sends a service request message to a core network element, and correspondingly, the core network element receives the service request message from the operation requesting party.

[0329] The service request message may be a service request message, which is used to request to perform a first operation on the terminal device. The first operation may be one or more of an inventory operation, a read operation, a write operation, an invalidation operation or other operations.

[0330] Exemplarily, the service request message includes an identifier of the terminal device, such as a UE ID; or the service request message includes an identifier group (e.g., a UE ID range or a UE ID group), wherein the identifier group includes the UE ID. The identifier group is used to indicate a group to which the terminal device belongs, and the group may include one or more terminal devices, so that the operation requester may request a service for one or more terminal devices.

[0331] Optionally, in the above step S401, the operation requesting party may also send a service request message to the base station, and then the base station sends the service request message to the core network element to instruct to perform the first operation on the terminal device.

[0332] In the embodiment of the present application, the terminal device may be purchased, used and managed by the operation requester (eg, AF), that is, the operation requester may know the security capabilities of the terminal device. Optionally, the operation requester may also obtain the security capabilities of the terminal device from the UDM / UDR.

[0333] Optionally, the service request message further includes one or more of an operation instruction type (e.g., action or command), a security capability of the terminal device, or first data. The operation instruction type is used to indicate a first operation, the security capability of the terminal device is used to indicate one or more integrity security protection algorithms and / or confidentiality security protection algorithms supported by the terminal device, and the first data is data to be written into a storage area of ​​the terminal device. For examples of integrity security protection algorithms and / or confidentiality security protection algorithms, reference can be made to the relevant description of the above method 300.

[0334] For example, when the first operation is an inventory operation, the service request message is used to inventory the information of the terminal device, or to obtain identification information of the terminal device, such as UE ID.

[0335] For example, when the first operation is a read operation, the service request message is used to read data in a storage area of ​​the terminal device, or data collected by the terminal device (for example, the second data described below). Optionally, the service request message carries the security capability of the terminal device, and correspondingly, the core network element can store the security capability of the terminal device.

[0336] For example, when the first operation is a write operation, the service request message also includes first data for requesting to write the first data into a storage area of ​​the terminal device. Optionally, the service request message carries the security capability of the terminal device, and correspondingly, the core network element can store the security capability of the terminal device.

[0337] For example, when the first operation is a failure operation, the service request message is used to enable the terminal device to fail or be deactivated, that is, the terminal device shall not be subsequently inventoried or subjected to other operations. In other words, after the terminal device fails or is deactivated, the operation requester cannot obtain the information of the terminal device, nor can it interact with the terminal device through messages. Optionally, the service request message carries the security capabilities of the terminal device, and correspondingly, the core network element can store the security capabilities of the terminal device.

[0338] In the embodiment of the present application, the security capability of the terminal device and the identifier of the terminal device can be a one-to-one relationship or a one-to-many relationship, that is, the security capability of the terminal device can be a security capability corresponding to a terminal device or a security capability corresponding to a group of terminal devices, and the security capabilities of one or more terminal devices in the group are the same. For example, the security capability of the UE with UE ID 000000 to 000100 is the first UE security capability, and the security capability of the UE with UE ID 000101 to 001000 is the second UE security capability.

[0339] S402, the terminal device sends a registration request message to the core network element, and correspondingly, the core network element receives the registration request message from the terminal device.

[0340] The registration request message may be a registration request message, which is used to request registration with a network.

[0341] Specifically, the registration request message is used to register the terminal device with the network. Exemplarily, the registration request message includes an identifier of the terminal device (eg, UE ID).

[0342] Optionally, the registration request message also includes the security capabilities of the terminal device, and for specific interpretation, please refer to the relevant description of the above step S305.

[0343] In one example, the terminal device may send a registration request message to a core network element through a base station.

[0344] Optionally, the registration request message here can be described as a "third message" for requesting network services. The third message can be a NAS message, or a combination of a message #a sent by the terminal device to the base station and a message #2 sent by the base station to the core network element, which is not limited in this application.

[0345] Optionally, the present application does not specifically limit the execution order of the above steps S401 and S402. In addition, step S401 only needs to be executed before step S405, for example, after executing step S402 or S403a.

[0346] Optionally, before executing step S402, the method further includes step S402a:

[0347] S402a, the core network element triggers the terminal device to access the network, that is, the terminal device establishes a communication connection with the base station. The specific implementation method can refer to the relevant description of steps S302 to S304 of the above method 300.

[0348] Furthermore, in order to ensure the communication security between the terminal device and the network, an authentication process is performed between the terminal device and the network. The specific implementation of the authentication process can refer to the relevant description of step S306 of the above method 300, which will not be repeated here.

[0349] S403a, when the core network element successfully authenticates the terminal device, the core network element activates the security context.

[0350] It should be noted that the present application does not specifically limit the timing of the core network element activating the security context. For example, the core network element may immediately generate and activate the security context if the terminal device is authenticated; or, the core network element may first generate the security context if the terminal device is authenticated, and then activate the security context after receiving the service request message in step S401; or, the core network element may also generate and activate the security context after receiving the service request message in step S401.

[0351] S403b: When the terminal device passes the network authentication, the terminal device activates the security context.

[0352] It should be noted that the present application does not specifically limit the timing of activating the security context by the terminal device. For example, the terminal device may immediately generate and activate the security context if the network authentication is passed; or, the terminal device may first generate the security context if the network authentication is passed, and then activate the security context after receiving the first message in step S405; or, the terminal device may also generate and activate the security context after receiving the first message in step S405.

[0353] It should be noted that the present application does not limit the order in which the above steps S403a and S403b are executed.

[0354] Optionally, the above authentication process can be performed once or multiple times. For example, when the terminal device is a passive tag, the terminal device performs authentication each time it communicates with the core network element; or when the terminal device is an active tag or a semi-passive tag, the core network element can authenticate the terminal device once every T1 time.

[0355] It should be understood that, in the case where the above authentication passes, the subsequent steps S403a, S403b to S409 are executed. If the authentication fails, there is no need to execute the subsequent steps S403a, S403b to S408, and the core network element can execute step S409, that is, the core network element sends a service response message to the operation requester, and the service response message is used to indicate that the first operation fails to be executed. Optionally, the service response message includes a failure reason value, which is used to indicate that the authentication of the terminal device fails.

[0356] Optionally, before executing step S403a, the method may further include steps S403c and S403d, that is, the core network element selects a suitable security algorithm according to the security capability of the terminal device. Optionally, step S403c may occur before the above authentication process or after the authentication process, which is not limited in this application.

[0357] S403c, the core network element obtains the security capability of the terminal device.

[0358] Exemplarily, the core network element may obtain the security capability of the terminal device from the terminal device, for example, the security capability of the terminal device is carried in the registration request message of step S402.

[0359] Exemplarily, the core network network element can obtain the security capabilities of the terminal device from the UDM / UDR. For example, when the core network network element passes the authentication of the terminal device, the core network network element sends a request message to the UDM / UDR to obtain the contract data of the terminal device, wherein the contract data of the terminal device includes the security capabilities of the terminal device.

[0360] Exemplarily, the core network element may obtain the security capability of the terminal device from the operation requester, for example, the security capability of the terminal device is carried in the service request message in step S401.

[0361] It should be understood that in the latter two implementation methods, the security capabilities of the terminal device are transmitted through a security-protected interface, which can not only reduce the air interface overhead between the terminal device and the core network elements, but also avoid the occurrence of interaction failures caused by malicious tampering by an attacker when the terminal device reports the security capabilities of the terminal device through the air interface.

[0362] Optionally, the core network element may determine whether to execute step S403c and / or step S403d according to the type of operation instruction.

[0363] For example, the triggering condition of step S403c may be: the core network element passes the authentication of the terminal device, and the first operation requested by the operation requester is a read operation, a write operation, or an invalidation operation. That is, if the core network element determines that the authentication of the terminal device fails, and / or the first operation is an inventory operation, step S403c may not be performed.

[0364] For another example, when the operation instruction type indicates any one of a read operation, a write operation, or a failure operation, step S403d is executed; when the operation instruction type indicates an inventory operation, step S403d can be skipped.

[0365] S403d, the core network element selects an integrity security protection algorithm and / or a confidentiality security protection algorithm according to the security capability of the terminal device and the algorithm priority list.

[0366] Optionally, before executing step S403d, the core network element configures the algorithm priority list, and the specific configuration method can refer to the relevant description of step S307 of the above method 300. Optionally, the timing of the occurrence of step S403d can be before step S403a, or during the execution of step S403a, that is, when the core network element authenticates the terminal device, the core network element selects the integrity security protection algorithm and / or the confidentiality security protection algorithm according to the security capability of the terminal device and the algorithm priority list, and then activates the security context.

[0367] Exemplarily, if the security capability of the terminal device indicates that the terminal device supports a confidentiality security protection algorithm and an integrity security protection algorithm, then the security algorithm selected by the core network element is a confidentiality security protection algorithm and an integrity security protection algorithm supported by the terminal device. For example, the AES integrity security protection algorithm and the AES confidentiality security protection algorithm, the core network element can determine whether the AES integrity security protection algorithm and the AES confidentiality security protection algorithm are included in the algorithm priority list configured by the core network element, or in other words, the core network element confirms whether it is allowed to use (or whether it supports) the AES integrity security protection algorithm and the AES confidentiality security protection algorithm.

[0368] Exemplarily, if the security capability of the terminal device indicates that the terminal device supports multiple confidentiality security protection algorithms and / or multiple integrity security protection algorithms, the core network network element can select one of the confidentiality security protection algorithms and / or one of the integrity security protection algorithms, and notify the terminal device of the selected confidentiality security protection algorithm and / or one of the integrity security protection algorithms. For example, the core network network element can determine whether the algorithm priority list configured by itself contains the confidentiality security protection algorithm and / or the integrity security protection algorithm supported by the terminal device. If it does, the core network network element can preferentially select the confidentiality security protection algorithm and / or the integrity security protection algorithm with a higher priority supported by the terminal device from the algorithm priority list, and notify the terminal device of the selected confidentiality security protection algorithm and / or the integrity security protection algorithm with a higher priority. Optionally, the core network can carry the selected confidentiality security protection algorithm and / or integrity security protection algorithm in the first message of the following step S405 and send it to the terminal device, or can also send it to the terminal device through other messages. For example, the algorithm priorities in the integrity security algorithm priority list configured by the core network element are from high to low: AES integrity security protection algorithm, SNOW integrity security protection algorithm, ZUC integrity security protection algorithm, and null integrity security protection algorithm; the algorithm priorities in the configured confidentiality security algorithm priority list are from high to low: ZUC confidentiality security protection algorithm, AES confidentiality security protection algorithm, SNOW confidentiality security protection algorithm, and null integrity security protection algorithm. The integrity security algorithms supported by the terminal device are: SNOW integrity security protection algorithm and ZUC integrity security protection algorithm, and the confidentiality security algorithm is ZUC confidentiality security protection algorithm. The security algorithms selected by the core network element are: SNOW integrity security protection algorithm and ZUC confidentiality security protection algorithm, and the selected security algorithm is notified to the terminal device for subsequent activation of the security context.

[0369] Based on the above implementation, when the core network element successfully verifies the security algorithm, it means that the core network element allows the use of (or supports) the security algorithm indicated by the security capability of the terminal device, and then continues to execute the method shown in, for example, steps S403a to S409; when the core network element fails to verify the security algorithm, there is no need to execute steps S403a to S408, and the core network element can execute step S409, that is, the core network element sends a service response message to the operation requester, and the service response message is used to indicate that the first operation failed to execute. Optionally, the service response message includes a failure reason value, which is used to indicate that the security algorithm supported by the core network element does not match the security capability of the terminal device, that is, the core network element rejects the service request of the operation requester.

[0370] Optionally, in the above step S403a, when the core network element authenticates the terminal device, the core network element determines whether to generate a security context before activating the security context (or understands as determining whether to activate the security context). It should be understood that generating a security context and activating a security context are related, so one can choose to execute one when judging. For example, after judging that the security context is generated, it is also necessary to activate the security context; for example, if the security context is activated, it means that the security context needs to be generated before the security context is activated, so the judgment of generating a security context and activating the security context can be equivalent, that is, the judgment of whether to generate a security context and the judgment of whether to activate the security context in this application can replace each other, or exist at the same time. That is, the method can also include the following step S403e.

[0371] S403e, the core network element determines whether to activate the security context.

[0372] In the first example, the core network element determines whether to activate the security context based on the operation instruction type of the first operation, which can also be understood as: the core network element determines whether to perform security protection on the message or cell corresponding to the first operation between the core network element and the terminal device.

[0373] Exemplarily, the security context includes a corresponding context of confidentiality security protection and / or a corresponding context of integrity security protection, for example, including one or more of the following: a key identifier, a security capability of a terminal device, an uplink and downlink NAS count value, an integrity security protection algorithm identifier, and a confidentiality security protection algorithm identifier. For specific interpretations, reference may be made to the relevant description of the above method 300. Accordingly, security protection includes confidentiality security protection and / or integrity security protection.

[0374] For example, when the operation instruction type indicates an inventory operation, the core network network element determines not to activate the security context, that is, it determines not to perform security protection on the messages or information elements corresponding to the first operation between the core network element and the terminal device. This is because for the inventory operation, the core network network element can obtain the identifier of the terminal device from the registration request message based on the above step S402, and then send the identifier of the terminal device to the operation requester, thereby completing the inventory operation. In other words, the core network network element may not interact with the terminal device regarding the messages of the inventory operation, and there is no need to generate and / or activate a security context for security protection of the messages corresponding to the inventory operation.

[0375] For example, when the operation instruction type is a read operation, a write operation, or an invalidation operation, the core network network element determines to activate the security context, that is, determines to perform security protection on the message or information element corresponding to the first operation between the core network network element and the terminal device. This is because for a read operation, the core network network element reads data from the storage area of ​​the terminal device or reads data collected by the terminal device; for a write operation, the core network network element notifies the terminal device to write the first data (from the operation requester) into the storage area of ​​the terminal device; for an invalidation operation, the core network network element performs an invalidation operation on the terminal device and notifies the terminal device that it has or is about to fail, that is, the terminal device may no longer perform other operations. Therefore, for the above-mentioned read operation, write operation, or invalidation operation, the terminal device and the core network element perform information interaction, and the communication security between the two can be protected by activating a security context.

[0376] Optionally, regardless of the type of operation instruction, the core network element in step S403e activates the security context. Further, the core network element can determine what type of security context to activate according to the operation type, that is, determine to perform integrity security protection and / or confidentiality security protection according to the operation instruction type, and the specific implementation method is described as follows.

[0377] Optionally, the method further includes: the core network element determines to activate the context corresponding to the confidentiality security protection and / or the context corresponding to the integrity security protection, that is, determines to perform integrity security protection and / or confidentiality security protection on the message or cell corresponding to the first operation between the terminal device and the core network element, that is, determines what specific security protection to perform. It should be understood that the core network element may determine to activate the context corresponding to the confidentiality security protection and / or the context corresponding to the integrity security protection after determining to activate the security context, or may directly determine to activate the context corresponding to the confidentiality security protection and / or the context corresponding to the integrity security protection, that is, it may not determine whether to activate the security context.

[0378] Specifically, the core network element determines to activate a corresponding context of confidentiality security protection and / or a corresponding context of integrity security protection according to the type of operation instruction.

[0379] For example, when the operation instruction type indicates an inventory operation, the core network element determines not to activate a context corresponding to integrity security protection and a context corresponding to confidentiality security protection.

[0380] For example, when the operation instruction type is a write operation, the core network element determines to activate the context corresponding to the integrity security protection and the context corresponding to the confidentiality security protection, that is, the core network element determines to activate the confidentiality security protection and the integrity security protection. Specifically, the security context may include a confidentiality security protection key and an integrity security protection key.

[0381] For example, when the operation instruction type is a read operation or an invalidation operation, the core network element determines to activate the context corresponding to the integrity security protection, that is, the core network element determines to activate the integrity security protection. Specifically, the security context may include an integrity security protection key.

[0382] In the second example, the core network element determines whether to activate the security context based on the type of the terminal device, which can also be understood as: the core network element determines whether to perform security protection on the message or information element corresponding to the first operation between the core network element and the terminal device.

[0383] Exemplarily, the core network element can obtain the type of terminal device from UDM / UDR, including active tag, semi-passive tag, or passive tag. For specific explanations, please refer to the above Figure 1 Related description in .

[0384] For example, when the type of the terminal device is an active tag or a semi-passive tag, the core network element determines to activate the security context, that is, determines to perform security protection on the message or information element corresponding to the first operation between the core network element and the terminal device.

[0385] For example, when the type of terminal device is a passive tag, the core network element determines whether to activate the security context based on the type of operation instruction, that is, it determines whether to perform security protection on the message or information element corresponding to the first operation between the terminal device and the core network element based on the type of operation instruction. The specific implementation method can refer to the relevant description of the first example above.

[0386] Optionally, the method also includes: the core network element determines, according to the type of the operating terminal device, to activate the corresponding context of confidentiality security protection and / or the corresponding context of integrity security protection.

[0387] For example, when the type of the terminal device is an active tag or a semi-passive tag, the core network element determines to activate the context corresponding to the integrity security protection and the context corresponding to the confidentiality security protection, that is, the core network element determines to activate the confidentiality security protection and the integrity security protection. Specifically, the security context may include a confidentiality security protection key and an integrity security protection key.

[0388] For example, when the type of the terminal device is a passive tag and the operation instruction type indicates an inventory operation, the core network element determines not to activate the context corresponding to the integrity security protection and the context corresponding to the confidentiality security protection.

[0389] For example, when the type of the terminal device is a passive tag and the operation instruction type indicates a write operation, the core network element determines to activate the context corresponding to the integrity security protection and the context corresponding to the confidentiality security protection, that is, the core network element determines to activate the confidentiality security protection and the integrity security protection. Specifically, the security context may include a confidentiality security protection key and an integrity security protection key.

[0390] For example, when the terminal device is a passive tag and the operation instruction type indicates a read operation or an invalidation operation, the core network element determines to activate the context corresponding to the integrity security protection. Specifically, the security context may include an integrity security protection key.

[0391] In the present application, the confidentiality security protection key is used for the confidentiality security protection of the communication between the terminal device and the core network element, and the integrity security protection key is used for the integrity security protection of the communication between the terminal device and the core network element. The derivation process of the integrity security protection key (for example, Knasint) and the confidentiality security protection key (Knasenc) can refer to the relevant description of the above method 300.

[0392] Optionally, the core network element determines whether to skip the NAS SMC process (that is, not executing the NAS SMC process before activating the security context), which can also be called determining the timing of activating the security context, or determining how to activate the security context, etc., including the following implementation methods.

[0393] (1) The core network element determines whether to skip the NAS SMC process based on the capabilities of the terminal device. The implementation method of skipping the NAS SMC process and activating the security context in this application can also be called a low-power activation security context method, or activating the security context when the core network element authenticates the terminal device.

[0394] For example, when the capabilities of the terminal device indicate that the terminal device supports a confidentiality protection algorithm (e.g., ZUC confidentiality security protection algorithm) and / or an integrity protection algorithm (e.g., SNOW integrity security protection algorithm), the core network element can skip the NAS SMC process, that is, activate the security context when the core network element authenticates the terminal device. At this time, the terminal device and the core network element can uniquely determine the security algorithm used to activate the security context, and there is no need to negotiate the security algorithm through the NAS SMC process.

[0395] (2) The core network element determines whether to skip the NAS SMC process based on the type of terminal device.

[0396] Exemplarily, the terminal device includes a low-power terminal device (such as an IoT device, or a tag, etc.) or a non-low-power terminal device (also referred to as an ordinary terminal device). Optionally, for a low-power terminal device, you can choose to skip the NAS SMC process, and for an ordinary terminal device, you do not need to skip the NAS SMC process. The storage and computing capabilities of low-power terminal devices are weak, and skipping the SMC process meets the low-power requirements. And low-power devices may support a security algorithm without the need to negotiate the security algorithm through the NAS SMC process.

[0397] Tags may specifically include active tags, semi-passive tags, and passive tags. The core network element may determine whether to skip the NAS SMC process based on the type of tag. For example, when the terminal device is a passive tag, the core network element may choose to skip the NAS SMC process, that is, to activate the security context when the core network element authenticates the terminal device. This is because for terminal devices of passive tag type, the storage and computing capabilities are weak, skipping the SMC process meets their low power consumption requirements, and the cost of such devices is relatively low, and they may support an integrity security protection algorithm and / or a confidentiality security protection algorithm. Therefore, the terminal device and the core network element may uniquely determine the security algorithm used to activate the security context, and the two do not need to negotiate the security algorithm through the NAS SMC process. That is, when the core network element authenticates the terminal device, the core network element may skip the NAS SMC process and activate the corresponding context for integrity security protection and / or the corresponding context for confidentiality security protection according to a confidentiality protection algorithm and / or an integrity protection algorithm supported by the terminal device of the passive tag type.

[0398] (3) The core network element determines whether to skip the NAS SMC process based on the locally configured security algorithm.

[0399] For example, when the security algorithm locally configured by the core network element includes a confidentiality protection algorithm (e.g., ZUC confidentiality security protection algorithm) and / or an integrity protection algorithm (e.g., SNOW integrity security protection algorithm), at this time, the terminal device and the core network element can uniquely determine the security algorithm used to activate the security context, and the two do not need to negotiate the security algorithm through the NAS SMC process. That is, when the core network element authenticates the terminal device, the core network element can skip the NAS SMC process and activate the corresponding context for integrity security protection and / or the corresponding context for confidentiality security protection according to a locally configured confidentiality protection algorithm and / or an integrity protection algorithm.

[0400] It should be understood that the implementation methods provided above are only examples given for ease of understanding and do not constitute any limitation on the technical solution of the present application. Among them, the above multiple implementation methods can be implemented independently or in combination, for example, including the following methods.

[0401] (4) The core network element determines whether to skip the NAS SMC process based on the type and capability of the terminal device.

[0402] For example, when the terminal device is a semi-passive tag and the terminal device only supports the SNOW integrity security protection algorithm and the SNOW confidentiality security protection algorithm, the core network element may not execute the NAS SMC process. This is because the terminal device and the core network element can uniquely determine the security algorithm used to activate the security context, and the two do not need to negotiate the security algorithm through the NAS SMC process. Therefore, when the core network element authenticates the terminal device, the core network element can activate the corresponding context for integrity security protection according to the SNOW integrity security protection algorithm, and activate the corresponding context for confidentiality security protection according to the SNOW confidentiality security protection algorithm.

[0403] (5) The core network element determines whether to skip the NAS SMC process based on the capabilities of the terminal device and the security algorithm locally configured in the core network element.

[0404] For example, when the security algorithm indicated by the terminal device's capability and the security algorithm locally configured by the core network element are both the ZUC integrity security protection algorithm and the SNOW confidentiality security protection algorithm, the core network element can skip the NAS SMC process. This is because at this time the terminal device and the core network element can uniquely determine the security algorithm used to activate the security context, and the two do not need to negotiate the security algorithm through the NAS SMC process. Therefore, the core network element can activate the corresponding context for integrity security protection according to the ZUC integrity security protection algorithm, and / or activate the corresponding context for confidentiality security protection according to the SNOW confidentiality security protection algorithm.

[0405] It should be understood that the above-mentioned combination implementation is only an example given for ease of understanding and does not constitute any limitation on the technical solution of the present application.

[0406] Optionally, in the above step S403b, the terminal device determines whether to generate a security context (or understands as determining whether to activate the security context) before activating the security context, that is, the method may also include the following step S403f.

[0407] S403f, the terminal device determines whether to activate the security context.

[0408] Exemplarily, the terminal device determines whether to activate the security context based on the operation instruction type of the first operation and / or the type of the terminal device. It can also be understood that: the terminal device determines whether to perform security protection on the message or information element corresponding to the first operation between the terminal device and the core network element. The specific implementation method refers to the relevant description on the core network element side in the above step S403e, which is not repeated here.

[0409] Optionally, regardless of the type of operation instruction, the terminal device in step S403f activates the security context. Further, the terminal device can determine what type of security context to activate according to the operation type, that is, determine to perform integrity security protection and / or confidentiality security protection according to the operation instruction type, and the specific implementation method is described below.

[0410] Optionally, the method also includes: the terminal device determines whether to activate the corresponding context of confidentiality security protection and / or the corresponding context of integrity security protection according to the type of operation instruction and / or the type of terminal device, that is, according to the type of operation instruction and / or the type of terminal device, it determines whether to perform security protection on the message or information element corresponding to the first operation between the terminal device and the core network network element. The specific implementation method refers to the relevant description on the core network network element side in the above step S403e, which is not repeated here.

[0411] Optionally, the terminal device can determine whether to skip the NAS SMC process (that is, not execute the NAS SMC process before activating the security context), which can also be called determining the timing of activating the security context, or determining how to activate the security context, etc., including the following implementation methods.

[0412] (1) The terminal device determines whether to skip the NAS SMC process according to the capabilities of the terminal device. The implementation method of skipping the NAS SMC process and activating the security context in this application can also be called a low-power activation security context method, or activating the security context when the terminal device passes the authentication of the core network element.

[0413] (2) The terminal device determines whether to skip the NAS SMC process based on the type of the terminal device.

[0414] (3) The terminal device determines whether to skip the NAS SMC process based on the locally configured security algorithm.

[0415] It should be understood that the specific implementation methods of the above (1)-(3) can refer to the relevant description of the methods (1)-(3) on the core network element side above.

[0416] (4) The terminal device determines the time to generate and / or activate the security context based on the EAP-success message and / or authentication request message received in the authentication process, that is, in response to the EAP-success message and / or authentication request message, the terminal device generates and / or activates the security context.

[0417] Exemplarily, the EAP-success message is used to indicate that the network has successfully authenticated the terminal device. That is, the message received by the terminal device after sending the registration request message is an EAP-success message, indicating that the network has successfully authenticated the terminal device. In response to the EAP-success message, the security context is activated when it is determined that the terminal device has successfully authenticated the network.

[0418] Exemplarily, the authentication request message includes an authentication vector on the network side, and the authentication vector is used by the terminal device to authenticate the network. The authentication vector is used by the terminal device to authenticate the network. That is, the terminal device receives the authentication request message after sending the registration request message, authenticates the network according to the authentication vector carried in the authentication request message, and activates the security context when the terminal device successfully authenticates the network.

[0419] (5) The terminal device determines the time to generate and / or activate the security context according to the received registration acceptance message or the first message. That is, in response to the registration acceptance message, the terminal device generates and / or activates the security context.

[0420] Optionally, the registration acceptance message may be a first message, and the registration acceptance message is used to accept a registration request of a terminal device. In this case, the registration acceptance message may carry an operation instruction type instructing the terminal device to perform a first operation.

[0421] Exemplarily, the message received by the terminal device after sending the registration request message is a registration acceptance message, indicating that the network accepts the registration request of the terminal device. In response to the registration acceptance message, the terminal device can activate the security context if the terminal device passes the authentication of the network.

[0422] Exemplarily, the terminal device can uniquely determine the security algorithm used to activate the security context based on a confidentiality protection algorithm identifier (for example, the confidentiality security protection algorithm identifier is used to indicate the ZUC confidentiality security protection algorithm) and / or an integrity protection algorithm identifier (for example, the integrity security protection algorithm identifier is used to indicate the SNOW integrity security protection algorithm) carried in the registration acceptance message. Therefore, there is no need to negotiate the security algorithm through the NAS SMC process, which can reduce the interaction process between the two. Then, when the terminal device passes the authentication of the network, the terminal device activates the confidentiality security key and / or integrity security key in the security context according to the ZUC confidentiality security protection algorithm and / or the SNOW integrity security protection algorithm.

[0423] It should be understood that the implementation methods provided above are only examples given for ease of understanding and do not constitute any limitation on the technical solution of the present application. Among them, the above multiple implementation methods can be implemented independently or in combination, for example, including the following methods.

[0424] (6) The terminal device determines whether to skip the NAS SMC process based on the type of the terminal device and the capabilities of the terminal device.

[0425] (7) The terminal device determines whether to skip the NAS SMC process based on the capabilities of the terminal device and the security algorithm locally configured on the terminal device.

[0426] It should be understood that the specific implementation methods of the above (6)-(7) can refer to the relevant description of the methods (4)-(5) on the core network element side above.

[0427] (8) The terminal device generates and / or activates a security context according to the capabilities of the terminal device, the security algorithm locally configured in the terminal device, and the EAP-success message and / or authentication request message received in the authentication process.

[0428] For example, when the type of terminal device is a passive tag, the message received by the terminal device after sending the registration request message is an EAP-success message, and the security algorithm locally configured in the terminal device is: ZUC confidentiality security protection algorithm and / or SNOW integrity security protection algorithm, it means that the network has successfully authenticated the terminal device, and at the same time, the terminal device and the core network element can uniquely determine the security algorithm used to activate the security context. The two do not need to negotiate the security algorithm through the NASSMC process, so the NAS SMC process can be skipped. At this time, in response to the EAP-success message, the terminal device can activate the corresponding context of integrity security protection and / or the corresponding context of confidentiality security protection according to the ZUC confidentiality security protection algorithm and / or the SNOW integrity security protection algorithm when it is determined that the terminal device has successfully authenticated the network.

[0429] It should be noted that the above-mentioned combination implementation method is only an example given for ease of understanding and should not constitute a limitation on the solution of the present application.

[0430] S404: The core network element performs integrity protection and / or confidentiality security protection on the first message according to the security context.

[0431] Exemplarily, the core network element performs integrity protection on the first message to be sent according to the integrity security protection algorithm and / or the integrity security protection key Knasint in the security context, and the calculation result of the integrity security protection on the first message can be recorded as MAC#1, which is carried in the first message of step S405. Similarly, the core network element performs confidentiality protection on the first data according to the confidentiality security protection algorithm and / or the confidentiality security protection key Knasenc in the security context, obtains the first data ciphertext, and carries it in the first message of step S405. The specific implementation method of integrity protection and / or confidentiality security protection can refer to the relevant description of the above method 300.

[0432] Optionally, before executing step S404, the method further includes step S404a:

[0433] S404a, the core network element determines whether to perform integrity security protection and / or confidentiality security protection on the first message. That is, based on the core network element determining to activate the security context in the above step S403e, the core network element can further determine whether to perform security protection and / or what type of protection (integrity security protection and / or confidentiality security protection) on the first message corresponding to the first operation between the core network element and the terminal device, or determine to activate the context corresponding to the integrity security protection and / or the context corresponding to the confidentiality security protection.

[0434] Exemplarily, the core network element determines whether to perform integrity security protection and / or confidentiality security protection on the first message according to the type of operation instruction.

[0435] For example, when the operation instruction type indicates an inventory operation, the core network element determines not to perform integrity security protection on the first message, that is, there is no need to generate and / or activate a context corresponding to integrity security protection.

[0436] For example, when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the core network element determines to perform integrity security protection on the first message, that is, generates and / or activates a context corresponding to integrity security protection.

[0437] Among them, the calculation result of the integrity security protection of the first message by the above-mentioned core network network element is recorded as MAC#1, which is carried in the first message and sent to the terminal device, and is used by the terminal device to perform integrity verification on the first message.

[0438] For example, when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the core network element determines that confidentiality security protection is not performed on the first message, that is, there is no need to generate and / or activate the corresponding context for confidentiality security protection.

[0439] For example, when the operation instruction type indicates a write operation, the core network network element determines to perform confidentiality security protection on the first data carried in the service request message of step S401 to obtain a first data ciphertext, that is, to generate and / or activate the corresponding context for confidentiality security protection, and the first data ciphertext is carried in the first message.

[0440] It should be noted that the above-mentioned integrity security protection and confidentiality security protection for the first message can be implemented independently or in combination. For example, when the operation instruction type indicates an inventory operation, the core network network element may not perform integrity security protection on the first message, and may not perform confidentiality security protection; when the operation instruction type indicates a read operation, the core network network element may perform integrity security protection on the first message, and may not perform confidentiality security protection; when the operation instruction type indicates a write operation, the core network network element may perform integrity security protection on the first message, and may not perform confidentiality security protection; when the operation instruction type indicates a write operation, the core network network element may perform integrity security protection on the first message, and may perform confidentiality security protection on the first data.

[0441] Optionally, the core network element may also determine whether to activate the security context based on the above step S403e, and then perform corresponding security protection (integrity security protection and / or confidentiality security protection) on the first message according to the security context, that is, the judgment step in which the core network element determines whether to perform integrity security protection and / or confidentiality security protection on the first message in the above example may not be performed, and the judgment result of step S403e may be used. For example, in step S403e, if the core network element determines to activate the security context, then in step S404a, it may be determined to perform corresponding integrity security protection and / or confidentiality security protection on the first message; if the core network element determines not to activate the security context, then in step S406a, it is determined not to perform integrity security protection and / or confidentiality security protection on the first message.

[0442] S405, the core network network element sends a first message to the terminal device, and correspondingly, the terminal device receives the first message from the core network element.

[0443] Exemplarily, the core network element may send the first message to the terminal device through the base station.

[0444] Optionally, the first message may be a registration acceptance message in response to step S402. That is, when the core network element determines that the authentication of the terminal device is passed, it skips the NAS SMC process and sends a registration acceptance message that has been protected by security to the terminal device, thereby reducing the number of interactions between the terminal device and the core network element, simplifying the processing complexity of the entire process, and reducing processing delays. Optionally, the registration acceptance message may carry an operation instruction type of the first operation, which is used to indicate that the network side accepts the registration request of the terminal device, and to indicate that the terminal device performs the first operation. For example, when the operation instruction type indicates a read operation, a write operation, or an invalid operation, the registration acceptance message also includes MAC#1. Among them, when the operation instruction type indicates a write operation, the registration acceptance message also includes a first data ciphertext. Optionally, the operation instruction type of the first operation may not be carried in the registration acceptance message. In this case, the operation instruction type and the registration acceptance message may be sent simultaneously or separately, and this application does not limit this.

[0445] Optionally, the operation instruction type may be sent in plain text, for the terminal device to determine the first operation.

[0446] It should be noted that the present application does not impose any limitation on the order in which the above steps S405 and S403b are executed. That is to say, the terminal device may first activate the security context and then receive the first message from the core network element; or, it may first receive the first message from the core network element and then activate the security context. That is, the present application does not impose any specific limitation on the timing for the terminal device to activate the security context.

[0447] Optionally, the core network element may also send a registration acceptance message to the terminal device, that is, the first message is not a registration acceptance message. In this case, the registration acceptance message may be protected according to the above security context or not, which is not limited in this application.

[0448] S406: The terminal device performs integrity check and / or decryption on the first message according to the security context.

[0449] Exemplarily, the terminal device calculates MAC#2 according to the integrity security protection algorithm in the security context. The specific calculation method can refer to the calculation method of MAC#1 above. Further, the terminal device compares MAC#1 and MAC#2 carried in the first message. If the two are the same, it can be considered that the integrity check passes; otherwise, the integrity check fails.

[0450] Exemplarily, the terminal device performs a decryption calculation or a decryption operation on the first data ciphertext in the first message according to the confidentiality security protection algorithm and / or the confidentiality security protection key (e.g., Knasenc) in the security context to obtain the first data, that is, the decryption is successful; otherwise, the decryption fails. It should be understood that this implementation corresponds to a write operation.

[0451] Optionally, if the terminal device fails to perform integrity check in the above step S406, and / or the decryption is unsuccessful, the terminal device refuses to perform the first operation, and the second message in the following step S408 is used to indicate that the first operation failed. Optionally, the second message carries a failure reason value to indicate that the integrity check of the first message failed, and / or the decryption of the first data ciphertext was unsuccessful. Further, the core network network element sends a service response message in step S409 to indicate that the first operation failed. Optionally, the service response message carries a failure reason value to indicate that the integrity check of the first message failed, and / or the decryption of the first data ciphertext was unsuccessful.

[0452] Optionally, before executing step S406, the method further includes step S406a:

[0453] S406a, the terminal device determines whether to perform integrity check and / or decryption on the first message. That is, based on the case where the terminal device determines to activate the security context in the above step S403f, the terminal device can further determine whether to perform security protection (integrity check and / or decryption) on the first message corresponding to the first operation between the terminal device and the core network element and / or what type of security protection is performed, or determine to activate the context corresponding to the integrity security protection and / or the context corresponding to the confidentiality security protection.

[0454] Exemplarily, the terminal device determines whether to perform integrity check and / or decryption on the first message according to the type of operation instruction.

[0455] For example, when the operation instruction type indicates an inventory operation, the terminal device determines not to perform an integrity check on the first message, that is, there is no need to generate and / or activate a corresponding context for integrity security protection.

[0456] For example, when the operation instruction type indicates a read operation, an invalidation operation, or a write operation, the terminal device determines to perform an integrity check on the first message, that is, to generate and / or activate a corresponding context for integrity security protection.

[0457] For example, when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the terminal device determines not to decrypt the first message, that is, there is no need to generate and / or activate a corresponding context for confidentiality security protection.

[0458] For example, when the operation instruction type indicates a write operation, the terminal device determines to decrypt the first data ciphertext carried in the first message to obtain the first data, that is, to generate and / or activate the corresponding context of confidentiality security protection.

[0459] It should be noted that the above-mentioned integrity check and decryption of the first message can be implemented independently or in combination. For example, when the operation instruction type indicates an inventory operation, the terminal device may not perform an integrity check on the first message and may not decrypt it; when the operation instruction type indicates a read operation, the terminal device may perform an integrity check on the first message and may not decrypt it; when the operation instruction type indicates an invalidation operation, the terminal device may perform an integrity check on the first message and may not decrypt it; when the operation instruction type indicates a write operation, the terminal device may perform an integrity check on the first message and may decrypt the first data ciphertext.

[0460] Optionally, the terminal device may also determine whether to activate the security context based on the above step S403f, and then perform corresponding security protection on the first message according to the security context, that is, the judgment step in the above example in which the terminal device determines whether to perform integrity check and / or decryption on the first message according to the type of operation instruction may not be performed, and the judgment result of step S403f may be used. For example, in step S403f, if the terminal device determines to activate the security context, then in step S406a, it may be determined to perform integrity check and / or decryption on the first message; if the terminal device determines not to activate the security context, then in step S406a, it is determined not to perform integrity check and / or decryption on the first message.

[0461] S407: When the integrity check passes and / or the decryption succeeds, the terminal device performs a first operation.

[0462] Exemplarily, when the integrity check passes and / or the decryption succeeds, the terminal device performs the first operation according to the operation instruction type.

[0463] For example, when the first operation is a read operation, the terminal device reports data in its storage area or collected data.

[0464] For example, when the first operation is a write operation, the terminal device writes the first data obtained by decryption in step S406 into a storage area of ​​the terminal device.

[0465] For example, when the first operation is a disabling operation, the terminal device is determined to be disabled or inactivated.

[0466] For example, when the first operation is an inventory operation, the terminal device may report an identification of the terminal device.

[0467] S408, the terminal device sends a second message to the core network element, and correspondingly, the core network element receives the second message from the terminal device.

[0468] The second message is used to indicate the execution status of the first operation.

[0469] Optionally, before executing step S408, the method further includes step S408a:

[0470] S408a: The terminal device performs integrity security protection and / or confidentiality security protection on the second message according to the security context.

[0471] Exemplarily, the terminal device performs integrity protection on the second message according to the integrity security protection algorithm and / or the integrity security protection key Knasint in the security context, and the calculation result of the integrity security protection on the second message can be recorded as MAC#2, which is carried in the second message of step S408. Similarly, the terminal device performs confidentiality protection on the second data according to the confidentiality security protection algorithm and / or the confidentiality security protection key Knasenc in the security context, and obtains the second data ciphertext, which is carried in the second message of step S408. Among them, the second data is the data in the storage area of ​​the terminal device, or the data collected by the terminal device. The specific implementation method of integrity protection and / or confidentiality security protection can refer to the relevant description of the above method 300.

[0472] Optionally, when the first message in step S405 is a registration acceptance message, the second message may be a registration completion message. In this case, the registration completion message may carry MAC#2 and / or the second data ciphertext.

[0473] Optionally, before executing step S408a, the method further includes step S408b:

[0474] S408b, the terminal device determines whether to perform integrity security protection and / or confidentiality security protection on the second message. That is, based on the case where the terminal device determines to activate the security context in the above step S403f, the terminal device can further determine whether to perform security protection and / or what type of protection (integrity security protection and / or confidentiality security protection) on the second message corresponding to the first operation between the terminal device and the core network element, or determine to activate the context corresponding to the integrity security protection and / or the context corresponding to the confidentiality security protection.

[0475] In one example, the terminal device determines whether to perform integrity security protection and / or confidentiality security protection on the second message according to the type of operation instruction.

[0476] For example, when the operation instruction type indicates an inventory operation, the terminal device determines not to perform integrity security protection on the second message, that is, there is no need to generate and / or activate a context corresponding to integrity security protection.

[0477] For example, when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the terminal device determines to perform integrity security protection on the second message, that is, generates and / or activates a corresponding context for integrity security protection.

[0478] For example, when the operation instruction type indicates an inventory operation, a write operation, or an invalidation operation, the terminal device determines not to perform confidentiality security protection on the second message, that is, there is no need to generate and / or activate a corresponding context for confidentiality security protection.

[0479] For example, when the operation instruction type indicates a read operation, the terminal device determines to perform confidentiality security protection on the second data to obtain a second data ciphertext, that is, to generate and / or activate the corresponding context for confidentiality security protection. The second data is data read from a storage area of ​​the terminal device, or data collected by the terminal device.

[0480] It should be noted that the above-mentioned integrity security protection and confidentiality security protection for the second message can be implemented independently or in combination. For example, when the operation instruction type indicates an inventory operation, the terminal device may not perform integrity security protection and confidentiality security protection on the second message; when the operation instruction type indicates a read operation, the terminal device may perform integrity security protection on the second message and not perform confidentiality security protection; when the operation instruction type indicates a write operation, the terminal device may perform integrity security protection on the second message and not perform confidentiality security protection; when the operation instruction type indicates a write operation, the terminal device may perform integrity security protection on the second message and confidentiality security protection on the second data.

[0481] Optionally, the terminal device may also determine whether to perform integrity security protection and / or confidentiality security protection on the second message based on the determination of whether to activate the security context in the above step S403f, or further determine whether to perform integrity security protection and / or confidentiality security protection on the second message based on the determination of whether to perform integrity check and / or decryption on the first message in step S406a. That is, in the above example, the terminal device may not perform the judgment step of determining whether to perform integrity security protection and / or confidentiality security protection on the second message according to the type of operation instruction, and the judgment result of step S403f or S406a may be used. For example, in step S403f, if the terminal device determines to generate and / or activate a security context, or, in step S406a, if the terminal device determines to perform integrity check and / or decrypt the first message, then in step S408b, it is determined to perform integrity security protection and / or confidentiality security protection on the second message; if the terminal device determines not to generate and / or activate a security context, or, if the terminal device determines not to perform integrity check and / or decrypt the first message, then in step S408b, it is determined not to perform integrity security protection and / or confidentiality security protection on the second message.

[0482] Optionally, after executing step S408, the method further includes steps S408c and S408d:

[0483] S408c, the core network element determines whether to perform integrity check and / or decryption on the second message. That is, based on the core network element determining to activate the security context in step S403e above, the core network element can further determine whether to perform security protection (integrity check and / or decryption) and / or what type of security protection is performed on the second message corresponding to the first operation between the core network element and the terminal device, or determine to activate the context corresponding to the integrity security protection and / or the context corresponding to the confidentiality security protection.

[0484] In one example, the core network element determines whether to perform integrity check and / or decryption on the second message according to the type of operation instruction.

[0485] For example, when the operation instruction type indicates an inventory operation, the core network element determines not to perform integrity check on the second message, that is, there is no need to generate and / or activate the corresponding context for integrity security protection.

[0486] For example, when the operation instruction type indicates a read operation, an invalidation operation, or a write operation, the core network element determines to perform an integrity check on the second message, that is, generates and / or activates a corresponding context for integrity security protection.

[0487] For example, when the operation instruction type indicates a read operation, the core network element determines to decrypt the second data ciphertext carried in the second message to obtain the second data, that is, to generate and / or activate the corresponding context of confidentiality security protection.

[0488] For example, when the operation instruction type indicates a write operation, an invalidation operation, or an inventory operation, the core network element determines not to decrypt the second message, that is, there is no need to generate and / or activate a corresponding context for confidentiality security protection.

[0489] It should be noted that the above-mentioned integrity check and decryption of the second message can be implemented independently or in combination. For example, when the operation instruction type indicates an inventory operation, the core network network element may not perform an integrity check on the second message and may not decrypt it; when the operation instruction type indicates a write operation, the core network network element may perform an integrity check on the second message and may not decrypt it; when the operation instruction type indicates an invalidation operation, the core network network element may perform an integrity check on the second message and may not decrypt it; when the operation instruction type indicates a read operation, the core network network element may perform an integrity check on the second message and may decrypt the second data ciphertext.

[0490] Optionally, the core network element may also determine whether to perform integrity check and / or decryption on the second message based on whether to activate the security context in the above step S403e, or determine whether to perform integrity check and / or decryption on the second message based on whether to perform integrity security protection and / or confidentiality security protection on the first message in step S404a. That is, in the above example, the core network element may not perform the judgment step of determining whether to perform integrity check and / or decryption on the second message based on the type of operation instruction, and the judgment result of step S403e or S404a may be used. For example, in step S403e, if the core network network element determines to generate and / or activate a security context, or, in step S404a, if the core network network element determines to perform integrity security protection and / or confidentiality security protection on the first message, then in step S408c, it is determined to perform integrity verification and / or decryption on the second message; if the core network network element determines not to generate and / or activate a security context, or, if the core network network element determines not to perform integrity security protection and / or confidentiality security protection on the first message, then in step S408c, it is determined not to perform integrity verification and / or decryption on the second message.

[0491] S408d, the core network element performs integrity check and / or decryption on the second message according to the security context.

[0492] Exemplarily, the core network element calculates MAC#1 according to the integrity security protection algorithm in the security context, and compares MAC#1 carried in the second message with MAC#2. If the two are the same, it can be considered that the integrity check passes; otherwise, the integrity check fails.

[0493] Exemplarily, when the operation instruction type indicates a write operation, the core network network element performs decryption calculation or decryption operation on the second data ciphertext in the second message according to the confidentiality security protection algorithm and / or the confidentiality security protection key (for example, Knasenc) in the security context to obtain the second data, that is, the decryption is successful; otherwise, the decryption fails.

[0494] Optionally, if the integrity check of the core network element fails in step S408d, and / or the decryption is unsuccessful, the service response message of the following step S409 is used to indicate that the first operation failed. Optionally, the service response message carries a failure reason value, which is used to indicate that the integrity check of the second message failed, and / or the decryption of the second data ciphertext was unsuccessful.

[0495] S409, the core network element sends a service response message to the operation requester, and correspondingly, the operation requester receives the service response message from the core network element.

[0496] The service response message may be a service response message, which is used to indicate the execution status of the first operation.

[0497] In the first example, when the following condition #1 is met, the service response message is used to indicate that the first operation is successfully executed. At this time, the service response message includes the identifier of the terminal device, and optionally, the service response message also includes second data.

[0498] Exemplarily, condition #1 includes: the authentication in the above steps S403a-S403b is passed, the supported security algorithm matches the security capability of the terminal device, the integrity check and / or decryption of the first message is successful, and the integrity check and / or decryption of the second message is successful.

[0499] Based on this implementation, step S409 may further include: the core network element sends a service response message to the operation requester according to the operation instruction type of the first operation.

[0500] For example, in the case where the operation instruction type indicates an inventory operation, a write operation, or a failure operation, the service response message includes an identification of the terminal device.

[0501] For example, when the operation instruction type indicates a read operation, the service response message includes the identifier of the terminal device and the second data.

[0502] In the second example, when any one or more of the following conditions are met, the service response message is used to indicate that the first operation fails to execute. At this time, the service response message includes an identifier of the terminal device, and optionally, the service response message also includes a failure reason value, which is used to indicate any one or more of the following conditions.

[0503] (1) The authentication in the above steps S403a and / or S403b fails;

[0504] (3) The integrity check and / or decryption of the first message in step S406 above fails;

[0505] (4) The integrity check and / or decryption of the second message in step S408c above fails;

[0506] (2) The core network element in the above step S403d fails to verify the security algorithm, or in other words, the security algorithm supported by the core network element does not match the security capability of the terminal device.

[0507] Optionally, the method further includes steps S410 and S411:

[0508] S410, the terminal device determines whether to delete the security context.

[0509] S411, the core network element determines whether to delete the security context.

[0510] Below, the implementation method of the core network element determining whether to delete the security context is taken as an example. The implementation method on the terminal device side can refer to the relevant description on the core network element side, which will not be repeated here.

[0511] In one example, the core network element determines whether to delete the security context, that is, whether to save the security context, based on the type of the terminal device.

[0512] For example, when the type of the terminal device is an active tag or a semi-passive tag, the core network element determines not to delete the security context, that is, the core network element saves the security context for subsequent secure interaction of information.

[0513] For example, when the terminal device is a passive tag, the core network element determines to delete the security context. Compared with terminal devices of semi-passive tag or active tag type, terminal devices of passive tag type have weaker storage and computing capabilities, so the security context may not be saved to save storage and computing overhead. In addition, for subsequent requests to perform operations such as inventory operations on terminal devices of passive tag type, no security context is required for security protection, so it is not necessary to store the security context. However, for terminal devices of semi-passive tag or active tag type, the security context can be saved. For subsequent requests to perform operations such as read operations, write operations or invalidation operations on terminal devices of semi-passive tag or active tag type, the security context can be used to protect information communication security without reactivating the security context, which can save computing overhead and reduce processing delays while ensuring communication security.

[0514] It should be noted that this application does not specifically limit the timing of deleting the security context by the terminal device and the core network element. Optionally, the terminal device can delete the security context at any time after generating the second message, for example, after sending the second message, the terminal device starts a timer, and deletes the security context after the timer expires.

[0515] Optionally, the core network element may delete the security context at any time after integrity checking and / or decrypting the second message, for example, deleting the security context after sending a service response message, or, after sending a first message to the terminal device, the core network element starts a timer and deletes the security context if no second message is received from the terminal device after the timer expires.

[0516] Optionally, the tag management function related to the above-mentioned core network element in this application can be implemented on the tag management function (TMF). Among them, TMF can be an independent network element, or it can be co-located with a base station (such as RAN) or a core network element (such as AMF).

[0517] For example, when TMF is deployed independently, functions such as management, authentication, and registration of terminal devices (such as tags) can be implemented on TMF, that is, the actions of the core network elements in the above embodiments can be performed by TMF. Optionally, the corresponding messages can be forwarded through AMF, or TMF and AMF cooperate to execute the above method. For example, in S401, the service request message is received by TMF and sent to AMF; in S402, the registration request message is received by AMF and sent to TMF; S403 and 404 are executed by TMF; the first message in S405 is generated by TMF and sent to the terminal device through AMF; the second message in S408 is sent to TMF through AMF; the service response message in S409 is sent by TMF.

[0518] For example, when TMF and AMF are jointly established, the management, authentication, registration of terminal devices (such as tags), activation of security contexts, security protection of messages or cells, and other functions can be implemented on the jointly established network elements, and this application does not limit this.

[0519] The solution provided in the present application ensures secure communication between the terminal device and the core network elements by activating the security context, and reduces the number of information interactions between the terminal device and the core network elements by omitting the NAS SMC process, thereby simplifying the processing complexity of the entire service process, reducing processing delays, reducing power consumption, and further enabling the operation requester to obtain services effectively and quickly.

[0520] By adding judgment logic on whether to generate and / or activate security contexts, and whether to delete security contexts, the computing and storage overhead of terminal devices and core network elements is reduced, the limited storage resources of terminal devices are avoided from being occupied, the power consumption of terminal devices is reduced, and the network is guaranteed to be able to provide services for more terminal devices and avoid network congestion. Especially for tag-type terminal devices, they usually obtain energy through radio or the environment, and the storage capacity of terminal devices is limited, which makes it possible for terminal devices to be unable to store security contexts, affecting the secure interaction of information, and may cause the limited storage resources of terminal devices to be occupied, resulting in increased power consumption, etc. In addition, reducing the air interface overhead between terminal devices and core network elements, for example, avoiding the interaction failure caused by malicious tampering by attackers when the terminal device reports the terminal device security capabilities to the core network elements through the air interface, can ensure network security.

[0521] Figure 5 It is a flow chart of a communication method 500 provided in an embodiment of the present application, in which the terminal device is a UE (or a tag), the core network element is an AMF, and the operation requester is an AF as the execution subject for interaction. This method can be regarded as a further refinement of the above method 400. It should be understood that Figure 5 The embodiment shown is Figure 4 The embodiments shown can be coupled to each other and can be used as references to each other, so the relevant description in the above method 400 is also applicable to this implementation, and the two may have the same or similar technical means. Figure 4 The contents described in the illustrated embodiment will not be repeated. Considering the cost and performance limitations of tag-type UEs, this implementation is applicable to UEs that support a confidentiality security protection algorithm and / or an integrity security protection algorithm, or AMF notifies UE of the selected security algorithm carried in the registration acceptance message of step S509. This implementation reduces the interaction process between UE and AMF by omitting the NAS SMC process, simplifies the processing complexity of the entire process, and reduces processing delay. Figure 5 As shown, the method includes the following steps, and the parts not described in detail can refer to the existing protocols.

[0522] S501, AF sends a service request message to AMF, and correspondingly, AMF receives the service request message from AF.

[0523] The parameters included in the service request message, their definitions, and specific implementation methods may refer to the relevant description of step S401 of the above method 400.

[0524] S502: UE accesses the network.

[0525] For the specific implementation, please refer to the relevant description of steps S302 to 304 of the above method 300.

[0526] S503, the UE sends a registration request message to the AMF, and correspondingly, the AMF receives the registration request message from the UE.

[0527] For the parameters and their definitions and specific implementations included in the registration request message, please refer to the relevant description of step S402 of the above method 400. At this time, the registration request message may not carry the security capability of the UE.

[0528] S504, authentication.

[0529] For the specific implementation of authentication, reference may be made to the relevant description of step S306 of the above method 300 .

[0530] It should be understood that when the UE authentication passes, the following steps S506 to S517 are continued to be executed; when the UE authentication fails, steps S506 to S514, S516 and S517 are skipped and step S515 is executed. At this time, the service response message is used to indicate that the first operation fails to be executed, or the AMF rejects the service request of the AF. Optionally, the service response message may carry a failure cause value to indicate that the UE authentication fails.

[0531] S505, AMF obtains UE security capabilities.

[0532] For the specific implementation, please refer to the relevant description of step S403c of the above method 400.

[0533] S506: AMF determines the security algorithm based on the UE security capability and algorithm priority list.

[0534] The contents and definitions of the security algorithm, as well as the specific implementation methods, can be found in the relevant description of step S403d of the above method 400.

[0535] Optionally, when the service request message is used to request a read operation, a write operation, or a failure operation to be performed on the UE, the above steps S504 to S506 are performed; when the service request message is used to request an inventory operation to be performed on the UE, the above steps S504 to S506 may not be performed;

[0536] S507: AMF determines whether to activate the security context.

[0537] Exemplarily, the AMF determines whether to generate a security context according to the operation instruction type. For specific implementation methods, please refer to the relevant description of step S403e of the above method 400.

[0538] It should be understood that this implementation can simplify the content of the security context and reduce the storage and computing overhead on the network side.

[0539] Optionally, when AMF authenticates the UE, AMF can determine whether to skip the NAS SMC process, determine the timing of activating the security context, or how to activate the security context, etc. The specific implementation method can refer to the relevant description of the above step S403e.

[0540] S508: AMF determines whether to perform integrity protection and / or confidentiality security protection on the registration acceptance message.

[0541] Exemplarily, the AMF determines whether to perform integrity protection and / or confidentiality security protection on the registration acceptance message according to the operation instruction type. For the specific implementation method, please refer to the relevant description of step S404a of the above method 400.

[0542] Further, when it is determined that the registration acceptance message is to be integrity protected and / or confidentiality protected, the AMF performs integrity protection and / or confidentiality protection on the registration acceptance message according to the security context. The specific implementation method can refer to the relevant description of step S404 of the above method 400.

[0543] S509, AMF sends a registration acceptance message to the UE, and correspondingly, the UE receives a registration acceptance message from the AMF.

[0544] The content and interpretation of the registration acceptance message, as well as the specific implementation method, can refer to the relevant description of step S405 of the above method 400.

[0545] S510: The UE determines whether to activate a security context.

[0546] Exemplarily, the UE may determine whether to activate the security context according to the type of operation instruction in the registration acceptance message of step S509. For the specific implementation method, reference may be made to the relevant description of the above step S403f.

[0547] It should be understood that this implementation can simplify the content of the security context and reduce the storage and computing overhead on the UE side.

[0548] Optionally, when the UE passes the authentication of the core network element, the UE can determine whether to skip the NAS SMC process, determine the timing of activating the security context, or how to activate the security context, etc. The specific implementation method can refer to the relevant description of the above step S403f.

[0549] S511, the UE determines whether to perform integrity check and / or decryption on the registration acceptance message.

[0550] Exemplarily, the UE determines whether to perform integrity check and / or decryption on the first message according to the type of operation instruction. For specific implementation, reference may be made to the relevant description of step S406a of the above method 400.

[0551] Further, when it is determined to perform integrity check and / or decryption on the registration acceptance message, the UE performs integrity check and / or decryption on the registration acceptance message according to the integrity security protection algorithm and / or confidentiality security protection algorithm in the security context. The specific implementation method can refer to the relevant description of step S406 of the above method 400.

[0552] S512: When the integrity check passes and / or the decryption succeeds, the UE performs a first operation.

[0553] Exemplarily, when the integrity check passes and / or the decryption succeeds, the UE performs the first operation according to the operation instruction type. For the specific implementation method, reference may be made to the relevant description of step S407 of the above method 400.

[0554] S513: The UE determines whether to perform integrity protection and / or confidentiality protection on the registration completion message.

[0555] Exemplarily, the UE determines whether to perform integrity protection and / or confidentiality protection on the registration completion message according to the operation instruction type. For specific implementation, reference may be made to the relevant description of step S408b of the above method 400.

[0556] Further, when it is determined that the registration completion message is to be integrity protected and / or confidentiality protected, the UE performs integrity security protection and / or confidentiality security protection on the registration completion message according to the integrity security protection algorithm and / or confidentiality security protection algorithm in the security context. The specific implementation method can refer to the relevant description of step S408a of the above method 400.

[0557] S514, the UE sends a registration completion message to the AMF, and correspondingly, the AMF receives a registration completion message from the UE.

[0558] The content and interpretation of the registration acceptance message, as well as the specific implementation method, can refer to the relevant description of step S408 of the above method 400.

[0559] Optionally, AMF determines whether to perform integrity check and / or decryption on the registration completion message. For specific implementation methods, please refer to the relevant description of step S408c of the above method 400.

[0560] Further optionally, the AMF performs integrity check and / or decryption on the registration completion message according to the security context. For specific implementation methods, please refer to the relevant description of step S408d of the above method 400.

[0561] S515, AMF sends a service response message to AF, and correspondingly, AF receives a service response message from AMF.

[0562] The content and interpretation of the service response message, as well as the specific implementation method, can refer to the relevant description of step S409 of the above method 400.

[0563] S516: UE and AMF determine whether to delete the security context.

[0564] For the specific implementation, please refer to the relevant description of step S410 of the above method 400.

[0565] The solution provided by the present application is that the UE and AMF ensure secure communication between the two by activating the security context, and by omitting the NAS SMC process and carrying the operation instruction type of the first instruction in the registration acceptance message, the number of interactions between the UE and the AMF is reduced, the processing complexity is simplified, the latency is reduced, and services can be effectively provided to the AF. By adding the judgment logic of whether to generate and activate the security context, and whether to delete the security context, the calculation and storage overhead of the UE and the AMF is reduced, the limited storage resources of the UE are avoided from being occupied, the power consumption of the UE is reduced, and the network side is guaranteed to provide services for more UEs, avoiding network congestion, etc. In addition, by reducing the air interface overhead between the UE and the AMF, for example, when the UE reports the UE security capability to the AMF through the air interface, the interaction failure caused by the malicious tampering of the attacker is avoided, and the network security is guaranteed.

[0566] Figure 6 600 is a flow chart of a communication method 600 provided in an embodiment of the present application. Figure 6 As shown, the terminal device, the core network element and the operation requester are used as the execution subjects to interact, and the method includes the following steps. For the parts not described in detail, please refer to the description of the previous embodiment.

[0567] S601, the operation requesting party sends a service request message to a core network element, and correspondingly, the core network element receives the service request message from the operation requesting party.

[0568] S602, the terminal device sends a registration request message to the core network element, and correspondingly, the core network element receives the registration request message from the terminal device.

[0569] The contents and interpretations of the service request message and registration request message involved in steps S601-S602, as well as the specific implementation methods, can refer to the relevant descriptions of steps S401-S402 of the above method 400.

[0570] S603, the core network element activates the security context.

[0571] Among them, the security context is used to protect the secure communication between the terminal device and the core network element.

[0572] In the first example, the core network element activates the security context according to the operation instruction type of the first operation and / or the type of the terminal device. Specifically, the core network element can determine whether to activate the security context according to the operation instruction type of the first operation and / or the type of the terminal device.

[0573] For example, when the operation instruction type indicates an inventory operation, the core network element does not activate the security context; when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the core network element activates the security context.

[0574] In the second example, the core network element activates the security context according to the operation instruction type of the first operation and / or the type of the terminal device. Specifically, the core network element can determine whether to activate the security context according to the operation instruction type of the first operation and / or the type of the terminal device.

[0575] For example, when the type of terminal device is an active tag or a semi-passive tag, the core network element activates the security context; when the type of terminal device is a passive tag, the core network element activates the security context according to the operation instruction type of the first operation. The specific implementation method can refer to the relevant description of the first example above.

[0576] Optionally, regardless of the type of operation instruction, the core network element in step S603 activates the security context. Further, the core network element can determine what type of security context to activate based on the operation type, that is, determine whether to perform integrity security protection and / or confidentiality security protection based on the type of operation instruction. The specific implementation method is described as follows.

[0577] Optionally, the core network element activates the security context according to the operation instruction type of the first operation and / or the type of the terminal device, including: the core network element activates the security context corresponding to the integrity security protection and / or the security context corresponding to the confidentiality security protection according to the operation instruction type of the first operation and / or the type of the terminal device. That is, the core network element can determine what security context to activate according to the operation instruction type of the first operation and / or the type of the terminal device, that is, determine to turn on the integrity security protection and / or the confidentiality security protection.

[0578] In a first example, the core network element activates a security context corresponding to integrity security protection and / or a security context corresponding to confidentiality security protection according to an operation instruction type of the first operation.

[0579] For example, when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the terminal device activates the corresponding security context for integrity security protection; when the operation instruction type indicates a write operation, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection. For the specific implementation method, please refer to the relevant description of step S403e of the above method 400.

[0580] In the second example, the core network element activates a security context corresponding to integrity security protection and / or a security context corresponding to confidentiality security protection according to the type of the terminal device.

[0581] For example, when the type of the terminal device is an active tag or a semi-passive tag, the core network network element activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection; when the type of the terminal device is a passive tag and the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the core network network element activates the corresponding security context for integrity security protection; when the type of the terminal device is a passive tag and the operation instruction type indicates a write operation, the core network network element activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection. For the specific implementation method, please refer to the relevant description of step S403e of the above method 400.

[0582] Optionally, the method further includes: performing an authentication process between the terminal device and the network. For example, before the core network element activates the security context, the method further includes: the network authenticates the terminal device. For example, when the network authenticates the terminal device, the core network element activates the security context.

[0583] Optionally, before the core network activates the security context, the method may further include: the core network element obtains the security capability of the terminal device, and selects the integrity security protection algorithm and / or the confidentiality security protection algorithm according to the security capability of the terminal device and the algorithm priority list. It should be understood that the security capability of the terminal device is used to determine the security algorithm in the security context. Optionally, the core network element may obtain the security capability of the terminal device from the operation requester, or the terminal device, or the unified data management element. For specific implementation methods, please refer to the relevant description of steps S403c-S403d of the above method 400.

[0584] S604, the core network element performs security protection on the first message according to the security context, the first message is a NAS SMC message, that is, the NAS SMC message is a security-protected message. The security protection includes integrity security protection and / or confidentiality security protection, and the specific implementation method can refer to the relevant description of step S404 of the above method 400.

[0585] It should be noted that the first message in this implementation manner can be used to activate a security context, to negotiate a security algorithm with the terminal device, and / or to instruct to perform a first operation on the terminal device.

[0586] Optionally, the core network element determines to perform a first operation on the terminal device through a NAS SMC message according to the type of the terminal device and / or capability information of the terminal device, or determines to carry an operation instruction type for indicating the first operation in the NAS SMC message, or determines to adopt a low-power processing flow.

[0587] Furthermore, the core network element can determine whether to perform the first operation on the terminal device through a NAS SMC message, or determine whether the NAS SMC message carries an operation instruction type for indicating the first operation, that is, determine whether to adopt a low-power processing flow, specifically including the following implementation methods.

[0588] (1) The core network element determines, according to the type of the terminal device, whether to instruct, through a NAS SMC message, to perform the first operation on the terminal device.

[0589] For example, for a low-power terminal device (such as an IoT device, or a tag, etc.), it is determined to perform a first operation on the terminal device through a NAS SMC message instruction; for a non-low-power terminal device (also referred to as an ordinary terminal device), it is determined not to perform the first operation on the terminal device through a NAS SMC message instruction.

[0590] The tag may specifically include an active tag, a semi-passive tag and / or a passive tag, etc. The core network element may determine whether to perform the first operation on the terminal device through a NAS SMC message instruction according to the type of the tag.

[0591] For example, taking a tag as an example, when the type of the terminal device is a passive tag, the core network element can instruct, through a NAS SMC message, to perform a first operation on the terminal device.

[0592] (2) The core network element determines, based on the capability information of the terminal device, whether to instruct, through a NAS SMC message, to perform the first operation on the terminal device.

[0593] Optionally, the core network element can obtain the capability information of the terminal device from UDM / UDR / PCF / UE, and the capability information of the terminal device can be used to indicate whether the terminal device supports parsing the NAS SMC message to obtain an instruction to perform the first operation, or to indicate whether the terminal device itself has the ability to parse the NAS SMC message to obtain an instruction to perform the first operation, or to indicate whether the terminal device can obtain the information element carried in the NAS SMC message, such as the operation instruction type of the first operation.

[0594] For example, when the capability information of the terminal device indicates that the terminal device is capable of parsing the information elements carried in the NAS SMC message, the core network network element can instruct the terminal device through the NAS SMC message to perform the first operation, that is, to perform the service in the NASSMC process, thereby ensuring the communication security between the core network network element and the terminal device, reducing the number of signaling interactions between the two, simplifying the process, and reducing processing delays.

[0595] Optionally, before the core network element performs security protection on the first message according to the security context, the method further includes: the core network element determines whether to perform security protection on the first message.

[0596] In one example, the core network element determines whether to perform security protection on the first message according to the operation instruction type of the first operation.

[0597] For example, when the operation instruction type indicates an inventory operation, the core network network element determines not to perform integrity security protection on the first message; when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the core network network element determines to perform integrity security protection on the first message. The specific implementation method can refer to the relevant description of step S404a of the above method 400.

[0598] For example, when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the core network network element determines not to perform confidentiality security protection on the first message; when the operation instruction type indicates a write operation, the core network network element determines to perform confidentiality security protection on the first data and obtains a first data ciphertext, where the first data is data to be written to a storage area of ​​the terminal device, and the first data ciphertext is carried in the first message. For the specific implementation method, please refer to the relevant description of step S404a of the above method 400.

[0599] Optionally, the calculation result of the core network element performing integrity security protection on the first message is recorded as MAC#1, carried in the first message and sent to the terminal device, so that the terminal device can perform integrity verification on the first message.

[0600] S605, the core network element sends a security-protected first message to the terminal device, and correspondingly, the terminal device receives the first message from the core network element, wherein the first message is a NAS SMC message.

[0601] It should be understood that the NAS SMC message is a security-protected message.

[0602] Optionally, the NAS SMC message may carry an operation instruction type to indicate the first operation, and the specific interpretation of the operation instruction type may refer to the relevant description of the above method 400. Optionally, the operation instruction type may be sent in plain text.

[0603] Optionally, based on the core network element determining in the above step S604 whether integrity security protection is performed on the first message, the core network element may further determine whether MAC#1 is carried in the first message. For example, when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the NAS SMC message may also include MAC#1, which is used by the terminal device to perform integrity verification on the NAS SMC message to determine whether it has been maliciously tampered with during the transmission process; when the operation instruction type indicates an inventory operation, the NAS SMC message does not include MAC#1.

[0604] Optionally, the terminal device may determine whether to carry MAC#1 in the NAS SMC message according to the type of the terminal device. For example, if the type of the terminal device is an active tag or a semi-passive tag, the NAS SMC message may carry MAC#1; if the type of the terminal device is a passive tag, the NAS SMC message may not carry MAC#1.

[0605] Optionally, based on the core network element determining in step S604 whether confidentiality security protection is performed on the first message, the core network element may further determine whether the first data ciphertext is carried in the first message. For example, when the operation instruction type indicates a write operation, the NAS SMC message may also include the first data ciphertext, which is used to indicate writing into the storage area of ​​the terminal device.

[0606] Optionally, the NAS SMC message may carry the security algorithm selected by the core network element. Optionally, if the terminal device only supports one integrity security protection algorithm and / or one confidentiality security protection algorithm, it is determined that the NAS SMC message may not carry the security algorithm selected by the core network element, and this application does not limit this.

[0607] S606: The terminal device activates the security context according to the NAS SMC message.

[0608] In the first example, the terminal device activates the security context according to the operation instruction type of the first operation. Specifically, the terminal device can determine whether to activate the security context according to the operation instruction type of the first operation and / or the type of the terminal device.

[0609] For example, when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the terminal device determines to activate the security context; optionally, when the operation instruction type indicates an inventory operation, the terminal device may not activate the security context. For the specific implementation method, please refer to the relevant description of step S403f of the above method 400.

[0610] Optionally, the terminal device activates a security context according to the operation instruction type of the first operation, including: the terminal device activates a corresponding context for integrity security protection and / or a corresponding context for confidentiality security protection according to the operation instruction type of the first operation.

[0611] For example, when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the terminal device activates the corresponding security context for integrity security protection; when the operation instruction type indicates a write operation, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection. For the specific implementation method, please refer to the relevant description of step S403f of the above method 400.

[0612] In the second example, the terminal device activates the security context according to the type of the terminal device. Specifically, the terminal device can determine whether to activate the security context according to the type of the terminal device.

[0613] For example, when the terminal device is an active tag or a semi-passive tag, the terminal device activates the security context; when the terminal device is a passive tag, the terminal device activates the security context according to the operation instruction type of the first operation. The specific implementation method can refer to the relevant description of the first example.

[0614] Optionally, the terminal device activates a security context according to the type of the terminal device, including: the terminal device activates a corresponding context for integrity security protection and / or a corresponding context for confidentiality security protection according to the type of the terminal device.

[0615] For example, when the type of the terminal device is an active tag or a semi-passive tag, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection; when the type of the terminal device is a passive tag and the operation instruction type of the first operation indicates an inventory operation, a read operation, or an invalidation operation, the terminal device activates the corresponding security context for integrity security protection; when the type of the terminal device is a passive tag and the operation instruction type of the first operation indicates a write operation, the terminal device activates the corresponding security context for integrity security protection and the corresponding security context for confidentiality security protection. For the specific implementation method, please refer to the relevant description of step S403f of the above method 400.

[0616] Optionally, before the terminal device activates the security context, the method further includes: the terminal device authenticates the network. For example, when the terminal device passes the network authentication, the terminal device activates the security context.

[0617] S607, the terminal device performs integrity check and / or decryption on the first message according to the security context. For specific implementation, please refer to the relevant description of step S406 of the above method 400.

[0618] Optionally, before the terminal device performs integrity check and / or decryption on the first message according to the security context, the method further includes: the terminal device determines whether to perform integrity check and / or decryption on the first message.

[0619] In one example, the terminal device determines whether to perform integrity verification and / or decryption on the first message according to the operation instruction type of the first operation.

[0620] For example, when the operation instruction type indicates an inventory operation, the terminal device determines not to perform an integrity check on the first message; when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the terminal device determines to perform an integrity check on the first message. The specific implementation method can refer to the relevant description of step S406a of the above method 400.

[0621] For example, when the operation instruction type indicates an inventory operation, a read operation, or an invalidation operation, the terminal device determines not to decrypt the first message; when the operation instruction type indicates a write operation, the terminal device determines to decrypt the first data ciphertext carried in the first message to obtain the first data, and the first data is the data to be written to the storage area of ​​the terminal device. The specific implementation method can refer to the relevant description of step S406a of the above method 400.

[0622] S608: After integrity verification and / or decryption, the terminal device performs a first operation.

[0623] Exemplarily, when the integrity check and / or decryption passes, the terminal device performs the first operation, and the specific implementation method can refer to the relevant description of step S407 of the above method 400. Among them, the terminal device performs the first operation by receiving a NAS SMC message to obtain an instruction of the core network element to perform the first operation on the terminal device, or the terminal device parses the information element in the NAS SMC message to obtain the instruction type of the first operation, and then performs the first operation when the integrity check and / or decryption passes.

[0624] S609, the terminal device sends a second message to the core network element. Correspondingly, the core network element receives the second message from the terminal device, where the second message is a NAS SMP message.

[0625] Optionally, before the terminal device sends the second message to the core network element, the method also includes: the terminal device determines whether to perform security protection on the second message, the security protection includes integrity security protection and / or confidentiality security protection, and the second message is used to indicate whether the first operation is executed successfully.

[0626] In one example, the terminal device determines whether to perform security protection on the second message according to the operation instruction type of the first operation.

[0627] For example, when the operation instruction type indicates an inventory operation, the terminal device determines not to perform integrity security protection on the second message; when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the terminal device determines to perform integrity security protection on the second message. The specific implementation method can refer to the relevant description of step S408b of the above method 400.

[0628] For example, when the operation instruction type indicates an inventory operation, a write operation, or an invalidation operation, the terminal device determines not to perform confidentiality security protection on the second message; when the operation instruction type indicates a read operation, the terminal device determines to perform confidentiality security protection on the second data to obtain a second data ciphertext, where the second data is data in a storage area of ​​the terminal device or data collected by the terminal device, and the second data ciphertext is carried in the second message. For the specific implementation method, please refer to the relevant description of step S408b of the above method 400.

[0629] Optionally, after the core network element receives the second message from the terminal device, the method further includes: the core network element determining whether to perform integrity verification and / or decryption on the second message.

[0630] In one example, the core network element determines whether to perform integrity check and / or decryption on the second message according to the operation instruction type of the first operation.

[0631] For example, when the operation instruction type indicates an inventory operation, the core network network element determines not to perform an integrity check on the second message; when the operation instruction type indicates a read operation, a write operation, or an invalidation operation, the core network network element determines to perform an integrity check on the second message. The specific implementation method can refer to the relevant description of step S408c of the above method 400.

[0632] For example, when the operation instruction type indicates a read operation, the core network network element determines to decrypt the second data ciphertext carried in the second message to obtain the second data, where the second data is data in a storage area of ​​the terminal device or data collected by the terminal device; when the operation instruction type indicates an inventory operation, a write operation, or an invalidation operation, the core network network element determines not to decrypt the second message. The specific implementation method can refer to the relevant description of step S408c of the above method 400.

[0633] Optionally, based on the above-mentioned core network network element, it is determined to perform integrity check and / or decryption on the second message. The core network network element performs integrity check and / or decryption on the second message according to the security context. The specific implementation method can refer to the relevant description of step S408d of the above-mentioned method 400.

[0634] Optionally, the method further includes: the terminal device and / or the core network element determines whether to delete the security context. For example, the terminal device and / or the core network element determines whether to delete the security context according to the type of the terminal device. For specific implementation methods, reference may be made to the relevant description of steps S410-S411 of the above method 400.

[0635] S610, the core network element sends a service response message to the operation requester, and correspondingly, the operation requester receives the service response message from the core network element. For specific implementation methods, please refer to the relevant description of step S409 of the above method 400.

[0636] Optionally, the label management function related to the above-mentioned core network network element in the present application can be implemented on the TMF network element, where the TMF can be an independent network element or can be jointly set up with a base station (such as RAN) or a core network network element (such as AMF).

[0637] For example, when TMF is deployed independently, functions such as management, authentication, and registration of terminal devices (such as tags) can be implemented on TMF, that is, the actions of the core network elements in the above embodiments can be performed by TMF. Optionally, the corresponding messages can be forwarded through AMF. Or TMF and AMF cooperate to execute the above method. For example, in S601, the service request message is received by TMF and sent to AMF; in S602, the registration request message is received by AMF and sent to TMF; S603 and 604 are executed by TMF; the first message in S605 is generated by TMF and sent to the terminal device through AMF; the second message in S609 is sent to ...

Claims

1. A communication method, characterized in that: include: The terminal device sends a registration request message, where the registration request message is used to request registration with the network, and the registration request message includes an identifier of the terminal device; When the terminal device passes the authentication of the network, the terminal device activates a security context, where the security context is used to protect secure communication between the terminal device and a network element; The terminal device performs an integrity check on a first message from the network element according to the security context, where the first message is used to request to perform a first operation on the terminal device; When the integrity check passes, the terminal device performs the first operation.

2. The method according to claim 1, characterized in that: The terminal device activates the security context, including: The terminal device skips the NAS SMC process and activates the security context according to the capabilities of the terminal device and / or the type of the terminal device.

3. The method according to claim 2, characterized in that The terminal device skips the NAS SMC process according to the type of the terminal device and activates the security context, including: In the case that the type of the terminal device is a passive tag, the terminal device skips the NAS SMC process and activates the security context.

4. The method according to claim 2 or 3, characterized in that: The terminal device skips the NAS SMC process according to the capability of the terminal device and activates the security context, including: In a case where the capabilities of the terminal device indicate that the terminal device supports a confidentiality protection algorithm and / or an integrity protection algorithm, the terminal device skips the NAS SMC process and activates the security context.

5. The method according to any one of claims 1 to 4, characterized in that The terminal device activates the security context, including: In response to an EAP-success message and / or an authentication request message received by the terminal device during the authentication process, the terminal device activates the security context.

6. The method according to any one of claims 1 to 5, characterized in that The terminal device activates the security context, including: The terminal device activates the security context according to a locally configured security algorithm, where the security algorithm includes an integrity security algorithm and / or a confidentiality security algorithm.

7. The method according to any one of claims 1 to 6, characterized in that The terminal device activates the security context, including: The terminal device activates the security context according to a received registration acceptance message, where the registration acceptance message is used to accept a registration request of the terminal device.

8. The method according to claim 7, characterized in that The terminal device activates the security context according to the received registration acceptance message, including: In response to the registration acceptance message received by the terminal device, the terminal device activates the security context; and / or, The terminal device activates the security context according to a security algorithm indicated by a security algorithm identifier carried in the registration acceptance message, where the security algorithm includes an integrity security algorithm and / or a confidentiality security algorithm.

9. The method according to any one of claims 1 to 8, characterized in that The terminal device activates the security context, including: The terminal device activates the security context according to the operation instruction type of the first operation.

10. The method according to claim 9, characterized in that The terminal device activates the security context according to the operation instruction type of the first operation, including one or more of the following: In a case where the operation instruction type indicates a read operation, the terminal device activates the security context; In a case where the operation instruction type indicates a write operation, the terminal device activates the security context; In a case where the operation instruction type indicates an invalid operation, the terminal device activates the security context.

11. The method according to any one of claims 1 to 10, characterized in that The method further comprises: The terminal device determines whether to decrypt the first message according to the operation instruction type of the first operation.

12. The method according to claim 11, characterized in that The terminal device determines whether to decrypt the first message according to the operation instruction type, including one or more of the following: In a case where the operation instruction type indicates an inventory operation, the terminal device determines not to decrypt the first message; When the operation instruction type indicates a read operation, the terminal device determines not to decrypt the first message; When the operation instruction type indicates an invalid operation, the terminal device determines not to decrypt the first message; When the operation instruction type indicates a write operation, the terminal device determines to decrypt the first data ciphertext carried in the first message, wherein the first data ciphertext is obtained by encrypting first data, and the first data is data to be written into the storage area of ​​the terminal device.

13. The method according to any one of claims 1 to 12, characterized in that The method further comprises: The terminal device determines whether to perform security protection on the second message according to the operation instruction type of the first operation, where the security protection includes integrity security protection and / or confidentiality security protection, and the second message is used to indicate whether the first operation is successfully executed; The terminal device sends the second message to the network element.

14. The method according to claim 13, characterized in that The terminal device determines whether to perform security protection on the second message according to the operation instruction type, including one or more of the following: When the operation instruction type indicates an inventory operation, the terminal device determines not to perform integrity security protection on the second message; When the operation instruction type indicates a read operation, the terminal device determines to perform integrity security protection on the second message; When the operation instruction type indicates a write operation, the terminal device determines to perform integrity security protection on the second message; In a case where the operation instruction type indicates an invalid operation, the terminal device determines to perform integrity security protection on the second message.

15. The method according to claim 13 or 14, characterized in that The terminal device determines whether to perform security protection on the second message according to the operation instruction type, including one or more of the following: In a case where the operation instruction type indicates an inventory operation, the terminal device determines not to perform confidentiality security protection on the second message; When the operation instruction type indicates a read operation, the terminal device determines to perform confidentiality security protection on the second data to obtain a second data ciphertext, where the second data is data in a storage area of ​​the terminal device or data collected by the terminal device, and the second data ciphertext is carried in the second message; When the operation instruction type indicates a write operation, the terminal device determines not to perform confidentiality security protection on the second message; In a case where the operation instruction type indicates an invalid operation, the terminal device determines not to perform confidentiality security protection on the second message.

16. The method according to any one of claims 1 to 15, characterized in that The method further comprises: The terminal device determines whether to delete the security context according to the type of the terminal device, specifically including one or more of the following: In a case where the type of the terminal device is an active tag or a semi-passive tag, the terminal device determines not to delete the security context; In a case where the type of the terminal device is a passive tag, the terminal device determines to delete the security context.

17. The method according to any one of claims 13 to 16, characterized in that The first message is a registration acceptance message, and the second message is a registration completion message.

18. A communication method, characterized in that: include: receiving a registration request message from a terminal device, the registration request message being used to request registration with a network, the registration request message including an identifier of the terminal device; When the authentication of the terminal device is successful, activating a security context, wherein the security context is used to protect secure communication between the terminal device and a network element; Performing integrity security protection on a first message according to the security context, where the first message is used to request a first operation to be performed on the terminal device; Sending the first message to the terminal device.

19. The method according to claim 18, characterized in that The security capability of the terminal device is used to determine the security algorithm in the security context, and the method further includes: Acquire the security capability of the terminal device from the operation requester; or, Acquire the security capability of the terminal device from the terminal device; or, The security capability of the terminal device is obtained from a unified data management network element.

20. The method according to claim 18 or 19, characterized in that Activate the security context, including: According to the capability of the terminal device and / or the type of the terminal device, the NAS SMC process is skipped and the security context is activated.

21. The method according to claim 20, characterized in that According to the type of the terminal device, skipping the NAS SMC process and activating the security context includes: In the case that the type of the terminal device is a passive tag, the NAS SMC process is skipped and the security context is activated.

22. The method according to claim 20 or 21, characterized in that According to the capability of the terminal device, skipping the NASSMC process and activating the security context includes: When the capability of the terminal device indicates that the terminal device supports a confidentiality protection algorithm and / or an integrity protection algorithm, the NAS SMC process is skipped and the security context is activated.

23. The method according to any one of claims 18 to 22, characterized in that Activate the security context, including: The security context is activated according to a locally configured security algorithm, the security algorithm comprising an integrity security algorithm and / or a confidentiality security algorithm.

24. The method according to any one of claims 20 to 23, characterized in that Activate the security context, including: The security context is activated according to an operation instruction type of the first operation.

25. The method according to claim 24, characterized in that Activating the security context according to the operation instruction type of the first operation includes one or more of the following: When the operation instruction type indicates a read operation, activating the security context; When the operation instruction type indicates a write operation, activating the security context; In a case where the operation instruction type indicates a failure operation, the security context is activated.

26. The method according to any one of claims 18 to 25, characterized in that The method further comprises: Whether to perform confidentiality security protection on the first message is determined according to the operation instruction type of the first operation.

27. The method according to claim 26, characterized in that Determining whether to perform confidentiality security protection on the first message according to the operation instruction type of the first operation includes one or more of the following: When the operation instruction type indicates an inventory operation, determining not to perform confidentiality security protection on the first message; When the operation instruction type indicates a read operation, determining not to perform confidentiality security protection on the first message; When the operation instruction type indicates an invalid operation, determining not to perform confidentiality security protection on the first message; When the operation instruction type indicates a write operation, it is determined to perform confidentiality security protection on the first data to obtain a first data ciphertext, where the first data is data to be written into a storage area of ​​the terminal device, wherein the first message includes the first data ciphertext.

28. The method according to any one of claims 18 to 27, characterized in that The method further comprises: receiving a second message from the terminal device, where the second message is used to indicate whether the first operation is successfully performed; Determine whether to perform integrity check and / or decryption on the second message according to the operation instruction type of the first operation.

29. The method according to claim 28, characterized in that Determining whether to perform integrity check on the second message according to the operation instruction type of the first operation includes one or more of the following: When the operation instruction type indicates a read operation, determining to perform an integrity check on the second message; When the operation instruction type indicates a write operation, determining to perform an integrity check on the second message; When the operation instruction type indicates an invalid operation, determining to perform an integrity check on the second message; When the operation instruction type indicates an inventory operation, it is determined not to perform integrity check on the second message.

30. The method according to claim 28 or 29, characterized in that Determining whether to decrypt the second message according to the operation instruction type of the first operation includes one or more of the following: In a case where the operation instruction type indicates a read operation, determining to decrypt the second data ciphertext carried in the second message to obtain second data, where the second data is data in a storage area of ​​the terminal device or data collected by the terminal device; When the operation instruction type indicates a write operation, determining not to decrypt the second message; When the operation instruction type indicates an invalid operation, determining not to decrypt the second message; In a case where the operation instruction type indicates an inventory operation, it is determined not to decrypt the second message.

31. The method according to any one of claims 18 to 30, characterized in that The method further comprises: Determining whether to delete the security context according to the type of the terminal device includes one or more of the following: In a case where the type of the terminal device is an active tag or a semi-passive tag, determining not to delete the security context; In a case where the type of the terminal device is a passive tag, it is determined to delete the security context.

32. The method according to any one of claims 18 to 31, characterized in that The method further comprises: receiving a service request message from an operation requester, wherein the service request message is used to request to perform the first operation on the terminal device; Sending a service response message to the operation requester according to the operation instruction type of the first operation includes one or more of the following: In the case where the operation instruction type indicates an inventory operation, the service response message includes an identification of the terminal device; In the case where the operation instruction type indicates a read operation, the service response message includes an identifier of the terminal device and second data, where the second data is data read from a storage area of ​​the terminal device or collected by the terminal device; In the case where the operation instruction type indicates a write operation, the service response message includes an identifier of the terminal device; In the case where the operation instruction type indicates an invalid operation, the service response message includes the identifier of the terminal device.

33. A communication device, characterized in that: include: One or more functional modules, wherein the one or more functional modules are used to execute the method according to any one of claims 1 to 17, or the one or more functional modules are used to execute the method according to any one of claims 18 to 32.

Images