Authentication method and device

Abstract

The invention relates to the technical field of communication, in particular to an authentication method and device, which are used for reducing the process complexity and power consumption of terminal equipment authentication. The method comprises the following steps: receiving a first verification value from core network equipment; generating a second verification value; and authenticating the core network according to the first verification value from the core network equipment and the generated second verification value. Through the mode, the terminal equipment can authenticate the core network, so that attack of an illegal network or stealing of user information by the illegal network can be prevented. And the process is simple and the power consumption is low.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an authentication method and device. Background Art

[0002] The working principle of passive radio frequency identification (RFID) technology is that the tag converts the wireless signal sent by the reader into energy and uses the energy to drive itself to work. In the development of communications, in order to save the power consumption of terminal devices, it is proposed to introduce RFID technology into the communication network. That is, the base station can integrate the capabilities of the card reader, and the base station can send wireless signals to the tag, such as passive or semi-passive terminal devices, and the terminal device can use the signal conversion capability to drive itself to work, such as sending data packets to the base station.

[0003] At present, terminal devices are authenticated based on a complex two-way authentication process, while tags are usually simple in structure design, low in cost and poor in measurement capability. Therefore, the current authentication method is not applicable to terminal devices with low cost and low power consumption requirements. How to authenticate terminal devices with low cost and low power consumption requirements has become an urgent problem to be solved. Summary of the invention

[0004] The present application provides an authentication method and apparatus for reducing the process complexity and power consumption of terminal device authentication.

[0005] In a first aspect, an authentication method is provided. The executor of the method may be a terminal device or a chip, a chip system or a circuit located in the terminal device. The method may be implemented by the following steps: receiving a first verification value from a core network device; generating a second verification value; and authenticating the core network based on the first verification value from the core network device and the generated second verification value.

[0006] This application sends a check value to the terminal device through the core network device, so that the terminal device can authenticate the core network, thereby preventing attacks from illegal networks or theft of user information by illegal networks. In addition, in this application, the generated check value is sent to the terminal device through the core network device, and the terminal device can authenticate the core network based on the check value generated by itself and the check value sent by the core network device. The process is simple and the power consumption is low.

[0007] In one possible design, the first check value is carried in the first paging message. By sending the check value in a multicast message such as a paging message, multiple terminal devices can be triggered to perform core network authentication at the same time. Compared with triggering core network authentication through a unicast message, this method can reduce signaling overhead on the one hand, and on the other hand, multiple terminal devices can authenticate the core network in parallel, thereby quickly realizing multiple terminal devices authenticating the core network.

[0008] In one possible design, generating a second verification value includes: generating a second verification value based on at least one of the following: a first key, a first random number, or a second random number, or a first serial number, wherein the first key is a group key, the first random number is a random number indicated by the core network, the second random number is a generated random number, and the first serial number is a serial number for data packet transmission.

[0009] The above method generates a second verification value through symmetric information such as a first secret key, so that the second verification value can verify the first verification value generated by the core network. The authentication method is simple and has low power consumption.

[0010] In one possible design, the method also includes: receiving at least one of the following: an index of the group key, and a first random number.

[0011] In one possible design, the method also includes: if the core network authentication is successful, sending a random access request; or if the core network authentication is unsuccessful, not sending a random access request.

[0012] The above method can improve communication security by performing random access when the core network is successfully authenticated.

[0013] In a possible design, the method further includes: sending a third verification value, the third verification value is used to authenticate the terminal device. This method can authenticate the terminal device by sending the third verification value, thereby realizing two-way authentication.

[0014] In one possible design, the third verification value is carried in an authentication request message, and the authentication request message is used to request authentication of the terminal device.

[0015] In one possible design, the method also includes: generating a third verification value based on at least one of the following: a second key, or a third random number, or a first serial number, wherein the second key is a group key or a root key, the third random number is a generated random number, and the first serial number is a serial number of a data packet transmission.

[0016] The above method generates a third check value through symmetric information such as a second secret key, and the authentication method is simple and has low power consumption.

[0017] In one possible design, the method also includes: sending at least one of the following: a third random number, a first serial number, or an identifier of the terminal device.

[0018] In one possible design, the method further includes: receiving first information, the first information being used to indicate whether the authentication method is one-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is beneficial to improving communication security.

[0019] In one possible design, the method further includes: sending a second message, wherein the second message is used to indicate that the supported authentication method or the specified authentication method is one-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is beneficial to improving communication security.

[0020] In one possible design, the method is applied to an environmental IoT terminal device. The method provided in this application has a simple authentication process and low power consumption, and is more suitable for environmental IoT terminal devices with low cost and low power consumption requirements.

[0021] On the second aspect, an authentication method is provided, the executor of the method may be a core network device or a chip, chip system or circuit located in the core network device, and the method may be implemented through the following steps: receiving a service request; sending a first verification value to a terminal device, the first verification value being used to authenticate the core network.

[0022] This application sends a check value to a terminal device through a core network device, so that the terminal device can authenticate the core network, thereby preventing attacks from illegal networks or theft of user information by illegal networks. In addition, in this application, the generated check value is sent to the terminal device through the core network device, and the terminal device can authenticate the core network based on the check value sent by the core network device. The process is simple and the power consumption is low.

[0023] In one possible design, the first check value is carried in the second paging message. By sending the check value in a multicast message such as a paging message, multiple terminal devices can be triggered to perform core network authentication at the same time. Compared with triggering core network authentication through a unicast message, this method can reduce signaling overhead on the one hand, and on the other hand, multiple terminal devices can authenticate the core network in parallel, thereby quickly realizing multiple terminal devices authenticating the core network.

[0024] In one possible design, the method further includes: generating a first check value according to at least one of the following: a first secret key, a first random number, wherein the first secret key is a group secret key, and the first random number is a generated random number. The above method generates the first check value through symmetric information such as the first secret key, and the authentication method is simple and has low power consumption.

[0025] In one possible design, the method also includes: The method also includes: sending at least one of the following: a group key, a first random number.

[0026] In one possible design, the method further includes: receiving a third check value, the third check value being used to authenticate the terminal device; generating a fourth check value; and authenticating the terminal device according to the first check value and the fourth check value. In this manner, the terminal device sends the third check value, and the core network device can authenticate the terminal device according to the fourth check value generated by itself and the third check value of the terminal device, thereby realizing two-way authentication.

[0027] In one possible design, the third verification value is carried in an authentication request message, which is used to request authentication of the terminal device.

[0028] In one possible design, generating a fourth check value includes: generating the fourth check value according to at least one of the following: a second key, or a third random number, or a fourth random number, or a first serial number, wherein the second key is a group key or a root key, the third random number is a random number indicated by the terminal device, the fourth random number is a generated random number, and the first serial number is a data packet number indicated by the terminal device.

[0029] The above method generates a fourth verification value through symmetric information such as the second secret key, so that the fourth verification value can verify the third verification value generated by the terminal device. The authentication method is simple and the power consumption is low.

[0030] In one possible design, the method also includes: receiving at least one of the following: a third random number, a first serial number, or an identifier of the terminal device.

[0031] In one possible design, the method further includes: sending first information, where the first information is used to indicate whether the authentication method is one-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is conducive to improving communication security.

[0032] In one possible design, the method further includes: receiving second information, the second information being used to indicate that the supported authentication method or the specified authentication method is one-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is beneficial to improving communication security.

[0033] In a possible design, the terminal device is an environmental Internet of Things terminal device. The method provided in this application has a simple authentication process and low power consumption, and is more suitable for environmental Internet of Things terminal devices with low cost and low power consumption requirements.

[0034] According to a third aspect, an authentication method is provided. The executor of the method may be a terminal device or a chip, a chip system or a circuit located in the terminal device. The method may be implemented by the following steps: receiving a first paging message from a network device; sending an authentication request message to the network device, the authentication request message carrying a first verification value, the first verification value being used to authenticate the terminal device, and the authentication request message being used to request authentication of the terminal device.

[0035] In this way, the terminal device can be authenticated by sending the first verification value through the terminal device.

[0036] In one possible design, the method also includes: generating a first verification value based on at least one of the following: a first secret key, or a first random number, or a first serial number, wherein the first secret key is a group key or a root key, the first random number is a generated random number, and the first serial number is a serial number of a data packet transmission.

[0037] The above method generates the first verification value through symmetric information such as the first secret key, and the authentication method is simple and has low power consumption.

[0038] In one possible design, the method also includes: the authentication request message also indicates a first random number and / or a first serial number.

[0039] In one possible design, the method also includes: the authentication request message also indicates a root key, or the first paging message indicates a group key.

[0040] In one possible design, the method also includes: receiving an authentication acceptance message from a network device, the authentication acceptance message indicating a second verification value; generating a third verification value; and authenticating the core network based on the second verification value and the third verification value.

[0041] The core network device sends a check value to the terminal device, so that the terminal device can authenticate the core network, thereby preventing attacks from illegal networks or theft of user information by illegal networks. In addition, in this application, the generated check value is sent to the terminal device through the core network device, and the terminal device can authenticate the core network based on the check value generated by itself and the check value sent by the core network device. The process is simple and the power consumption is low.

[0042] In one possible design, generating a third verification value includes: generating the third verification value based on at least one of the following: a second key, a second random number, or a third random number, wherein the second key is a group key or a root key, the second random number is a random number indicated by an authentication acceptance message, and the third random number is a generated random number.

[0043] The above method generates a third verification value through symmetric information such as the first secret key, so that the third verification value can verify the second verification value generated by the core network. The authentication method is simple and the power consumption is low.

[0044] In one possible design, the first paging message indicates that the authentication method is single-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is conducive to improving communication security.

[0045] In one possible design, before sending an authentication request message to a network device, the method further includes: sending a random access message or a non-access layer message to the network device, wherein the random access message or the non-access layer message indicates that a supported authentication method or a specified authentication method is one-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is beneficial to improving communication security.

[0046] In one possible design, the method is applied to an environmental IoT terminal device. The method provided in this application has a simple authentication process and low power consumption, and is more suitable for environmental IoT terminal devices with low cost and low power consumption requirements.

[0047] In a fourth aspect, an authentication method is provided, wherein the executor of the method may be a network device or a chip, a chip system or a circuit located in the network device, and the method may be implemented through the following steps: receiving a second paging message from a core network device; sending a first paging message to a terminal device; receiving an authentication request message from the core network device, the authentication request message carrying a first verification value, the first verification value being used to authenticate the terminal device, and the authentication request message being used to request authentication of the terminal device; and sending the authentication request message to the terminal device.

[0048] In this way, the terminal device can be authenticated by sending the first verification value through the terminal device.

[0049] In one possible design, the authentication request message also indicates a first random number and / or a first serial number.

[0050] In one possible design, the authentication request message also indicates a root key; or, the second paging message indicates a group key, and the first paging message indicates a group key.

[0051] In one possible design, the method also includes: receiving an authentication acceptance message from a core network device, the authentication acceptance message indicating a second verification value, and the second verification value is used to verify the core network; and sending the authentication acceptance message to the terminal device.

[0052] The core network device sends a check value to the terminal device, so that the terminal device can authenticate the core network, thereby preventing attacks from illegal networks or theft of user information by illegal networks. In addition, in this application, the generated check value is sent to the terminal device through the core network device, and the terminal device can authenticate the core network based on the check value generated by itself and the check value sent by the core network device. The process is simple and the power consumption is low.

[0053] In one possible design, the authentication acceptance message indicates a second random number.

[0054] In one possible design, the second paging message further indicates that the authentication method is one-way authentication or two-way authentication; the first paging message further indicates that the authentication method is one-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is conducive to improving communication security.

[0055] In one possible design, before receiving the authentication request message, the method also includes: receiving a random access message or a non-access layer message from a terminal device, the random access message or the non-access layer message indicating that the authentication method supported by the terminal device or the specified authentication method is one-way authentication or two-way authentication.

[0056] In a possible design, the terminal device is an environmental Internet of Things terminal device. The method provided in this application has a simple authentication process and low power consumption, and is more suitable for environmental Internet of Things terminal devices with low cost and low power consumption requirements.

[0057] In a fifth aspect, an authentication method is provided, wherein the executor of the method may be a core network device or a chip, a chip system or a circuit located in the core network device, and the method may be implemented through the following steps: sending a second paging message to the network device; receiving an authentication request message from the network device, the authentication request message carrying a first verification value, and the first verification value is used to authenticate the terminal device; generating a fourth verification value; and authenticating the terminal device based on the first verification value from the terminal device and the generated fourth verification value.

[0058] In this way, the terminal device can be authenticated by sending the first verification value through the terminal device.

[0059] In one possible design, generating a fourth check value includes: generating a check value according to at least one of the following: a first key, a first random number, or a fourth random number, or a first serial number, wherein the first key is a group key or a root key indicated by an authentication request message, the first random number is a random number indicated by the authentication request message, the fourth random number is a generated random number, and the first serial number is a data packet number indicated by the authentication request message.

[0060] The above method generates a fourth verification value through symmetric information such as a first secret key, so that the fourth verification value can verify the first verification value generated by the terminal device. The authentication method is simple and has low power consumption.

[0061] In one possible design, the method also includes: sending an authentication acceptance message to the network device, the authentication acceptance message indicating a second verification value, and the second verification value is used to verify the core network.

[0062] The core network device sends a check value to the terminal device, so that the terminal device can authenticate the core network, thereby preventing attacks from illegal networks or theft of user information by illegal networks. In addition, in this application, the generated check value is sent to the terminal device through the core network device, and the terminal device can authenticate the core network based on the check value generated by itself and the check value sent by the core network device. The process is simple and the power consumption is low.

[0063] In one possible design, the method further includes: generating a second verification value according to at least one of the following: a second secret key, or a second random number, wherein the second secret key is a group secret key, and the second random number is a generated random number.

[0064] The above method generates the second verification value through symmetric information such as the second secret key, and the authentication method is simple and has low power consumption.

[0065] In one possible design, the authentication acceptance message also indicates a second random number.

[0066] In one possible design, the second paging message also indicates whether the authentication method is single-way authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is conducive to improving communication security.

[0067] In one possible design, the authentication request message indicates that the authentication method supported by the terminal device or the specified authentication method is single authentication or two-way authentication. In this way, the authentication behaviors of the terminal device and the core network can be aligned, which is conducive to improving communication security.

[0068] In a possible design, the terminal device is an environmental Internet of Things terminal device. The method provided in this application has a simple authentication process and low power consumption, and is more suitable for environmental Internet of Things terminal devices with low cost and low power consumption requirements.

[0069] In a sixth aspect, the present application further provides a communication device, which is a terminal device or a chip in a terminal device. The communication device has the function of implementing any method provided in the first aspect or the third aspect above. The communication device can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0070] In one possible design, the communication device includes: a processor, which is configured to support the communication device to perform the corresponding functions of the terminal device in the method shown above. The communication device may also include a memory, which can be coupled to the processor and stores the necessary program instructions and data of the communication device. Optionally, the communication device also includes an interface circuit, which is used to support communication between the communication device and a network device or other device, such as the transmission and reception of data or signals. Exemplarily, the communication interface can be a transceiver, circuit, bus, module or other type of communication interface.

[0071] In one possible design, the communication device includes corresponding functional modules, which are respectively used to implement the steps in the above method. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0072] In one possible design, the structure of the communication device includes a processing unit and a communication unit, which can perform the corresponding functions in the above method examples. For details, please refer to the description of the method provided in the first aspect or the third aspect, which will not be repeated here.

[0073] In a seventh aspect, the present application further provides a communication device, which is a network device or a chip in a network device. The communication device has the function of implementing any method provided in the fourth aspect. The communication device can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0074] In one possible design, the communication device includes: a processor, which is configured to support the communication device to perform the corresponding functions of the network device in the method shown above. The communication device may also include a memory, which can be coupled to the processor and stores the necessary program instructions and data for the communication device. Optionally, the communication device also includes an interface circuit, which is used to support communication between the communication device and a terminal device, a core network device and other devices, such as the transmission and reception of data or signals. Exemplarily, the communication interface can be a transceiver, a circuit, a bus, a module or other types of communication interfaces.

[0075] In one possible design, the communication device includes corresponding functional modules, which are respectively used to implement the steps in the above method. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0076] In one possible design, the structure of the communication device includes a processing unit and a communication unit, which can perform the corresponding functions in the above method example. For details, please refer to the description of the method provided in the fourth aspect, which will not be repeated here.

[0077] In an eighth aspect, the present application further provides a communication device, wherein the device is a core network device or a chip in a core network device. The communication device has the function of implementing any method provided in the second aspect or the fifth aspect. The communication device can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above functions.

[0078] In one possible design, the communication device includes: a processor, which is configured to support the communication device to perform the corresponding functions of the core network device in the method shown above. The communication device may also include a memory, which can be coupled to the processor and stores the necessary program instructions and data for the communication device. Optionally, the communication device also includes an interface circuit, which is used to support communication between the communication device and a network device or other device, such as the transmission and reception of data or signals. Exemplarily, the communication interface can be a transceiver, circuit, bus, module or other type of communication interface.

[0079] In one possible design, the communication device includes corresponding functional modules, which are respectively used to implement the steps in the above method. The functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0080] In one possible design, the structure of the communication device includes a processing unit and a communication unit, which can perform the corresponding functions in the above method examples. For details, please refer to the description of the method provided in the second aspect or the fifth aspect, which will not be repeated here.

[0081] In the ninth aspect, a communication device is provided, comprising a processor and an interface circuit, the interface circuit being used to receive signals from other communication devices outside the communication device and transmit them to the processor or to send signals from the processor to other communication devices outside the communication device, the processor being used to implement the methods in the aforementioned first aspect or third aspect and any possible design through logic circuits or execution code instructions.

[0082] In the tenth aspect, a communication device is provided, comprising a processor and an interface circuit, the interface circuit being used to receive signals from other communication devices outside the communication device and transmit them to the processor or to send signals from the processor to other communication devices outside the communication device, the processor being used to implement the methods in the aforementioned second aspect or fifth aspect and any possible design through logic circuits or execution code instructions.

[0083] In the eleventh aspect, a communication device is provided, comprising a processor and an interface circuit, the interface circuit being used to receive signals from other communication devices outside the communication device and transmit them to the processor or to send signals from the processor to other communication devices outside the communication device, the processor being used to implement the method in the aforementioned fourth aspect and any possible design through logic circuits or execution code instructions.

[0084] In the twelfth aspect, a computer-readable storage medium is provided, in which a computer program or instruction is stored. When the computer program or instruction is executed by a processor, the method in any one of the first to fifth aspects and any possible design is implemented.

[0085] In the thirteenth aspect, a computer program product storing instructions is provided, which, when executed by a processor, implements the method in any one of the first to fifth aspects and any possible design.

[0086] In a fourteenth aspect, a chip system is provided, the chip system includes a processor and may also include a memory, for implementing the method in any aspect of the first to fifth aspects and any possible design. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0087] In a fifteenth aspect, a communication system is provided, the system comprising the apparatus described in the first aspect (such as a terminal device) and the apparatus described in the second aspect (such as a core network device).

[0088] In the sixteenth aspect, a communication system is provided, the system comprising a terminal device, a network device and a core network device, wherein the core network device sends a first verification value to the network device. The network device sends the first verification value from the core network device to the terminal device. The terminal device generates a second verification value, and authenticates the core network based on the first verification value from the core network device and the generated second verification value. In one possible design, the terminal device is also used to execute the method described in the first aspect or the third aspect; the network device is also used to execute the method described in the fourth aspect, and the core network device is also used to execute the method described in the second aspect or the fifth aspect. In the seventeenth aspect, a communication system is provided, the system comprising the device described in the third aspect (such as a terminal device), the device described in the fourth aspect (such as a network device), and the device described in the fifth aspect (such as a core network device).

[0089] The technical effects that can be achieved by the technical solutions of any of the sixth to sixteenth aspects mentioned above can be described with reference to the technical effects that can be achieved by the technical solutions of the first to fifth aspects mentioned above, and the repeated parts will not be repeated. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 A schematic diagram of the architecture of a communication system according to an embodiment of the present application;

[0091] Figure 2 A schematic diagram of the architecture of another communication system according to an embodiment of the present application;

[0092] Figure 3 A schematic diagram of a 5G authentication process in an embodiment of the present application;

[0093] Figure 4 A flowchart of an authentication method according to an embodiment of the present application;

[0094] Figure 5 A schematic diagram of a process flow of an authentication terminal device according to an embodiment of the present application;

[0095] Figure 6 A flowchart of an authentication method according to an embodiment of the present application;

[0096] Figure 7 A flowchart of an authentication method according to an embodiment of the present application;

[0097] Figure 8 A schematic diagram of the structure of a communication device according to an embodiment of the present application;

[0098] Fig. 9 A schematic diagram of the structure of a communication device according to an embodiment of the present application. DETAILED DESCRIPTION

[0099] The embodiment of the present application provides an authentication method that can be used for authentication of an Internet of Things (IoT) terminal, where IoT includes ambient IoT (A-IoT), narrowband IoT (NB-IoT), etc. IoT technology is widely used in various industries. For example, IoT technology can be applied to logistics, warehousing, industrial manufacturing, identity recognition, or environmental monitoring, agriculture, animal husbandry and forestry, etc. For example, logistics management is a typical application, and logistics management is achieved by taking inventory of tags on objects. Taking inventory of tags means that the reader performs an inventory operation on some tags within the coverage range to obtain the identification of the tags within the coverage range of the reader.

[0100] IoT is based on radio frequency identification (RFID) technology. RFID technology is a contactless communication technology that uses radio frequency communication. Its principle is that data communication is achieved through radio waves without contact between the reader / reader and the tag.

[0101] The technical solution provided in the embodiments of the present application can be applied to IoT systems, such as A-IoT systems; it can also be applied to communication systems related to the 3rd Generation Partnership Project (3GPP), such as the long term evolution (LTE) communication system, the sixth generation (5G) mobile communication system, or it can also be applied to other next generation mobile communication systems, such as the sixth generation (6G) communication system, or other similar communication systems. Other similar communication systems may include wireless fidelity (Wi-Fi), vehicle to everything (V2X), and the like.

[0102] See also Figure 1 , is a schematic diagram of a communication system provided in an embodiment of the present application. The communication system includes at least one terminal device and at least one network device. Figure 1 Take a communication system including a terminal device and a network device as an example. Figure 1 The network architecture shown is only for illustration, and the number of terminal devices and / or network devices may be less or more. Optionally, the communication system of the present application may also include core network devices, such as access and mobility management function (AMF) network elements and application function (AF) network elements. It should be understood that the above communication system may also include other core network devices, which are not limited here.

[0103] The communication system described in the embodiment of the present application is to more clearly illustrate the technical solution of the embodiment of the present application, and does not constitute a limitation on the communication system to which the embodiment of the present application is applicable. It is known to those skilled in the art that with the evolution of network architecture, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems. When the technical solution of the embodiment of the present application is applied to other communication systems, the devices, components, modules, etc. in the embodiment can be replaced with corresponding devices, components, modules in other communication systems without limitation.

[0104] Among them, anything that can communicate data with network equipment can be regarded as a terminal device. Terminal equipment is also called terminal, terminal device, user equipment (UE), mobile station, or mobile terminal. For example, the terminal device can be: a mobile phone, a computer, a mobile internet device (MID), a wearable device, a virtual reality (VR) device, an augmented reality (AR) device, a robotic arm, a camera, a robot, or a smart home device (such as a TV, air conditioner, sweeper, speaker, set-top box), a relay, a customer premise equipment (CPE), and a device with the function of a tag device. For example, the terminal device can be a tag in IoT / A-IoT, etc. Figure 1 Take the case where the terminal device is an A-IoT terminal.

[0105] Tags can be called RFID tags or electronic tags, or A-IoT terminals or A-IoT devices or devices, and are generally attached to objects to identify target objects. Tags can receive radio frequency signals from readers and writers, and with the energy obtained from the induced current, tags can send out information stored in the chip inside the tag, or tags can actively send a signal of a certain frequency to the reader and writer, and the reader and writer reads the information from the tag. The design of the tag is relatively simple, which is a design that integrates application layer signaling and air interface signaling, and has the characteristics of low power consumption. Tags are divided into three types: active, passive, and semi-active / semi-passive. Active tags are also called active tags, passive tags are also called passive tags, and semi-active / semi-passive tags are also called semi-passive tags. Active tags / active tags are equipped with a power supply and adopt a communication method of actively generating carrier waves, that is, they can actively send signals to the reader and writer without obtaining energy for sending signals based on the received signals. Passive tags / passive tags are not equipped with power modules or the power module has low power. They can use a communication method based on backscatter, which can obtain energy from the environment and send signals through the energy. Passive tags can work in reflection communication scenarios. For example, passive tags reflect signals from readers to obtain energy to transmit data. Semi-active / semi-passive tags integrate the advantages of active tags and passive tags and can be used as a special marker. Usually, semi-active / semi-passive tags are in a dormant state and may not work or send signals to the outside world. Only when they enter the activation signal range of a low-frequency activator, the semi-active / semi-passive tag is activated and starts working. The tags involved in the embodiments of the present application may be active tags, passive tags, or semi-active / semi-passive tags.

[0106] In the embodiment of the present application, the tag can be regarded as a terminal device. Accordingly, the terminal device in the present application can be of the following three types: passive terminal: a device without energy storage and independent signal generation, such as a device with backscatter transmission having such characteristics, such as device A; semi-passive terminal: a device with energy storage but without independent signal generation, such as a device with backscatter transmission having such characteristics, such as device B, wherein the use of stored energy may include amplification of reflected signals; active terminal: a device with energy storage and independent signal generation, such as an active wireless radio frequency (RF) component for transmission, such as device C.

[0107] Both the tag device and the reader-writer can be implemented based on the infrastructure in the cellular network, or the tag device and the reader-writer can be devices in the cellular network. For example, the function of the reader-writer can be implemented by the network device or the terminal device, and the tag device can be implemented by the terminal device in the cellular network. For example, the tag device can be an IoT terminal with extremely low power consumption and extremely low complexity. When the terminal device has the function of the tag device, non-contact data communication can be performed between the terminal device and the network device or another terminal device.

[0108] The various terminal devices introduced above, if located on the vehicle (for example, placed / installed in the vehicle), can be considered as vehicle-mounted terminal devices. The vehicle-mounted terminal device can be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into the vehicle as one or more components or units. The vehicle-mounted terminal device can also be a complete vehicle device, a vehicle-mounted module, a vehicle, an on-board unit (OBU), a roadside unit (RSU), a vehicle-mounted system (or a vehicle-mounted sending unit) (telematics box, T-box), a chip or a system on chip (SOC), etc. The above chip or SOC can be installed in a vehicle, OBU, RSU or T-box.

[0109] In the embodiments of the present application, the device for realizing the function of the terminal device may be the terminal device itself, or may be a device that can support the terminal device to realize the function, such as a chip system or a combination device or component that can realize the function of the terminal device, and the device may be installed in the terminal device. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device. For example, in the embodiments of the present application, the terminal device may be in the form of a tag or other terminal form.

[0110] The network devices involved in the embodiments of the present application are mainly access network devices. Therefore, in the following text, unless otherwise specified, the "network devices" referred to refer to radio access network (RAN) devices, which can be referred to as access network devices for short. RAN may be a cellular system related to 3GPP, for example, an LTE system, a new radio (NR system), or a future-oriented evolution system (for example, a 6G mobile communication system). RAN may also be an open access network (open RAN, O-RAN or ORAN), a cloud radio access network (cloud radio access network, CRAN), or a virtualized RAN (virtualized RAN, vRAN), etc. RAN may also be a communication system in which two or more of the above systems are integrated. RAN equipment may also be referred to as a RAN node, a RAN entity, or an access node, etc. For example, a RAN node may be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a next generation base station in a 6G mobile communication system, a base station in a future mobile communication system, etc. A RAN node may be a RAN node in a V2X technology, an RSU, an access node in a Wi-Fi system, etc.

[0111] The RAN node may also be a module or unit that completes part of the functions of the base station; or multiple RAN nodes collaborate to assist the terminal device in achieving wireless access, and different RAN nodes respectively implement part of the functions of the base station. For example, the RAN node may be a centralized unit (CU), a distributed unit (DU) or a radio unit (RU). In different systems, CU, DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, CU, CU-CP, CU-UP, DU and RU are described as examples in this application. CU and DU can be configured according to the protocol layer functions of the wireless network they implement, and which protocol layers are configured for CU and DU respectively are not limited in the embodiments of this application. Any unit in CU, DU and RU in this application may be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0112] In the embodiment of the present application, the network device may have a built-in reader / writer. When the terminal device is a tag, the tag and the network device may communicate via the Uu port. Figure 1 As shown in the figure. The functions of the reader can be further separated, and the reader can be divided into a receiver and an exciter. The receiver is also called a receiving end or a receiving unit, and the exciter is also called an exciter end or an exciter unit. The exciter unit is equivalent to the transmitter in the reader, and the receiving unit is equivalent to the receiver in the reader. When the reader is implemented in a separated architecture, different entities of the reader can be deployed on different network devices, such as Figure 2 shown. Figure 2 In the embodiment, an activator is deployed on the first network device to execute the sending function of the reader / writer; a receiver is deployed on the second network device to execute the receiving function of the reader / writer.

[0113] In the embodiments of the present application, the device for realizing the function of the network device can be the network device itself, or a device that can support the network device to realize the function, such as a chip system or a combination device or component that can realize the function of the network device, and the device can be installed in the network device. The embodiments of the present application do not limit the specific technology and specific device form adopted by the network device.

[0114] In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0115] Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the size, content, order, timing, priority or importance of multiple objects. For example, the first information and the second information are only used to distinguish different information, and do not indicate the difference in priority or importance of the two information.

[0116] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0117] The terms "including" and "having" and any variations thereof mentioned in the following description of the embodiments of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0118] In order to ensure the security of the communication network, authentication is required after the terminal device accesses the network. Figure 3 As shown, the authentication process of 5G communication is as follows:

[0119] S301, UE sends a registration request (Registration Request) to the AMF network element.

[0120] Among them, the registration request can carry the UE's 5G globally unique temporary UE identifier (5G globally Unique temporary identifier, 5G-GUTI) or user hidden identifier (SUbscription Concealed Identifier, SUCI) (or 5G subscription permanent identifier (subscription permanent identifier, SUPI)).

[0121] S302, the AMF network element sends an authentication request to the authentication server function (AUSF) network element.

[0122] If the registration request carries a valid 5G-GUTI or SUPI, the authentication request carries the corresponding SUPI. If the registration request carries SUCI, the authentication request carries SUCI.

[0123] S303, the AUSF network element determines whether the AMF network element is authorized to use the service network.

[0124] If the AMF network element is authorized to use the service network, execute S304.

[0125] S304, the AUSF network element sends an authentication data request (Nudm_UEAuthentication_Get) to the unified data management (UDM) network element.

[0126] S305: The UDM network element selects an authentication method for the UE.

[0127] S306, the UDM network element sends a 5G authentication vector (5G HE AV) to the AUSF network element.

[0128] Among them, 5G HE AV includes a random number (RAND), an authentication token (AUTN), an expected UE authentication response parameter (Expected user RESponse*, XRES*) and an AUSF key (KAUSF).

[0129] S307, the AUSF network element sends a 5G serving environment authentication vector (5G SE AV) to the AMF network element.

[0130] Among them, 5G SE AV includes RAND, AUTN and HXRES*, among which HXRES* is calculated based on XRES*.

[0131] S308, the AMF network element sends an air interface message to the UE.

[0132] The air interface message carries RAND, AUTN, NAS key set identifier (ngKSI) and ABBA. The anti-bidding down between architectures parameter (ABBA) is used to prevent network degradation attacks.

[0133] S309, the UE calculates a response parameter (RES*).

[0134] S310, UE sends an authentication response (Authentication Response) to the AMF network element.

[0135] The authentication response carries RES*.

[0136] S311, AMF network element calculates HRES* based on RES*.

[0137] S312, the AMF network element compares the calculated HRES* with the HXRES* included in the 5G SE AV.

[0138] If HRES* is consistent with HXRES*, the terminal device authentication is successful. If HRES* is inconsistent with HXRES*, the terminal device authentication fails.

[0139] Since IoT devices are low-cost, low-complexity in design, poor in coverage, and limited in applicable scenarios, the authentication process of the above-mentioned terminal devices is relatively complicated and not applicable to IoT devices. How to authenticate IoT devices with low cost and low power consumption requirements has become an urgent problem to be solved.

[0140] Based on this, the embodiment of the present application provides an authentication method and device. The method and device are based on the same concept. Since the method and device solve the problem in a similar principle, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0141] The authentication method provided in the embodiment of the present application is particularly suitable for the authentication of A-IoT terminal devices (such as tags), and of course it is also suitable for the authentication of other types of terminal devices.

[0142] The following describes the authentication method provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0143] For ease of understanding, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0144] 1) Slot Aloha method: The slot Aloha method divides the time domain resources into multiple discrete time slots, each time slot length is equal to or greater than a frame, and the tag can only transmit data at the beginning of the time slot. The time slots used for data transmission are controlled by the reader. Only when the reader allocates all the time slots can the tag use these time slots to transmit data.

[0145] In the embodiment of the present application, the paging message may be a paging message or a Select signaling. It is understandable that the Select signaling is used for paging tags. Accordingly, if the terminal device A is paged, when the paging message is a paging message, the identifier of the terminal device A included in the paging message may be the identifier (ID) of the terminal device A. When the paging message is a Select signaling, the paging message may include mask information, and the mask information is used to filter the terminal device A. For example, the mask carried by the Select signaling is 4 bits "0000", and the mask of the terminal device A is "00001111". Since the first 4 bits of "00001111" are the mask carried by the Select signaling, the terminal device A meets the selection range of the Select signaling, and the terminal device A can respond to the Select signaling. Of course, the Select signaling may also carry the identifier / group identifier of the terminal device; or, the Select signaling includes a filter, and the filter is used to filter the terminal devices to be paged. The filter can be the identifier / group identifier of the terminal device, which is used to page a certain terminal device or a certain group of terminal devices; or the filter can also indicate the type of the terminal device, that is, it is used to page a class of terminal devices. It can be understood that the filter is used to filter the terminal devices, and the filter can also be called filtering information. The specific name of the filter is not limited in the embodiment of the present application.

[0146] In the embodiments of the present application, "authentication" can also be replaced by "authentication", "authentication authentication", etc.

[0147] The following is an example of the authentication method provided in the embodiment of the present application being performed by a core network device, a network device, and a terminal device. The steps performed by the network device can be implemented by the RAN device itself, or by a component in the RAN device (such as a baseband chip, or other processing units or processors). For example, the network device can be Figure 1 The network device in the Figure 1The steps performed by the terminal device may be implemented by the terminal device itself or by components in the terminal device (such as a chip, a processing unit, or a processor module). The terminal device may be Figure 1 The terminal device shown, or it can be Figure 1 The chip (system) in the terminal device in the. The terminal device can be a UE or an A-IoT terminal device. For example, the terminal device can be a tag. The steps performed by the core network device can be implemented by the core network device itself, or by components in the core network device (such as chips, or other processing units or processor modules). The following takes the core network device as an AMF network element as an example. It should be noted that the actions performed by the AMF network element can also be performed by other network elements, such as network elements for managing tags. Among them, the network element for managing tags can be called a tag management function (TMF) network element, or it can be called others, which is not specifically limited here. Please refer to Figure 4 , Figure 4 A flow chart of the authentication method provided in an embodiment of the present application is shown.

[0148] S401, the AMF network element sends a first verification value to the terminal device.

[0149] Correspondingly, the terminal device receives the first verification value from the AMF network element.

[0150] In a possible implementation, the AMF network element may send the first verification value through the network device. Specifically, the AMF network element sends the first verification value to the network device, and the network device transparently transmits the first verification value to the terminal device.

[0151] As an example, the first check value can be carried in a paging message or other broadcast message (or groupcast message or multicast message). For example, taking a paging message as an example, the AMF network element sends a second paging message to a network device, and the second paging message carries the first check value. The network device sends a first paging message to a terminal device, and the first paging message carries the first check value.

[0152] By sending a checksum value in a multicast message such as a paging message, multiple terminal devices can be triggered to authenticate the core network at the same time. Compared with triggering the core network authentication through a unicast message, this method can reduce signaling overhead on the one hand, and on the other hand, it can enable multiple terminal devices to authenticate the core network in parallel, thereby quickly realizing multiple terminal devices authenticating the core network. Especially in the A-IoT scenario, multiple terminal devices authenticate the core network in parallel, which can increase the inventory rate of the terminal devices, thereby improving the efficiency of A-IoT management. For example, in logistics management, the above method can enable multiple tags in the logistics to authenticate the core network in parallel, thereby reducing the inventory delay and improving the efficiency of logistics management.

[0153] As another example, the first verification value may be carried in an authentication acceptance message. For example, the AMF network element sends an authentication acceptance message to the network device, the authentication acceptance message carries the first verification value, and the authentication acceptance message is used to notify the terminal device that the authentication is successful. The network device forwards (or transparently transmits) the authentication acceptance message to the terminal device. Optionally, before S401, the AMF network element may authenticate the terminal device. The authentication process of the terminal device can be referred to below. Figure 5 The method may also authenticate the terminal device through other processes, which are not specifically limited here.

[0154] As another example, the first verification value can be carried in an authentication request message, and the authentication request message is used to request authentication of the core network. For example, the AMF network element sends an authentication request message to the terminal device through a network device, and the authentication request message carries the first verification value.

[0155] Optionally, before S401, the AMF network element may receive a service request from the AF network element. It should be noted that the operations performed by the AF network element in this application may also be performed by other network elements.

[0156] Exemplarily, the service request may carry, but is not limited to, a service identifier (or event identifier), an identifier of at least one terminal device (or a group identifier or mask information of a terminal device group), and area information. The service identifier (or event identifier) ​​is used to identify a service (or event or session). For example, the service request carries an inventory service identifier. The identifier of at least one terminal device (or a group identifier or mask information of a terminal device group) is used to identify the terminal device being paged. The area information is used to indicate the area where the service is executed.

[0157] In one implementation, the AMF network element may generate the first verification value according to at least one of the following: a first key, a first random number, or a first sequence number, wherein the first key is a group key, and the first random number is a generated random number.

[0158] Optionally, the AMF network element may also send relevant parameters for generating the first verification value to the terminal device, such as a first secret key, a first random number, or a first serial number, etc. For example, the AMF network element sends relevant parameters for generating the first verification value to the network device, and the network device sends relevant parameters for generating the first verification value to the terminal device through an air interface message such as a paging message.

[0159] S402: The terminal device generates a second verification value.

[0160] In one implementation, the terminal device may generate the second verification value according to at least one of the following: the first secret key, the first random number, or a second random number generated by the terminal device, or a first serial number, wherein the first serial number is a serial number of a data packet transmission.

[0161] S403, the terminal device authenticates the core network according to the first verification value and the second verification value.

[0162] Specifically, if the first check value and the second check value meet the first condition, the core network authentication is successful. If the first check value and the second check value do not meet the first condition, the core network authentication fails. Exemplarily, the first condition may be that the first check value is consistent with the second check value, or the first condition may be that the first N high-order bits of the first check value are consistent with the second check value, or the first condition may be that the first M low-order bits of the first check value are consistent with the second check value, or the first condition may be other matching conditions, which are not specifically limited here. N and M are both integers greater than 0.

[0163] Optionally, the above-mentioned process of authenticating the core network device can be performed before the terminal device randomly accesses or after the random access.

[0164] In one implementation, if the process of authenticating the core network device is performed before the terminal device performs random access, the terminal device can determine whether to send a random access request based on the result of the core network authentication. For example, if the core network authentication is successful, the terminal device initiates random access, which can be a 4-step random access or a 2-step random access process, which is not specifically limited here.

[0165] Specifically, if it is a 4-step random access, the terminal device can send a preamble, and after receiving a random access response sent by the network device, send message 3 (Msg3), and wait to receive message 4 (Msg4) sent by the network device. The specific process can refer to the relevant description of 3GPP protocol 38.321 or 36.321 protocol, which will not be described here.

[0166] If it is a two-step random access, the terminal device can send a random access request message (such as message A (MsgA)), and then receive a response message (such as message B (MsgB)) sent by the network device. Specifically, the two-step random access can adopt the time slot aloha method. Other methods can also be used. Among them, the access timing used for random access can be an access timing of a fixed time unit in the time domain, or an access timing of variable length. In the case of a variable timing, the access timing can be a timing triggered by a special signaling, that is, when the special signaling is received, a time domain resource for terminal access is triggered.

[0167] Alternatively, if the core network authentication is unsuccessful, the terminal device does not send a random access request.

[0168] In another implementation, if the process of authenticating the core network device is performed after the terminal device randomly accesses, the terminal device can notify the AMF network element of the result of the core network authentication. If the core network authentication fails, the terminal device notifies the AMF network element of the authentication failure, for example, by sending an authentication failure message to the AMF network element through a network device. If the core network authentication is successful, the terminal device can also notify the core network of the authentication success, for example, by sending an authentication acceptance message to the AMF network element through a network device. Optionally, the authentication acceptance message can be sent together with the identification information of the terminal device, or it can also be sent together with an authentication request message from the terminal device, wherein the authentication request message is used to request authentication of the terminal device. Alternatively, the terminal device can also implicitly indicate that the core network has been successfully authenticated by sending an authentication request message.

[0169] This application sends a check value to the terminal device through the AMF network element, so that the terminal device can authenticate the core network, thereby preventing attacks from illegal networks or theft of user information by illegal networks. In addition, in this application, the generated check value is sent to the terminal device through the AMF network element, and the terminal device compares the check value generated by itself with the check value sent by the core network device, so that the core network can be authenticated, with a simple process and low power consumption.

[0170] It should be noted that the method of authenticating the core network in this application can also be applied to the scenario of authenticating network devices, such as authenticating network devices in a scenario without a core network. Figure 4 The method can be executed by the network device when authenticating the network device Figure 4 Actions of the AMF network element.

[0171] The above describes the method for authenticating the core network. Optionally, the present application can also authenticate the terminal device. The following describes the method for authenticating the terminal device. It should be noted that the method for authenticating the terminal device (i.e. Figure 5 The method) may not rely on the above Figure 4 The method can be implemented alone or in combination with Figure 4 The methods are combined to achieve two-way authentication.

[0172] like Figure 5 As shown, the method for authenticating a terminal device includes:

[0173] S501, the terminal device generates a third verification value.

[0174] Exemplarily, the terminal device may generate a third verification value based on at least one of the following: a second key, or a third random number, or a first serial number, wherein the second key is a group key or a root key, the third random number is a generated random number, and the first serial number is a serial number for data packet transmission. Optionally, the terminal device may save one or more group keys. If the terminal device saves multiple group keys, the AMF network element may instruct the terminal device which group key to use to generate the third verification value. For example, the AMF network element may send an index of the group key to the terminal device. Alternatively, the terminal device determines which group key to use to generate the third verification value. Alternatively, the terminal device may also generate a group key based on a root key or a derived key of the root key.

[0175] Of course, the terminal device may also determine the group key for generating the third verification value in other ways, which are not specifically limited here.

[0176] Optionally, the terminal device may also send relevant parameters for generating a third verification value to the AMF network element, such as the terminal device identifier, the index of the group key, the third random number, the first serial number, etc. Among them, the terminal device identifier can be used to determine the root key or the derived key of the root key.

[0177] It should be noted that S501 is an optional step.

[0178] S502, the terminal device sends a third verification value to the AMF network element, and the third verification value is used to authenticate the terminal device.

[0179] In a possible implementation, the terminal device may send a third verification value to the AMF network element through the network device. Specifically, the terminal device sends the third verification value to the network device, and the network device transparently transmits the third verification value to the AMF network element.

[0180] As an example, the third check value can be carried in an authentication request message or a random access request or a non-access stratum (NAS) message. For example, taking the authentication request message as an example, the terminal device sends an authentication request message to the AMF network element through the network device, and the authentication request message carries the third check value, and the authentication request message is used to request authentication of the terminal device.

[0181] S503, the AMF network element generates a fourth verification value after receiving the third verification value.

[0182] Optionally, the AMF network element may generate a fourth verification value according to at least one of the following: the second secret key, the third random number, the fourth random number, or the first serial number. The fourth random number is a random number generated by the AMF network element.

[0183] S504, the AMF network element authenticates the terminal device according to the third verification value and the fourth verification value.

[0184] Specifically, if the third check value and the fourth check value meet the second condition, the terminal device is authenticated successfully. If the third check value and the fourth check value do not meet the second condition, the terminal device is authenticated unsuccessfully. Exemplarily, the second condition may be that the third check value is consistent with the fourth check value, or the second condition may be that the first n high-order bits of the third check value and the fourth check value are consistent, or the second condition may be that the first check value is consistent with the first m low-order bits of the second check value, or the second condition may be other matching conditions, which are not specifically limited here. n and m are both integers greater than 0.

[0185] Optionally, if the third verification value and the fourth verification value meet the second condition, the AMF network element can also send the third verification value and related parameters for generating the third verification value to the AUSF network element for further authentication.

[0186] In one possible implementation, if the terminal device is successfully authenticated, the AMF network element sends an authentication acceptance message to the terminal device through the network device. If the terminal device is authenticated unsuccessfully, the AMF network element may send an authentication failure message to the terminal device through the network device.

[0187] Figure 3 In the 5G authentication process described above, the authentication of the terminal device requires that the terminal device identifier be sent to the UDM network element first. The UDM network element determines the authentication method of the terminal device, and then generates the authentication vector 5G HE AV by the UDM network element. The AUSF network element further calculates the 5G SE AV based on the 5GHE AV and sends it to the AMF network element. At this point, the AMF network element obtains the authentication parameter HXRES* on the core network side. As for the authentication parameters on the terminal device side, the terminal device first generates the response parameter RES*, and then the AMF network element generates the authentication parameter HRES* on the terminal device side based on RES*. Finally, the AMF network element authenticates the terminal device by comparing the authentication parameter HXRES* on the core network side with the authentication parameter HRES* on the terminal device side. The above-mentioned Figure 5 The method only requires the terminal device to generate a check value, and then the AMF network element can authenticate the terminal device by comparing the check value generated by the terminal device with the reference value generated by itself. Figure 5Compared with the 5G authentication process, the method has a simple terminal device authentication process, low power consumption, and is more suitable for A-IoT devices.

[0188] According to the previous introduction to the solution, one-way authentication can be performed between the terminal device and the core network, for example Figure 4 In the method, the core network is authenticated unidirectionally. Figure 5 In the method, one-way authentication is performed on the terminal device. Alternatively, two-way authentication can also be performed between the terminal device and the core network, for example Figure 4 The method and Figure 5 The method is combined to implement two-way authentication. In a specific implementation, the terminal device and the AMF network element can negotiate the authentication method.

[0189] For example, the AMF network element can indicate to the terminal device whether the authentication method is one-way authentication or two-way authentication. For example, the AMF network element sends the first information to the terminal device through the network device, and the first information is used to indicate whether the authentication method is one-way authentication or two-way authentication. As an example, the first information can be carried in a paging message. For example, the AMF network element sends a paging message to the network device, and the paging message carries the first information. The network device sends the first information to the terminal device through a paging message.

[0190] In one implementation, the first information can be determined as follows: the terminal device sends identification information to the AMF network element through the network device. The AMF network element obtains the authentication capability of the terminal device based on the identification, and determines the first information based on the authentication capability of the terminal device.

[0191] For another example, the terminal device may also report the supported (or recommended or expected or specified) authentication method to the AMF network element. For example, the terminal device sends the second information to the AMF network element through the network device, and the second information is used to indicate that the supported authentication method or the specified authentication method is one-way authentication or two-way authentication. As an example, the terminal device can carry the second information in a message of the random access process (such as message 3 (Msg3) or a random access request message, etc.) and send it to the network device, or carry the second information in a NAS message and send it to the network device. The network device can carry the second information in an authentication request message and send it to the AMF network element. The authentication request message is used to request authentication of the terminal device. Furthermore, after receiving the second information, the AMF network element can reply a response message to the terminal device through the network device, and the response message indicates the authentication method used.

[0192] It should be noted that if the authentication method negotiated by the terminal device and the core network device is one-way authentication, the one-way authentication can be to authenticate the terminal device or to authenticate the core network. The specific type of one-way authentication can be indicated in the above-mentioned first information or second information, or it can also be defined by the protocol.

[0193] To facilitate understanding of the solution, the authentication method described in this application is introduced below in conjunction with specific scenarios.

[0194] Example 1: Figure 6 As shown, the authentication methods include:

[0195] S601, the AF network element sends a service request to the AMF network element.

[0196] The service request can refer to the previous description, which will not be repeated here.

[0197] It should be understood that S601 is an optional step.

[0198] S602, the AMF network element sends a second paging message to the network device.

[0199] The second paging message carries the first verification value. The method for generating the first verification value can refer to the relevant description of S401, which will not be repeated here.

[0200] The second paging message may also carry a service identifier (or event identifier), an identifier of at least one terminal device (or a group identifier or mask information of a terminal device group), and relevant parameters for generating a first verification value (such as a first secret key, a first random number, etc.).

[0201] The second paging message may also carry the first information. If the first information indicates one-way authentication, S603 to S604 are executed to authenticate the core network. If the first information indicates two-way authentication and the core network authentication is successful, S605 is continued to be executed after S604, and after S605, S606 to S608 are executed to authenticate the terminal device.

[0202] S603: The network device sends a first paging message to the terminal device.

[0203] The first paging message may carry a first check value.

[0204] The first paging message may also carry an identifier of at least one terminal device (or a group identifier or mask information of a terminal device group) and relevant parameters for generating a first verification value (such as a first secret key, a first random number, etc.).

[0205] The first paging message may also carry first information.

[0206] S604, the terminal device authenticates the core network.

[0207] Specifically, the terminal device may generate a second verification value, and authenticate the core network according to the first verification value and the second verification value. For details, please refer to the relevant description of S402 and S403, which will not be elaborated here.

[0208] In a possible implementation, if the core network authentication is successful, the terminal device initiates random access. If the core network authentication is unsuccessful, the terminal device does not initiate random access.

[0209] Assuming that the first information indicates bidirectional authentication and the authentication to the core network is successful, S605 is continued to be executed after S604.

[0210] S605: The terminal device initiates random access.

[0211] The specific process can be found in the related description of S403, which will not be repeated here.

[0212] S606, the terminal device sends an authentication request message to the core network device through the network device.

[0213] The authentication request message carries a third verification value. The method for generating the third verification value can refer to the relevant description of S501, which will not be repeated here.

[0214] The authentication request message may also carry relevant parameters for generating a third verification value (such as an identifier of the terminal device, an index of a group key, a third random number, a first serial number, etc.).

[0215] S607, the AMF network element authenticates the terminal device.

[0216] Specifically, the AMF network element may generate a fourth verification value, and authenticate the terminal device according to the third verification value and the fourth verification value. For details, please refer to the relevant description of S503 and S504, which will not be described here.

[0217] Optionally, if the third verification value and the fourth verification value meet the second condition, the AMF network element can also send the third verification value and related parameters for generating the third verification value to the AUSF network element for further authentication.

[0218] In one possible implementation, if the terminal device is successfully authenticated, the AMF network element sends an authentication acceptance message to the terminal device through the network device. If the terminal device is authenticated unsuccessfully, the AMF network element may send an authentication failure message to the terminal device through the network device.

[0219] As a possible implementation method, after the terminal device and the core network have successfully performed two-way authentication, the terminal device and the core network (or network device) perform data transmission.

[0220] Example 2: Figure 7 As shown, the authentication methods include:

[0221] S701, the AF network element sends a service request to the AMF network element.

[0222] The service request can refer to the previous description, which will not be repeated here.

[0223] It should be understood that S601 is an optional step.

[0224] S702, the AMF network element sends a first paging message to the network device.

[0225] The first paging message may carry a service identifier (or an event identifier) ​​and an identifier of at least one terminal device (or a group identifier or mask information of a terminal device group).

[0226] Optionally, the first paging message may also carry first information. If the first information indicates one-way authentication, S705 to S707 are executed to authenticate the terminal device.

[0227] If the first information indicates two-way authentication and the terminal device is successfully authenticated, the first verification value is carried in the authentication acceptance message in S708, and S709 is continued to be executed to authenticate the core network.

[0228] S703: The network device sends a second paging message to the terminal device.

[0229] The second paging message may carry an identifier of at least one terminal device (or a group identifier or mask information of a terminal device group).

[0230] Optionally, the second paging message may also carry the first information.

[0231] S704, the terminal device initiates random access.

[0232] The second information may be carried in the message of the random access process. For example, the second information may be carried in message 3 (Msg3) or a random access request. If the second information indicates one-way authentication, S705 to S707 are executed to authenticate the terminal device.

[0233] If the second information indicates two-way authentication or the second paging message indicates two-way authentication, and the terminal device is successfully authenticated, the first verification value is carried in the authentication acceptance message in S708, and S709 is continued to be executed to authenticate the core network.

[0234] It should be noted that S702 to S703 and S704 are optional steps.

[0235] In one implementation, the terminal device and the core network may negotiate an authentication method through S702-S703. Optionally, in this method, S704 may be executed or may not be executed. If S704 is executed, the message of the random access process may not carry the second information.

[0236] In another implementation, the terminal device and the core network may negotiate the authentication method through S704. In this implementation, the network device may carry the second information in a subsequent authentication request message (such as the authentication request message of S706), thereby sending the second information to the AMF network element. Optionally, in this method, S702 to S703 may be executed or not. If S702 to S703 are executed, the first information may not be carried in the third paging message and the fourth paging message.

[0237] S705~S706 can refer to the above S606~S607, and will not be repeated here.

[0238] If the terminal device is authenticated successfully, the AMF network element sends an authentication acceptance message to the terminal device through the network device.

[0239] If the authentication of the terminal device fails, the AMF network element can send an authentication failure message to the terminal device through the network device.

[0240] Assume that the authentication mode indicated by the first information or the second information is two-way authentication, and the terminal device is successfully authenticated. Continue to execute S708.

[0241] S707, the AMF network element sends an authentication acceptance message to the terminal device through the network device.

[0242] The authentication acceptance message may carry a first verification value.

[0243] S708, the terminal device authenticates the core network.

[0244] Specifically, the terminal device may generate a second verification value, and authenticate the core network according to the first verification value and the second verification value. For details, please refer to the relevant description of S402 and S403, which will not be elaborated here.

[0245] Optionally, if the core network authentication is successful, the terminal device sends an authentication acceptance message to the AMF network element through the network device.

[0246] If the core network authentication is unsuccessful, the terminal device sends an authentication failure message to the AMF network element through the network device.

[0247] As a possible implementation, after the terminal device and the core network are successfully bidirectionally authenticated, the terminal device and the core network (or network device) perform data transmission.

[0248] This application sends a check value to the terminal device through the AMF network element, so that the terminal device can authenticate the core network, thereby preventing attacks from illegal networks or theft of user information by illegal networks. In addition, in this application, the generated check value is sent to the terminal device through the AMF network element, and the terminal device compares the check value generated by itself with the check value sent by the core network device, so that the core network can be authenticated, with a simple process and low power consumption.

[0249] Above Figure 5 Compared with the 5G authentication process, the process of the method only requires the terminal device to generate a verification value, and then the AMF network element can authenticate the terminal device by comparing the verification value generated by the terminal device with the reference value generated by itself. There is no need for UDM network elements and AUSF network elements to participate in the calculation of the core network verification value. The terminal device authentication process is simple, the power consumption is low, and it is more suitable for A-IoT devices.

[0250] Based on the same inventive concept as the method embodiment, the present application embodiment provides a communication device, the structure of which can be as follows: Figure 8 As shown, it includes a communication unit 801 and a processing unit 802.

[0251] In one embodiment, the communication device can be used to implement Figure 4 In the embodiment of the method performed by the terminal device, the device can be the terminal device itself, or a chip or a chipset in the terminal device or a part of the chip used to perform the function of the related method. Among them, the communication unit 801 is used to receive a first verification value from the core network device. The processing unit 802 is used to generate a second verification value, and authenticate the core network according to the first verification value and the second verification value.

[0252] Exemplarily, the first check value is carried in the first paging message.

[0253] Optionally, the processing unit 802, when generating the second verification value, is specifically used to: generate the second verification value according to at least one of the following: a first key, a first random number, or a second random number, or a first serial number, wherein the first key is a group key, the first random number is a random number indicated by the core network, the second random number is a generated random number, and the first serial number is a serial number for data packet transmission.

[0254] Optionally, the communication unit 801 is further used to: receive at least one of the following: an index of a group key, and a first random number.

[0255] Optionally, the communication unit 801 is further used to: send a random access request if the core network authentication is successful; or not send a random access request if the core network authentication is unsuccessful.

[0256] Optionally, the communication unit 801 is further used to: send a third verification value, where the third verification value is used to authenticate the terminal device.

[0257] Exemplarily, the third verification value is carried in the authentication request message.

[0258] Optionally, the processing unit 802 is also used to: generate a third verification value based on at least one of the following: a second key, or a third random number, or a first serial number, wherein the second key is a group key or a root key, the third random number is a generated random number, and the first serial number is a serial number of a data packet transmission.

[0259] Optionally, the communication unit 801 is further used to send at least one of the following: a third random number, a first serial number, or an identifier of the terminal device.

[0260] Optionally, the communication unit 801 is further used to: receive first information, where the first information is used to indicate whether the authentication method is one-way authentication or two-way authentication.

[0261] Optionally, the communication unit 801 is further used to: send second information, where the second information is used to indicate that the supported authentication method or the specified authentication method is one-way authentication or two-way authentication.

[0262] Exemplarily, the above-mentioned terminal device is an environmental Internet of Things terminal device.

[0263] In one embodiment, the communication device can be used to implement Figure 4 In the embodiment of the method performed by the core network device, the device can be the core network device itself, or a chip or a chipset in the core network device or a part of the chip used to perform the function of the related method. Among them, the processing unit 802 is used to receive a service request through the communication unit 801; and send a first verification value to the terminal device through the communication unit 801, and the first verification value is used to authenticate the core network.

[0264] Exemplarily, the first check value is carried in the second paging message.

[0265] Optionally, the processing unit 802 is further used to: generate a first verification value according to at least one of the following: a first secret key, a first random number, wherein the first secret key is a group secret key, and the first random number is a generated random number.

[0266] Optionally, the communication unit 801 is further used to: send at least one of the following: a group key, a first random number.

[0267] Optionally, the communication unit 801 is further used to: receive a third verification value, the third verification value is used to authenticate the terminal device; the processing unit 802 is further used to generate a fourth verification value; and authenticate the terminal device according to the first verification value and the fourth verification value.

[0268] Exemplarily, the third verification value is carried in the authentication request message.

[0269] Optionally, when generating the fourth verification value, the processing unit 802 is specifically used to: generate the fourth verification value according to at least one of the following: a second key, or a third random number, or a fourth random number, or a first serial number, wherein the second key is a group key or a root key, the third random number is a random number indicated by the terminal device, the fourth random number is a generated random number, and the first serial number is a data packet number indicated by the terminal device.

[0270] Optionally, the communication unit 801 is further used to: receive at least one of the following: a third random number, a first serial number, or an identifier of a terminal device.

[0271] Optionally, the communication unit 801 is further used to: send first information, where the first information is used to indicate whether the authentication method is one-way authentication or two-way authentication.

[0272] Optionally, the communication unit 801 is further used to: receive second information, where the second information is used to indicate that the authentication method supported by the terminal device or the specified authentication method is one-way authentication or two-way authentication.

[0273] Exemplarily, the above-mentioned terminal device is an environmental Internet of Things terminal device.

[0274] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. It is understood that the functions or implementations of each module in the embodiments of the present application may further refer to the relevant description of the method embodiment.

[0275] In one possible approach, the communication device may be as follows Fig. 9 As shown, the device can be a communication device or a chip in a communication device, wherein the communication device can be a terminal device in the above embodiment or a core network device in the above embodiment. The device includes a processor 901 and a communication interface 902, and can also include a memory 903. Among them, the processing unit 802 can be the processor 901. The communication unit 801 can be the communication interface 902. Optionally, the processor 901 and the memory 903 can also be integrated together.

[0276] The processor 901 may be a CPU, or a digital processing unit, etc. The communication interface 902 may be a transceiver, or an interface circuit such as a transceiver circuit, or a transceiver chip, etc. The device further includes: a memory 903 for storing programs executed by the processor 901. The memory 903 may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory (volatile memory), such as a random-access memory (RAM). The memory 903 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0277] The processor 901 is used to execute the program code stored in the memory 903, specifically to execute the actions of the processing unit 802, which will not be described in detail in this application. The communication interface 902 is specifically used to execute the actions of the communication unit 801, which will not be described in detail in this application.

[0278] The specific connection medium between the communication interface 902, the processor 901 and the memory 903 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 903, the processor 901 and the communication interface 902 are connected via a bus 904. Fig. 9 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0279] An embodiment of the present application also provides a computer-readable storage medium for storing computer software instructions required to be executed by the above-mentioned processor, which includes a program required to be executed by the above-mentioned processor.

[0280] The present application also provides a communication system, including a Figure 4 In the embodiment of the terminal device function and the communication device for realizing Figure 4 The communication device of the core network device function in the embodiment of the present invention may also include Figure 4 The communication device of the network device function in the embodiment.

[0281] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0282] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0283] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0284] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

Claims

1. An authentication method, characterized in that: The method comprises: Receiving a first verification value from a core network device; generating a second check value; The core network is authenticated according to the first verification value and the second verification value.

2. The method according to claim 1, characterized in that The first check value is carried in the first paging message.

3. The method according to claim 1 or 2, characterized in that The generating of the second check value comprises: The second check value is generated according to at least one of the following: a first key, a first random number, a second random number, or a first serial number, wherein the first key is a group key, the first random number is a random number indicated by the core network, the second random number is a generated random number, and the first serial number is a serial number for data packet transmission.

4. The method according to claim 3, characterized in that The method further comprises: Receive at least one of the following: an index of the group key, and the first random number.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the core network authentication is successful, sending a random access request; Alternatively, if the core network authentication is unsuccessful, no random access request is sent.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: A third verification value is sent, where the third verification value is used to authenticate the terminal device.

7. The method according to claim 6, characterized in that The third verification value is carried in the authentication request message.

8. The method according to claim 6 or 7, characterized in that The method further comprises: The third verification value is generated according to at least one of the following: a second key, a third random number, or a first serial number, wherein the second key is a group key or a root key, the third random number is a generated random number, and the first serial number is a serial number of a data packet transmission.

9. The method according to claim 8, characterized in that The method further comprises: Send at least one of the following: the third random number, the first serial number, or an identifier of the terminal device.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: First information is received, where the first information is used to indicate whether the authentication method is one-way authentication or two-way authentication.

11. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Sending second information, where the second information is used to indicate that the supported authentication method or the specified authentication method is one-way authentication or two-way authentication.

12. The method according to any one of claims 1 to 11, characterized in that: The method is applied to environmental Internet of Things terminal devices.

13. An authentication method, characterized in that: The method comprises: Receive service requests; A first verification value is sent to the terminal device, where the first verification value is used to authenticate the core network.

14. The method according to claim 13, characterized in that The first check value is carried in the second paging message.

15. The method according to claim 13 or 14, characterized in that The method further comprises: The first verification value is generated according to at least one of the following: a first secret key, a first random number, wherein the first secret key is a group secret key, and the first random number is a generated random number.

16. The method according to claim 15, characterized in that The method further comprises: Send at least one of the following: a group key and the first random number.

17. The method according to any one of claims 13 to 16, characterized in that: The method further comprises: receiving a third verification value, wherein the third verification value is used to authenticate the terminal device; generating a fourth check value; The terminal device is authenticated according to the first verification value and the fourth verification value.

18. The method according to claim 17, characterized in that The third verification value is carried in the authentication request message.

19. The method according to claim 17 or 18, characterized in that The generating of the fourth check value comprises: The fourth check value is generated according to at least one of the following: a second key, a third random number, a fourth random number, or a first serial number, wherein the second key is a group key or a root key, the third random number is a random number indicated by the terminal device, the fourth random number is a generated random number, and the first serial number is a data packet number indicated by the terminal device.

20. The method of claim 19, wherein: The method further comprises: Receive at least one of the following: the third random number, the first serial number, or an identifier of a terminal device.

21. The method according to any one of claims 13 to 20, characterized in that: The method further comprises: Sending first information, where the first information is used to indicate whether the authentication method is one-way authentication or two-way authentication.

22. The method according to any one of claims 13 to 20, characterized in that: The method further comprises: Receive second information, where the second information is used to indicate that the authentication method supported by the terminal device or the specified authentication method is one-way authentication or two-way authentication.

23. The method according to any one of claims 13 to 22, characterized in that The terminal device is an environmental Internet of Things terminal device.

24. A communication device, characterized in that: The method comprises a unit or module for executing the method according to any one of claims 1 to 12, or comprises a unit or module for executing the method according to any one of claims 13 to 23.

25. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed on the communication device, the method according to any one of claims 1 to 12 is executed, or the method according to any one of claims 13 to 23 is executed.

26. A computer program product, characterized in that When the computer program product is executed on a device, the device is caused to execute the method according to any one of claims 1 to 23.

Images