An authorization authentication method and related device

Abstract

The application provides a method for authorization authentication and related equipment, and relates to the technical field of wireless communication. The method is applied to a first intelligent agent running in a terminal device, and the method comprises the following steps: receiving a first authentication parameter configured by the terminal device, wherein the first authentication parameter comprises an identity of the terminal device, a temporary identity of the first intelligent agent, a proxy key and context information; determining a first challenge parameter based on a first random number and a specified generator; sending the identity, the context information and the first challenge parameter to a first network device; receiving a second authentication parameter sent by the first network device; and performing access authentication based on the second authentication parameter, the first challenge parameter, the temporary identity of the first intelligent agent and the proxy key. Thus, an access authentication method for AI Agent is provided, so that the AI Agent can independently participate in network access and secure communication.

Description

Technical Field

[0001] This application relates to the field of wireless communication technology, and in particular to an authorization and authentication method and related equipment. Background Technology

[0002] As communication networks evolve towards native intelligence, AI Agents (a type of intelligent agent) are gradually being introduced into both terminal devices and the network side to perform tasks such as perception, strategy, collaboration, and communication. By running AI Agents with a certain degree of autonomy, terminal devices can interact with the network side and participate in business processing on their behalf.

[0003] Currently, AI agents running on terminal devices cannot establish distinguishable identities in the network, nor can they form independent and secure context information. AI agents performing different tasks or having different functions on terminal devices can only share the same identity and session key, which can easily lead to potential security risks. Summary of the Invention

[0004] This application provides an authorization and authentication method, apparatus, system, program product, and readable storage medium. It provides an access authentication method for AI Agents, enabling AI Agents to independently participate in network access and secure communication under the authorization of terminal devices, thereby supporting the secure deployment and trusted operation of AI Agents in the network, and has good applicability and scalability.

[0005] Firstly, an authorization and authentication method is provided, which can be executed by a first intelligent agent in a terminal device, wherein the terminal device has pre-interacted with the network side to complete authentication. The method includes: the terminal device configuring first authentication parameters for the first intelligent agent to authorize the first intelligent agent to independently request authentication from the network, wherein the first authentication parameters include the terminal device's identity identifier, the first intelligent agent's temporary identity identifier, a proxy key, and context information. Additionally, the first intelligent agent determines first challenge parameters based on a first random number and a specified generator, wherein the first random number (e.g., i) can be randomly generated by the first intelligent agent. Then, the first intelligent agent sends an access authentication request to a first network device, the access authentication request including the identity identifier, context information, and the first challenge parameters, the access authentication request being used to request access authentication for the first intelligent agent. An access authentication response is received from the first network device, the access authentication response including second authentication parameters, thus the first intelligent agent performs access authentication based on the second authentication parameters, the first challenge parameters, the first intelligent agent's temporary identity identifier, and the proxy key.

[0006] As an example, the terminal device's identity is identified as SUCI or SUPI.

[0007] The temporary identity identifier of the first intelligent agent (such as...) ), proxy key (such as ) and contextual information (such as All of these are generated and configured by the terminal device for the first intelligent agent.

[0008] The second authentication parameter is determined by the first network device in interaction with the second network device after receiving the access authentication request. For example, the second authentication parameter includes a second random number, an authentication token, and a second challenge parameter. The second authentication parameter can be determined by the second network device and sent to the first network device, which then distributes it to the first intelligent agent.

[0009] Thus, an access authentication method for AI Agents is provided, enabling AI Agents to independently participate in network access and secure communication under the authorization of terminal devices, thereby supporting the secure deployment and trusted operation of AI Agents in the network, and has good applicability and scalability.

[0010] As an example, the context information includes the network identifier of the terminal device's serving network, for example, the network identifier is denoted as... The temporary identity is obtained by hashing the identity identifier, network identifier, and context information, as detailed in Formula 1 below. Thus, by determining the temporary identity based on the identity identifier, network identifier, and context information, the network side can parse the received temporary identity and perform authentication based on the parsing result.

[0011] As an example, the proxy key of the first agent is generated through a key derivation function based on the terminal device's first anchor key, temporary identity, and context information. The first anchor key is the key used between the terminal device and the AUSF network element. The method for determining the proxy key can be found in Formula 2 below.

[0012] In this way, a unique temporary identity and proxy key are dynamically generated from the first anchor key and the context in each session, realizing "one-time password" secure authorization and ensuring that the identity cannot be replayed and the authorization is unique.

[0013] As an example, context information includes one or more of the following: task information, policy label, state parameters, and timestamp. Task information indicates the task to be performed by the first agent; policy label indicates the policy associated with the first agent; state parameters characterize the first agent's operating environment and authorization conditions; and the timestamp records the current system time. Thus, by generating context information, the network side can determine whether the terminal device has subscribed to the AI ​​Agent service and / or is within the subscription authorization scope, thereby determining whether to allow the first agent to independently access the network and enabling effective authentication of the first agent.

[0014] As an example, the second authentication parameters include a second random number, an authentication token, and a second challenge parameter. In this case, access authentication is performed based on the second authentication parameters, the first challenge parameter, the temporary identity of the first agent, and the proxy key, including: key negotiation based on the first and second challenge parameters to obtain a first shared key, such as the first shared key being... The first shared key is hashed to obtain its hash value. The authentication token is then parsed to obtain the encrypted hash value of the second shared key, the first network device identifier (such as the AMF network element identifier), and the first message authentication code. Based on the proxy key, the hash value of the first shared key, and the second random number, the first anonymous key is determined. For example, if the first anonymous key is... Based on the first anonymous key, the encrypted hash value of the second shared key is decrypted to obtain the hash value of the third shared key. Access authentication is then performed based on the hash value of the third shared key, the hash value of the first shared key, and the first message authentication code. Thus, by obtaining the hash value of the third shared key, the hash value of the first shared key, and the first message authentication code on the first intelligent agent's side, the freshness and network-side legitimacy can be verified based on these parameters, thereby locally determining whether authentication is successful.

[0015] As an example, the specific implementation of access authentication based on the hash value of the third shared key, the hash value of the first shared key, and the first message authentication code may include: comparing the hash value of the third shared key with the hash value of the first shared key; if the hash value of the first shared key matches the hash value of the third shared key, the freshness verification is deemed successful. After the freshness verification, a second message authentication code is determined based on the proxy key, the second random number, the hash value of the third shared key, and the identifier of the first network device; if the second message authentication code matches the first message authentication code, the network-side legitimacy verification is deemed successful; a first expected hash response value is determined and sent to the first network device; upon receiving an authentication success message from the first network device, access authentication is confirmed to be successful. Thus, through freshness and network-side legitimacy verification, replay attacks can be effectively defended, and the security of the network side can be verified, thereby ensuring subsequent access to a reliable network.

[0016] As an example, determining the first expected hash response value includes: determining the first expected response value based on the proxy key, the second random number, and the hash value of the first shared key using an expected response generation function (see Formula 16 for details); determining the first expected derived response value based on the proxy key, the first shared key, the second random number, the network identifier, and the first expected response value using a key derivation function (see Formula 17 for details); and performing a hash calculation on the first expected derived response value and the second random number to obtain the first expected hash response value (see Formula 18 for details). Thus, by determining the first expected hash response value and sending it to the first network device, the first network device can determine whether the authentication result of the first intelligent agent side is the same as the authentication result of the second network device side, based on the first expected hash response value and the second expected hash response value generated by the second network device, thereby determining whether the access authentication is successful.

[0017] As an example, the method further includes: upon successful access authentication, generating an authentication server function key and a security anchor function key. The authentication server function key is generated based on a proxy key, a first shared key, a second random number, a first network device identifier, a temporary identity identifier, and the hash value of the first shared key. The security anchor function key is generated based on the authentication server function key and a network identifier. Exemplarily, the authentication server function key is an AUSF anchor key, used for subsequent data encryption between the first agent and the AUSF network element; the security anchor function key is a SEAF anchor key, used for subsequent data encryption between the first agent and the SEAF function network element.

[0018] This allows the first intelligent agent to independently interact with the network using the authentication server function key and the security anchor function key, thereby supporting the secure deployment and trusted operation of AI agents within the network.

[0019] Secondly, an authorization and authentication method is provided. This method can be executed by a first network device, or by a component (such as a circuit, chip, or chip system) configured in the first network device, or by a logic module or software capable of implementing all or part of the terminal device's functions. This application does not limit this approach. The following description uses a network device as an example. The method includes:

[0020] The system receives an access authentication request from a first intelligent agent. This request includes the identity of the terminal device running the first intelligent agent, the context information of the first intelligent agent, and a first challenge parameter. The access authentication request is used to request access authentication for the first intelligent agent. An access authentication request is then sent to a second network device, such as an AUSF network element. A proxy authentication vector is received from the second network device. Based on the proxy authentication vector, an access authentication response is generated, including a second authentication parameter, and sent to the first intelligent agent. In this way, acting as an interaction bridge between the first intelligent agent and the AUSF network element, by receiving the first intelligent agent's access authentication request, sending an access authentication request to the second network device to request access authentication, and returning an access authentication response to the first intelligent agent, the AI ​​Agent can independently participate in network access and secure communication under the authorization of the terminal device. This supports the secure deployment and trusted operation of the AI ​​Agent in the network, demonstrating good applicability and scalability.

[0021] As an example, the proxy authentication vector includes a second random number, an authentication token, and a second challenge parameter. Generating an access authentication response based on the proxy authentication vector involves encapsulating the second random number, authentication token, and second challenge parameter into an access authentication response. The second authentication parameter includes the second random number, authentication token, and second challenge parameter. Thus, by encapsulating the second random number, authentication token, and second challenge parameter into an access authentication response and sending it to the first agent, the first agent can perform local authentication based on the data generated by the second network device.

[0022] As an example, the proxy authentication vector also includes a second expected hash response value. The method further includes receiving the first expected hash response value sent by the first agent. If the first expected hash response value and the second expected hash response value are the same, the first expected hash response value is sent to the second network device. The first expected hash response value is used to verify whether the first agent has passed access authentication. Thus, a security verification is performed before sending the first expected hash response value to the second network device, and only after successful verification is the secure and reliable data (i.e., the first expected hash response value) sent to the second network device, thereby avoiding security risks to the second network device.

[0023] As an example, the second network device includes a first network element and a second network element, such as the first network element being an AUSF network element and the second network element being a UDM network element. Thus, sending an access authentication request to the second network device includes: sending an access authentication request to the first network element, so that the first network element can authenticate the access of the first intelligent agent based on the access authentication request. Additionally, the first network device extracts an identity identifier and the context information of the first intelligent agent from the access authentication request, and sends the identity identifier and context information to the second network element, so that the second network element can authenticate the first intelligent agent and its associated terminal device, and determine the subscription authorization scope, thereby effectively authenticating the access of the first intelligent agent.

[0024] Thirdly, an authorization and authentication method is provided. This method can be executed by a second network device, or by a component (such as a circuit, chip, or chip system) configured in the second network device, or by a logic module or software capable of implementing all or part of the functions of the terminal device. This application does not limit this. The following description uses a network device as an example. The method includes:

[0025] The system receives an access authentication request from a first network device. The access authentication request includes the identity identifier of the terminal device running the first intelligent agent, the context information of the first intelligent agent, and a first challenge parameter. The access authentication request is used to request access authentication for the first intelligent agent. Based on the access authentication request, a proxy authentication vector is determined. The proxy authentication vector is sent to the first network device; this proxy authentication vector is used for the first intelligent agent's access authentication.

[0026] Thus, an access authentication method for AI Agents is provided, enabling AI Agents to independently participate in network access and secure communication under the authorization of terminal devices, thereby supporting the secure deployment and trusted operation of AI Agents in the network, and has good applicability and scalability.

[0027] As an example, based on the access authentication request, the proxy authentication vector is determined, including: obtaining the terminal device's first anchor key based on the identity identifier; determining the first agent's temporary identity identifier based on the first anchor key, the identity identifier, and context information; determining the first agent's proxy key based on the first anchor key, the temporary identity identifier, and context information; and determining the proxy authentication vector based on the temporary identity identifier, the proxy key, and a first challenge parameter. Thus, by obtaining the first anchor key, the first agent's temporary identity identifier and proxy key are recalculated on the second network device side to generate the proxy authentication vector used for authentication, thereby achieving access authentication for the first agent.

[0028] As an example, based on the temporary identity, proxy key, and first challenge parameters, the proxy authentication vector is determined, including: determining the second challenge parameters based on a third random number and a specified generator; negotiating a key based on the first and second challenge parameters to obtain a second shared key; hashing the second shared key to obtain its hash value; and constructing the proxy authentication vector based on the proxy key, second challenge parameters, second shared key hash value, and second random number. Thus, by obtaining the proxy key, second challenge parameters, second shared key hash value, and second random number, the proxy authentication vector is constructed so that after some parameters in the proxy authentication vector are sent to the first agent, the first agent can perform authentication calculations on the edge, thereby completing access authentication.

[0029] As an example, a proxy authentication vector is constructed based on the proxy key, the hash value of the second shared key, and the second random number. This includes: determining an authentication token based on the proxy key, the second shared key, the second random number, and the hash value of the second shared key; and determining a second expected hash response value based on the proxy key, the second random number, the second shared key, the network identifier, and the hash value of the second shared key, where the network identifier indicates the serving network of the terminal device. The proxy authentication vector is then constructed based on the second random number, the authentication token, the second challenge parameter, and the second expected hash response value. After some parameters from the proxy authentication vector are sent to the first agent, the first agent can perform authentication calculations on the terminal side, thereby completing access authentication.

[0030] As an example of this application, determining an authentication token based on a proxy key, a second shared key, a second random number, and a hash value of the second shared key includes: generating a second anonymous key using an anonymous key generation function based on the proxy key, the hash value of the second shared key, and the second random number; encrypting the hash value of the second shared key using the second anonymous key to obtain an encrypted hash value of the second shared key; generating a first message authentication code using a message authentication code generation function based on the proxy key, the second random number, the hash value of the second shared key, and a first network device identifier; and constructing an authentication token, wherein the authentication token includes the encrypted hash value of the second shared key, the first network device identifier, and the first message authentication code.

[0031] As an example of this application, determining the second expected hash response value based on the proxy key, the second random number, the second shared key, the network identifier, and the hash value of the second shared key includes: generating the second expected response value using an expected response generation function based on the proxy key, the second random number, and the hash value of the second shared key; determining the second expected derived response value using a key derivation function based on the proxy key, the second shared key, the second random number, the network identifier, and the second expected response value; and performing a hash calculation on the second expected derived response value and the second random number to obtain the second expected hash response value. Thus, by determining the second expected hash response value, it is possible to subsequently compare the second expected hash response value with the first expected hash response value calculated by the first agent to determine whether the network-side calculation result is consistent with the terminal-side calculation result. Since the calculation of the first and second expected hash response values ​​is based on the same parameters, if these two values ​​are the same, it can be determined that the authentication of the first agent has passed.

[0032] As an example, the method further includes: receiving a first expected hash response value sent by a first network device; if the first expected hash response value is the same as a second expected hash response value, then determining that the first agent's access authentication is successful. As mentioned above, since the first expected hash response value and the second expected hash response value are calculated based on the same parameters, if these two values ​​are the same, it can be determined that the authentication of the first agent is successful.

[0033] As an example of this application, the method further includes: upon successful access authentication, generating an authentication server function key and a security anchor function key. The authentication server function key is generated based on a proxy key, a first shared key, a second random number, a network identifier, a temporary identity identifier, and a hash value of the second shared key. The security anchor function key is generated based on the authentication server function key and the network identifier. Exemplarily, the authentication server function key is an AUSF anchor key, used for subsequent data encryption between the first agent and the AUSF network element; the security anchor function key is a SEAF anchor key, used for subsequent data encryption between the first agent and the SEAF functional network element.

[0034] This allows the first intelligent agent to independently interact with the network using the authentication server function key and the security anchor function key, thereby supporting the secure deployment and trusted operation of AI agents within the network.

[0035] As an example of this application, the second network device includes a first network element and a second network element. The first network element receives an access authentication request; the second network element receives the identity identifier of the terminal device and the context information of the first intelligent agent sent by the first network device; based on the identity identifier and context information, when the second network element determines that the terminal device has the authority to authorize the first intelligent agent to initiate access authentication, it generates a second random number; the second network element sends the second random number to the first network element, and the second network element sends the second random number back to the first network element for the first network element to perform access authentication on the first intelligent agent. For example, the first network element is an AUSF network element, and the second network element is a UDM network element. Thus, after the second network element authenticates the first intelligent agent and its associated terminal device, and determines the subscription authorization scope, it generates a second random number and sends the second random number to the first network element, which then authenticates the access of the first intelligent agent based on the access authentication request, thereby enabling effective authentication of the first intelligent agent's access.

[0036] Fourthly, a communication system is provided, the communication system including a first intelligent agent, a first network device, and a second network device, wherein the first intelligent agent operates in a terminal device and includes:

[0037] The first intelligent agent receives first authentication parameters configured by the terminal device. These first authentication parameters include the terminal device's identity identifier, the first intelligent agent's temporary identity identifier, a proxy key, and context information. Based on a first random number and a specified generator, the first intelligent agent determines a first challenge parameter. The first intelligent agent then sends an access authentication request to the first network device. This access authentication request includes the identity identifier, the context information, and the first challenge parameter. The access authentication request is used to request access authentication for the first intelligent agent.

[0038] The first network device sends the access authentication request to the second network device and determines a proxy authentication vector based on the access authentication request. The second network device sends the proxy authentication vector to the first network device. The first network device generates an access authentication response based on the proxy authentication vector, the access authentication response including a second authentication parameter. The first network device sends the access authentication response to the first agent. The first agent performs access authentication based on the second authentication parameter, the first challenge parameter, the temporary identity of the first agent, and the proxy key in the access authentication response.

[0039] Optionally, the communication system may also include other devices that communicate with terminal devices and / or network devices.

[0040] Fifthly, a communication device is provided, comprising a processing module and a transceiver module, the communication device being configured to execute a program or instruction as described in the first aspect above, or to execute a program or instruction as described in the second aspect above, or to execute a program or instruction as described in the third aspect above.

[0041] A sixth aspect provides a communication device including a processor. The processor is coupled to a memory and can be used to execute instructions or data in the memory to implement the method in any possible implementation of the first aspect, or the method in any possible implementation of the second aspect, or the method in any possible implementation of the third aspect. Optionally, the communication device further includes a memory.

[0042] Optionally, the processor may be one or more, and the memory may be one or more.

[0043] In a seventh aspect, a computer program product is provided, the computer program product comprising: a computer program (also referred to as code or instructions), which, when the computer program is run, causes a computer to perform the method in any possible implementation of the first aspect, or to perform the method in any possible implementation of the second aspect, or to perform the method in any possible implementation of the third aspect.

[0044] Eighthly, a computer-readable storage medium is provided that stores a computer program (also referred to as code or instructions) that, when executed on a computer, causes the computer to perform the method in any possible implementation of the first aspect, or the method in any possible implementation of the second aspect, or the method in any possible implementation of the third aspect.

[0045] Ninthly, embodiments of this application provide a chip system including one or more processors for calling and executing instructions stored in memory, causing the methods in any of the above aspects or possible implementations to be executed. The chip system may be composed of chips or may include chips and other discrete devices.

[0046] The chip system may include input circuits or interfaces for transmitting information or data, and output circuits or interfaces for receiving information or data. Attached Figure Description

[0047] Figure 1This is a schematic diagram illustrating a communication system according to an exemplary embodiment;

[0048] Figure 2 This is a flowchart illustrating an authorization and authentication method according to an exemplary embodiment;

[0049] Figure 3 This is a schematic diagram illustrating a verification process according to an exemplary embodiment;

[0050] Figure 4 This is a schematic diagram illustrating a method for constructing a proxy authentication vector according to an exemplary embodiment;

[0051] Figure 5 This is a schematic flowchart illustrating a method for local authentication calculation and network-side legitimate verification according to an exemplary embodiment;

[0052] Figure 6 This is a schematic block diagram illustrating a communication device according to an exemplary embodiment. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0054] It should be understood that "multiple" as mentioned in this application refers to two or more. In the description of this application, unless otherwise stated, " / " indicates "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist, for example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, to facilitate a clear description of the technical solutions of this application, the terms "first," "second," etc., are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or execution order, and that "first," "second," etc., do not necessarily imply differences.

[0055] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0056] The authorization and authentication method for AI Agents provided in this application is applied to a communication system. This communication system can be a 5th generation (5G) communication system, a 6th generation (6G) communication system, or a new communication system emerging in the future development of wireless communication; this application does not limit this. The communication system may include terminal equipment, access network equipment, a core network, and an Internet-protocol Multimedia Subsystem (IMS) or the Internet. In some examples, the access network equipment, core network, and IMS / Internet can be collectively referred to as the Network (NW) side; they are all network devices.

[0057] Figure 1 This is a schematic diagram of a communication system to which the technical solutions provided in the embodiments of this application are applicable, such as... Figure 1 As shown, the communication system includes user equipment (UE) and a 5G NW. The 5G NW can be deployed in a standalone (SA) configuration. The 5G NW may include a 5G base station 01, a core network 02, and an IMS 03. A communication connection is established between the 5G base station 01 and the 5G core network 02, and a communication connection is established between the 5G core network 02 and the IMS 03.

[0058] The UE can be a smartphone (e.g., a phone running Android or iOS), tablet computer, laptop computer, PDA, mobile internet device (MID), wearable device (e.g., smartwatch, smart bracelet), or other terminal device capable of accessing the internet. In this embodiment, the terminal device can be a separately sold terminal or a chip within a terminal.

[0059] As an example, a terminal device stores user information, which may include a subscription permanent identifier (SUPI). SUPI is the secure evolution of the International Mobile Subscriber Identification Number (IMSI) in the 5G architecture. The terminal device can use this user information as an identity identifier to initiate or receive calls through various voice solutions. When the terminal device first accesses the network or requires identity verification, it typically does not send the SUPI. Instead, it encrypts the SUPI using the home network's public key, generating a temporary, unrecoverable subscription concealed identifier (SUCI) in its place. This means the SUPI is not exposed over the air, thus protecting user privacy.

[0060] 5G base station 01 can be a next-generation NodeB (gNB). UE can access 5G base station 01 through 5G new radio (NR) access technology and communicate with core network 02 through 5G base station 01. That is, 5G base station 01 and UE communicate through NR link.

[0061] The 5G core network O2 can have functions such as connection management and session control, user management and authentication, and data routing and forwarding. The network elements in the 5G core network O2 are functional virtual units, which may include, but are not limited to: access and mobility management function (AMF) network elements, unified data management (UDM) network elements, and authentication server function (AUSF) network elements.

[0062] AMF network elements can perform registration, connection, reachability, and mobility management, and provide authentication and authorization functions for UE access.

[0063] UDM network elements are used to store and manage core user data, which includes user identity information (such as SUPI), subscription information, authentication credentials, etc. In the core network, the encrypted SUCI sent by the terminal device is usually decrypted into the real SUPI through UDM network elements.

[0064] AUSF network elements can support the 5G-authentication and keyagreement (5G-AKA) authentication process. AUSF network elements verify the legitimacy of user identity by interacting with AMF and UDM network elements. For example, when a terminal device accesses the network for the first time, the AMF network element initiates an authentication request to the AUSF network element, and the AUSF network element obtains the user's subscription information from the UDM network element, generates an authentication vector, and returns it to the AMF network element, thereby achieving two-way authentication.

[0065] It should be noted that each network element in the core network can also be called a functional entity. It can be a network element implemented on dedicated hardware, a software instance running on dedicated hardware, or an instance of virtualized function on an appropriate platform.

[0066] It should be understood that the names of all network elements in this application are merely examples. In future communications, they may be referred to by other names, or the network elements involved in this application may be replaced by other entities or devices with the same function, etc., and this application does not limit their use in this regard. This is a unified explanation here and will not be repeated later. Optionally, the various network elements in the embodiments of this application may be communication devices, or chips or chip systems that can be used in such communication devices, etc., and this application does not limit their use in this regard.

[0067] In some embodiments, some network elements can be deployed on the same entity, such as UDM network elements and AUSF network elements can be deployed in a network device.

[0068] Understandable Figure 1 The core network in the network architecture shown may also include other devices, network elements, network entities, or network subsystems, such as policy control function (PCF) network elements, etc., which are not limited in this application. It should be noted that this application does not limit the distribution of each network element in the core network. For details on the distribution, please refer to relevant technical documents, which will not be elaborated here.

[0069] In this embodiment, the terminal device or network device includes a hardware layer, an operating system layer running on top of the hardware layer, and an application layer running on top of the operating system layer. The hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also called main memory). The operating system can be any one or more computer operating systems that implement business processing through processes, such as Linux, Unix, Android, iOS, or Windows. The application layer includes applications such as browsers, address books, word processing software, and instant messaging software. Furthermore, this embodiment does not specifically limit the structure of the execution entity of the method provided in this embodiment, as long as it can communicate according to the method provided in this embodiment by running a program that records the code of the method provided in this embodiment.

[0070] In traditional communication technologies, terminal devices are somewhat passive when interacting with the network and processing services. As communication networks evolve towards native intelligence, AI agents are gradually being introduced into both the terminal device and network sides to perform tasks such as perception, policy, collaboration, and communication. For example, in typical application scenarios like vehicle-to-everything (V2X), industrial internet, and digital twins, terminal devices run AI agents with a degree of autonomy to interact with the network and participate in service processing on their behalf. An AI agent is an intelligent agent; one or more AI agents can run within a terminal device. Multiple AI agents can share the terminal device's resources, but each AI agent has its own independent sandbox environment. Different AI agents can perform different tasks, enabling multi-tasking in parallel. Multiple AI agents can collaborate and solve complex problems, and terminal devices can adapt AI agents to different scenarios. Compared to traditional communication models, AI agents may proactively initiate access or service requests to the network based on different tasks, policies, or environmental states, thus placing new demands on network access management and security mechanisms.

[0071] The 3rd Generation Partnership Project (3GPP), in its Rel-20 phase studies, has clearly stated that AI Agents will become important participating entities in the network architecture, no longer limited to auxiliary functional modules within terminal devices. For example, in TR22.870, 3GPP systematically analyzed typical application scenarios and capability requirements for AI Agents, proposing that AI Agents need to support independent network interaction, cross-domain collaboration, and secure access capabilities. Furthermore, document S2-2508037 (WT#3.2 NetforAIv5) proposes that network devices should support the interaction capabilities between AI Agents and network functions; document S3-253680 further emphasizes the need to establish a systematic identity management, authorization, and authentication mechanism for AI Agents to support their trusted operation within the network.

[0072] However, despite the aforementioned standards research and proposals clearly defining the capability requirements for AI Agents, existing 5G / 6G security architectures still rely solely on terminal devices for access authentication. According to the 5G-AKA process defined in TS33.501, the terminal device's identity identifier (SUPI / SUCI) and key system are designed at the terminal device level, assuming that no autonomous entity requiring separate identification and management exists within the terminal device. Under this network architecture, AI Agents running on the terminal device side cannot establish distinguishable identities within the network, nor can they form independent and secure context information. AI Agents performing different tasks or with different functions within the terminal device can only share the same identity and session key.

[0073] Meanwhile, existing standards have not defined an authorization and authentication mechanism for AI agents by terminal devices. The network side cannot determine the legitimate source of the AI ​​agent or its authorization and authentication status, nor can it independently authorize, authenticate, control permissions, or manage sessions. In multi-tasking or complex business scenarios, this can easily lead to blurred security boundaries, difficulty in subdividing permissions, and potential security risks. These issues have been clearly identified as key challenges that future 6G intelligent agent networks need to address in TR22.870 and proposals such as S2-2508037 and S3-253680, but current standards have not yet provided specific implementation mechanisms.

[0074] Based on this, the embodiments of this application provide an authorization and authentication method. While maintaining compatibility with the existing 5G / 6G core network authentication system, this method introduces an identity generation, authorization binding, and access authentication mechanism for AI Agents, enabling AI Agents to independently participate in network access and secure communication under the authorization of terminal devices, thereby supporting the secure deployment and trusted operation of AI Agents in the network.

[0075] The authorization and authentication method provided in this application can be applied to scenarios such as network resource maintenance, negotiation, and scheduling, as well as scenarios such as executing third-party tasks. For ease of understanding, several exemplary application scenarios are described below:

[0076] In an exemplary application scenario, users engage in multiplayer online games using terminal devices. The terminal device can monitor network quality and user behavior through an AI Agent (such as a Game Agent) to dynamically formulate network resource allocation strategies. For instance, when network latency exceeds a specific threshold (e.g., 100ms), the Game Agent can automatically switch the game data stream to a dedicated service channel through network resource scheduling. This can be achieved by marking the game process with a higher Quality of Service (QoS) level in the terminal's network stack, thus ensuring high priority and low latency for game data transmission and reducing network latency throughout the game. Additionally, the terminal device can simultaneously initiate voice calls through another AI Agent (such as a VoIP Agent). Optionally, the VoIP Agent can negotiate with the Game Agent to intelligently enhance voice quality to ensure clarity.

[0077] In another exemplary application scenario, a user needs to upload a large (e.g., 1GB) design draft to the company's cloud storage while participating in a video conference. The terminal device can run an AI Agent (such as FileTransferAgent) to analyze the file type, use a lossless compression algorithm to reduce the size to 30%, and split the design draft into 10 blocks, uploading them to different server nodes in parallel via multi-threading. Simultaneously, the electronic device uses another AI Agent (such as VOIPAgent) to allocate dedicated bandwidth for the video conference and dynamically adjusts the resolution to ensure smooth playback.

[0078] In another exemplary application scenario, a user opens a video app on the subway and selects a 4K high-definition movie to play. The terminal device detects that the current network is a 5G network, but the signal strength fluctuates. StreamAgent dynamically reduces the bitrate to 1080p and preloads the next 5 minutes of content to avoid buffering. Furthermore, the terminal device also restricts network access for background applications through another AI agent (such as batteryAgent) to prioritize power consumption for video playback.

[0079] It should be noted that the above application scenarios are merely exemplary and do not limit the application of the authorization and authentication method provided in this application embodiment. In another example, this method can also be widely applied to various 6G and future network scenarios. For instance, in the vehicle-to-everything (V2X) scenario, multiple AI Agents can run inside the vehicle terminal. These AI Agents are responsible for autonomous driving, cooperative perception, and vehicle-to-infrastructure (V2I) communication, respectively. The method provided in this application embodiment can provide independent authentication and security contexts for different AI Agents, supporting fine-grained access control and task isolation. Furthermore, in the industrial internet scenario, AI Agents inside industrial terminals or edge control devices can represent different production tasks and interact with the network. The method provided in this application embodiment can ensure that the access behavior of each AI Agent is identifiable and authenticable, thereby improving the security and reliability of the industrial control system.

[0080] The specific implementation of the authorization and authentication method provided in the embodiments of this application will be described below. See also Figure 2 , Figure 2 This is a flowchart illustrating an authorization and authentication method according to an exemplary embodiment, which can be applied to... Figure 1 In the communication system shown, the interaction between the terminal device, the AI ​​Agent, and the network side is implemented. Before executing the following authorization and authentication process, the terminal device has completed identity authentication through the 5G-AKA mechanism, established a terminal-level security context with the network side, and obtained the corresponding anchor key (hereinafter referred to as the first anchor key) and session security capabilities. That is, the terminal device is in a registered and communicable network access state. The network side includes AMF network elements, UDM network elements, and AUSF network elements. The terminal device or AI Agent interacts with the AMF network elements through access network devices (such as base stations), which will not be described in detail below. For example, the method may include some or all of the following:

[0081] S201: The terminal device creates the first intelligent agent.

[0082] As an example, a terminal device can create a first intelligent agent based on one or more of the following: tasks, policies, and environmental conditions. Tasks include, but are not limited to, network resource management, scheduling, and third-party tasks; policies include network access permissions and data access permissions, where network access permissions can refer to the types of network functions that are allowed to be accessed; and environmental conditions include the terminal device's battery status, load, geographical location, and application status.

[0083] For example, when a terminal device needs to call an AI Agent to perform a specific task or needs an AI Agent to interact with the network side on behalf of the terminal device, it creates a corresponding AI Agent (i.e., the first intelligent agent) based on one or more of the task, policy, and environmental state. For example, as mentioned above, when a user uses a terminal device to play a multiplayer online game, the terminal device creates a Game Agent to monitor network quality and user behavior. In this case, the Game Agent is the first intelligent agent.

[0084] Optionally, before creating the first intelligent agent, the terminal device can determine whether the conditions for participating in network access and communication through the first intelligent agent are met, thereby deciding whether to create the first intelligent agent. For example, the terminal device evaluates the channel quality based on QoS requirements. If the channel quality meets the QoS requirements, it determines that the conditions for participating in network access and communication through the first intelligent agent are met; otherwise, if the channel quality does not meet the QoS requirements, it determines that the conditions for participating in network access and communication through the first intelligent agent are not met. If the conditions are met, the terminal device creates the first intelligent agent, thus ensuring the efficiency of creating the first intelligent agent.

[0085] S202: The terminal device determines the first authentication parameters.

[0086] The first authentication parameters are used by the first intelligent agent to request access authentication from the network side. The first authentication parameters include the identity identifier of the terminal device, the temporary identity identifier of the first intelligent agent, the proxy key, and context information.

[0087] As an example, the identity of the terminal device is During deployment, the UDM network element generates an asymmetric key pair, including a private key and a public key. The public key is configured for the terminal device, while the private key is stored by the UDM network element. The terminal device uses the public key to define its permanent user identifier. Encryption processing is performed to obtain When interacting with the network, the terminal device uses this This avoids direct use This leads to the leakage of user privacy. Based on this, the terminal device will... As an authentication parameter, so that UDM network elements can be used in subsequent authentication processes. Identify the terminal device to which the first intelligent agent belongs.

[0088] In another example, the identity of the terminal device could also be This application does not limit the scope of the embodiments.

[0089] A temporary identity is used to uniquely identify the first intelligent agent; for example, the temporary identity is denoted as... .

[0090] The proxy key is used for the first agent's access authentication and is the root key from which all keys of the first agent are derived.

[0091] The context information is a set of context parameters used for identity derivation and authorization binding of the first intelligent agent. The context information includes network identifiers and task information, and may also include, but is not limited to, one or more of policy tags, state parameters, and timestamps. Specifically, task information indicates the task that the first intelligent agent needs to perform; policy tags indicate the policy associated with the first intelligent agent; state parameters include environmental state parameters of the terminal device and / or state parameters associated with the current decision and access behavior, reflecting the operating environment and authorization conditions of the first intelligent agent, where authorization conditions refer to conditions related to the current decision and access behavior; the network identifier indicates the service network of the terminal device; and the timestamp records the current system time. For example, the context information is denoted as... .

[0092] In one example, the terminal device determines the first authentication parameters by: obtaining context information for the first intelligent agent's access; generating a temporary identity for the first intelligent agent based on the context information; and generating a proxy key for the first intelligent agent based on the temporary identity, the context information, and the first anchor key. The first anchor key is the anchor key used between the terminal device and the AUSF network element.

[0093] For example, after creating the first intelligent agent, the terminal device generates context information for this first intelligent agent's access, and then, based on its own... Based on contextual information, a temporary identity identifier for the first intelligent agent is generated. For example, the terminal device will... After concatenating the network identifier and context information, a hash calculation is performed on the concatenation result to obtain the temporary identity identifier of the first intelligent agent. See Formula 1 below for the specific implementation:

[0094] (Formula 1)

[0095] in, For network identification; The hash function is represented by ; || is the string concatenation operator.

[0096] To enable the first intelligent agent to support independent network interaction and secure access capabilities, the terminal device further generates a proxy key for the first intelligent agent. As an example, the terminal device generates the proxy key for the first intelligent agent based on the temporary identity, context information, and the first anchor key using a key derivation function. The specific implementation is shown in Formula 2 below:

[0097] (Formula 2)

[0098] in, The agent key representing the first intelligent agent; This represents the first anchor key, which is the anchor key used between the terminal device and the AUSF network element. This represents the key derivation function.

[0099] In this way, a unique temporary identity and proxy key are dynamically generated from the first anchor key and the context in each session, realizing "one-time password" secure authorization and ensuring that the identity cannot be replayed and the authorization is unique.

[0100] S203: The terminal device sends the identity identifier, temporary identity identifier, proxy key and context information to the first intelligent agent.

[0101] As an example, terminal devices rely on their own identity identifiers (such as...) ), and the temporary identity identifier generated for the first intelligent agent ( ), proxy key ( ) and contextual information ( A binding message is generated, for example, the binding message is Agent_Binding_Message. The terminal device sends this binding message to the first agent through an internal secure channel, thereby authorizing the first agent to participate in subsequent network access authentication with an independent identity under the corresponding context and decision conditions. In this way, multi-dimensional binding of context information, identity, environment, task and timeliness is integrated in the subsequent key derivation process.

[0102] It should be noted, of course, that the embodiments in this application are used during the authorization and authentication process. For example, in another example, a terminal device can also be used. Authorization and authentication are performed, and the binding message carries this information. You don't need to carry it. This application does not limit the scope of the embodiments.

[0103] S204: The first agent stores the proxy key.

[0104] After receiving the Agent_Binding_Message from the terminal device, the first agent extracts the proxy key carried within and securely stores it. This proxy key is then used to decrypt and verify the authentication token received from the network side, thus confirming the network's legitimacy. Furthermore, this proxy key serves as the root of the key system, used to derive other keys for the first agent. Its specific implementation is detailed below.

[0105] S205: The first agent generates the first challenge parameters.

[0106] The first challenge parameter can be used to achieve two-way authentication and key negotiation, while avoiding the direct transmission of secret information in the channel.

[0107] The first agent can generate a first random number, such as i, and then determine the first challenge parameter based on a predefined specified generator and the first random number i. For example, the first agent determines the first challenge parameter using the following formula (iii):

[0108] (Formula 3)

[0109] in, Indicates the first challenge parameter. This indicates a predefined specified generator.

[0110] S206: The first intelligent agent sends an access authentication request to the AMF network element. The access authentication request carries the identity identifier, context information and the first challenge parameter.

[0111] The access authentication request is used to request access authentication for the first intelligent agent.

[0112] The first intelligent agent obtains the first challenge parameters based on calculations ( ), context information ( ) and the identity identifier of the terminal device ( Construct an access authentication request. If the access authentication request is N1_Message, the first agent sends the access authentication request to the AMF network element to trigger the subsequent authentication process for the first agent.

[0113] S207: The AMF network element sends its identity and context information to the UDM network element, and sends an access authentication request to the AUSF network element.

[0114] After receiving an access authentication request from the first intelligent agent, the AMF network element can extract the identity identifier from the access authentication request. and context information Then and The request is sent to the UDM network element, and the AMF network element sends an access authentication request to the AUSF network element. This enables the AUSF network element and the UDM network element to collaboratively authenticate the first agent's access.

[0115] S208: The UDM network element performs verification operations based on context information and identity identifier, and generates a second random number when the verification is successful.

[0116] As an example, see Figure 3 The specific implementation of step S208 may include the following sub-steps A1 to A5:

[0117] A1: UDM network elements verify the integrity and compliance of context information.

[0118] UDM network elements check context information Check if the specified field is included, and check the context information. Does the format conform to the specified format? If If the specified field is included, then confirm. Complete, meaning the integrity check has passed, if If the format matches the specified format, then confirm. Compliance verification passed.

[0119] Both the specified fields and the specified format can be set according to actual needs. For example, the specified fields include, but are not limited to, one or more of the following: task information, policy label, status parameters, network identifier, and timestamp.

[0120] In the context information If the integrity and compliance of the information are verified to be satisfactory, proceed to step A2 below. Otherwise, if the context information is... If the integrity and / or compliance verification fails, the subsequent process can be skipped. Optionally, in the event of a failed verification, the UDM network element can send an authentication failure message to the first intelligent agent. The authentication failure message can indicate to the user that authentication failed, and may also include the reason for the failure, such as incomplete context information.

[0121] A2: UDM network element is based on Retrieve subscription configuration information for terminal devices.

[0122] As an example, subscription configuration information includes subscription instruction information and subscription configuration content.

[0123] The subscription instruction information is used to indicate whether the terminal device subscribes to the AI ​​Agent service. If the AI ​​Agent service is subscribed to, the AI ​​Agent in the terminal device is allowed to perform independent authentication. If the AI ​​Agent service is not subscribed to, the AI ​​Agent in the terminal device is not allowed to perform independent authentication.

[0124] As an example, the subscription configuration includes, but is not limited to, a set of task information and a set of policy tags. It may also include service time information, activation status information, and the number of concurrent sessions. The task information set includes the task information of the subscribed tasks; the policy tag set includes the policy tags of the subscribed policies; the service time information indicates the validity period of the AI ​​Agent service. For example, the service time information includes the subscription start time and subscription duration, such as a subscription start time of xx year xx month xx day and a subscription duration of 3 months, or the service time information includes a specific valid time period; the activation status information indicates whether the subscribed AI Agent service is active; and the number of concurrent sessions limits the maximum number of AI Agents that a terminal device can independently access the network.

[0125] As an example, UDM network elements Decryption process to obtain As mentioned earlier, when a UDM network element is deployed, it generates a pair of asymmetric keys, including a private key and a public key. The public key is configured for the terminal device, and the terminal device uses the public key to... After encryption Thus, when the UDM network element receives... At that time, the private key held by the user can be used to perform a decryption operation, thereby obtaining the original identity of the terminal device. Additionally, the UDM network element stores... With the corresponding subscription configuration information, the UDM network element is decrypted and obtained. Afterwards, based on Obtain the subscription configuration information of the terminal device.

[0126] A3: The UDM network element determines whether the terminal device has subscribed to the AI ​​Agent service and / or whether it is within the scope of the subscription authorization based on the subscription configuration information.

[0127] For example, the UDM network element determines whether the terminal device has subscribed to the AI ​​Agent based on the subscription instruction information in the subscription configuration information, and checks the context information. Do the task information, policy tags, etc. in the subscription match the subscription configuration content? For example, if If the task information in the subscription configuration belongs to the task information set in the subscription configuration content, and the policy tag belongs to the policy tag set in the subscription configuration content, then a match is determined; otherwise, if If the task information in the subscription configuration does not belong to the task information set in the subscription configuration content, and / or the policy tag does not belong to the policy tag set in the subscription configuration content, then a mismatch is determined. If a match is found, it is determined to be within the subscription authorization scope. In this case, the UDM network element continues to execute subsequent operations. If a mismatch is found, it is determined to be outside the subscription authorization scope. In this case, the UDM network element determines that authentication has failed, for example, by sending an authentication failure message to the first agent through the AMF network element.

[0128] It is worth mentioning that the UDM network element is based on Retrieve the subscription configuration information of the terminal device, and based on the subscription configuration information, determine whether the terminal device has subscribed to the AI ​​Agent service and / or whether it is within the scope of the subscription authorization, thereby ensuring effective authentication of the first intelligent agent.

[0129] A4: UDM network element verifies the authorization status of the terminal device.

[0130] UDM network elements can be based on terminal devices The UDM network element checks the service validity period, subscription activation status, and concurrent session limits to confirm whether the terminal device is authorized to use the AI ​​Agent service. For example, based on the service time information in the subscription configuration, the UDM network element determines whether the first agent's access authentication request is within the service validity period; and / or, based on the activation status information in the subscription configuration, checks whether the AI ​​Agent service subscribed to by the terminal device is active; and / or, based on the concurrent session limit in the subscription configuration, checks whether the number of AI Agents authorized for independent authentication by the terminal device exceeds the subscribed limit. If the UDM network element confirms that the terminal device is authorized to use the AI ​​Agent service, it continues with subsequent operations; otherwise, authentication fails.

[0131] As an example, UDM network elements can also be based on context information. The timestamp in the data is used to verify whether the access authentication request is within a valid time window, for example, by... The timestamp in the time frame is compared with the current time. If the time difference between the two is less than a preset time threshold, the access authentication request is determined to be within the valid time window. Otherwise, if the time difference is greater than or equal to the time threshold, the access authentication request is determined to be outside the valid time window. This verifies the freshness of the access authentication request and prevents replay attacks.

[0132] A5: The UDM network element generates a second random number.

[0133] If all the above verifications pass, the UDM network element generates a second random number. .

[0134] It should be noted that steps S207 to S208 are optional operations. In another example, the context information may not be required. The AMF network element will perform the verification. Send to the UDM network element, then the UDM network element... Decrypt to obtain And generate a second random number. Then, perform the following operation S209.

[0135] S209: UDM network element sends to AUSF network element And the second random number.

[0136] UDM network elements will decrypt the identity identifier Second random number It is sent to the AUSF network element so that subsequent operations such as authentication vector generation can be performed through the AUSF network element.

[0137] S210: AUSF network element based on Locate the first anchor key.

[0138] The first anchor key is stored in the AUSF network element. and Thus, the AUSF network element receives the identity identifier sent by the UDM network element. Second random number Afterwards, according to Retrieve the first anchor key .

[0139] S211: AUSF network element based on The temporary identity of the first agent is recalculated using context information.

[0140] Context information This is obtained by the AUSF network element after receiving the access authentication request from the AMF network element and parsing the request. Of course, after parsing the access authentication request, the first challenge parameter carried within it can also be obtained. .

[0141] AUSF network elements will identify the terminal devices. Context information of the first intelligent agent Includes network identifiers and context information The system performs character concatenation and then hashes the concatenation result to obtain a temporary identity identifier for the first agent. For its specific implementation, please refer to Formula 1 above.

[0142] S212: The AUSF network element generates a proxy key based on the temporary identity, context information, and the first anchor key.

[0143] AUSF network elements are based on temporary identity identifiers ( ), context information ( ) and the first anchor key of the terminal device ( The proxy key for the first agent is generated through a key derivation function, the specific implementation of which is described in Formula 2 above. AUSF network element generates the proxy key. Used to generate proxy authentication vectors, see below for details.

[0144] It is worth mentioning that the AUSF network element calculates the temporary identity and proxy key required for the authentication process based on the parameters reported by the first intelligent agent, thus avoiding the security risks caused by directly transmitting the temporary identity and proxy key.

[0145] S213: AUSF network element constructs proxy authentication vector.

[0146] As an example, see Figure 4 The implementation of constructing a proxy authentication vector for AUSF network elements can include the following sub-steps B1 to B4:

[0147] B1: Determine the second shared key and the hash value of the second shared key.

[0148] In implementation, the AUSF network element generates a third random number, for example, the third random number is j. Then, based on the predefined specified generator and the third random number j, the second challenge parameter is determined by the following formula (iv):

[0149] (Formula 4)

[0150] in, This is the second challenge parameter.

[0151] The AUSF network element determines the second shared key based on the first challenge parameter and the second challenge parameter, and performs a hash calculation on the second shared key to obtain the hash value of the second shared key.

[0152] For example, the AUSF network element performs an Elliptic Curve Diffie-Hellman (ECDH) key negotiation operation based on the first challenge parameter and the second challenge parameter to calculate the second shared key. Perform a hash operation on the second shared key to obtain its hash value. Second shared key hash value It is 256 bits.

[0153] In one example, the AUSF network element can use the second shared key hash value as a session freshness identifier to replace the sequence number (SQN) in the traditional AKA process. In subsequent authentication processes, the AUSF network element constructs a proxy authentication vector based on the second shared key hash value and sends the session freshness identifier to the first agent, enabling the first agent to recognize the second shared key hash value. Performing freshness verification can avoid the state maintenance and resynchronization problems caused by counter-based synchronization mechanisms.

[0154] In another example, since the traditional SQN is 48 bits, the AUSF network element can also hash the second shared key. Perform a truncation operation to obtain the hash value of the second shared key. The first 48 bits are used as a session freshness identifier, for example, denoted as , In this case, during subsequent calculations, the following method is used: replace This involves computation, which improves authentication randomness and eliminates synchronization overhead. The following example illustrates this using the hash value of the second shared key as a session freshness identifier.

[0155] After determining the second shared key and the hash value of the second shared key, the AUSF network element constructs a proxy authentication vector based on the proxy key, the second shared key, the hash value of the second shared key, and the second random number. The specific implementation is described below.

[0156] B2: Determine the authentication token based on the proxy key, the second shared key, the second random number, and the hash value of the second shared key.

[0157] The AMF identifier can be obtained by the AUSF network element when the AMF network element sends an access authentication request to the AUSF network element.

[0158] In one example, the specific implementation of the AMF network element determining the authentication token based on the proxy key, the second shared key, the second random number, and the hash value of the second shared key includes: generating a second anonymous key using an anonymous key generation function based on the proxy key, the hash value of the second shared key, and the second random number; encrypting the hash value of the second shared key using the second anonymous key to obtain an encrypted second shared key hash value; generating a first message authentication code using a message authentication code generation function based on the proxy key, the second random number, the hash value of the second shared key, and the AMF identifier; and constructing an authentication token, which includes the encrypted hash value of the second shared key, a first network device identifier, and the first message authentication code.

[0159] For example, the AUSF network element is based on the agent key of the first intelligent agent. Second shared key hash value Second random number The second anonymity key is determined using the following formula five:

[0160] (Formula 5)

[0161] in, This represents the second anonymous key. It is an anonymous key generation function defined in the standard.

[0162] The AUSF network element performs an XOR operation on the hash values ​​of the second anonymous key and the second shared key to encrypt the hash value of the second shared key, obtaining the encrypted hash value. .

[0163] AUSF network elements are based on proxy keys. Second shared key hash value Second random number and AMF logo The first message authentication code is determined using the following formula six:

[0164] (Formula 6)

[0165] in, Represents the first message authentication code. It is a message authentication code generation function defined in the standard.

[0166] AUSF network elements are based on the hash value of the encrypted second shared key. First Message Authentication Code and AMF logo The authentication token is constructed using the following formula seven:

[0167] (Formula 7)

[0168] in, Represents an authentication token; Represents the XOR operation. and The XOR operation yields an encrypted string, that is... It is an encrypted string.

[0169] B3: Determine the second expected hash response value based on the proxy key, the second random number, the second shared key, the network identifier, and the hash value of the second shared key.

[0170] As an example, the specific implementation of step B2 may include: generating a second expected response value based on the proxy key, the second random number, and the hash value of the second shared key using an expected response generation function; determining a second expected derived response value based on the proxy key, the second shared key, the second random number, the network identifier, and the second expected response value using a key derivation function; and performing a hash calculation on the second expected derived response value and the second random number to obtain a second expected hash response value.

[0171] For example, AUSF network elements are based on proxy keys Second shared key hash value Second random number The second expected response value is calculated using the following formula:

[0172] (Formula 8)

[0173] in, This represents the second expected response value. It is a response generation function defined in the standard.

[0174] Then, the AUSF network element is based on the proxy key. Second shared key Second random number The first security parameter is determined using the following formula (nine), and the parameter is based on the proxy key. Second shared key Second random number The second safety parameter is determined using the following formula:

[0175] (Formula Nine)

[0176] (Formula 10)

[0177] in, First safety parameter; This indicates the second safety parameter. It is a standard-defined function for generating cryptographic keys. It is a standard-defined integrity key generation function.

[0178] AUSF network elements are based on the second expected response value. First safety parameter Second safety parameter Network Identifier Second random number The second expected derived response value is determined using Formula 11:

[0179] (Formula Eleven)

[0180] in, This represents the second expected derived response value.

[0181] Subsequently, the AUSF network element determines the second expected hash response value based on the second expected derived response value and the second random number using the following formula:

[0182] (Formula 12)

[0183] in, This represents the second expected hash response value.

[0184] B4: Construct the proxy authentication vector based on the second random number, authentication token, second challenge parameter, and second expected hash response value.

[0185] Upon obtaining the second expected hash response value, the AUSF network element generates a proxy authentication vector, which includes a second random number. Authentication token Second challenge parameters and the second expected hash response value This is to facilitate subsequent access authentication of the first intelligent agent using the proxy authentication vector.

[0186] S214: The AUSF network element sends a proxy authentication vector to the AMF network element.

[0187] For example, the proxy authentication vector is denoted as 5G SE AV. The AUSF network element can encapsulate the 5G SE AV into an authentication proxy response message, such as denoted as Nausf_Agent_Authentication_Response, which carries the 5G SE AV. The AUSF network element sends Nausf_Agent_Authentication_Response to the AMF network element to send the proxy authentication vector to the AMF network element.

[0188] S215: The AMF network element sends the second random number, authentication token, and second challenge parameter from the agent authentication vector to the first agent.

[0189] For example, the AMF network element parses the proxy authentication vector from the proxy authentication response message and extracts the second random number from the proxy authentication vector. Authentication token Second challenge parameters and the first expected hash response value The AMF network element will use the second random number in the proxy authentication vector. Authentication token Second challenge parameters The first expected hash response value is sent to the first intelligent agent and stored. .

[0190] In one example, the AMF network element will generate a second random number. Authentication token Second challenge parameters Encapsulate it as an access authentication response, such as an Authentication_Request, and send the Authentication_Request to the first agent via a non-access stratum (NAS) signaling connection, thereby passing the second random number. Authentication token Second challenge parameters Send to the first intelligent agent.

[0191] S216: The first intelligent agent performs local authentication calculation and network-side legality verification based on the second random number, the authentication token, and the second challenge parameters.

[0192] In implementation, see Figure 5 The first intelligent agent is based on the second random number. Authentication token Second challenge parameters The main implementation steps for local authentication calculation and network-side legality verification can be as follows (1)-(7):

[0193] (1) Determine the first shared key based on the first challenge parameter and the received second challenge parameter.

[0194] After receiving the Authentication_Request from the AMF network element, the first agent parses it to obtain the second random number. Authentication token Second challenge parameters The first intelligent agent is based on its own stored first challenge parameters. With the received second challenge parameter Key negotiation is performed, which involves executing ECDH operations to determine the first shared key. , .

[0195] It is understood that, assuming the data has not been illegally attacked, the first shared key and the second shared key are the same. In this embodiment, the distinction between the two shared keys is made solely by identifying who generated the data. The first agent determines the first shared key to verify the freshness of the session freshness identifier.

[0196] (2) Perform a hash calculation on the first shared key to obtain the hash value of the first shared key.

[0197] (3) Calculate the first anonymous key based on the proxy key, the hash value of the first shared key, and the second random number.

[0198] For example, the first intelligent agent is based on the agent key. First shared key hash value Second random number The first anonymous key is determined using the following formula (13):

[0199] (Formula Thirteen)

[0200] in, This represents the first anonymous key.

[0201] (4) Decrypt the hash value of the encrypted second shared key based on the first anonymous key to obtain the hash value of the third shared key.

[0202] According to Formula 7, the authentication token Includes the encrypted second shared key hash value AMF logo And First Message Authentication Code By using the authentication token After parsing, these parameters can be obtained, which can then be used to verify the validity of network testing.

[0203] As mentioned above, It is an encrypted string, and the first agent uses a first anonymous key. The hash value of the encrypted second shared key is XORed to decrypt the hash value of the third shared key. See Formula Fourteen for the specific implementation.

[0204] (Formula Fourteen)

[0205] in, It is the hash value of the third shared key.

[0206] (5) Compare the hash value of the third shared key with the hash value of the first shared key.

[0207] If the hash value of the third shared key is the same as the hash value of the first shared key, then the hash value of the third shared key is the hash value of the second shared key generated by the AUSF network element. Because the hash value of the second shared key is based on the proxy key by the AUSF network element. Second shared key hash value Second random number It's encrypted, so if the decrypted hash value of the third key is the same as the locally calculated hash value of the first shared key, then it means... It is fresh, thus confirming that the freshness verification of the session freshness identifier has passed.

[0208] In this way, freshness verification can ensure the freshness of authentication, defend against replay attacks, maintain network and terminal device synchronization to avoid authentication interruption, and ensure that key derivation is based on the latest state, thereby improving session security.

[0209] (6) If the freshness verification passes, calculate the second message authentication code.

[0210] The first agent is based on the proxy key. Third shared key hash value Second random number and AMF logo The second message authentication code is determined using the following formula (fifteen):

[0211] (Formula 15)

[0212] in, This represents the second message authentication code.

[0213] (7) Perform network-side legality authentication based on the second message verification code.

[0214] The first agent can compare the second message authentication code with the first message authentication code. If This indicates that the first message authentication code includes a proxy key. and AMF logo This confirms that the AUSF network element has successfully acquired these two parameters. It also states that the first message authentication code includes a second random number, thus confirming that the first message authentication code is complete, and consequently, that the network-side legitimacy verification has passed. Otherwise, if and If they are different, the network-side validity verification has failed. If the verification passes, proceed with subsequent operations; if the verification fails, authentication fails.

[0215] S217: After successful verification, the first agent determines the first expected hash response value.

[0216] The first agent is based on a proxy key. Second random number First shared key hash value and AMF logo The first expected response value is determined using the following formula sixteen:

[0217] (Formula Sixteen)

[0218] in, This represents the first expected response value.

[0219] S218: The first intelligent agent determines the first expected derived response value based on the agent key, the first shared key, the second random number, the network identifier, and the first expected response value.

[0220] In implementation, the first intelligent agent uses the proxy key and the first shared key. Second random number Determine the first security parameter and the second security parameter. Then, based on the first security parameter, the second security parameter, the network identifier, the second random number, and the first expected response value, determine the first expected derived response value using the following formula seventeen:

[0221] (Formula 17)

[0222] in, This represents the first expected derived response value.

[0223] S219: The first agent determines the first expected hash response value based on the first expected derived response value and the second random number.

[0224] Based on the second random number and the first expected derived response value The first expected hash response value is determined using the following formula (18):

[0225] (Formula 18)

[0226] in, This represents the first expected hash response value.

[0227] S220: The first agent sends the first expected hash response value to the AMF network element.

[0228] As an example, the first intelligent agent encapsulates the first expected hash response value in an authentication response message, such as the authentication response message being Authentication_Response, and sends the authentication response message to the AMF network element via the NAS signaling connection.

[0229] In addition, the first agent calculates and stores the AUSF anchor key and the SEAF anchor key. The AUSF anchor key is used for interaction between the first agent and the AUSF network element, while the SEAF anchor key is used for interaction between the first agent and the SEAF. The SEAF is a functional module in the AMF network element, which is responsible for the initial access and authentication of the first agent. For example, when the first agent attempts to access the 5G network, the request will reach the SEAF, which is responsible for initiating the entire authentication process.

[0230] In implementation, the first intelligent agent can calculate the AUSF anchor key using the following formula nineteen, and the SEAF anchor key using the following formula twentieth:

[0231] (Formula 19)

[0232] (Formula 20)

[0233] in, Represents the AUSF anchor key. This represents the SEAF anchor key.

[0234] In this way, security context synchronization with the core network is achieved, while some computation and verification are completed on the first intelligent agent side, significantly reducing authentication round-trip latency and enhancing the intelligent security collaboration capability of the first intelligent agent.

[0235] S221: The AMF network element verifies the first expected hash response value.

[0236] The AMF network element parses the Authentication_Response, extracts the first expected hash response value, and compares the second expected hash response value with the first expected hash response value. If they are the same, the verification is considered successful; otherwise, the verification is considered unsuccessful.

[0237] If the verification passes, proceed to step S221; otherwise, if the verification fails, the first agent's authentication is deemed to have failed. In this case, the AMF network element rejects the first agent's access and terminates the authentication process.

[0238] It is worth mentioning that the AMF network element verifies the first expected hash response value instead of directly executing the S221 operation. This can prevent the AMF network element from sending insecure data to the AUSF network element, thereby avoiding affecting the security of the AUSF network element.

[0239] S222: After the verification is successful, the AMF network element sends the first expected hash response value to the AUSF network element.

[0240] S223: The AUSF network element verifies the first expected hash response value based on the stored second expected hash response value.

[0241] The SAUSF network element determines whether the first expected hash response value and the second expected hash response value are the same. If they are the same, the verification is considered successful; otherwise, the verification is considered unsuccessful. If the verification is successful, the AUSF network element determines that the first intelligent agent's access authentication is successful; otherwise, the AUSF network element determines that the first intelligent agent's access authentication is unsuccessful.

[0242] S224: After successful authentication, the AUSF network element returns an authentication success message to the AMF network element.

[0243] A successful authentication message is used to indicate that the first agent has successfully completed authentication. For example, the successful authentication message is Nausf_AgentAuthentication_Authentication_Response.

[0244] The successful authentication message includes the temporary identity of the first agent and the SEAF anchor key. The SEAF anchor key is generated by the AUSF network element using a key derivation function, based on the AUSF anchor key and the network identifier, as detailed in Formula 19. The AUSF anchor key is generated by the AUSF network element using a key derivation function, based on the first security parameter. Second safety parameter Network Identifier First shared key hash value and the temporary identity of the first intelligent agent The generated formula is shown in Formula 20.

[0245] In this way, the first intelligent agent and the core network independently calculate and negotiate to generate a consistent session key through the authentication interaction process, thereby achieving bidirectional verifiable secure association and shared key synchronization.

[0246] S225: The AMF network element establishes the access security context corresponding to the first intelligent agent based on the temporary identity identifier and the SEAF anchor key.

[0247] After receiving the authentication success message, the AMF network element performs a hash calculation based on the temporary identity and the SEAF anchor key to obtain the session identifier associated with the first agent, for example, through the following formula twenty-one:

[0248] (Formula 21)

[0249] in, This represents the session identifier, which serves as an index for uniquely identifying and quickly retrieving all security contexts established for this authentication.

[0250] AMF network elements derive base station keys based on session identifiers and SEAF anchor keys, as implemented using formula twenty-two:

[0251] (Formula 22)

[0252] in, This represents the base station key.

[0253] Then, the base station key and session identifier are sent to the base station accessed by the first agent. Of course, after the first agent sends the first expected hash response value to the AMF network element, it will also determine the session identifier and base station key locally. Subsequent communication data between the first agent and the base station will be protected for confidentiality and integrity based on the base station key.

[0254] This completes the authorization and authentication process for the first intelligent agent.

[0255] It is understood that the embodiments of this application are illustrated using a single first intelligent agent as an example. In another example, the terminal device may run multiple first intelligent agents simultaneously. For any one of the multiple first intelligent agents, it can be performed according to... Figure 2 Authorization and authentication are performed using processes that are the same or similar to those used in the implementation examples.

[0256] In this embodiment, the terminal device configures first authentication parameters for a first AI agent. These parameters include the terminal device's identity identifier, the first AI agent's temporary identity identifier, a proxy key, and context information. The first AI agent determines first challenge parameters based on a first random number and a specified generator, and then sends an access authentication request to a first network device. This access authentication request includes the identity identifier, context information, and the first challenge parameters, requesting access authentication for the first AI agent. The first AI agent receives an access authentication response from the first network device. This response includes second authentication parameters determined by the network side, such as a second random number, an authentication token, and the second challenge parameters. The first AI agent performs access authentication based on the second authentication parameters, the first challenge parameters, the first AI agent's temporary identity identifier, and the proxy key. This provides an access authentication method for AI agents, enabling them to independently participate in network access and secure communication under the authorization of the terminal device. This supports the secure deployment and trusted operation of AI agents in the network, demonstrating good applicability and scalability.

[0257] In addition, the method provided in this application embodiment is nested and integrated with the 5G-AKA authentication process, keeping the original key derivation chain structure unchanged, while extending to the internal intelligent agent of the terminal, so as to achieve the unity of compatibility, security and intelligent collaboration.

[0258] Figure 6 A schematic block diagram of a communication device provided in an embodiment of this application is shown. The communication device 1800 can be a terminal device / network device, or a chip, chip system, or processor within the terminal device / network device that implements the above-described methods. This device can be used to implement the methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0259] The communication device 1800 may include one or more processors 1810, which may also be referred to as processing units, and can implement certain control functions. The processor 1810 may be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit. The baseband processor can be used to process communication protocols and communication data, while the central processing unit can be used to control the communication device, execute software programs, and process data from the software programs.

[0260] In an alternative design, the processor 1810 may also store instructions and / or data that can be executed by the processor 1810 to cause the communication device 1800 to perform the methods described in the above method embodiments.

[0261] In another alternative design, the communication device 1800 may include a communication interface 1820 for implementing receiving and transmitting functions. For example, the communication interface 1820 may be a transceiver circuit, interface, interface circuit, or transceiver. The transceiver circuit, interface, interface circuit, or transceiver for implementing receiving and transmitting functions may be separate or integrated. The aforementioned transceiver circuit, interface, interface circuit, or transceiver may be used for reading and writing code / data, or it may be used for transmitting or relaying signals.

[0262] Optionally, the communication device 1800 may include one or more memories 1830, which may store instructions that can be executed on the processor 1810, causing the communication device 1800 to perform the methods described in the above method embodiments. Optionally, the memories 1830 may also store data. Optionally, the processor 1810 may also store instructions and / or data. The processor 1810 and the memories 1830 may be provided separately or integrated together.

[0263] It should be understood that, in one possible design, the steps in the method embodiments provided in this application can be implemented by integrated logic circuits in the processor's hardware or by instructions in software form. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are not provided here.

[0264] It should be noted that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiments can be completed by the integrated logic circuitry in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied as execution by a hardware decoding processor, or as a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above methods.

[0265] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0266] This application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute the various steps or processes executed by the terminal device / network device in any of the above method embodiments.

[0267] This application also provides a computer-readable storage medium storing program code that, when run on a computer, causes the computer to execute the various steps or processes performed by the terminal device / network device in any of the above method embodiments.

[0268] This application also provides a communication device, including a processor and an interface, the interface being used to send and / or receive signals, causing the processor to execute the various steps or processes executed by the terminal device / network device in any of the above method embodiments.

[0269] The above-described device and method embodiments are completely corresponding, with corresponding modules or units performing corresponding steps. For example, a communication unit or communication interface performs the receiving or sending steps in the method embodiment, while other steps besides sending and receiving can be performed by a processing unit or processor.

[0270] In the embodiments of this application, the terms and English abbreviations are exemplary examples given for ease of description and should not be construed as limiting the application in any way. The embodiments of this application do not preclude the possibility of defining other terms that can achieve the same or similar functions in existing or future agreements.

[0271] The terms “component,” “module,” “system,” etc., used in this specification are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process and / or an execution thread, and components may be located on a single computer and / or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable storage media on which various data structures are stored. Components can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, such as the Internet interacting with other systems via signals).

[0272] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0273] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be based on the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0274] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0275] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0276] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0277] In the above embodiments, the functions of each functional unit can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0278] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially or in other words, the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of software products. These computer software products are stored in a storage medium and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0279] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0280] Furthermore, various aspects or features of this application can be implemented as methods, apparatus, or articles of manufacture using standard programming and / or engineering techniques. The term "article of manufacture" as used herein encompasses a computer program accessible from any computer-readable device, carrier, or medium. For example, computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes), optical discs (e.g., compact discs (CDs), digital versatile discs (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memory (EPROMs), cards, sticks, or key drives, etc.). Additionally, the various storage media described herein may represent one or more devices and / or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

Claims

1. A method for authorization and authentication, characterized in that, Applied to a first intelligent agent, which runs in a terminal device, the method includes: The terminal device receives a first authentication parameter configured by the terminal device, the first authentication parameter including the identity identifier of the terminal device, the temporary identity identifier of the first intelligent agent, the proxy key and context information; Determine the first challenge parameters based on the first random number and the specified generator; Send an access authentication request to the first network device. The access authentication request includes the identity identifier, the context information, and the first challenge parameter. The access authentication request is used to request access authentication for the first intelligent agent. Receive an access authentication response sent from the first network device, wherein the access authentication response includes a second authentication parameter; Access authentication is performed based on the second authentication parameters, the first challenge parameters, the temporary identity of the first intelligent agent, and the proxy key.

2. The method as described in claim 1, characterized in that, The context information includes the network identifier of the service network of the terminal device; the temporary identity identifier is obtained by hashing the identity identifier, the network identifier, and the context information.

3. The method as described in claim 1 or 2, characterized in that, The proxy key is generated using a key derivation function based on the terminal device's first anchor key, the temporary identity identifier, and the context information.

4. The method as described in claim 1 or 2, characterized in that, The context information includes one or more of the following: task information, policy label, state parameters, and timestamp. The task information is used to indicate the task to be executed by the first agent. The policy label is used to indicate the policy associated with the first agent. The state parameters are used to characterize the operating environment and authorization conditions of the first agent. The timestamp is used to record the current system time.

5. The method as described in claim 1 or 2, characterized in that, The second authentication parameters include a second random number, an authentication token, and a second challenge parameter; The access authentication based on the second authentication parameter, the first challenge parameter, the temporary identity of the first intelligent agent, and the proxy key includes: Based on the first challenge parameter and the second challenge parameter, a key negotiation is performed to obtain a first shared key; Perform a hash calculation on the first shared key to obtain the hash value of the first shared key; The authentication token is parsed to obtain the encrypted second shared key hash value, the first network device identifier, and the first message authentication code; The first anonymous key is determined based on the proxy key, the hash value of the first shared key, and the second random number; Based on the first anonymous key, the encrypted hash value of the second shared key is decrypted to obtain the hash value of the third shared key; Access authentication is performed based on the hash value of the third shared key, the hash value of the first shared key, and the first message authentication code.

6. The method as described in claim 5, characterized in that, The access authentication based on the third shared key hash value, the first shared key hash value, and the first message authentication code includes: Compare the hash value of the third shared key with the hash value of the first shared key; If the hash value of the first shared key matches the hash value of the third shared key, the freshness verification is deemed successful. After freshness verification, a second message authentication code is determined based on the proxy key, the second random number, the hash value of the third shared key, and the first network device identifier; If the second message authentication code is the same as the first message authentication code, then the network-side legality verification is confirmed to be successful. Determine a first expected hash response value and send the first expected hash response value to the first network device; Upon receiving a successful authentication message from the first network device, the access authentication is confirmed to be successful.

7. The method as described in claim 6, characterized in that, Determining the first expected hash response value includes: Based on the proxy key, the second random number, and the hash value of the first shared key, the first expected response value is determined using the expected response generation function; Based on the proxy key, the first shared key, the second random number, the network identifier, and the first expected response value, the first expected derived response value is determined through a key derivation function; The first expected derived response value and the second random number are hashed to obtain the first expected hash response value.

8. The method as described in claim 5, characterized in that, The method further includes: Upon successful access authentication, an authentication server function key and a security anchor function key are generated. The authentication server function key is generated based on the proxy key, the first shared key, the second random number, the first network device identifier, the temporary identity identifier, and the hash value of the first shared key. The security anchor function key is generated based on the authentication server function key and the network identifier.

9. An authorization and authentication method, characterized in that, Applied to a first network device, the method includes: The system receives an access authentication request from a first intelligent agent. The access authentication request includes the identity identifier of the terminal device running the first intelligent agent, the context information of the first intelligent agent, and a first challenge parameter. The access authentication request is used to request access authentication for the first intelligent agent. Send the access authentication request to the second network device; Receive the proxy authentication vector sent by the second network device; Based on the proxy authentication vector, an access authentication response is generated, which includes a second authentication parameter. Send the access authentication response to the first intelligent agent.

10. The method as described in claim 9, characterized in that, The proxy authentication vector includes a second random number, an authentication token, and a second challenge parameter; Based on the proxy authentication vector, an access authentication response is generated, including: The second random number, the authentication token, and the second challenge parameter are encapsulated into the access authentication response, wherein the second authentication parameter includes the second random number, the authentication token, and the second challenge parameter.

11. The method as described in claim 9, characterized in that, The proxy authentication vector also includes a second expected hash response value, and the method further includes: Receive the first expected hash response value sent by the first intelligent agent; If the first expected hash response value is the same as the second expected hash response value, the first expected hash response value is sent to the second network device. The first expected hash response value is used to verify whether the first intelligent agent has passed access authentication.

12. The method as described in claim 9, characterized in that, The second network device includes a first network element and a second network element. Sending the access authentication request to the second network device includes: Send the access authentication request to the first network element; The method further includes: Extract the identity identifier and the context information of the first intelligent agent from the access authentication request; The identity identifier and the context information are sent to the second network element.

13. An authorization and authentication method, characterized in that, Applied to a second network device, the method includes: The system receives an access authentication request sent by a first network device. The access authentication request includes the identity identifier of the terminal device running by the first intelligent agent, the context information of the first intelligent agent, and a first challenge parameter. The access authentication request is used to request access authentication for the first intelligent agent. Based on the access authentication request, determine the proxy authentication vector; The proxy authentication vector is sent to the first network device, and the proxy authentication vector is used for the first intelligent agent's access authentication.

14. The method as described in claim 13, characterized in that, The step of determining the proxy authentication vector based on the access authentication request includes: Based on the identity identifier, obtain the first anchor key of the terminal device; Based on the first anchor key, the identity identifier, and the context information, a temporary identity identifier for the first intelligent agent is determined; Based on the first anchor key, the temporary identity identifier, and the context information, the agent key of the first intelligent agent is determined; The proxy authentication vector is determined based on the temporary identity, the proxy key, and the first challenge parameter.

15. The method as described in claim 14, characterized in that, Determining the proxy authentication vector based on the temporary identity, the proxy key, and the first challenge parameter includes: The second challenge parameters are determined based on the third random number and the specified generator. Based on the first challenge parameter and the second challenge parameter, a key negotiation is performed to obtain a second shared key; Perform a hash calculation on the second shared key to obtain the hash value of the second shared key; The proxy authentication vector is constructed based on the proxy key, the second challenge parameter, the hash value of the second shared key, and the second random number.

16. The method as described in claim 15, characterized in that, The process of constructing the proxy authentication vector based on the proxy key, the hash value of the second shared key, and the second random number includes: The authentication token is determined based on the proxy key, the second shared key, the second random number, and the hash value of the second shared key; Based on the proxy key, the second random number, the second shared key, the network identifier, and the hash value of the second shared key, a second expected hash response value is determined, wherein the network identifier is used to indicate the service network of the terminal device; The proxy authentication vector is constructed based on the second random number, the authentication token, the second challenge parameter, and the second expected hash response value.

17. The method as described in claim 16, characterized in that, The step of determining the authentication token based on the proxy key, the second shared key, the second random number, and the hash value of the second shared key includes: Based on the proxy key, the hash value of the second shared key, and the second random number, a second anonymous key is generated using an anonymous key generation function; The hash value of the second shared key is encrypted using the second anonymous key to obtain the encrypted hash value of the second shared key; Based on the proxy key, the second random number, the hash value of the second shared key, and the first network device identifier, a first message authentication code is generated using a message authentication code generation function; The authentication token is constructed, which includes an encrypted second shared key hash value, the first network device identifier, and the first message authentication code.

18. The method as described in claim 16 or 17, characterized in that, The step of determining the second expected hash response value based on the proxy key, the second random number, the second shared key, the network identifier, and the hash value of the second shared key includes: Based on the proxy key, the second random number, and the hash value of the second shared key, a second expected response value is generated using the expected response generation function; Based on the proxy key, the second shared key, the second random number, the network identifier, and the second expected response value, the second expected derivation response value is determined through a key derivation function; The second expected derived response value and the second random number are hashed to obtain the second expected hash response value.

19. The method as described in claim 16 or 17, characterized in that, The method further includes: Receive the first expected hash response value sent by the first network device; If the first expected hash response value is the same as the second expected hash response value, then the first intelligent agent access authentication is confirmed to be successful.

20. The method according to any one of claims 13-17, characterized in that, The method further includes: Upon successful access authentication, an authentication server function key and a security anchor function key are generated. The authentication server function key is generated based on the proxy key, the first shared key, the second random number, the network identifier, the temporary identity identifier, and the hash value of the second shared key. The security anchor function key is generated based on the authentication server function key and the network identifier.

21. The method according to any one of claims 13-17, characterized in that, The second network device includes a first network element and a second network element, wherein the first network element receives the access authentication request; The second network element receives the identity identifier of the terminal device and the context information of the first intelligent agent sent by the first network device; When the second network element determines, based on the identity identifier and the context information, that the terminal device has the authority to authorize the first intelligent agent to initiate access authentication, it generates a second random number. The second network element sends the second random number to the first network element and then sends the second random number back to the first network element, which is used by the first network element to perform access authentication for the first intelligent agent.

22. A communication system, characterized in that, The communication system includes a first intelligent agent, a first network device, and a second network device. The first intelligent agent runs in a terminal device and includes: The first intelligent agent receives the first authentication parameters configured by the terminal device, the first authentication parameters including the identity identifier of the terminal device, the temporary identity identifier of the first intelligent agent, the proxy key and context information; The first intelligent agent determines the first challenge parameters based on the first random number and the specified generator; The first intelligent agent sends an access authentication request to the first network device. The access authentication request includes the identity identifier, the context information, and the first challenge parameter. The access authentication request is used to request access authentication for the first intelligent agent. The first network device sends the access authentication request to the second network device; The second network device determines the proxy authentication vector based on the access authentication request; The second network device sends the proxy authentication vector to the first network device; The first network device generates an access authentication response based on the proxy authentication vector, and the access authentication response includes a second authentication parameter; The first network device sends the access authentication response to the first intelligent agent; The first intelligent agent performs access authentication based on the second authentication parameter, the first challenge parameter, the temporary identity identifier of the first intelligent agent, and the proxy key in the access authentication response.

23. A communication device, characterized in that, The communication device includes a processing unit and a transceiver unit, and is used to execute a program or instructions of the method as described in any one of claims 1 to 8, or to execute a program or instructions of the method as described in any one of claims 9 to 12, or to execute a program or instructions of the method as described in any one of claims 13 to 21.

24. A communication device, characterized in that, The device includes a processor coupled to a memory storing a program or instructions for performing the method as described in any one of claims 1 to 8, or the memory storing a program or instructions for performing the method as described in any one of claims 9 to 12, or performing the method as described in any one of claims 13 to 21.

25. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed, the computer performs the program or instructions of the method as described in any one of claims 1 to 8, or performs the program or instructions of the method as described in any one of claims 9 to 12, or performs the program or instructions of the method as described in any one of claims 13 to 21.

26. A computer program product, characterized in that, Includes a computer program that, when run, causes the method as described in any one of claims 1 to 8 to be performed, or the method as described in any one of claims 9 to 12 to be performed, or the method as described in any one of claims 13 to 21 to be performed.

Images