Verification method, communication method, device, network side equipment, medium and product

Abstract

The application discloses a verification method, a communication method, a device, a network side equipment, a medium and a product, and belongs to the technical field of communication. The verification method comprises the following steps: a first network node receives first information sent by an access network node, wherein the first information comprises a first token, and the first token is a token related to a terminal and obtained by the access network node; and the first network node obtains a verification result of the first token according to the first information. That is, the token related to the terminal provided by the access network node is verified to verify whether the information is truly related to the terminal, so that the security of communication can be improved in the case that a network node including a mobility management function cannot perform security processing on the terminal based on a NAS message.

Description

Technical Field

[0001] This application belongs to the field of communication technology, specifically relating to a verification method, communication method, apparatus, network-side equipment, medium, and product. Background Technology

[0002] In the Service Based Architecture (SBA) of 5G mobile communication technology, the control plane network elements of the core network include network nodes such as the Access & Mobility Management Function (AMF), Session Management Function (SMF), Policy Control Function (PCF), Unified Data Management (UDM), and Authentication Server Function (AUSF). The Radio Access Network (RAN) communicates with the AMF through the Reference Point Interface (N2). The AMF forwards messages between the RAN and other network nodes (e.g., RAN and SMF) through the N2 interface. The AMF also forwards NAS messages between the User Equipment (UE) and other network nodes (e.g., UE and SMF) through the N2 interface. For example, the AMF forwards session management-related NAS messages between the UE and SMF through the N2 interface. In related technologies, NAS messages between the UE and other network nodes need to be forwarded through the AMF, resulting in a roundabout information transmission path and low transmission efficiency.

[0003] To improve the efficiency of information transmission, it is possible to have the terminal send uplink NAS messages directly to other network nodes outside of the AMF. However, the AMF cannot verify the authenticity of the terminal during this process, which may lead to a decrease in communication security. Summary of the Invention

[0004] This application provides a verification method, communication method, apparatus, network-side device, medium, and product that can solve the problem of reduced communication security.

[0005] Firstly, a verification method is provided, which includes:

[0006] The first network node receives first information sent by the access network node, the first information including a first token, the first token being a terminal-related token obtained by the access network node;

[0007] The first network node obtains the verification result of the first token based on the first information.

[0008] Secondly, a communication method is provided, the method comprising:

[0009] The access network node sends first information to the first network node. The first information includes a first token, which is a token related to the terminal obtained by the access network node.

[0010] Thirdly, a communication method is provided, the method comprising:

[0011] The second network node performs any of the following:

[0012] Obtain second information from the first network node and send seventh information to the access network node. The second information includes a second token, and the seventh information includes a second token, which is a token generated by the first network node for the terminal.

[0013] A second token is generated for the terminal, and a seventh message, including the second token, is sent to the access network node.

[0014] Fourthly, a verification device is provided, comprising:

[0015] The first receiving module is used to receive first information sent by the access network node, the first information including a first token, the first token being a terminal-related token obtained by the access network node;

[0016] The first acquisition module is used to acquire the verification result of the first token based on the first information.

[0017] Fifthly, a communication device is provided, comprising:

[0018] The fifth sending module is used to send first information to the first network node. The first information includes a first token, which is a token related to the terminal obtained by the communication device.

[0019] Sixthly, a communication device is provided, comprising:

[0020] The execution module is used to perform any of the following:

[0021] Obtain second information from the first network node and send seventh information to the access network node. The second information includes a second token, and the seventh information includes a second token, which is a token generated by the first network node for the terminal.

[0022] A second token is generated for the terminal, and a seventh message, including the second token, is sent to the access network node.

[0023] In a seventh aspect, a verification apparatus is provided, the apparatus being configured to perform the steps of the method described in the first aspect.

[0024] Eighthly, a communication device is provided, the device being configured to perform the steps of the method described in the second aspect, or to implement the steps of the method described in the third aspect.

[0025] A ninth aspect provides a network-side device including a processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions, when executed by the processor, implementing the steps of the method as described in the first, second, or third aspect.

[0026] In a tenth aspect, a network-side device is provided, including a processor and a communication interface, wherein the communication interface is used to receive first information sent by an access network node, the first information including a first token, the first token being a terminal-related token obtained by the access network node;

[0027] The processor is used to obtain the verification result of the first token based on the first information.

[0028] Eleventhly, a network-side device is provided, including a processor and a communication interface, wherein the communication interface is used to send first information to a first network node, the first information including a first token, the first token being a terminal-related token obtained by the access network node.

[0029] In a twelfth aspect, a network-side device is provided, including a processor and a communication interface, wherein the communication interface is used to: obtain second information from a first network node and send seventh information to an access network node, the second information including a second token, the seventh information including a second token being a token generated by the first network node for a terminal;

[0030] And / or, the processor is used to generate a second token for the terminal;

[0031] The communication interface is used to send a seventh message to the access network node, the seventh message including the second token.

[0032] In a thirteenth aspect, a readable storage medium is provided, on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect, or the steps of the method described in the second aspect, or the steps of the method described in the third aspect.

[0033] Eleventhly, a wireless communication system is provided, comprising: a first network node, an access network node, and a second network node, wherein the first network node is configured to perform the steps of the method described in the first aspect, the access network node is configured to perform the steps of the method described in the second aspect, and the second network node is configured to perform the steps of the method described in the third aspect.

[0034] In a twelfth aspect, a chip is provided, the chip including a processor and a communication interface coupled to the processor, the processor being configured to run a program or instructions to implement the steps of the method described in the first aspect, or the steps of the method described in the second aspect, or the steps of the method described in the third aspect.

[0035] In a thirteenth aspect, a computer program / program product is provided, which is stored in a storage medium and is executed by at least one processor to implement the steps of the verification method as described in the first aspect, or the computer program / program product is executed by at least one processor to implement the steps of the communication method as described in the second aspect, or the computer program / program product is executed by at least one processor to implement the steps of the communication method as described in the third aspect.

[0036] In this embodiment, a first network node receives first information sent by an access network node. The first information includes a first token, which is a terminal-related token obtained by the access network node. The first network node obtains a verification result of the first token based on the first information. That is, by verifying the terminal-related token provided by the access network node, the system verifies whether the information is truly related to the terminal. This improves communication security when network nodes, including those with mobility management functions, cannot perform secure processing of the terminal based on NAS messages. Attached Figure Description

[0037] Figure 1 This is a block diagram of a wireless communication system applicable to embodiments of this application;

[0038] Figure 2 This is a block diagram of another wireless communication system to which the embodiments of this application can be applied;

[0039] Figure 3 This is a block diagram of another wireless communication system to which the embodiments of this application can be applied;

[0040] Figure 4 This is a flowchart of a verification method provided in an embodiment of this application;

[0041] Figure 5 This is a flowchart of a communication method provided in an embodiment of this application;

[0042] Figure 6 This is a flowchart of another communication method provided in an embodiment of this application;

[0043] Figure 7 This is a flowchart of another communication method provided in an embodiment of this application;

[0044] Figure 8 This is a flowchart of another communication method provided in an embodiment of this application;

[0045] Figure 9 This is a flowchart of another communication method provided in an embodiment of this application;

[0046] Figure 10 This is a flowchart of another communication method provided in an embodiment of this application;

[0047] Figure 11 This is a schematic diagram of a verification device provided in an embodiment of this application;

[0048] Figure 12 This is a schematic diagram of a communication device provided in an embodiment of this application;

[0049] Figure 13 This is a schematic diagram of another communication device provided in an embodiment of this application;

[0050] Figure 14 This is a schematic diagram of a communication device provided in an embodiment of this application;

[0051] Figure 15 This is a schematic diagram of a terminal provided in an embodiment of this application;

[0052] Figure 16 This is a schematic diagram of a network-side device provided in an embodiment of this application;

[0053] Figure 17 This is a schematic diagram of another network-side device provided in an embodiment of this application. Detailed Implementation

[0054] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0055] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, the first object can be one or more. Furthermore, "or" in this application indicates at least one of the connected objects. For example, the scope of protection for "A or B" covers at least three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. In addition, the terms "A and / or B," "at least one of A and B," and "at least one of A or B" also cover at least the above three scenarios. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0056] The term "instruction" in this application can be either a direct instruction (or explicit instruction) or an indirect instruction (or implicit instruction). A direct instruction can be understood as the sender explicitly informing the receiver of specific information, the required operation, or the requested result in the instruction sent. An indirect instruction can be understood as the receiver determining the corresponding information based on the instruction sent by the sender, or making a judgment and determining the required operation or requested result based on the judgment result.

[0057] It is worth noting that the technologies described in this application are not limited to Long Term Evolution (LTE) / LTE-Advanced (LTE-A) systems, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA), or other systems. The terms "system" and "network" in this application are often used interchangeably, and the described technologies can be used with the systems and radio technologies mentioned above, as well as with other systems and radio technologies. The following description describes New Radio (NR) systems for illustrative purposes, and the term NR is used in most of the following description; however, these technologies can also be applied to systems other than NR systems, such as 6th generation (6G) radio systems. th Generation 6G communication system.

[0058] Figure 1This diagram illustrates a block diagram of a wireless communication system applicable to embodiments of this application. The wireless communication system includes a terminal 11 and a network-side device 12. The terminal 11 can also be referred to as User Equipment (UE), and can be a mobile phone, tablet computer, laptop computer, notebook computer, personal digital assistant (PDA), handheld computer, netbook, ultra-mobile personal computer (UMPC), mobile internet device (MID), augmented reality (AR), virtual reality (VR) device, robot, wearable device, flight vehicle, vehicle user equipment (VUE), shipboard equipment, pedestrian user equipment (PUE), smart home devices (home appliances with wireless communication capabilities, such as refrigerators, televisions, washing machines, or furniture), game consoles, personal computers (PCs), ATMs, or self-service machines, etc. Wearable devices include: smartwatches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart chains, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. Among these, in-vehicle devices can also be referred to as in-vehicle terminals, in-vehicle controllers, in-vehicle modules, in-vehicle components, in-vehicle chips, or in-vehicle units, etc. It should be noted that the specific type of terminal 11 is not limited in this application embodiment. Network-side equipment 12 may include access network equipment or core network equipment. Access network equipment can also be referred to as Radio Access Network (RAN) equipment, Radio Access Network function, or Radio Access Network unit, and can also be referred to as access network node, access network element, etc. Access network equipment may include base stations, Wireless Local Area Network (WLAN) access points (APs), or Wireless Fidelity (WiFi) nodes, etc.Among them, base stations can be referred to as Node B (NB), Evolved Node B (eNB), Next Generation Node B (gNB), New Radio Node B (NR Node B), Access Point, Relay Base Station (RBS), Serving Base Station (SBS), Base Transceiver Station (BTS), Radio Base Station, Radio Transceiver, Basic Service Set (BSS), Extended Service Set (ESS), Home Node B (HNB), Home Evolved Node B, Transmit / Receive Point (TRP), Non-Terrestrial Network (NTN) equipment (such as satellite or high altitude platform stations). The term "base station" can be any suitable term in the field, such as "station" or any other appropriate term in the relevant field, as long as the same technical effect is achieved. The term "base station" is not limited to specific technical terms. It should be noted that the embodiments of this application only use the base station in the NR system as an example for introduction, and do not limit the specific type of base station.

[0059] Core network equipment, also known as core network nodes, core network functions, or core network elements, includes, but is not limited to, at least one of the following: Mobility Management Entity (MME), Access and Mobility Management Function (AMF), Session Management Function (SMF), User Plane Function (UPF), Policy Control Function (PCF), Policy and Charging Rules Function (PCRF), Edge Application Server Discovery Function (EASDF), Unified Data Management (UDM), Unified Data Repository (UDR), Home Subscriber Server (HSS), Centralized network configuration (CNC), Network Repository Function (NRF), Network Exposure Function (NEF), Local NEF (L-NEF), and Binding Support. Functions include BSF, Application Function (AF), Location Management Function (LMF), Gateway Mobile Location Centre (GMLC), Network Data Analytics Function (NWDAF), and Non-Terrestrial Network (NTN) equipment (such as satellite or high altitude platform station).It should be noted that the embodiments of this application only use the core network equipment in the NR system as an example for introduction, and do not limit the specific type of core network equipment. If the name of the core network equipment mentioned in the embodiments of this application changes in subsequent protocol versions (e.g., 6G), it is also within the scope of protection of this application.

[0060] Optionally, the core network equipment can be implemented by one or more functional modules in a single device, or by multiple devices working together; this application does not specifically limit this. It is understood that the aforementioned functional modules can be network elements in hardware devices, software functional modules running on dedicated hardware, or virtualized functional modules instantiated on a platform (e.g., a cloud platform).

[0061] For ease of understanding, the following describes some aspects of the embodiments of this application:

[0062] In related technologies, such as Figure 2 As shown, in the 5G Service Based Architecture (SBA), the core network control plane elements AMF, SMF, PCF, UDM, and AUSF communicate with each other through a Service Based Interface (SBI). The Radio Access Network (RAN) communicates with the AMF through the Reference Point Interface (N2). The N2 interface is also used to transmit Non-Access Stratum (NAS) messages between the UE and the AMF on the N1 interface. The AMF forwards messages between the RAN and the SMF, as well as session management-related NAS messages between the UE and the SMF, through the N2 interface.

[0063] In another type of SBA, such as Figure 3 As shown, the N2 interface between RAN and AMF is service-oriented, enabling communication between RAN and network functions (NFs) such as AMF and SMF based on the SBI interface.

[0064] The above NF is a general term for all core network elements. For example, it can be a general term for 6G core network control plane elements. The above NF can be replaced by different NF types, such as AMF, SMF, PCF, etc.

[0065] In related technologies, Figure 2 and Figure 3In the framework shown, the forwarding of NAS messages between the UE and other NFs by the AMF results in path detours and low transmission efficiency. Specifically, when the UE transitions from the idle state (Connection Management Idle, CM_Idle) to the connected state (Connection Management connected, CM_Connected), the UE first sends a Service Request (SR) message or a Registration Request (MRU) message to the AMF. Since NAS messages between the UE and other NFs need to be forwarded through the AMF, the AMF verifies the UE through secure processing of the NAS messages, ensuring that subsequent connection establishment serves the actual UE.

[0066] In this application embodiment, consideration is given to Figure 2 and Figure 3 Under the framework shown ( Figure 2 (Interface improvements are needed within the framework) The UE can communicate with any NF (Network Function) via NAS without needing to go through the AMF (Advanced Management Function), thus resolving the NAS path detour issue caused by AMF forwarding NAS messages. Specifically, Figure 2 Within this framework, reference point interfaces can be established between the RAN and other NFs in the core network, allowing the RAN to forward NAS messages between the UE and other NFs. Figure 3 Within this framework, the RAN can transmit NAS messages between the UE and the corresponding NF (such as SMF, PCF) through the SBI interface.

[0067] Specifically, during the connection state transition, the UE can send an uplink NAS message to other NFs (e.g., SMF) to enter the connected state, and the AMF can remain uninvolved in the UE's transition from idle to connected state. However, because the AMF does not participate in this process, it may lead to defects in the communication flow. Specifically, from the AMF's perspective, the RAN initiates a UE-related connection establishment process, which does not carry NAS information. The AMF cannot verify the authenticity of the UE, posing a risk of impersonating a UE to establish a connection and serving a non-genuine UE.

[0068] To reduce the problems of circuitous information transmission paths and low transmission efficiency in related technologies, this application considers that the UE can communicate with any NF in NAS without needing to go through the AMF (which can be understood as a distributed NAS architecture). However, since NAS messages between the UE and other NFs do not need to be forwarded through the AMF, the AMF cannot perform secure processing of NAS messages and thus cannot verify the UE. Based on this, the embodiments of this application further consider the security problem caused by the AMF's inability to perform any verification of the UE's authenticity.

[0069] The verification method, communication method, apparatus, network-side device, medium, and product provided in this application will be described in detail below with reference to the accompanying drawings and through some embodiments and application scenarios.

[0070] See Figure 4 , Figure 4 This is a flowchart of a verification method provided in an embodiment of this application, used for a first network node, such as... Figure 4 As shown, the method includes the following steps:

[0071] Step 401: The first network node receives first information sent by the access network node. The first information includes a first token, which is a token related to the terminal obtained by the access network node.

[0072] In this embodiment, a node can be understood as a network element, device, or function. The first network node can be a first network element, a first network device, or a first network function (NF). The access network node can be an access network device, an access network element, or an access network function. The information transmitted between the nodes can be transmitted in the form of messages or not. Optionally, the aforementioned first information can also be described as a first message.

[0073] In this embodiment, the first information includes a first token associated with the terminal. The meaning of the token can be found in conventional definitions in related technologies. The aforementioned first token can be understood as data used for information verification and / or identity verification, such as a random number configured for the terminal to verify the association between relevant information and the terminal. The terminal-related token obtained by the access network node may be a legitimate token received by the access network node from the core network node, or it may be an illegitimate token fabricated by the access network node, or an illegitimate token received by the access network node from other nodes. The legitimacy of the first token needs to be verified by the first network node.

[0074] The aforementioned first network node may be a network node that includes mobility management functions. A network node that includes mobility management functions includes, but is not limited to, at least one of the following: a 5G AMF, 6G AMF, or AMF separated into Access Management (AM) and Mobility Management (MM) functions, and the MMF may further include other functions.

[0075] Step 402: The first network node obtains the verification result of the first token based on the first information.

[0076] In this embodiment of the application, the first network node obtains the verification result of the first token based on the first information. This can be done by the first network node directly performing the verification of the first token itself, or by obtaining the verification result of the first token from other network nodes (e.g., the second network node), i.e., the other network node performs the verification of the first token and provides the verification result to the first network node.

[0077] The verification process for the first token can be a matching process with a legitimate token. For example, if the first token matches a legitimate token, the first token is considered to have passed verification or been successfully verified. The legitimate token can be a token assigned to the terminal by a network node (e.g., a first network node or a second network node).

[0078] If the first token is verified or successfully verified, it means that the first information corresponding to the first token is genuinely related to the terminal, rather than being falsely related.

[0079] In this embodiment, the association between relevant information and the terminal is verified by sending first information to the access network node via a token, which differs from the NAS signaling-based verification method in related technologies. Optionally, the aforementioned first information does not include NAS signaling.

[0080] In this embodiment of the application, by verifying the token provided by the access network node that is related to the terminal, the authenticity or legality of the communication is verified. This can improve the security of communication when NAS messages between the terminal and other network nodes do not need to be forwarded through the AMF, and the AMF cannot perform secure processing of NAS messages and thus cannot verify the UE.

[0081] Optionally, the first network node obtains the verification result of the first token based on the first token, including:

[0082] The first network node determines the verification result of the first token based on the matching result of the first token and the second token, wherein the second token is either a token generated by the first network node for the terminal or a token generated by the second network node for the terminal.

[0083] The second network node is the node that receives the non-access stratum (NAS) signaling from the terminal.

[0084] In this embodiment, the first network node verifies the first token itself. Specifically, it matches the first token with a second token to determine the verification result of the first token. For example, it compares the first token and the second token, and if they are the same, the first token is considered to have been successfully verified. The second token can be a token generated by the first network node for the terminal, or it can be a token generated by another network node (the second network node) for the terminal. The second network node can be an NF other than the NF containing mobility management functions, such as an SMF, PCF, or Sensing Function (SF).

[0085] The aforementioned second network node can be understood as a trusted network node. Optionally, the second network node can replace the AMF in related technologies to perform secure processing and verification of NAS messages for the UE, ensuring that subsequent connection establishment serves the real UE. Optionally, the second network node is a node that receives the non-access stratum NAS signaling of the terminal. Optionally, the second network node generates a second token for the terminal only after successfully verifying the integrity of the NAS signaling, or requests the first network node to provide a second token.

[0086] In this embodiment of the application, when the second token is a token generated by the first network node for the terminal, the first network node will also send the second token to the second network node.

[0087] Optionally, if the second token is a token generated by the first network node for the terminal, the method further includes:

[0088] The first network node sends second information to the second network node, the second information including the second token.

[0089] In this embodiment, after receiving the second token, the second network node distributes the second token to the access network node. The legitimate access network node uses the second token as the first token to verify the association between relevant information and the terminal. For example... Figure 5As shown, in step 5, the 6G AMF (first network node) generates a token and distributes it to the 6G SMF (second network node), and in step 6, the 6G SMF distributes the token to the access network node.

[0090] Optionally, the first network node may send the second token to the second network node when feeding back the terminal mobility management context (MM context). That is, the second message also includes the terminal's mobility management MM context.

[0091] In this embodiment of the application, when the second token is a token generated by the first network node for the terminal, the second token can be a regular token (e.g., a random number) or an identifier associated with the terminal assigned by the first network node.

[0092] Optionally, the second token is an identifier associated with the terminal assigned by the first network node.

[0093] In this embodiment of the application, taking the first network node as an AMF as an example, the identifier assigned by the first network node to the terminal may be an AM NGAP ID (Access and Mobility Management Next Generation Application Protocol Identifier). For example, as shown... Figure 6 As shown in step 5, the 6G AMF (first network node) distributes the AM NGAP ID as a token to the 6G SMF (second network node). That is, the first NF can allocate identification information used to identify the UE as a token.

[0094] In this embodiment of the application, when the second token is a token generated by the second network node for the terminal, the second network node will also send the second token to the first network node, so that the first network node can independently complete the verification of the first token.

[0095] Optionally, if the second token is a token generated by the second network node for the terminal, the method further includes:

[0096] The first network node receives third information sent by the second network node, the third information including the second token.

[0097] In this embodiment, the second network node can proactively send the second token to the first network node after configuring the second token. Optionally, the second token can be sent to the first network node when the first network node requests the Terminal Mobility Management (MM) context from the first network node. For example, as shown... Figure 7 As shown in step 4.

[0098] In this embodiment, the second network node can send the second token to the first network node based on a request from the first network node, provided the second token is configured. Alternatively, the first network node, upon receiving the aforementioned first information (i.e., when it needs to perform first token verification), requests the second token from the second network node. For example, as shown... Figure 8 As shown in step 7, the 6G AMF (first network node) can request a second token from the 6G SMF (second network node) (the [token] shown in the figure is optional; in this embodiment, the token is not carried, but the request information for the second token is carried). In step 8, the 6G SMF (second network node) sends the token back to the 6G AMF (first network node).

[0099] Optionally, the first network node obtains the verification result of the first token based on the first token, including:

[0100] The first network node sends a fourth message to the second network node, the fourth message being used to request a second token;

[0101] The first network node receives the fifth information sent by the second network node, the fifth information including the second token;

[0102] The first network node determines the verification result of the first token based on the matching result of the first token and the second token, whereby the second token is a token generated by the second network node for the terminal.

[0103] The second network node is the node that receives the NAS signaling from the terminal.

[0104] In this embodiment of the application, in an optional scheme, the second network node may perform the verification of the first token and provide the verification result to the first network node. That is, the second network node generates the second token without distributing it to the first network node. When the first network node receives the aforementioned first information, i.e., when it needs to perform the first token verification, the first network node requests verification of the first token from the second network node. For example, as shown... Figure 8In step 7, the 6G AMF (first network node) may request verification of the first token from the 6G SMF (second network node), that is, provide the first token to the 6G SMF (second network node), for example as follows: Figure 8 The token in step 7 represents the first token. The 6G SMF (second network node) verifies the first token based on the second token it generates, obtains the verification result of the first token, and feeds back the verification result to the first network node, for example as follows: Figure 8 The indication in step 8 is used to indicate the verification result.

[0105] Optionally, the first network node obtains the verification result of the first token based on the first token, including:

[0106] The first network node sends a fourth message to the second network node, the fourth message including the first token;

[0107] The first network node receives the fifth information sent by the second network node, the fifth information being used to indicate the verification result of the first token;

[0108] The second network node is the node that receives the NAS signaling from the terminal.

[0109] Optionally, the method further includes:

[0110] If the verification result indicates that the first token verification was successful, the first network node sends sixth information to the access network node, the sixth information including an identifier related to the terminal assigned by the first network node.

[0111] In this embodiment, successful verification of the first token can be understood as the first token being a valid token, or as the first token matching the second token. The verification result can be determined by the first network node itself, or by the second network node determining and sending it to the first network node. Based on either process, the first network node can determine the verification result of the first token. If the first network node determines that the first token verification is successful, it can provide the access network node with an identifier related to the terminal assigned by the first network node, such as an AM NGAP ID. For example, as shown... Figure 5 , Figure 7 or Figure 8 Step 9 in the process.

[0112] It is understood that if the second token is an identifier related to the terminal assigned by the first network node, that is, if the second information includes the identifier related to the terminal assigned by the first network node, then the sixth message may not need to be sent. For example, as shown... Figure 6 As shown.

[0113] In this embodiment, a first network node receives first information sent by an access network node. The first information includes a first token, which is a terminal-related token obtained by the access network node. The first network node obtains the verification result of the first token based on the first information. That is, by verifying the terminal-related token provided by the access network node, it is possible to verify whether the information is truly related to the terminal. This improves communication security when network nodes, including those with mobility management functions, cannot perform secure processing of the terminal based on NAS messages.

[0114] See Figure 9 , Figure 9 This is a flowchart of a communication method provided in an embodiment of this application, used for accessing network nodes, such as... Figure 9 As shown, the method includes the following steps:

[0115] Step 901: The access network node sends first information to the first network node. The first information includes a first token, which is a token related to the terminal obtained by the access network node.

[0116] In this embodiment of the application, the access network node provides a first token to the first network node to verify whether the first information is truly related to the terminal.

[0117] Optionally, the method further includes:

[0118] The access network node forwards the NAS signaling of the terminal to the second network node;

[0119] The access network node receives the seventh information sent by the second network node. The seventh information includes a second token, which is either a token generated by the first network node for the terminal or a token generated by the second network node for the terminal.

[0120] The access network node obtains the first token based on the seventh information.

[0121] In this embodiment, the first token provided by the access network node to the first network node is determined based on the second token provided by the second network node. Optionally, the access network node provides the received second token as the first token to the first network node. The specific method for generating the second token can be found in [reference needed]. Figure 4The specific details of the illustrated embodiments will not be repeated here.

[0122] Optionally, the second token is an identifier associated with the terminal assigned by the first network node.

[0123] Optionally, the method further includes:

[0124] The access network node receives a sixth piece of information sent by the first network node, the sixth piece of information including an identifier related to the terminal assigned by the first network node.

[0125] Optionally, the method further includes:

[0126] The access network node is associated with the terminal and the identifier related to the terminal.

[0127] In this embodiment, the first network node provides the access network node with an identifier associated with the terminal, assigned by the first network node, indicating that the first network node acknowledges the authenticity of the terminal's identity. In this case, the access network node can associate the identifier associated with the terminal assigned by the first network node with the terminal. Subsequent uplink messages sent by the access network node to the terminal will carry the identifier associated with the terminal assigned by the first network node (e.g., AM NGAP ID), enabling the first network node to correctly associate the terminal.

[0128] In another alternative embodiment, exemplary, reference may be made to Figure 6 The second network node sends the terminal-related identifier (i.e., the second token) assigned by the first network node to the access network device via the seventh information. That is, the access network device obtains the terminal-related identifier assigned by the first network node from the second network node and associates the terminal-related identifier assigned by the first network node with the terminal. Subsequent access network nodes carry the terminal-related identifier assigned by the first network node (e.g., AM NGAP ID) in all uplink messages sent to this terminal, enabling the first network node to correctly associate the terminal. It should be noted that this embodiment is used as a reference for... Figure 4-8 The implementation methods of the access network nodes shown in the embodiments can be found in the following examples. Figure 4-8 The relevant descriptions in the illustrated embodiments all achieve the same or similar beneficial effects. To avoid repetition, these descriptions will not be repeated in this embodiment.

[0129] See Figure 10 , Figure 10 This is a flowchart of a communication method provided in an embodiment of this application, used for a second network node, such as... Figure 10 As shown, the method includes the following steps:

[0130] Step 1001: The second network node performs any of the following:

[0131] Obtain second information from the first network node, the second information including a second token; send seventh information to the access network node, the seventh information including a second token, the second token being a token generated by the first network node for the terminal;

[0132] A second token is generated for the terminal, and a seventh message, including the second token, is sent to the access network node.

[0133] In this embodiment, the second network node can provide a second token to the access network node, enabling the access network node to obtain a valid token. The second token provided by the second network node can be generated by the second network node itself or by the first network node. If the token is generated by the first network node, the second network node obtains the second token through second information.

[0134] In this embodiment, the second network node provides the second token to the access network node through the seventh information. Optionally, the seventh information carries information about the first network node, so that the access network node knows which network node to use to verify the first token (which network node to which the first information is sent). Optionally, the first network node may refer to the network node that generated the second token, or a network node that has already received the second token configured by the second network node.

[0135] It is understandable that the seventh piece of information may not carry information about the first network node. For example, such as... Figure 8 As shown, the second token is generated by the second network node. The first network node only sends a request to the second network node (requesting the second token or requesting verification of the first token) when verifying the first token. In this case, the second token is not associated with a specific first network node, and the access network device can flexibly select the first network node (a network node including mobility management functions) without being limited to the first network node specified by the second network node. It is understandable that, in this case, the second network node can still indicate a specific first network node to the access network node.

[0136] Optionally, if the second token is a token generated by the first network node for the terminal, the second token is an identifier associated with the terminal assigned by the first network node.

[0137] Optionally, if the second network node generates a second token for the terminal, the method further includes:

[0138] The second network node sends a third message to the first network node, the third message including the second token.

[0139] Optionally, if the second network node generates a second token for the terminal, the method further includes:

[0140] The second network node receives fourth information sent by the first network node, the fourth information including a first token, the first token being a token from the access network node;

[0141] The second network node verifies the first token based on the matching result of the first token and the second token, and sends fifth information to the first network node, the fifth information being used to indicate the verification result of the first token;

[0142] Alternatively, if the second network node generates a second token for the terminal, the method further includes:

[0143] The second network node receives a fourth message sent by the first network node, the fourth message being used to request a second token;

[0144] The second network node sends a fifth message to the first network node, the fifth message including the second token.

[0145] Optionally, the method further includes:

[0146] The second network node receives NAS signaling from the terminal;

[0147] The second network node obtains second information from the first network node and sends seventh information to the access network node, and / or the second network node generates a second token for the terminal and sends seventh information to the access network node, including:

[0148] If the second network node successfully verifies the integrity of the NAS signaling, it obtains the second information from the first network node, sends the seventh information to the access network node, and / or

[0149] The second network node obtains the second information from the first network node, generates a second token for the terminal, and sends the seventh information to the access network node.

[0150] In this embodiment, the second network node receives NAS signaling from the terminal. Upon successfully verifying the integrity of the NAS signaling, it executes the configuration and / or interaction of the second signaling. That is, the second network node will only send a second token generated for the terminal (which can be a token generated by the first network node or a token generated by the second network node) to the access network node after verifying the authenticity of the UE.

[0151] It should be noted that this embodiment is used as a reference for... Figure 4-8 The implementation method of the second network node in the illustrated embodiment can be found in the following examples. Figure 4-8 The relevant descriptions in the illustrated embodiments all achieve the same or similar beneficial effects. To avoid repetition, these descriptions will not be repeated in this embodiment.

[0152] For ease of understanding, several examples are provided below as optional implementation methods of this application.

[0153] Example 1: AMF Token Allocation

[0154] For example, attached Figure 5 As shown in this example, the AMF allocates a token and transfers it to the RAN via the SMF. The RAN carries the token for AMF verification when establishing a connection. The specific process is as follows:

[0155] Step 1: The UE sends a NAS request message (SM N1 Request) to the SMF through the RAN, carrying the terminal identifier (UEID).

[0156] Step 2: The RAN sends an N2 request message (SM N2 Request) to the SMF, carrying the SM N1 Request and the RAN-assigned ID associated with the UE (RAN NGAP ID).

[0157] Step 3: The SMF verifies the Media Access Control (MAC) of the SM N1 Request to verify the authenticity of the UE identified by the UE ID (to prevent unauthorized UEs from impersonating the genuine UE to send SM N1 Requests). This verification process refers to the NAS message verification process in related technologies and will not be described in detail here. If the verification is successful, proceed to the following steps.

[0158] Step 4: The SMF requests the UE's context from the AMF via a message (Context Transfer Req). The Context Transfer Req carries the UE's context request (MM Context Req), and optionally, it can also carry the Subscription Permanent Identifier (SUPI).

[0159] Step 5: The AMF generates a token for the UE, and then returns the UE's context and the generated token to the SMF via a message (Context Transfer Rsp). Optionally, the Context Transfer Rsp also carries the SUPI.

[0160] Step 6: In response to the request message in Step 2, the SMF sends an N2 response message (SM N2 Response) to the RAN, carrying the RAN NGAP ID from Step 2, the SM N1 Response message sent to the UE, and a token. Optionally, the SM N2 Response also carries the AMF's identification information.

[0161] Step 7: The RAN identifies the UE corresponding to the message based on the RAN NGAP ID, and sends an N2 request message (AM N2 Request) to the AMF based on the received token, carrying the RAN NGAP ID and the token.

[0162] Step 8: The RAN sends an SM N1 Response to the UE based on the received SM N1 Response.

[0163] It is understandable that there is no necessary order between steps 7 and 8. Steps 7 and 8 can be executed simultaneously, or step 8 can be executed before step 7, or step 7 can be executed before step 8.

[0164] Step 9: The AMF verifies the received token (e.g., compares it with the token generated in Step 5). If successful (e.g., they are the same), it assigns an ID (AM NGAP ID) to the UE and sends an N2 response message (AM N2Response) to the RAN, carrying the RAN NGAP ID and the AM NGAP ID. The RAN identifies the UE targeted by the message based on the RAN NGAP ID and associates the UE with the AM NGAP ID (subsequent uplink messages from this UE will carry the AM NGAP ID for the AMF to associate with the UE).

[0165] Example 2: SMF Token Allocation

[0166] For example, attached Figure 7 As shown in this example, the SMF allocates a token and sends it to both the RAN and AMF. The RAN carries the token for AMF verification when establishing a connection. The specific process is as follows:

[0167] Step 1: The UE sends a NAS request message (SM N1 Request) to the SMF through the RAN, carrying the terminal identifier (UEID).

[0168] Step 2: The RAN sends an N2 request message (SM N2 Request) to the SMF, carrying the SM N1 Request and the RAN-assigned ID associated with the UE (RAN NGAP ID).

[0169] Step 3: The SMF verifies the MAC address of the SM N1 Request to verify the authenticity of the UE identified by the UE ID (to prevent unauthorized UEs from impersonating the genuine UE and sending SM N1 Requests). This verification process refers to the NAS message verification process in related technologies and will not be elaborated upon here. If the verification is successful, proceed to the following steps.

[0170] Step 4: The SMF generates a token for the UE, and then requests the UE's context from the AMF via a message (Context Transfer Req), carrying the generated token in the request. Optionally, the Context Transfer Req also carries SUPI.

[0171] Step 5: The AMF returns the UE's context to the SMF via a message (Context Transfer Rsp). Optionally, the Context Transfer Rsp also carries the SUPI.

[0172] Step 6: In response to the request message in Step 2, the SMF sends an N2 response message (SM N2 Response) to the RAN, carrying the RAN NGAP ID from Step 2, the SM N1 Response message sent to the UE, and a token. Optionally, the SM N2 Response also carries the AMF's identification information.

[0173] Step 7: The RAN identifies the UE corresponding to the message based on the RAN NGAP ID, and sends an N2 request message (AM N2 Request) to the AMF based on the received token, carrying the RAN NGAP ID and the token.

[0174] Step 8: The RAN sends an SM N1 Response to the UE based on the received SM N1 Response.

[0175] It is understandable that there is no necessary order between steps 7 and 8. Steps 7 and 8 can be executed simultaneously, or step 8 can be executed before step 7, or step 7 can be executed before step 8.

[0176] Step 9: The AMF verifies the received token (e.g., compares it with the token received in Step 4). If successful (e.g., they are the same), it assigns an ID (AM NGAP ID) to the UE and sends an N2 response message (AM N2Response) to the RAN, carrying both the RAN NGAP ID and the AM NGAP ID. The RAN identifies the UE targeted by the message based on the RAN NGAP ID and associates the UE with the AM NGAP ID (subsequent uplink messages from this UE will carry the AM NGAP ID for the AMF to associate with the UE).

[0177] Example 3: AMF request token or request verification

[0178] For example, attached Figure 8 As shown in this example, the SMF allocates a token and sends it to the RAN. The RAN carries the token when establishing a connection. The AMF requests the token from the SMF for verification or requests the SMF to perform verification. The specific process is as follows:

[0179] Step 1: The UE sends a NAS request message (SM N1 Request) to the SMF through the RAN, carrying the terminal identifier (UEID).

[0180] Step 2: The RAN sends an N2 request message (SM N2 Request) to the SMF, carrying the SM N1 Request and the RAN-assigned ID associated with the UE (RAN NGAP ID).

[0181] Step 3: The SMF verifies the MAC address of the SM N1 Request to verify the authenticity of the UE identified by the UE ID (to prevent unauthorized UEs from impersonating the genuine UE and sending SM N1 Requests). This verification process refers to the NAS message verification process in related technologies and will not be elaborated upon here. If the verification is successful, proceed to the following steps.

[0182] Step 4: The SMF generates a token for the UE and then sends an N2 response message (SM N2 Response) to the RAN, carrying the RAN NGAP ID from Step 2, the SM N1 Response message sent to the UE, and the generated token. This step does not require carrying the AMF's identifier; optionally, the SM N2 Response may or may not carry the AMF's identifier.

[0183] Step 5: The RAN identifies the UE corresponding to the message based on the RAN NGAP ID, and upon receiving the token, sends an N2 Request message (AM N2 Request) to the AMF, carrying the RAN NGAP ID and the token. Optionally, the AM N2 Request may include SMF information.

[0184] Step 6: The RAN sends an SM N1 Response to the UE based on the received SM N1 Response.

[0185] It is understandable that there is no necessary order between steps 5 and 6. Steps 5 and 6 can be executed simultaneously, or step 6 can be executed before step 5, or step 5 can be executed before step 6.

[0186] Step 7: The AMF requests a token or a verification token from the SMF, carrying the RAN NGAP ID for the SMF to identify the UE. The AMF requesting a token can be understood as the AMF requesting to obtain the token generated for the UE by the SMF in Step 4, and the AMF requesting a verification token can be understood as the AMF sending the token to be verified (the token obtained by the AMF in Step 5) to the SMF, which then performs the verification.

[0187] Step 8: The SMF returns the token generated in Step 4 to the AMF, or the SMF verifies the received token (e.g., compares it with the token generated in Step 4). If successful (e.g., they are the same), the SMF returns a SUPI and a success indication to the AMF; otherwise, it returns a failure indication to the AMF.

[0188] Step 9: The AMF verifies the received token (e.g., compares it with the token received in Step 5). If successful (e.g., they are the same), it assigns an ID (AM NGAP ID) to the UE; or, based on the received indication information, if the indication information indicates successful verification, the AMF assigns an ID (AM NGAP ID) to the UE. In successful cases, the AMF sends an N2 response message (AM N2 Response) to the RAN, carrying the RAN NGAP ID and the AM NGAP ID. The RAN identifies the UE targeted by the message based on the RAN NGAP ID and associates the UE with the AM NGAP ID (subsequent uplink messages from this UE will carry the AM NGAP ID for the AMF to associate with the UE).

[0189] Example 4 Implicit Tokens

[0190] For example, attached Figure 6 As shown in this example, the MF implicitly assigns the AM NGAP ID as a token and transfers it to the RAN via the SMF. The RAN carries the token for AMF verification when establishing a connection. The specific process is as follows:

[0191] Step 1: The UE sends a NAS request message (SM N1 Request) to the SMF through the RAN, carrying the terminal identifier (UEID).

[0192] Step 2: The RAN sends an N2 request message (SM N2 Request) to the SMF, carrying the SM N1 Request and the RAN-assigned ID associated with the UE (RAN NGAP ID).

[0193] Step 3: The SMF verifies the MAC address of the SM N1 Request to verify the authenticity of the UE identified by the UE ID (to prevent unauthorized UEs from impersonating the genuine UE and sending SM N1 Requests). This verification process refers to the NAS message verification process in related technologies and will not be elaborated upon here. If the verification is successful, proceed to the following steps.

[0194] Step 4: The SMF requests the UE's context from the AMF via a message (Context Transfer Req). The Context Transfer Req carries the UE's context request (MM Context Req), and optionally, it can also carry SUPI.

[0195] Step 5: The AMF generates a token for the UE and uses the token as the UE identification information, i.e., AM NGAP ID. Then, it returns the UE's context and the generated token to the SMF via a message (Context Transfer Rsp). Optionally, the Context Transfer Rsp also carries SUPI.

[0196] Step 6: In response to the request message in Step 2, the SMF sends an N2 response message (SM N2 Response) to the RAN, carrying the RAN NGAP ID from Step 2, the SM N1 Response message sent to the UE, and the token (AM NGAP ID).

[0197] Step 7: The RAN identifies the UE corresponding to the message based on the RAN NGAP ID. Upon receiving the token, it sends an N2 Indication message (AM N2 Indication) to the AMF, carrying the RAN NGAP ID and the token (AM NGAP ID). The AMF verifies the received token (e.g., compares it with the token generated in Step 5). If successful (e.g., they are the same), it accepts the N2 Indication message (AM N2 Indication). Optionally, the AMF can respond by accepting the AM N2 Indication, rejecting the AM N2 Indication, or not respond at all.

[0198] The RAN identifies the UE targeted by the message based on the RAN NGAP ID and associates the UE with a token, namely the AM NGAP ID (subsequent uplink messages for this UE will carry the token, i.e., the AM NGAP ID, used by the AMF to associate the UE). It can be understood that the above association operation of the RAN can be performed based on the AMF's feedback (acceptance) of the AM N2 Indication, or it can be performed directly without the need for feedback from the AMF.

[0199] Step 8: The RAN sends an SM N1 Response to the UE based on the received SM N1 Response.

[0200] It is understandable that there is no necessary order between steps 7 and 8. Steps 7 and 8 can be executed simultaneously, or step 8 can be executed before step 7, or step 7 can be executed before step 8.

[0201] The application embodiment solves the problem of the first NF identifying whether the N2 message originates from the operation of a real terminal, and prevents illegal terminals from impersonating real terminals to trigger access network nodes to send N2 messages.

[0202] The verification method provided in this application can be executed by a verification device. This application uses the example of a verification device executing the verification method to illustrate the verification device provided in this application.

[0203] This application provides a verification device. As an example, the verification device may be a communication device or a component within a communication device, such as a chip. The communication device may be a terminal, a network-side device, or a server, etc. Exemplarily, the terminal may include, but is not limited to, the type of terminal 11 listed above, and the network-side device may include, but is not limited to, the type of network-side device 12 listed above. This application does not impose specific limitations.

[0204] The verification device includes a receiving module, a transmitting module, and a processing module. These modules can be implemented in software or hardware. When implemented in hardware, the processing module can be implemented by a processor. For example, the processor can include general-purpose processors, special-purpose processors, etc., such as central processing units (CPUs), microprocessors, digital signal processors (DSPs), artificial intelligence (AI) processors, graphics processing units (GPUs), application-specific integrated circuits (ASICs), network processors (NPs), field-programmable gate arrays (FPGAs), or other programmable logic devices, gate circuits, transistors, discrete hardware components, etc. The receiving and transmitting modules can be implemented by a communication interface, which can include one or more of the following: transceivers, pins, circuits, buses, radio frequency units, etc.

[0205] See Figure 11 When the verification device is a network-side device or a component within a network-side device, the verification device 1100 includes:

[0206] The first receiving module 1101 is used to receive first information sent by the access network node, the first information including a first token, the first token being a terminal-related token obtained by the access network node;

[0207] The first acquisition module 1102 is used to acquire the verification result of the first token based on the first information.

[0208] Optionally, the first acquisition module includes:

[0209] The first determining module is used to determine the verification result of the first token based on the matching result of the first token and the second token, wherein the second token is a token generated by the verification device for the terminal or a token generated by the second network node for the terminal.

[0210] Optionally, if the second token is a token generated by the verification device for the terminal, the device further includes:

[0211] The first sending module is used to send second information to the second network node, the second information including the second token.

[0212] Optionally, if the second token is a token generated by the second network node for the terminal, the device further includes:

[0213] The second receiving module is used to receive third information sent by the second network node, the third information including the second token.

[0214] Optionally, the first acquisition module includes:

[0215] The second sending module is used to send fourth information to the second network node, the fourth information including the first token;

[0216] The third receiving module is used to receive the fifth information sent by the second network node, the fifth information being used to indicate the verification result of the first token;

[0217] Alternatively, the first acquisition module includes:

[0218] The third sending module is used to send fourth information to the second network node, the fourth information being used to request a second token;

[0219] The fourth receiving module is used to receive the fifth information sent by the second network node, the fifth information including the second token;

[0220] The second determining module is used to determine the verification result of the first token based on the matching result of the first token and the second token, wherein the second token is a token generated by the second network node for the terminal;

[0221] The second network node is the node that receives the NAS signaling from the terminal.

[0222] Optionally, the device includes:

[0223] The fourth sending module is used to send sixth information to the access network node when the verification result indicates that the first token verification is successful. The sixth information includes an identifier related to the terminal assigned by the verification device.

[0224] The verification device provided in this application embodiment can achieve... Figures 4 to 8 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0225] The communication method provided in this application can be executed by a communication device. This application uses the example of a communication device executing the communication method to illustrate the communication device provided in this application.

[0226] This application provides a communication device. As an example, the communication device may be a communication equipment or a component within a communication equipment, such as a chip. The communication equipment may be a terminal, a network-side device, or a server, etc. Exemplarily, the terminal may include, but is not limited to, the type of terminal 11 listed above, and the network-side device may include, but is not limited to, the type of network-side device 12 listed above. This application does not impose specific limitations.

[0227] The communication device includes a receiving module, a transmitting module, and a processing module. These modules can be implemented in software or hardware. When implemented in hardware, the processing module can be implemented by a processor. For example, the processor can include general-purpose processors, special-purpose processors, etc., such as central processing units (CPUs), microprocessors, digital signal processors (DSPs), artificial intelligence (AI) processors, graphics processing units (GPUs), application-specific integrated circuits (ASICs), network processors (NPs), field-programmable gate arrays (FPGAs), or other programmable logic devices, gate circuits, transistors, discrete hardware components, etc. The receiving and transmitting modules can be implemented by a communication interface, which can include one or more of the following: transceivers, pins, circuits, buses, radio frequency units, etc.

[0228] See Figure 12 When the communication device is a network-side device or a component within a network-side device, the communication device 1200 includes:

[0229] The fifth sending module 1201 is used to send first information to the first network node. The first information includes a first token, which is a token related to the terminal obtained by the communication device.

[0230] Optionally, the device further includes:

[0231] The sixth sending module is used to forward the NAS signaling of the terminal to the second network node;

[0232] The fifth receiving module is used to receive the seventh information sent by the second network node. The seventh information includes a second token, which is either a token generated by the first network node for the terminal or a token generated by the second network node for the terminal.

[0233] The second acquisition module is used to acquire the first token based on the seventh information.

[0234] Optionally, the second token is an identifier associated with the terminal assigned by the first network node.

[0235] Optionally, the device further includes:

[0236] The sixth receiving module is used to receive the sixth information sent by the first network node, the sixth information including an identifier related to the terminal assigned by the first network node.

[0237] Optionally, the device further includes:

[0238] The association module is used to associate the terminal with the identifier associated with the terminal.

[0239] The communication device provided in this application embodiment can achieve... Figures 4 to 9 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0240] See Figure 13 When the communication device is a network-side device or a component within a network-side device, the communication device 1300 includes:

[0241] Execution module 1301 is used to perform any of the following:

[0242] Obtain second information from the first network node and send seventh information to the access network node. The second information includes a second token, and the seventh information includes a second token, which is a token generated by the first network node for the terminal.

[0243] A second token is generated for the terminal, and a seventh message, including the second token, is sent to the access network node.

[0244] Optionally, if the communication device generates a second token for the terminal, the device further includes:

[0245] The seventh sending module is used to send third information to the first network node, the third information including the second token.

[0246] Optionally, if the communication device generates a second token for the terminal, the device further includes:

[0247] The seventh receiving module is used to receive the fourth information sent by the first network node, the fourth information including a first token, the first token being a token from the access network node;

[0248] The verification module is used to verify the first token based on the matching result of the first token and the second token;

[0249] The eighth sending module is used to send fifth information to the first network node, the fifth information being used to indicate the verification result of the first token;

[0250] Alternatively, if the communication device generates a second token for the terminal, the device further includes:

[0251] The eighth receiving module is used to receive the fourth information sent by the first network node, the fourth information being used to request the second token;

[0252] The ninth sending module is used to send fifth information to the first network node, the fifth information including the second token.

[0253] Optionally, the method further includes:

[0254] The ninth receiving module is used to receive NAS signaling from the terminal;

[0255] The execution module is specifically used for:

[0256] If the integrity of the NAS signaling is successfully verified, second information is obtained from the first network node, seventh information is sent to the access network node, and / or a second token is generated for the terminal, and seventh information is sent to the access network node.

[0257] The communication device provided in this application embodiment can achieve... Figures 4 to 8 and Figure 10 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0258] like Figure 14 As shown in the illustration, this application also provides a communication device 1400, including a processor 1401 and a memory 1402. The memory 1402 stores a program or instructions that can run on the processor 1401. For example, when the communication device 1400 is a terminal, the program or instructions executed by the processor 1401 implement the various steps of the above-described verification method or communication method embodiments and achieve the same technical effect. When the communication device 1400 is a network-side device, the program or instructions executed by the processor 1401 implement the various steps of the above-described verification method or communication method embodiments and achieve the same technical effect. To avoid repetition, further details are omitted here.

[0259] This application embodiment also provides a terminal, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions. This terminal embodiment corresponds to the terminal in the above embodiments, and all implementation processes and methods of the above method embodiments can be applied to this terminal embodiment and achieve the same technical effect. Specifically, Figure 15 A schematic diagram of the hardware structure of a terminal to implement an embodiment of this application.

[0260] The terminal 1500 includes, but is not limited to, at least some of the following components: radio frequency unit 1501, network module 1502, audio output unit 1503, input unit 1504, sensor 1505, display unit 1506, user input unit 1507, interface unit 1508, memory 1509, and processor 1510.

[0261] Those skilled in the art will understand that the terminal 1500 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 1510 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 15 The terminal structure shown does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0262] It should be understood that, in this embodiment, the input unit 1504 may include a graphics processor 15041 and a microphone 15042. The graphics processor 15041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 1506 may include a display panel 15061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, or the like. The user input unit 1507 includes a touch panel 15071 and at least one of other input devices 15072. The touch panel 15071 is also called a touch screen. The touch panel 15071 may include a touch detection device and a touch controller. Other input devices 15072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be described in detail here.

[0263] In this embodiment, after receiving downlink data from the network-side device, the radio frequency unit 1501 can transmit it to the processor 1510 for processing; in addition, the radio frequency unit 1501 can send uplink data to the network-side device. Typically, the radio frequency unit 1501 includes, but is not limited to, antennas, amplifiers, transceivers, couplers, low-noise amplifiers, duplexers, etc.

[0264] The memory 1509 can be used to store software programs or instructions, as well as various data. The memory 1509 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 1509 may include volatile memory or non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 1509 in the embodiments of this application includes, but is not limited to, these and any other suitable types of memory.

[0265] Processor 1510 may include one or more processing units; optionally, processor 1510 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into processor 1510.

[0266] It is understood that the implementation process of each implementation method mentioned in this embodiment can refer to the relevant description of the method embodiment and achieve the same or corresponding technical effect. To avoid repetition, it will not be described again here.

[0267] This application embodiment also provides a network-side device, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement, for example... Figure 4 or Figure 9 or Figure 10 The steps of the method embodiment shown are illustrated. This network-side device embodiment corresponds to the above-described network-side device method embodiment. All implementation processes and methods of the above-described method embodiments can be applied to this network-side device embodiment and can achieve the same technical effect.

[0268] Specifically, embodiments of this application also provide a network-side device, which can be... Figure 12 The communication device shown. (For example) Figure 16 As shown, the network-side device 1600 includes: an antenna 161, a radio frequency (RF) device 162, a baseband device 163, a processor 164, and a memory 165. The antenna 161 is connected to the RF device 162. In the uplink direction, the RF device 162 receives information through the antenna 161 and transmits the received information to the baseband device 163 for processing. In the downlink direction, the baseband device 163 processes the information to be transmitted and sends it to the RF device 162. The RF device 162 processes the received information and transmits it through the antenna 161.

[0269] The method executed by the network-side device in the above embodiments can be implemented in the baseband device 163, which includes a baseband processor.

[0270] Baseband device 163 may include, for example, at least one baseband board on which multiple chips are disposed, such as Figure 16 As shown, one of the chips is, for example, a baseband processor, which is connected to the memory 165 via a bus interface to call the program or instructions in the memory 165 to execute the network-side device operations shown in the above method embodiments.

[0271] The network-side device may also include a network interface 166, such as a Common Public Radio Interface (CPRI).

[0272] The radio frequency device 162 is used to send first information to the first network node. The first information includes a first token, which is a token related to the terminal obtained by the access network node.

[0273] Furthermore, the network-side device 1600 in this embodiment of the application also includes: a program or instructions stored in a memory 165 and executable on a processor 164, wherein the processor 164 calls the program or instructions in the memory 165 to execute. Figure 12 The methods executed by each module shown achieve the same technical effect, and to avoid repetition, they will not be described in detail here.

[0274] Specifically, embodiments of this application also provide a network-side device. For example... Figure 17As shown, the network-side device 1700 includes: a processor 1701, a network interface 1702, and a memory 1703. This network-side device can be... Figure 11 The verification device shown or Figure 13 The communication device shown. The network interface 1702 is, for example, a common public radio interface (CPRI).

[0275] Among them, network interface 1702 is used to receive first information sent by access network node, the first information including first token, the first token being a terminal-related token obtained by access network node;

[0276] The processor 1701 is used to obtain the verification result of the first token based on the first information.

[0277] Alternatively, network interface 1702 is used to obtain second information from the first network node and send seventh information to the access network node. The second information includes a second token, and the seventh information includes a second token, which is a token generated by the first network node for the terminal.

[0278] Alternatively, processor 1701 is used to generate a second token for the terminal;

[0279] Network interface 1702 is used to send seventh information to the access network node, the seventh information including the second token.

[0280] Furthermore, the network-side device 1700 in this application embodiment also includes: a program or instructions stored in memory 1703 and executable on processor 1701, wherein processor 1701 calls the program or instructions in memory 1703 to execute. Figure 11 Alternatively, the methods executed by each module shown in Figure 13 can achieve the same technical effect. To avoid repetition, they will not be described in detail here.

[0281] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described verification method or communication method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0282] The processor mentioned above is either the processor in the terminal described in the above embodiments or the processor in the network-side device. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk. In some examples, the readable storage medium may be a non-transient readable storage medium.

[0283] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described verification method or communication method embodiments, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0284] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0285] This application also provides a computer program / program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above-described verification method or communication method embodiments, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0286] This application also provides a communication system, including: a first network node, an access network node, and a second network node. The first network node can be used to perform the steps of the verification method described above, and the access network node can be used to perform... Figure 9 The steps of the communication method shown are such that the second network node can be used to perform, for example... Figure 10 The steps of the communication method shown.

[0287] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0288] From the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of computer software products plus necessary general-purpose hardware platforms, and of course, they can also be implemented by hardware. The computer software product is stored in a storage medium (such as ROM, RAM, magnetic disk, optical disk, etc.), and the computer software product includes several instructions to cause the terminal or network-side device to execute the methods described in the various embodiments of this application.

[0289] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other implementations under the guidance of this application without departing from the spirit and scope of the claims. All of these implementations are within the protection scope of this application.

Claims

1. A verification method, characterized in that, include: The first network node receives first information sent by the access network node, the first information including a first token, the first token being a terminal-related token obtained by the access network node; The first network node obtains the verification result of the first token based on the first information.

2. The method according to claim 1, characterized in that, The first network node obtains the verification result of the first token based on the first token, including: The first network node determines the verification result of the first token based on the matching result of the first token and the second token, wherein the second token is either a token generated by the first network node for the terminal or a token generated by the second network node for the terminal. The second network node is the node that receives the non-access stratum (NAS) signaling from the terminal.

3. The method according to claim 2, characterized in that, When the second token is a token generated by the first network node for the terminal, the method further includes: The first network node sends second information to the second network node, the second information including the second token.

4. The method according to claim 2 or 3, characterized in that, The second token is an identifier associated with the terminal assigned by the first network node.

5. The method according to claim 2, characterized in that, When the second token is a token generated by the second network node for the terminal, the method further includes: The first network node receives third information sent by the second network node, the third information including the second token.

6. The method according to claim 1, characterized in that, The first network node obtains the verification result of the first token based on the first token, including: The first network node sends a fourth message to the second network node, the fourth message including the first token; The first network node receives the fifth information sent by the second network node, the fifth information being used to indicate the verification result of the first token; Alternatively, the first network node obtains the verification result of the first token based on the first token, including: The first network node sends a fourth message to the second network node, the fourth message being used to request a second token; The first network node receives the fifth information sent by the second network node, the fifth information including the second token; The first network node determines the verification result of the first token based on the matching result of the first token and the second token, whereby the second token is a token generated by the second network node for the terminal. The second network node is the node that receives the NAS signaling from the terminal.

7. The method according to any one of claims 1-3 and 5-6, characterized in that, The method further includes: If the verification result indicates that the first token verification was successful, the first network node sends sixth information to the access network node, the sixth information including an identifier related to the terminal assigned by the first network node.

8. A communication method, characterized in that, include: The access network node sends first information to the first network node. The first information includes a first token, which is a token related to the terminal obtained by the access network node.

9. The method according to claim 8, characterized in that, The method further includes: The access network node forwards the NAS signaling of the terminal to the second network node; The access network node receives the seventh information sent by the second network node, the seventh information including a second token, the second token being either a token generated by the first network node for the terminal or a token generated by the second network node for the terminal; The access network node obtains the first token based on the seventh information.

10. The method according to claim 9, characterized in that, The second token is an identifier associated with the terminal assigned by the first network node.

11. The method according to claim 8 or 9, characterized in that, The method further includes: The access network node receives a sixth piece of information sent by the first network node, the sixth piece of information including an identifier related to the terminal assigned by the first network node.

12. The method according to claim 10 or 11, characterized in that, The method further includes: The access network node is associated with the terminal and the identifier related to the terminal.

13. A communication method, characterized in that, include: The second network node performs any of the following: Obtain second information from the first network node and send seventh information to the access network node. The second information includes a second token, and the seventh information includes a second token, which is a token generated by the first network node for the terminal. A second token is generated for the terminal, and a seventh message, including the second token, is sent to the access network node.

14. The method according to claim 13, characterized in that, In the case where the second token is a token generated by the first network node for the terminal, the second token is an identifier associated with the terminal assigned by the first network node.

15. The method according to claim 13, characterized in that, When the second network node generates a second token for the terminal, the method further includes: The second network node sends a third message to the first network node, the third message including the second token.

16. The method according to claim 13, characterized in that, When the second network node generates a second token for the terminal, the method further includes: The second network node receives fourth information sent by the first network node, the fourth information including a first token, the first token being a token from the access network node; The second network node verifies the first token based on the matching result of the first token and the second token; The second network node sends a fifth message to the first network node, the fifth message being used to indicate the verification result of the first token; Alternatively, if the second network node generates a second token for the terminal, the method further includes: The second network node receives a fourth message sent by the first network node, the fourth message being used to request a second token; The second network node sends a fifth message to the first network node, the fifth message including the second token.

17. The method according to any one of claims 13-16, characterized in that, The method further includes: The second network node receives NAS signaling from the terminal; The second network node obtains second information from the first network node and sends seventh information to the access network node, and / or the second network node generates a second token for the terminal and sends seventh information to the access network node, including: If the second network node successfully verifies the integrity of the NAS signaling, it obtains the second information from the first network node and sends the seventh information to the access network node. And / or, if the second network node successfully verifies the integrity of the NAS signaling, it generates a second token for the terminal and sends the seventh information to the access network node.

18. A verification device, characterized in that, include: The first receiving module is used to receive first information sent by the access network node, the first information including a first token, the first token being a terminal-related token obtained by the access network node; The first acquisition module is used to acquire the verification result of the first token based on the first information.

19. The apparatus according to claim 18, characterized in that, The first acquisition module includes: The first determining module is used to determine the verification result of the first token based on the matching result of the first token and the second token, wherein the second token is a token generated by the verification device for the terminal or a token generated by the second network node for the terminal; The second network node is the node that receives the non-access stratum (NAS) signaling from the terminal.

20. The apparatus according to claim 19, characterized in that, If the second token is a token generated by the verification device for the terminal, the device further includes: The first sending module is used to send second information to the second network node, the second information including the second token.

21. The apparatus according to claim 19, characterized in that, If the second token is a token generated by the second network node for the terminal, the device further includes: The second receiving module is used to receive third information sent by the second network node, the third information including the second token.

22. The apparatus according to claim 18, characterized in that, The first acquisition module includes: The second sending module is used to send fourth information to the second network node, the fourth information including the first token; The third receiving module is used to receive the fifth information sent by the second network node, the fifth information being used to indicate the verification result of the first token; Alternatively, the first acquisition module includes: The third sending module is used to send fourth information to the second network node, the fourth information being used to request a second token; The fourth receiving module is used to receive the fifth information sent by the second network node, the fifth information including the second token; The second determining module is used to determine the verification result of the first token based on the matching result of the first token and the second token, wherein the second token is a token generated by the second network node for the terminal; The second network node is the node that receives the NAS signaling from the terminal.

23. The apparatus according to any one of claims 18-22, characterized in that, The device includes: The fourth sending module is used to send sixth information to the access network node when the verification result indicates that the first token verification is successful. The sixth information includes an identifier related to the terminal assigned by the verification device.

24. A communication device, characterized in that, include: The fifth sending module is used to send first information to the first network node. The first information includes a first token, which is a token related to the terminal obtained by the communication device.

25. The apparatus according to claim 24, characterized in that, The device further includes: The sixth sending module is used to forward the NAS signaling of the terminal to the second network node; The fifth receiving module is used to receive the seventh information sent by the second network node. The seventh information includes a second token, which is either a token generated by the first network node for the terminal or a token generated by the second network node for the terminal. The second acquisition module is used to acquire the first token based on the seventh information.

26. The apparatus according to claim 25, characterized in that, The second token is an identifier associated with the terminal assigned by the first network node.

27. The apparatus according to claim 24 or 25, characterized in that, The device further includes: The sixth receiving module is used to receive the sixth information sent by the first network node, the sixth information including an identifier related to the terminal assigned by the first network node.

28. The apparatus according to claim 26 or 27, characterized in that, The device further includes: The association module is used to associate the terminal with the identifier associated with the terminal.

29. A communication device, characterized in that, include: The execution module is used to perform any of the following: Obtain second information from the first network node and send seventh information to the access network node. The second information includes a second token, and the seventh information includes a second token, which is a token generated by the first network node for the terminal. A second token is generated for the terminal, and a seventh message, including the second token, is sent to the access network node.

30. The apparatus according to claim 29, characterized in that, When the communication device generates a second token for the terminal, the device further includes: The seventh sending module is used to send third information to the first network node, the third information including the second token.

31. The apparatus according to claim 29, characterized in that, When the communication device generates a second token for the terminal, the device further includes: The seventh receiving module is used to receive the fourth information sent by the first network node, the fourth information including a first token, the first token being a token from the access network node; The verification module is used to verify the first token based on the matching result of the first token and the second token; The eighth sending module is used to send fifth information to the first network node, the fifth information being used to indicate the verification result of the first token; Alternatively, if the communication device generates a second token for the terminal, the device further includes: The eighth receiving module is used to receive the fourth information sent by the first network node, the fourth information being used to request the second token; The ninth sending module is used to send fifth information to the first network node, the fifth information including the second token.

32. The apparatus according to any one of claims 29-31, characterized in that, The device further includes: The ninth receiving module is used to receive NAS signaling from the terminal; The execution module is specifically used for: If the integrity of the NAS signaling is successfully verified, second information is obtained from the first network node, seventh information is sent to the access network node, and / or a second token is generated for the terminal, and seventh information is sent to the access network node.

33. A network-side device, characterized in that, The device includes a processor and a memory, the memory storing a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the verification method as described in any one of claims 1 to 7, or, when executed by the processor, the program or instructions implement the steps of the communication method as described in any one of claims 8 to 12, or, when executed by the processor, the program or instructions implement the steps of the communication method as described in any one of claims 13 to 17.

34. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions, which, when executed by a processor, implement the verification method as described in any one of claims 1-7, or the steps of the communication method as described in any one of claims 8-12, or the steps of the communication method as described in any one of claims 13-17.

35. A computer program product, characterized in that, The computer program product is stored in a storage medium and is executed by at least one processor to implement the steps of the verification method as described in any one of claims 1 to 7, or the steps of the communication method as described in any one of claims 8 to 12, or the steps of the communication method as described in any one of claims 13 to 17.

Images