Akma authentication with device information

Abstract

A method includes: receiving an application key request from an application function, including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating a terminal device; determining a first device identifier for the terminal device based on the device information; verifying the terminal device based on the first device identifier and the AKMA key identifier; and sending an application key response to the application function based on the verification result of the terminal device.

Description

Technical Field

[0001] Various exemplary embodiments of this disclosure generally relate to the telecommunications field, and more specifically to methods, apparatus, devices, and computer-readable storage media for application authentication and key management (AKMA) authentication with device information. Background Technology

[0002] AKMA authentication is a novel delegated authentication service based on cellular networks. Using AKMA, users can log in to application services based on 3GPP credentials, which are permanent keys stored in the user's tamper-proof SIM card. Application service providers can also delegate user authentication tasks to mobile network operators using AKMA. Summary of the Invention

[0003] In a first aspect of this disclosure, an apparatus is provided. The apparatus includes at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive an application key request from an application function, the application key request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating a terminal device; determine a first device identifier for the terminal device based on the device information; verify the terminal device based on the first device identifier and the AKMA key identifier; and send an application key response to the application function based on the verification result of the terminal device.

[0004] In a second aspect of this disclosure, an apparatus is provided. The apparatus includes at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive from a terminal device an application session establishment request, the establishment request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device; send an application key request to an AKMA anchor function, the application key request including the AKMA key identifier and the device information; receive an application key response from the anchor function, the application key response indicating a verification result of the terminal device; and send an application session establishment response to the terminal device based on the application key response.

[0005] In a third aspect of this disclosure, an apparatus is provided. The apparatus includes at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: send an application function a request for establishing an application session, the request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the apparatus; and receive an application function a response for establishing the application session.

[0006] In a fourth aspect of this disclosure, an apparatus is provided. The apparatus includes at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive a device identifier request including a subscriber identifier from a network function, the network function including at least one of: an Authentication and Key Management (AKMA) anchor function for an application, or a network open function; determine whether the subscriber identifier corresponds to a registered device identifier; and send a device identifier response to the network function based on the determination result.

[0007] In a fifth aspect of this disclosure, an apparatus is provided. The apparatus includes at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive a device identification check request from a network function including a first device identifier of the terminal device, the network function including at least one of: an Authentication and Key Management (AKMA) anchor function for an application, or a network open function; check whether the terminal device is blocked from network access based on the first device identifier; and send a device identification check response to the network function based on the result of the check.

[0008] In a sixth aspect of this disclosure, a method is provided. The method includes: receiving an application key request from an application function, the application key request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating a terminal device; determining a first device identifier for the terminal device based on the device information; verifying the terminal device based on the first device identifier and the AKMA key identifier; and sending an application key response to the application function based on the verification result of the terminal device.

[0009] In a seventh aspect of this disclosure, a method is provided. The method includes: receiving from a terminal device an application session establishment request, the establishment request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device; sending an application key request to an AKMA anchor function, the application key request including the AKMA key identifier and the device information; receiving an application key response from the anchor function, the application key response indicating a verification result of the terminal device; and sending an application session establishment response to the terminal device based on the application key response.

[0010] In an eighth aspect of this disclosure, a method is provided. The method includes: sending an application session establishment request at a terminal device to an application function, the establishment request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device; and receiving an application session establishment response from the application function.

[0011] In a ninth aspect of this disclosure, a method is provided. The method includes: receiving a device identifier request including a subscriber identifier from a network function, the network function including at least one of: an Authentication and Key Management (AKMA) anchor function for an application, or a network open function; determining whether the subscriber identifier corresponds to a registered device identifier; and sending a device identifier response to the network function based on the determination result.

[0012] In a tenth aspect of this disclosure, a method is provided. The method includes: receiving a device identifier check request from a network function including a first device identifier of the terminal device, the network function including at least one of: an Authentication and Key Management (AKMA) anchor function for applications, or a network open function; checking whether the terminal device is blocked from network access based on the first device identifier; and sending a device identifier check response to the network function based on the result of the check.

[0013] In the eleventh aspect of this disclosure, an apparatus is provided. The apparatus includes: components for receiving an application key request from an application function, the application key request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating a terminal device; components for determining a first device identifier of the terminal device based on the device information; components for verifying the terminal device based on the first device identifier and the AKMA key identifier; and components for sending an application key response to the application function based on the verification result of the terminal device.

[0014] In a twelfth aspect of this disclosure, an apparatus is provided. The apparatus includes: components for receiving from a terminal device an application session establishment request, the establishment request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device; components for sending an application key request to an AKMA anchor function, the application key request including the AKMA key identifier and the device information; components for receiving an application key response from the anchor function, the application key response indicating a verification result of the terminal device; and components for sending an application session establishment response to the terminal device based on the application key response.

[0015] In a thirteenth aspect of this disclosure, an apparatus is provided. The apparatus includes: components for sending an application session establishment request at a terminal device to an application function, the establishment request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device; and components for receiving an application session establishment response from the application function.

[0016] In a fourteenth aspect of this disclosure, an apparatus is provided. The apparatus includes: components for receiving a device identifier request including a subscriber identifier from a network function, the network function including at least one of: an Authentication and Key Management AKMA anchor function for an application, or a network open function; components for determining whether the subscriber identifier corresponds to a registered device identifier; and components for sending a device identifier response to the network function based on the determination result.

[0017] In a fifteenth aspect of this disclosure, an apparatus is provided. The apparatus includes: components for receiving a device identifier check request from a network function including a first device identifier of the terminal device, the network function including at least one of: an Authentication and Key Management (AKMA) anchor function for applications, or a network open function; components for checking whether the terminal device is blocked from network access based on the first device identifier; and components for sending a device identifier check response to the network function based on the result of the check.

[0018] In a sixteenth aspect of this disclosure, a computer-readable medium is provided. The computer-readable medium includes instructions stored thereon for causing a device to perform at least one of the following: the method according to the sixth aspect, the method according to the seventh aspect, the method according to the eighth aspect, the method according to the ninth aspect, or the method according to the tenth aspect.

[0019] It should be understood that the summary section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to be used to limit the scope of this disclosure. Other features of this disclosure will be readily understood from the following description. Attached Figure Description

[0020] Some exemplary embodiments will now be described with reference to the accompanying drawings, in which:

[0021] Figure 1 The illustration shows an example communication environment that can be implemented in the example embodiments of this disclosure;

[0022] Figure 2 The illustration shows a signaling diagram of an example process for AKMA authentication according to some example embodiments of the present disclosure;

[0023] Figure 3 The illustration shows a schematic diagram of AKMA key identifier generation according to some example embodiments of the present disclosure;

[0024] Figure 4 The illustration shows a signaling diagram of an example procedure for checking the Device Identifier Register (EIR) according to some example embodiments of the present disclosure;

[0025] Figure 5 The illustration shows a signaling diagram of an example process for AKMA authentication according to some example embodiments of the present disclosure;

[0026] Figure 6 The illustration shows a flowchart of a method implemented at a device according to some exemplary embodiments of the present disclosure;

[0027] Figure 7 The illustration shows a flowchart of a method implemented at a device according to some exemplary embodiments of the present disclosure;

[0028] Figure 8 The illustration shows a flowchart of a method implemented at a device according to some exemplary embodiments of the present disclosure;

[0029] Figure 9 The illustration shows a flowchart of a method implemented at a device according to some exemplary embodiments of the present disclosure;

[0030] Figure 10 The illustration shows a flowchart of a method implemented at a device according to some exemplary embodiments of the present disclosure;

[0031] Figure 11 A simplified block diagram of a device suitable for implementing exemplary embodiments of the present disclosure is illustrated; and

[0032] Figure 12 A block diagram of an example computer-readable medium according to some example embodiments of the present disclosure is illustrated.

[0033] Throughout the accompanying drawings, the same or similar reference numerals denote the same or similar elements. Detailed Implementation

[0034] The principles of this disclosure will now be described with reference to some exemplary embodiments. It should be understood that these embodiments are described for illustrative purposes only and to assist those skilled in the art in understanding and implementing this disclosure, and do not imply any limitation on the scope of this disclosure. The embodiments described herein can be implemented in various ways other than those described below.

[0035] In the following description and claims, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0036] References to "an embodiment," "an embodiment," "an example embodiment," etc., in this disclosure indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily needs to include that particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Additionally, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is believed that such a feature, structure, or characteristic can be implemented by combining it with other embodiments (whether explicitly described or not) to the extent of knowledge of those skilled in the art.

[0037] It should be understood that although the terms "first," "second," etc., preceding the noun(s) ...

[0038] As used herein, “at least one of the following: ”, “at least one of ”, and similar wording (where the list of two or more elements is connected by “and” or “or”) means at least any one of the elements, or at least any two or more of the elements, or at least all of the elements.

[0039] As used herein, unless explicitly stated otherwise, the “responding to A” execution step does not indicate that the step is executed immediately after “A” occurs, and may include one or more intermediate steps.

[0040] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that, when used herein, the terms “comprising,” “including,” “having,” “containing,” “comprise,” and / or “containing,” etc., specify the presence of the stated features, elements, and / or components, but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0041] As used in this application, the term "circuit system" may refer to one or more, or all of the following: (a) Pure hardware circuit implementation (e.g., implemented only in analog and / or digital circuit systems) and (b) A combination of hardware circuitry and software, such as (if applicable): (i) A combination of (multiple) analog and / or digital hardware circuits and software / firmware, and (ii) Any portion of a hardware processor(s) (including a plurality of digital signal processors(s)) having software, working in conjunction with the software and a plurality of memories(s) to enable a device (e.g., a mobile phone or a server) to perform various functions, and (c) (multiple) hardware circuits and / or (multiple) processors (such as (multiple) microprocessors or portions thereof) that require software (e.g. firmware) to operate, but which may be absent when not in operation.

[0042] The definition of "circuit system" applies to all uses of the term in this application (including in any claim). As another example, as used herein, the term "circuit system" also covers only hardware circuitry or processors (or processors), or portions of hardware circuitry or processors and their accompanying software and / or firmware implementations. The term "circuit system" also covers (e.g., and if applicable to specific claim elements) baseband integrated circuits or processor integrated circuits for mobile devices, or similar integrated circuits in servers, cellular network devices, or other computing or network devices.

[0043] As used herein, the term "communication network" refers to a network that conforms to any suitable communication standard, such as New Radio (NR), Long Term Evolution (LTE), LTE-A Advanced (LTE-A), Wideband Code Division Multiple Access (WCDMA), High-Speed ​​Packet Access (HSPA), Narrowband Internet of Things (NB-IoT), etc. Furthermore, communication between terminal devices and network devices in the communication network can be performed according to any suitable intergenerational communication protocol, including but not limited to first-generation (1G), second-generation (2G), 2.5G, 2.75G, third-generation (3G), fourth-generation (4G), 4.5G, fifth-generation (5G), sixth-generation (6G) communication protocols, and / or any other protocols currently known or to be developed in the future. Embodiments of this disclosure can be applied to a variety of communication systems. Given the rapid development of communications, there will naturally be future types of communication technologies and systems that can be embodied in this disclosure. This should not be construed as limiting the scope of this disclosure to only the systems described above.

[0044] As used herein, the term "network device" refers to a node in a communication network through which terminal devices access the network and receive services. This network device can refer to a base station (BS) or access point (AP), such as a Node B (NodeB or NB), an evolved Node B (eNodeB or eNB), an NR NB (also known as a gNB), a Remote Radio Unit (RRU), a Radio Header (RH), a Remote Radio Header (RRH), a relay, an Integrated Access and Backhaul (IAB) node, a low-power node (such as a femtocell, picocell), a non-terrestrial network (NTN) or non-terrestrial network equipment (such as satellite network equipment, low Earth orbit (LEO) satellites, and geostationary Earth orbit (GEO) satellites), aircraft network equipment, etc., depending on the terminology and technology applied. In some example embodiments, the Radio Access Network (RAN) separation architecture includes a centralized unit (CU) and a distributed unit (DU) at the IAB donor node. The IAB node includes a mobile communication terminal (IAB-MT) portion that behaves similarly to a UE towards the parent node, and the DU portion of the IAB node that behaves similarly to a base station towards the next-hop IAB node.

[0045] The term "terminal device" refers to any terminal device capable of wireless communication. By way of example and not limitation, a terminal device may also be referred to as a communication device, user equipment (UE), subscriber station (SS), portable subscriber station, mobile station (MS), or access terminal (AT). Terminal devices can include, but are not limited to: mobile phones, cellular phones, smartphones, VoIP phones, wireless local loop phones, tablets, wearable terminal devices, personal digital assistants (PDAs), portable computers, desktop computers, image capture terminal devices (such as digital cameras), gaming terminal devices, music storage and playback devices, in-vehicle wireless terminal devices, wireless endpoints, mobile stations, laptop embedded devices (LEE), laptop installed devices (LME), USB dongles, smart devices, wireless client devices (CPE), Internet of Things (IoT) devices, watches or other wearable devices, head-mounted displays (HMDs), vehicles, drones, medical devices and applications (such as remote surgery), industrial devices and applications (such as one or more robots or other wireless devices operating in industrial and / or automated processing chain environments), consumer electronics devices, devices operating on commercial and / or industrial wireless networks, etc. Terminal equipment may also correspond to the mobile communication terminal (MT) portion of an IAB node (e.g., a relay node). In the following description, the terms "terminal equipment," "communication equipment," "terminal," "user equipment," and "UE" are used interchangeably.

[0046] As used herein, the terms “resource,” “transmission resource,” “resource block,” “physical resource block” (PRB), “uplink resource,” or “downlink resource” can refer to any resource used to perform communication, such as communication between terminal devices and network devices, including time-domain resources, frequency-domain resources, spatial-domain resources, code-domain resources, or any other combination of time-domain, frequency-domain, spatial-domain, and / or code-domain resources that enable communication. In the following, unless explicitly stated otherwise, both frequency-domain and time-domain resources will be used as examples of transmission resources used in this disclosure to describe some example embodiments. It should be noted that the example embodiments of this disclosure are equally applicable to other resources in other domains.

[0047] Figure 1 An example environment 100 according to some example embodiments of the present disclosure is shown. In environment 100, AKMA may be employed. As shown, environment 100 may include at least a terminal device 110 (e.g., user equipment, UE), a home network (HN) 120, and an application function (AF) 130.

[0048] HN 120 can represent a mobile network provider, acting as an authenticator for users and helping application providers and users agree on session keys in AKMA services. HN 120 contains several network functions, such as Unified Data Management (UDM) 121, AKMA Anchor Function (AAnF) 122, Authentication Server Function (AUSF) 123, and Network Open Function (NEF) 124. UDM 121 stores information about all subscribers of HN 120. AAnF 122 manages temporary information about subscribers and generates temporary session keys K for application functions. AF AUSF 123 establishes a connection between UDM 121 and AAnF 122, obtains the 5G certification vector from UDM 121, and generates the associated AKMA material. When the target AF is located outside HN 120, NEF 124 establishes a connection between AAnF 122 and AF 130.

[0049] AF 130 can be considered an application vendor or service provider, representing the online services a user may wish to use. The purpose of AKMA is to facilitate the establishment of a secure channel (exchange of secret keys) between AF 130 and terminal device 110, where authentication of the terminal device is delegated to its corresponding HN 120.

[0050] In some example embodiments, environment 100 may include additional network functions, such as Figure 1 EIR 125 is shown. EIR 125 can be included in the serving network of terminal device 110. If terminal device 110 is located in a Home Public Land Mobile Network (HPLMN), then EIR 125 is included in HN 120. If terminal device 110 is located in a Visited Public Land Mobile Network (VPLMN), then EIR 125 is outside HN 120.

[0051] Communication in communication environment 100 can be implemented according to any suitable communication protocol(s), including but not limited to cellular communication protocols such as first-generation (1G), second-generation (2G), third-generation (3G), fourth-generation (4G), fifth-generation (5G), and sixth-generation (6G), wireless local area network communication protocols (such as IEEE 802.11), and / or any other protocols currently known or to be developed in the future. Furthermore, the communication can utilize any suitable wireless communication technology, including but not limited to: Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Frequency Division Duplex (FDD), Time Division Duplex (TDD), Multiple-Input Multiple-Output (MIMO), Orthogonal Frequency Division Multiple Access (OFDM), Discrete Fourier Transform Spread Spectrum OFDM (DFT-s-OFDM), and / or any other technologies currently known or to be developed in the future.

[0052] As briefly mentioned above, AKMA authentication aims to leverage 5G authentication mechanisms to provide a session key to applications, which is subsequently used to protect communication between the UE and the application server. AAnF has already been introduced in 5G systems to obtain the intermediate AKMA key (K) from AUSF123. AKMA ), and provide application keys (K) to application vendors. AF (also known as a session key). AF can use the received session key K. AF Or based on session key K AF Further key derivation is performed to protect communication between the UE and the application server. This considers enabling K in the home network and within the UE. AUSF Storage, for use in 5G security design for additional services, AKMA is designed to utilize master authentication (i.e., K... AUSF This simplifies the process. Specifically, if the UE has subscribed to the AKMA service capability, K will be stored in the UE. AUSF And further from K after successful master authentication AUSF Derive K AKMA .

[0053] During the AKMA process, an A-KID is generated as a unique identifier in both the UE and AUSF to identify the UE's K. AKMA Key.

[0054] The purpose of AKMA is to provide authentication and key management to applications based on 3GPP credentials used for 5GS access, which allows the UE to securely exchange data with AKMA application functions.

[0055] Received from the upper layer to obtain the AKMA key (K AKMA When requesting an AKMA key identifier (A-KID), an AKMA-enabled UE should, if available, obtain it from a valid K... AUSF Derive K AKMA The AKMA temporary identifier (A-TID) should be further derived from the A-TID to obtain the A-KID, and the KID should be provided to higher levels. AKMA And A-KID.

[0056] After receiving the Extensible Authentication Protocol (EAP) success message or the security mode command message, when any K AUSF When changes are made, UEs that support AKMA should notify higher management.

[0057] From K AKMA Derive the AKMA application key (K AF Whether an application needs to use AKMA knowledge is application-specific. Using K...AF The exact method for protecting data exchange at the upper layer is application-specific. Before initiating communication with the AKMA application function, the upper layer requests the UE NAS layer to provide K... AKMA And A-KID. Received from the upper layer to obtain K AKMA When making a request for A-KID, if no K is available AUSF Therefore, the UE NAS layer cannot derive K. AKMA And A-KID, and provide higher levels with the inability to generate K AKMA And A-KID's instructions.

[0058] Given the above, AKMA will still work even if authentication is successful and registration is rejected, because the UE will have already provided the key material to the application layer.

[0059] AKMA utilizes a master authentication based on the highly secure HPLMN to provide a reliable framework for applications to authenticate UEs and protect communication between the UE and the application server. However, it only checks credentials in the SIM card and does not verify device information in the master authentication. In some cases, only authorized devices should be able to access the services they provide. Unauthorized devices can bypass AKMA authentication. For example, if user A owns UE-A and has AKMA-based authentication at a bank server, and then user B takes user A's SIM card and inserts it into UE-B, the AKMA authentication will succeed.

[0060] Furthermore, AKMA does not require EIR checks. Another scenario can be considered: the UE generates A-KID and K... AKMA And immediately send the generated A-KID and K to the application layer. AF The application layer stores A-KID and K. AF If UE registration is rejected (not accepted) by the Access and Mobility Management Function (AMF) due to EIR check failure, the application layer still holds the AKMA key.

[0061] During the ongoing master authentication and key negotiation process, if the UE receives a key from the upper layer to obtain K... AKMA If the UE requests an A-KID, it should derive the KID after the ongoing master authentication and key negotiation process is completed. AKMA And A-TID, A-KID should be further derived from A-TID, and K should be provided to higher management. AKMA And A-KID.

[0062] Because the application layer has the key and the UE connects via Wi-Fi, applications within the UE can connect to the AF to initiate an application session via A-KID. However, in this scenario, AKMA authentication can still pass even if UE registration is rejected by the AMF due to EIR blocking. In this case, the PLMN is providing AKMA service (carrier service), which requires an EIR check, which is omitted in the above scenario. Therefore, this is a gap in existing AKMA services.

[0063] In view of the above, this disclosure proposes a solution for AKMA authentication with device information. In this solution, a terminal device about to establish an application session with an application server can request the establishment of the application session by including device information indicating the terminal device.

[0064] In this way, the network performs additional checks on device information to ensure that unauthorized devices do not pass AKMA certification. This solution simultaneously enhances security and leverages AKMA certification to provide a seamless user experience. In this manner, user data security is ensured, potential attacks are mitigated, and service providers are provided with better device control mechanisms.

[0065] Exemplary embodiments of this disclosure will be described in detail below with reference to the accompanying drawings.

[0066] Now for reference Figure 2 The diagram illustrates a signaling diagram of an example process for AKMA authentication according to some example embodiments of this disclosure. For discussion purposes, reference is made to... Figure 1 To describe signaling diagram 200.

[0067] like Figure 2 As shown, in some example embodiments, primary authentication 201 may be performed first. During primary authentication 201, AUSF 123 may interact with UDM 121 to obtain authentication information. AUSF 123 may send (212) an authentication request to UDM 121 including the subscription persistent identifier (SUPI) or subscription hidden identifier (SUCI) of terminal device 110, such as a Nudm_UEAuthentication_Get request including SUPI or SUCI.

[0068] Depending on whether terminal device 110 is able to use and is permitted to use the AKMA service, UDM 121 may send an authentication response (214) to AUSF 123 to indicate to AUSF 123 whether a KMA should be generated. AKMAFor example, a Nudm_UEAuthentication_Get response can be used, which includes the AKMA indication and the route indicator (RID) of terminal device 110. If terminal device 110 is able to use the AKMA service and is allowed to use the AKMA service, the value of the AKMA indication is set to True.

[0069] It should be noted that Figure 2 The Master Authentication 201 shown is an example and does not impose any limitations on the scope of protection.

[0070] Then, key deduction 202 can be performed. After receiving the AKMA instruction from UDM 121, both AUSF 123 and terminal device 110 store the key. AUSF After the master authentication process is completed, AUSF 123 can be obtained from K. AUSF Derive (220)K AKMA And generate (222)K AKMA The AKMA key identifier (A-KID).

[0071] In generating AKMA key materials (such as A-KID and K) AKMA Afterwards, AUSF 123 can send (224) them and the SUPI of terminal device 110 to AAnF 122 in the AKMA registration request for further key derivation. For example, it can send to AAnF 122 a message carrying A-KID and K AKMA And the SUPI's Naanf_AKMA_AnchorKey_Register request. AAnF122 can, for example, use the Naanf_AKMA_AnchorKey_Register response service operation to send an (226) AKMA registration response to AUSF 123.

[0072] Correspondingly, terminal device 110 can access K AUSF Derive (216)K AKMA Terminal device 110 can generate K AKMA The device information (A-KID) and the device information indicating the terminal device 110 can be generated using any suitable method to uniquely identify the terminal device 110.

[0073] In some example embodiments, device information can be generated by encrypting the device identifier (also known as the first device identifier) ​​of the terminal device 110. This ensures the security of the device information during transmission. The device identifier can be a permanent device identifier (PEI) of the terminal device 110, therefore the device information can be referred to as "PEI extension" or "PEI information".

[0074] In some example embodiments, the device information may be included in the K AKMA In A-KID. For example... Figure 2 As shown, terminal device 110 can generate (218) an A-KID that includes the device information. In other words, the device information can be an attribute of the A-KID.

[0075] Now for reference Figure 3 This illustrates the generation of an A-KID containing device information. Figure 3 In the example, the PEI extension is shown. Utilizing the device information extension, an A-KID in the format "username@realm" can include two parts. The username part 301 can include the RID and AKMA temporary UE identifier (A-TID), and the domain part 303 can include the home network identifier.

[0076] PEI extensions may include the PEI of terminal device 110, which utilizes K AKMA Encryption is performed using a shared key. For example, a symmetric encryption algorithm (AES) or the Data Encryption Standard (DES) can be used to encrypt PEI. The prefix (e.g., "ext_pei") and the encrypted string are then concatenated as an extension. As an example without any restrictions, a PEI extension can be constructed as follows: PEI extension = “ext_pei” || SYNMETRIC_ENCRYPTION (Key, PEI) Key = K AKMA "SYNMETRIC_ENCRYPTION" represents the encryption algorithm.

[0077] The PEI extension 302 can be added to an A-KID. As shown in the diagram, the PEI extension 302 is inserted between the username portion 301 and the domain portion 302. Below is a possible example of an A-KID with the PEI extension: atid316e0b4e3c5d633db077771c5c77bf14533ce36005c11c7b43146da64736b946.rid1234.ext_pei12345678910@eps.mnc234.mcc15.3gppnetwork.org in "atid316e0b4e3c5d633db077771c5c77bf14533ce36005c11c7b43146da64736b946" is an example of an A-TID, "rid1234" is an example of an RID, ".ext_pei12345678910" is an example of a PEI extension, and "eps.mnc234.mcc15.3gppnetwork.org" is an example of a domain part. It should be noted that this example A-KID is given for illustrative purposes and is not intended to be restrictive.

[0078] Both the username and domain portions are associated with the SIM card. Therefore, by incorporating device information, the SIM card can be linked to an authorized mobile device that uses 5G AKMA certification.

[0079] In some example embodiments, this device information may be another attribute instead of A-KID. Such example embodiments will be referenced. Figure 5 Described below.

[0080] Now return to the reference Figure 2 When terminal device 110 is about to communicate with AF 130 (e.g., an application server), terminal device 110 may send (228) a request to AF 130 to establish an application session. This request may include A-KID and device information. Figure 2 In the example, the device information is part of the A-KID. For instance, terminal device 110 can send an application session establishment request to AF 130 carrying an A-KID with PEI extensions.

[0081] If AF 130 does not have key material associated with A-KID, AF 130 can request the application key (K) from AAnF 122. AF From K AKMA (Derived). Therefore, AF 130 can send an application key request (230) to AAnF 122 (e.g., a Naanf_AKMA_ApplicationKey_Get request). This application key request can be used to obtain the application key K from AAnF 122. AF It may also include the A-KID and device information indicating the terminal device 110. Figure 2 In this example, the application key request includes an A-KID with device information added. The application key request may also include the AF identifier (AF_ID) of the AF 130.

[0082] In some example embodiments, the application key request may also include an indication of whether the device identifier of terminal device 110 will be fed back in the application key response. For example, the application key request may include the indicator "PEI_Required_Ind". If the value of this indicator is set to TRUE, then the PEI is required to be fed back to AF 130. This indication is required if AF 130 needs to perform a PEI check based on a local policy.

[0083] As an example, AF 130 can request a K from AAnF 122 using a Naanf_AKMA_ApplicationKey_Get request that includes an A-KID with PEI extensions, AF_ID, and the optional indicator "PEI_Required_Ind". AF .

[0084] AAnF 122 may receive an application key request from AF 130. In some example embodiments, if AAnF 122 determines that the AF requires a General Public Subscription Identifier (GPSI), AAnF 122 may send a Subscriber Data Management (SDM) request (e.g., a Nudm_SDM_Get request) to UDM 121 to obtain the GPSI of terminal device 110. UDM 121 may respond to AAnF 122 with an SDM response (e.g., a Nudm_SDM_Get response) that includes the GPSI of terminal device 110 (234). AAnF 122 may store the received GPSI as part of the AKMA context of terminal device 110. If a particular AF does not require a GPSI, actions 232 and 234 may be skipped, and AAnF 122 may continue with the following procedures.

[0085] If AAnF 122 does not yet have K AF Then AAnF 122 can be obtained from K AKMA Derive the (236) AKMA application key (i.e., K AF AAnF 122 can determine (238) the device identifier (also referred to as the first device identifier) ​​of terminal device 110 based on the device information in the application key request. For example, AAnF 122 can extract device information from A-KID and derive the first device identifier from the extracted device information. The first device identifier can be stored in the AKMA context of terminal device 110.

[0086] In some example embodiments, AAnF 122 can determine the K corresponding to the received A-KID. AKMAFor example, based on the AKMA registration request received at 224. Accordingly, AAnF 122 can utilize the determined K AKMA Decrypt the device information to deduce the first device identifier. In one example, if the PEI extension exists in A-KID, then AAnF 122 can utilize K... AKMA Decrypt the PEI extension to obtain the PEI of terminal device 110, and store the PEI in the AKMA context of terminal device 110.

[0087] Then, the terminal device 110 can be verified (240) based on the first device identifier and A-KID. For example, AAnF 122 can verify the terminal device 110 based on the derived PEI and A-KID.

[0088] Terminal device 110 can be verified based on an EIR check. In some example embodiments, the verification of terminal device 110 can be based on information exchange between AAnF 122 and UDM 121. Alternatively or additionally, in some example embodiments, the verification of terminal device 110 can be based on information exchange between AAnF 122 and EIR 125. Some example embodiments of verification will be referred to Figure 4 describe.

[0089] After obtaining the authentication result from terminal device 110, AAnF 122 can send an application key response (e.g., Naanf_AKMA_ApplicationKey_Get response) to AF 130 based on the authentication result. If the authentication result indicates that terminal device 110 is not authorized, for example, if the derived PEI is blocked from network access, then the application key response is a failure response indicating that the authentication of terminal device 110 has failed. In this case, the application key response does not include K. AF In some example embodiments, the application key response may also indicate the reason for the failure, such as an unauthorized terminal device.

[0090] If the verification result indicates that terminal device 110 is authorized, for example, if the derived PEI is not blocked from network access, then the application key response is a success response. In this case, the application key response may include K. AF In some example embodiments, the application key response may also include a first device identifier of the terminal device 110. In one example, AAnF 122 may utilize SUPI, K AF K AF The expiration time and the Naanf_AKMA_ApplicationKey_Get response of the PEI of terminal device 110 are used to respond to AF 130.

[0091] AF 130 can receive an application key response from AF 122 indicating the authentication result for terminal device 110, and can send (246) an application session establishment response based on the application key response. For example, if the application key response indicates successful authentication of terminal device 110, AF 130 can send an acceptance response for the application session. Based on the acceptance response, terminal device 110 can deduce K accordingly. AF Thus, both terminal device 110 and AF 130 possess K AF For further use. If the application key response indicates a failed verification by terminal device 110, AF 130 may send a rejection response for the application session. The rejection response may include an indication of the reason for the failure, such as "PEI is blocked".

[0092] Furthermore, in some example embodiments, AF 130 may examine (244) the device identifier of terminal device 110 based on one or more local policies. Based on the first device identifier in the application key response (e.g., according to local policies or according to whether the first device identifier is bound to a user account), AF 130 may determine whether to allow the establishment of an application session at terminal device 110. If the establishment of an application session at terminal device 110 is allowed, AF 130 may send an accept response to terminal device 110. If the establishment of an application session at terminal device 110 is not allowed, AF 130 may send a reject response to terminal device 110.

[0093] In one example, AF 130 can check whether the PEI of terminal device 110 is allowed based on the AF local policy. If the PEI is allowed, AF 130 can accept the application session establishment request from terminal device 110. Then, terminal device 110 derives K accordingly. AF Both terminal devices 110 and AF 130 possess K AF This is for further use. If PEI is not allowed, the AF 130 can use the failure reason "PEI is blocked" to refuse application session establishment.

[0094] The above describes a general example procedure for AKMA authentication with device verification. As a general example, when the UE initiates an application session establishment request with the AF during AKMA authentication, it can provide the AF with an A-KID and PEI extension (either as part of the A-KID or as a separate attribute). The AF can send a Naanf_AKMA_ApplicationKey_Get request with the A-KID, PEI extension, and AF_ID to the AF to obtain the key. AF K AFExpiration time and UE's PEI. AAnF can check whether the PEI is blocked by the EIR based on local policies. AF can perform additional PEI checks based on AF local policies. If the PEI is not allowed (e.g., not bound to a user account, not an authorized device), AF can reject the application session establishment request.

[0095] Now for reference Figure 4 Some example embodiments of device verification based on EIR inspection are described.

[0096] Figure 4 The illustration shows an example process signaling diagram 400 for EIR checking according to some example embodiments of this disclosure. Signaling diagram 400 can be considered as an example of signaling diagram 200. Figure 2 Actions with the same reference number are similar to those mentioned above. Figure 2 The actions described are not repeated here. Actions 410, 415, 425, 430, and 435 can be considered as example implementations of action 240, and each of actions 420 and 440 can be considered as an example implementation of action 242.

[0097] like Figure 4 As shown, in some example embodiments, after determining the first device identifier of terminal device 110 from the device information in the application key request, AAnF 122 may send (410) a device identifier request to UDM 121 including a subscriber identifier corresponding to A-KID. This device identifier may be used to request UDM to check whether the subscriber identifier corresponds to a registered device identifier. For example, the device identifier may be a Nudm_UECM_Get request, and the subscriber identifier may be a SUPI. AAnF 130 may determine the SUPI corresponding to A-KID based on the AKMA registration request received at 224.

[0098] In some example embodiments, the device identifier may further include: if a registered device identifier exists, then indicating the presence of a registered device identifier corresponding to the subscriber identifier. This indication may also indicate: if no registered device identifier exists, then the service network name corresponding to the subscriber identifier.

[0099] In one example, if a PEI EIR based on the local policy of AAnF 122 is required, AAnF 122 can send a Nudm_UECM_Get request with a SUPI and the indicator "PEI_Required_Ind" to UDM 121. The indicator "PEI_Required_Ind" indicates to UDM 121 whether the terminal device 110 has registered and returned the registered PEI or service network name corresponding to the SUPI.

[0100] After receiving a device identifier request from AAnF 122, UDM 121 can determine whether the subscriber identifier corresponds to a registered device identifier, or in other words, whether the subscriber identifier has been registered using a terminal device. Based on this determination, UDM 121 can send a (415) device identifier response to AAnF 122. If the subscriber identifier corresponds to a second device identifier in the registration data, the device identifier response may include the second device identifier. If no device identifier corresponding to the subscriber identifier is determined in the registration data, the device identifier response may include the service network name corresponding to the subscriber identifier, but without a device identifier.

[0101] In one example, once UDM 121 receives a Nudm_UECM_Get request from AAnF 122 containing a SUPI and the indicator "PEI_Required_Ind", UDM 121 can check whether terminal device 110 is registered in AMF 3GPP and whether a PEI corresponding to the SUPI exists in the amf3gppRegistration data. If the check is positive, UDM 121 can respond to AAnF 122 using the PEI present in the amf3gppRegistration data. If the check is negative, UDM 121 can respond to AAnF 122 using the service network name. This service network name can be used by AAnF 122 to discover the EIR service of the service network corresponding to the SUPI.

[0102] Upon receiving the device identifier response, AAnF 122 can verify the terminal device 110 based on the device identifier response and optionally the previously derived first device identifier, and accordingly send an application key response (420) to AF 130.

[0103] In some example embodiments, if the device identifier response includes a second device identifier, ANF 122 can compare the first device identifier with the second device identifier. If the first device identifier and the second device identifier match, for example, if both device identifiers are identical, it means that the terminal device 110 is not blocked. Accordingly, the application key response is a positive response. For example, the application key response may include a subscriber identifier, K... AF K AF Expiry time and first device identifier. In this case, actions 425, 430, 435, and 440 can be skipped.

[0104] In one example, upon receiving a Nudm_UECM_Get response with a PEI from UDM 121, AAnF 122 can check whether the PEI from UDM 121 is the same as the PEI received from terminal device 110. If the two PEIs are the same, it indicates that the PEI is not blocked by the EIR, and therefore AAnF 122 can send a response with SUPI, K to AF 130. AF K AF The expiration time and the Naanf_AKMA_ApplicationKey_Get response of the PEI of terminal device 110.

[0105] In some example embodiments, if the device identifier response includes a serving network name but lacks a device identifier, AAnF 122 can discover (425) EIR 125 based on the serving network name. EIR 125 provides EIR services for the serving network of terminal device 110. For example, if the Nudm_UECM_Get response from UDM 121 includes a serving network name, AAnF 122 can extract the Mobile Country Code (MCC) and Mobile Network Code (MNC) from the received serving network name and use them to discover EIR services for the visited network (e.g., VPLMN or HPLMN).

[0106] Then, AAnF 122 can send a device identification check request (430) to EIR 125, including a first device identifier of terminal device 110. This device identification check request can be used to request EIR 125 to check whether terminal device 110 is an authenticated device. Upon receiving the device identification request, EIR 125 can check whether terminal device 110 is blocked from network access based on the first device identifier. EIR 125 can send a device identification response (435) based on the result of this check.

[0107] In one example, if an EIR service is found, AAnF 122 can send an N5g_eirEquipmentIdentityCheckGet request to EIR 125 containing a SUPI and a PEI (i.e., one derived from an extension of the PEI) for the terminal device 110. EIR 125 can check whether the received combination of SUPI and PEI is blocked and send back a success or failure response based on the check result.

[0108] Continuing with Figure 400, after receiving the device identification check response, AF 122 can send an application key response (440) to AF 130 based on the device identification check response. The application key response is affirmative if the device identification check response indicates that terminal device 110 is allowed network access. For example, the application key response may include a subscriber identifier, K... AF K AF The expiration time and the first device identifier. If the device identifier check response indicates that the terminal device is blocked from network access, the application key response is negative. For example, the application key response may include an indication of failed authentication for terminal device 110. In this case, K may not be returned to AF 130. AF .

[0109] In one example, AAnF 122 can receive an N5g_eirEquipmentIdentityCheckGet response from EIR 125, which includes the EIR check result. If the PEI is not blocked, AAnF 122 can send a SUPI, K... AF K AF The expiration time and the successful response of Naanf_AKMA_ApplicationKey_Get for the PEI of terminal device 110. If the PEI is blocked, AAnF 122 can send a failure response to AF 130.

[0110] The following process is similar to Figure 2 Therefore, it will not be repeated here.

[0111] As briefly mentioned above, in some example embodiments, this device information may be a separate attribute from the A-KID. The generation of this device information can be similar to the referenced above. Figure 2 and Figure 3 As described, however, this device information will not be added to the A-KID. For example, the PEI extension can be a separate optional attribute and generated after the A-KID is generated.

[0112] Figure 5The illustration shows an example process signaling diagram 500 for AKMA authentication according to some example embodiments of this disclosure. Figure 2 Actions with the same reference number are similar to those mentioned above. Figure 2 The actions described will not be repeated here. Only the differences between signaling diagram 200 and signaling diagram 500 will be described.

[0113] As shown in the figure, terminal device 110 can generate (510) A-KID. This A-KID may include a username portion and a domain portion. Terminal device 110 can further generate (515) device information. For example, this can be achieved by utilizing K... AKMA The PEI of the encrypted terminal device 110 is used to generate PEI information. The terminal device 110 may add this device information as part of the setup request, different from the A-KID, and send the setup request to the AF 130 (520). For example, the terminal device 110 may insert the PEI information and the A-KID into the application session setup request and send the application session setup request to the AF 130.

[0114] As can be seen from the above, device information is incorporated into AKMA authentication, either by extending the A-KID device information or by using this device information as a separate attribute. To ensure security and to ensure that the device identifier is not tampered with at the application end, this device information utilizes the shared key K. AKMA Encryption will be applied. Device information will not be used to uniquely identify K. AKMA When AF receives A-KID, it can obtain K. AF And request ANF to decrypt device information. After obtaining K AF After obtaining a device identifier (such as a PEI), the AF can check whether the device identifier is bound to a user account, or check whether the device identifier is allowed based on local policies, and decide whether to accept or reject the application session establishment request.

[0115] It should be noted that in the above description, the authentication of the terminal device (such as the EIR check) is performed by AAnF, but this is for illustrative purposes. In some example embodiments, the authentication of the terminal device (such as the EIR check) can be performed by another network function, such as NEF 124. The application key request can be sent to AAnF 122 via NEF 124. Therefore, NEF 124 can extract device information from the application key request and authenticate the terminal device 110 based on that device information. The authentication performed by NEF 124 (such as the EIR check) is similar to the authentication performed by AAnF 122 described above, and therefore will not be repeated here. If the authentication is performed by NEF 124, the authentication result can be returned to AAnF 122, which forwards the authentication result to AF 130 in the application key response.

[0116] By utilizing EIR checks in AKMA authentication, either AAnF or NEF can perform an EIR check before providing the application key to the AF. Specifically, AAnF or NEF can check whether the UDM UE is registered. If the UE is registered, AAnF can retrieve the PEI from the UDM and match it with the PEI provided by the UE. This ensures an additional check that the PEI provided by the UE via AKMA is identical to the PEI registered by the UE in 5GC. Note that if the UE is registered in the UDM, an EIR check must have already been performed.

[0117] If the UE is not registered (possibly due to registration rejection after authentication caused by an EIR check), the AAnF can determine the AMF details based on the authentication data in the UDM. If the AMF belongs to the HPLMN, the AAnF can contact the EIR to perform a PEI check. If the PEI check fails, the AAnF may not provide service to the AF. If the AMF belongs to the VPLMN, the AAnF can contact the VPLMN's EIR to perform a PEI check. If the PEI check fails, the AAnF may not provide service to the AF. Alternatively, based on operator policy, since the UE is not registered in the VPLMN, the AAnF may only contact the HPLMN's EIR.

[0118] Figure 6 A flowchart of an example method 600 implemented at a device according to some example embodiments of the present disclosure is shown. For the purposes of discussion, method 600 will be described from the perspective of network functionality.

[0119] At box 610, the network function receives an application key request from the application function, the application key request including an AKMA key identifier for application authentication and key management, and device information indicating the terminal device.

[0120] At box 620, the network function determines the first device identifier of the terminal device based on the device information.

[0121] At box 630, the network function verifies the terminal device based on the first device identifier and the AKMA key identifier.

[0122] At box 640, the network function sends an application key response to the application function based on the authentication result of the terminal device.

[0123] In some example embodiments, determining the first device identifier of the terminal device based on the device information includes: deriving the first device identifier by decrypting the device information using an AKMA key corresponding to the AKMA key identifier.

[0124] In some example embodiments, verifying the terminal device based on the first device identifier and the AKMA key identifier includes: sending a request to the unified data management system including a device identifier, the device identifier corresponding to a subscriber identifier of the AKMA key identifier; receiving a device identifier response from the unified data management system, the device identifier response indicating whether the subscriber identifier corresponds to a registered device identifier; and verifying the terminal device based on the device identifier response and the first device identifier.

[0125] In some example embodiments, sending an application key response to the application function based on the verification result of the terminal device includes: comparing the first device identifier with the second device identifier if the device identifier response includes a second device identifier; and sending the application key response including the first device identifier to the application function if it is determined that the first device identifier and the second device identifier are consistent.

[0126] In some example embodiments, verifying the terminal device based on the first device identifier and the AKMA key identifier includes: sending a device identifier check request to a device identifier register, the device identifier check request including the first device identifier of the terminal device; and receiving a device identifier check response from the device identifier register, the device identifier check response indicating whether the terminal device is blocked from network access; and sending an application key response to the application function based on the verification result of the terminal device includes: sending the application key response to the application function based on the device identifier check response.

[0127] In some example embodiments, sending the application key response to the application function based on the device identifier check response includes: sending the application key response including the first device identifier to the application function based on determining that the device identifier check response indicates that the terminal device is allowed network access; and sending the application key response indicating that the terminal device's authentication has failed based on determining that the device identifier check response indicates that the terminal device is blocked from network access.

[0128] In some example embodiments, the network function can also receive a device identifier response from the unified data management system, the device identifier response indicating whether the subscriber identifier corresponding to the AKMA key identifier corresponds to a registered device identifier; and determine the device identifier register based on the service network name if it is determined that the device identifier response includes a service network name and lacks a device identifier.

[0129] In some example embodiments, the device information is included as part of the AKMA key identifier, or the device information is included in the application key request as part of something other than the AKMA key identifier.

[0130] In some example embodiments, the application key request further includes an indication of whether to return a first device identifier of the terminal device in the application key response.

[0131] In some example embodiments, the device identifier request further includes, if the registered device identifier exists, providing an indication of the registered device identifier in the device identifier response.

[0132] In some example embodiments, the network function is included in the network open function, and the application key response is sent to the application function via the AKMA anchor function.

[0133] In some example embodiments, this network functionality is included in the AKMA anchor functionality.

[0134] Figure 7 A flowchart of an example method 700 implemented at a device according to some example embodiments of the present disclosure is shown. For the purposes of discussion, method 700 will be discussed from... Figure 1 It is described from the angle of AF 130.

[0135] At box 710, AF 130 receives an application session establishment request from the terminal device, which includes an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device.

[0136] At box 720, AF 130 sends an application key request to the AKMA anchor function, which includes the AKMA key identifier and the device information.

[0137] At box 730, AF 130 receives an application key response from the AKMA anchor function, which indicates the result of the terminal device's authentication.

[0138] At box 740, AF 130 sends an application session establishment response to the terminal device based on the application key response.

[0139] In some example embodiments, the application key response includes a first device identifier of the terminal device, and sending an application session establishment response to the terminal device based on the application key response includes: determining, based on the first device identifier, whether the application session is allowed to be established on the terminal device; sending an acceptance response to the terminal device for the application session if the application session is allowed to be established on the terminal device; and sending a rejection response to the terminal device for the application session if the application session is not allowed to be established on the terminal device.

[0140] In some example embodiments, sending an application session establishment response to the terminal device based on the application key response includes: sending a rejection response to the terminal device for the application session based on determining that the application key response indicates a failure in the terminal device's authentication.

[0141] In some example embodiments, the device information is included as part of the AKMA key identifier, or the device information is included in the setup request and the application key request as part of something other than the AKMA key identifier.

[0142] In some example embodiments, the application key request further includes an indication of whether to return a first device identifier of the terminal device in the application key response.

[0143] Figure 8 A flowchart of an example method 800 implemented at a device according to some example embodiments of the present disclosure is shown. For the purposes of discussion, method 800 will be discussed from... Figure 1 This is described from the perspective of terminal device 110.

[0144] At box 810, terminal device 110 sends an application session establishment request to the application function. The establishment request includes an AKMA key identifier for application authentication and key management, as well as device information indicating terminal device 110.

[0145] At box 810, terminal device 110 receives an application session establishment response from the application function.

[0146] In some example embodiments, method 800 further includes generating device information by encrypting a first device identifier of the device using an AKMA key corresponding to the AKMA key identifier.

[0147] In some example embodiments, method 800 further includes: adding the device information as part of the AKMA key identifier, or adding the device information as part of the establishment request that is different from the AKMA key identifier.

[0148] Figure 9 A flowchart of an example method 900 implemented at a device according to some example embodiments of the present disclosure is shown. For the purposes of discussion, method 900 will be discussed from... Figure 1 This is described from the perspective of UDM 121.

[0149] At box 910, UDM 121 receives a device identifier request including a subscriber identifier from a network function, which includes at least one of the following: AKMA anchor function for application authentication and key management, or network open function.

[0150] At box 920, UDM 121 determines whether the subscriber identifier corresponds to a registered device identifier.

[0151] At box 930, UDM 121 sends a device identifier response to the network function based on the determined result.

[0152] In some example embodiments, sending a device identifier response to the network function based on the determination includes: sending a device identifier response to the network function that includes the second device identifier based on the determination that the subscriber identifier corresponds to a second device identifier in the registration data; and sending a device identifier response to the network function that includes a service network name corresponding to the subscriber identifier and lacks a device identifier based on the determination that no device identifier corresponding to the subscriber identifier is determined in the registration data.

[0153] Figure 10 A flowchart of an example method 1000 implemented at a device according to some example embodiments of the present disclosure is shown. For the purposes of discussion, method 1000 will be discussed from... Figure 1 Described from the perspective of EIR 125.

[0154] At box 1010, EIR 125 receives a device identifier check request from a network function that includes a first device identifier of the terminal device, the network function including at least one of the following: AKMA anchor function for application authentication and key management, or network open function.

[0155] At box 1020, EIR 125 checks whether the terminal device is blocked from network access based on the first device identifier.

[0156] At box 1030, EIR 125 sends a device identification check response to the network function based on the result of the check.

[0157] In some example embodiments, the means capable of performing any of the methods 600 may include components for performing the corresponding operations of method 600. These components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module. The means may be implemented as or included in... Figure 1 In AAnF 122 or NEF 124.

[0158] In some example embodiments, the apparatus includes: components for receiving an application key request from an application function, the application key request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating a terminal device; components for determining a first device identifier of the terminal device based on the device information; components for verifying the terminal device based on the first device identifier and the AKMA key identifier; and components for sending an application key response to the application function based on the verification result of the terminal device.

[0159] In some example embodiments, the component for determining a first device identifier of the terminal device based on the device information includes: a component for deriving the first device identifier by decrypting the device information using an AKMA key corresponding to the AKMA key identifier.

[0160] In some example embodiments, the components for verifying the terminal device based on the first device identifier and the AKMA key identifier include: components for sending a device identifier request to the unified data management system, the device identifier request including a subscriber identifier corresponding to the AKMA key identifier; components for receiving a device identifier response from the unified data management system, the device identifier response indicating whether the subscriber identifier corresponds to a registered device identifier; and components for verifying the terminal device based on the device identifier response and the first device identifier.

[0161] In some example embodiments, the component for sending an application key response to the application function based on the verification result of the terminal device includes: a component for comparing the first device identifier with the second device identifier based on determining that the device identifier response includes a second device identifier; and a component for sending the application key response including the first device identifier to the application function based on determining that the first device identifier and the second device identifier are consistent.

[0162] In some example embodiments, the components for verifying the terminal device based on the first device identifier and the AKMA key identifier include: components for sending a device identifier check request to a device identifier register, the device identifier check request including the first device identifier of the terminal device; and components for receiving an identifier check response from the device identifier register, the device identifier check response indicating whether the terminal device is blocked from network access; and the components for sending an application key response to the application function based on the verification result of the terminal device include: components for sending the application key response to the application function based on the device identifier check response.

[0163] In some example embodiments, sending the application key response to the application function based on the device identifier check response includes: a component for sending the application key response including the first device identifier to the application function based on determining that the device identifier check response indicates that the terminal device is allowed network access; and a component for sending the application key response indicating that the terminal device's authentication has failed to the application function based on determining that the device identifier check response indicates that the terminal device is blocked from network access.

[0164] In some example embodiments, the apparatus further includes: components for receiving a device identifier response from a unified data management system, the device identifier indicating whether a subscriber identifier corresponding to the AKMA key identifier corresponds to a registered device identifier; and components for determining the device identifier register based on the service network name if the device identifier response includes a service network name and lacks a device identifier.

[0165] In some example embodiments, the device information is included as part of the AKMA key identifier, or the device information is included in the application key request as part of something other than the AKMA key identifier.

[0166] In some example embodiments, the application key request further includes an indication of whether to return a first device identifier of the terminal device in the application key response.

[0167] In some example embodiments, the device identifier request further includes, if the registered device identifier exists, providing an indication of the registered device identifier in the device identifier response.

[0168] In some example embodiments, the network function is included in the network open function, and the application key response is sent to the application function via the AKMA anchor function.

[0169] In some example embodiments, this network functionality is included in the AKMA anchor functionality.

[0170] In some example embodiments, the device further includes components for performing other operations in some example embodiments of method 600. In some example embodiments, the components include at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the device to perform corresponding operations.

[0171] In some example embodiments, the means capable of performing any of the methods 700 may include components for performing the corresponding operations of method 700. These components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module. The means may be implemented as or included in... Figure 1 In AF 130.

[0172] In some example embodiments, the apparatus includes: components for receiving from a terminal device an application session establishment request, the establishment request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device; components for sending an application key request to an AKMA anchor function, the application key request including the AKMA key identifier and the device information; components for receiving an application key response from the AKMA anchor function, the application key response indicating the authentication result of the terminal device; and components for sending an application session establishment response to the terminal device based on the application key response.

[0173] In some example embodiments, the application key response includes a first device identifier of the terminal device, and the components for sending an application session establishment response to the terminal device based on the application key response include: components for determining, based on the first device identifier, whether the application session is allowed to be established on the terminal device; components for sending an acceptance response to the terminal device for the application session based on the determination that the application session is allowed to be established on the terminal device; and components for sending a rejection response to the terminal device for the application session based on the determination that the application session is not allowed to be established on the terminal device.

[0174] In some example embodiments, the component for sending an application session establishment response to the terminal device based on the application key response includes: a component for sending a rejection response to the terminal device for the application session based on determining that the application key response indicates a failure in the verification of the terminal device.

[0175] In some example embodiments, the device information is included as part of the AKMA key identifier, or the device information is included in the setup request and the application key request as part of something other than the AKMA key identifier.

[0176] In some example embodiments, the application key request further includes an indication of whether to return a first device identifier of the terminal device in the application key response.

[0177] In some example embodiments, the device further includes components for performing other operations in some example embodiments of method 700. In some example embodiments, the components include at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the device to perform corresponding operations.

[0178] In some example embodiments, the means capable of performing any of the methods 800 may include components for performing the corresponding operations of method 800. These components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module. The means may be implemented as or included in... Figure 1 In terminal device 110.

[0179] In some example embodiments, the apparatus includes: components for sending an application session establishment request to an application function at a terminal device, the establishment request including an Authentication and Key Management (AKMA) key identifier for the application and device information indicating the terminal device; and components for receiving an application session establishment response from the application function.

[0180] In some example embodiments, the device further includes a component for generating device information by encrypting a first device identifier of the device using an AKMA key corresponding to the AKMA key identifier.

[0181] In some example embodiments, the apparatus further includes: a component for adding the device information as part of the AKMA key identifier, or a component for adding the device information as a part different from the AKMA key identifier in the setup request.

[0182] In some example embodiments, the apparatus further includes components for performing other operations in some example embodiments of method 800. In some example embodiments, the components include at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform corresponding operations.

[0183] In some example embodiments, the means capable of performing any of the methods 900 may include components for performing the corresponding operations of method 900. These components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module. The means may be implemented as or included in... Figure 1 In UDM 121.

[0184] In some example embodiments, the apparatus includes: components for receiving a device identifier request including a subscriber identifier from a network function, the network function including at least one of: an Authentication and Key Management AKMA anchor function for an application, or a network open function; components for determining whether the subscriber identifier corresponds to a registered device identifier; and components for sending a device identifier response to the network function based on the determination result.

[0185] In some example embodiments, the component for sending a device identifier response to the network function based on the determination result includes: a component for sending a device identifier response including the second device identifier to the network function based on determining that the subscriber identifier corresponds to a second device identifier in the registration data; and a component for sending a device identifier response including a service network name corresponding to the subscriber identifier and lacking a device identifier to the network function based on determining that no device identifier corresponding to the subscriber identifier has been determined in the registration data.

[0186] In some example embodiments, the apparatus further includes components for performing other operations in some example embodiments of method 900. In some example embodiments, the components include at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform corresponding operations.

[0187] In some example embodiments, the means capable of performing any of the methods 1000 may include components for performing the corresponding operations of method 1000. These components may be implemented in any suitable form. For example, the components may be implemented in a circuit system or a software module. The means may be implemented as or included in... Figure 1 In EIR 125.

[0188] In some example embodiments, the apparatus includes: components for receiving a device identity check request from a network function including a first device identifier of the terminal device, the network function including at least one of the following: an Authentication and Key Management (AKMA) anchor function for applications, or a network open function; components for checking whether the terminal device is blocked from network access based on the first device identifier; and components for sending a device identity check response to the network function based on the result of the check.

[0189] In some example embodiments, the apparatus further includes components for performing other operations in some example embodiments of method 1000. In some example embodiments, the components include at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform corresponding operations.

[0190] Figure 11 This is a simplified block diagram suitable for implementing the exemplary embodiments of this disclosure, specifically device 1100. Device 1100 may be provided to implement a communication device, such as... Figure 1 The terminal devices shown are 110, AF 130, AAnF 122, UDM 121, EIR 125, or AUSF 123. As shown, device 1100 includes one or more processors 1110, one or more memories 1120 coupled to processor 1110, and one or more communication modules 1140 coupled to processor 1110.

[0191] Communication module 1140 is used for bidirectional communication. Communication module 1140 has one or more communication interfaces to facilitate communication with one or more other modules or devices. The communication interface can represent any interface necessary for communicating with other network elements. In some example embodiments, communication module 1140 may include at least one antenna.

[0192] Processor 1110 can be any type suitable for a local technology network and can include one or more of the following: general-purpose computer, special-purpose computer, microprocessor, digital signal processor (DSP), and processor based on a multi-core processor architecture, etc. (as non-limiting examples). Device 1100 can have multiple processors, such as application-specific integrated circuit chips subordinate to a clock that synchronizes the main processor.

[0193] Memory 1120 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 1124, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disc (CD), digital video disc (DVD), optical disc, laser disc, and other magnetic and / or optical storage. Examples of volatile memories include, but are not limited to, random access memory (RAM) 1122 and other volatile memories that are not persistent during power outages.

[0194] Computer program 1130 includes computer-executable instructions that are executed by an associated processor 1110. The instructions of program 1130 may include instructions for performing operations / actions of some example embodiments of this disclosure. Program 1130 may be stored in memory, such as ROM 1124. Processor 1110 can perform any suitable actions and processes by loading program 1130 into RAM 1122.

[0195] The exemplary embodiments of this disclosure can be implemented by means of program 1130, such that device 1100 can execute as described in the reference. Figures 2 to 10 Any process discussed in this disclosure. Exemplary embodiments of this disclosure may also be implemented by hardware or by a combination of software and hardware.

[0196] In some example embodiments, program 1130 may be tangibly contained in a computer-readable medium, which may be included in device 1100 (such as in memory 1120) or in other storage devices accessible by device 1100. Device 1100 may load program 1130 from the computer-readable medium into RAM 1122 for execution. In some example embodiments, the computer-readable medium may include any type of non-transitory storage medium, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. As used herein, the term "non-transitory" is a limitation on the medium itself (i.e., tangible, not tactile) rather than on the persistence of data storage (e.g., RAM vs. ROM).

[0197] Figure 12 An example of a computer-readable medium 1200 is shown, which may be in the form of a CD, DVD, or other optical storage disc. A program 1130 is stored on the computer-readable medium 1200.

[0198] Generally, the various embodiments of this disclosure can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects can be implemented in hardware, and others can be implemented in firmware or software, which can be executed by a controller, microprocessor, or other computing device. Although various aspects of embodiments of this disclosure are illustrated and described with reference to block diagrams, flowcharts, or other graphical representations, it should be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof, in non-limiting examples.

[0199] Some exemplary embodiments of this disclosure also provide at least one computer program product tangibly stored on a computer-readable medium, such as a non-transitory computer-readable medium. The computer program product includes computer-executable instructions, such as those included in a program module that executes on a device targeting a physical or virtual processor to perform any of the methods described above. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., that perform specific tasks or implement specific abstract data types. The functionality of program modules can be combined or split among program modules as needed in various embodiments. The executable machine instructions for the program modules can execute on local or distributed devices. In distributed devices, program modules can reside on both local and remote storage media.

[0200] The program code used to perform the methods of this disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that, when executed by the processor or controller, it enables the functions / operations specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, as a stand-alone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0201] In the context of this disclosure, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, etc.

[0202] Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable media can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any suitable combination thereof. More specific examples of computer-readable storage media will include: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0203] Furthermore, although the operations are depicted in a specific order, this should not be construed as requiring the operations to be performed in the specific order shown or in sequential order, or requiring the execution of all illustrated operations to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure, but rather as a description of features that may be specific to particular embodiments. Unless explicitly stated otherwise, certain features described in the context of a single embodiment may also be combined and implemented in a single embodiment. Conversely, unless explicitly stated otherwise, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0204] Although this disclosure has been described using language specifically used for structural features and / or method actions, it should be understood that this disclosure as defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are disclosed as exemplary forms for implementing the claims.

Claims

1. An apparatus comprising: At least one processor; as well as At least one memory, the at least one memory storing instructions, the instructions, when executed by the at least one processor, causing the device to at least: The application key request is received from the application function. The application key request includes an AKMA key identifier for application authentication and key management, and device information indicating the terminal device. Based on the device information, a first device identifier for the terminal device is determined; The terminal device is verified based on the first device identifier and the AKMA key identifier; as well as Based on the verification result of the terminal device, an application key response is sent to the application function.

2. The apparatus of claim 1, wherein the apparatus is configured to determine a first device identifier of the terminal device based on the device information by means of: The first device identifier is derived by decrypting the device information using the AKMA key corresponding to the AKMA key identifier.

3. The apparatus of claim 1, wherein the apparatus is configured to authenticate the terminal device based on the first device identifier and the AKMA key identifier by means of: Send a device identifier request to the unified data management system, the device identifier request including a subscriber identifier corresponding to the AKMA key identifier; The unified data management receives a device identifier response, which indicates whether the subscriber identifier corresponds to a registered device identifier. as well as The terminal device is verified based on the device identifier response and the first device identifier.

4. The apparatus of claim 3, wherein the apparatus is configured to send an application key response to the application function based on the result of the authentication of the terminal device by means of: Based on the determination that the device identifier response includes a second device identifier, the first device identifier is compared with the second device identifier; and Based on the determination that the first device identifier and the second device identifier are consistent, the application key response including the first device identifier is sent to the application function.

5. The apparatus of claim 1, wherein the apparatus is configured to authenticate the terminal device based on the first device identifier and the AKMA key identifier by means of: Send a device identifier check request to the device identifier register, the device identifier check request including the first device identifier of the terminal device; and Receive a device identifier check response from the device identifier register, the device identifier check response indicating whether the terminal device is blocked from network access; and The device is configured to send an application key response to the application function based on the authentication result of the terminal device by: Based on the device identifier check response, the application key response is sent to the application function.

6. The apparatus of claim 5, wherein the apparatus is configured to send the application key response to the application function based on the device identifier check response by: Based on the determination of the device identifier check response indicating that the terminal device is allowed network access, the application function sends an application key response including the first device identifier; and Based on the determination of the device identifier check response indicating that the terminal device is blocked from network access, the application function sends an application key response indicating that the terminal device's authentication has failed.

7. The apparatus of claim 5, wherein the apparatus is further configured to: Receive a device identifier response from the unified data management system, the device identifier response indicating whether the subscriber identifier corresponding to the AKMA key identifier corresponds to a registered device identifier; and The device identifier register is determined based on the service network name if the device identifier response includes a service network name and lacks a device identifier.

8. The apparatus of claim 1, wherein the device information is included as part of the AKMA key identifier, or The device information is included in the application key request as part of the application key request, distinct from the AKMA key identifier.

9. The apparatus of claim 1, wherein the application key request further comprises: Whether to provide an indication of whether the first device identifier of the terminal device is fed back in the application key response.

10. The apparatus of claim 3, wherein the device identifier request further comprises: If the registered device identifier exists, the device identifier response will indicate the registered device identifier.

11. The apparatus of claim 1, wherein the apparatus is included in a network open function, and the application key response is sent to the application function via an AKMA anchor function.

12. The apparatus of claim 1, wherein the apparatus is included in the AKMA anchor function.

13. An apparatus comprising: At least one processor; as well as At least one memory, the at least one memory storing instructions, the instructions, when executed by the at least one processor, causing the device to at least: Receive an application session establishment request from the terminal device, the establishment request including an AKMA key identifier for application authentication and key management, and device information indicating the terminal device; Send an application key request to the AKMA anchor function, the application key request including the AKMA key identifier and the device information; Receive an application key response from the AKMA anchor function, the application key response indicating the verification result of the terminal device; as well as Based on the application key response, a response for establishing the application session is sent to the terminal device.

14. The apparatus of claim 13, wherein the application key response includes a first device identifier of the terminal device, and the apparatus is configured to send an establishment response for the application session to the terminal device based on the application key response by: Based on the first device identifier, determine whether the application session is allowed to be established on the terminal device; Based on the determination that the application session is allowed to be established on the terminal device, an acceptance response for the application session is sent to the terminal device; as well as Based on the determination that the application session is not allowed to be established on the terminal device, a rejection response for the application session is sent to the terminal device.

15. The apparatus of claim 13, wherein the apparatus is configured to send an application session establishment response to the terminal device based on the application key response by: Based on the determination that the application key response indicates a failure in the authentication of the terminal device, a rejection response for the application session is sent to the terminal device.

16. The apparatus of claim 13, wherein the device information is included as part of the AKMA key identifier, or The device information is included in the establishment request and the application key request as part of the AKMA key identifier.

17. The apparatus of claim 13, wherein the application key request further comprises: Whether to provide an indication of whether the first device identifier of the terminal device is fed back in the application key response.

18. An apparatus comprising: At least one processor; as well as At least one memory, the at least one memory storing instructions, the instructions, when executed by the at least one processor, causing the device to at least: Sending an application session establishment request to the application function, the establishment request including an AKMA key identifier for application authentication and key management, and device information indicating the device; and Receive a response from the application function to establish the application session.

19. The apparatus of claim 18, wherein the apparatus is further configured to: The device information is generated by encrypting a first device identifier of the device using an AKMA key corresponding to the AKMA key identifier.

20. The apparatus of claim 18, wherein the apparatus is further configured to: Add the device information as part of the AKMA key identifier, or The device information is added to the establishment request as part of the request, distinct from the AKMA key identifier.

21. An apparatus comprising: At least one processor; as well as At least one memory, the at least one memory storing instructions, the instructions, when executed by the at least one processor, causing the device to at least: Receive a device identifier request including a subscriber identifier from a network function, the network function including at least one of the following: AKMA anchor function for application authentication and key management, or network open function; Determine whether the subscriber identifier corresponds to a registered device identifier; and Based on the determined result, a device identifier response is sent to the network function.

22. The apparatus of claim 21, wherein the apparatus is configured to send a device identifier response to the network function based on the determined result by: Based on the determination that the subscriber identifier corresponds to a second device identifier in the registration data, a device identifier response including the second device identifier is sent to the network function; and Based on the determination that no device identifier corresponding to the subscriber identifier is found in the registration data, a response containing the service network name corresponding to the subscriber identifier and the missing device identifier is sent to the network function.

23. An apparatus comprising: At least one processor; as well as At least one memory, the at least one memory storing instructions, the instructions, when executed by the at least one processor, causing the device to at least: The device identifier check request, which includes a first device identifier of the terminal device, is received from a network function, wherein the network function includes at least one of the following: Authentication and Key Management (AKMA) anchor function for application, or network open function; Based on the first device identifier, check whether the terminal device is blocked from network access; as well as Based on the results of the inspection, a device identification check response is sent to the network function.

24. A method comprising: The application key request is received from the application function. The application key request includes an AKMA key identifier for application authentication and key management, and device information indicating the terminal device. Based on the device information, a first device identifier for the terminal device is determined; The terminal device is verified based on the first device identifier and the AKMA key identifier; as well as Based on the verification result of the terminal device, an application key response is sent to the application function.

25. A method comprising: Receive an application session establishment request from the terminal device, the establishment request including an AKMA key identifier for application authentication and key management, and device information indicating the terminal device; Send an application key request to the AKMA anchor function, the application key request including the AKMA key identifier and the device information; Receive an application key response from the AKMA anchor function, the application key response indicating the verification result of the terminal device; as well as Based on the application key response, a response for establishing the application session is sent to the terminal device.

26. A method comprising: At the terminal device, a request for establishing an application session is sent to the application function. The request includes an AKMA key identifier for application authentication and key management, and device information indicating the terminal device. as well as Receive a response from the application function to establish the application session.

27. A method comprising: Receive a device identifier request including a subscriber identifier from a network function, the network function including at least one of the following: AKMA anchor function for application authentication and key management, or network open function; Determine whether the subscriber identifier corresponds to a registered device identifier; and Based on the determined result, a device identifier response is sent to the network function.

28. A method comprising: The device identifier check request, which includes a first device identifier of the terminal device, is received from a network function, wherein the network function includes at least one of the following: Authentication and Key Management (AKMA) anchor function for application, or network open function; Based on the first device identifier, check whether the terminal device is blocked from network access; as well as Based on the results of the inspection, a device identification check response is sent to the network function.

29. An apparatus comprising: A component for receiving an application key request from an application function, the application key request including an AKMA key identifier for application authentication and key management, and device information indicating a terminal device; A component for determining a first device identifier of the terminal device based on the device information; Components used to verify the terminal device based on the first device identifier and the AKMA key identifier; as well as A component for sending an application key response to the application function based on the result of the verification of the terminal device.

30. An apparatus comprising: A component for receiving an application session establishment request from a terminal device, the establishment request including an AKMA key identifier for application authentication and key management, and device information indicating the terminal device; A component for sending an application key request to the AKMA anchor function, the application key request including the AKMA key identifier and the device information; A component for receiving an application key response from the AKMA anchor function, the application key response indicating the result of the terminal device's verification; as well as A component for sending an application session establishment response to the terminal device based on the application key response.

31. An apparatus comprising: A component for sending an application session establishment request to an application function at a terminal device, the establishment request including an AKMA key identifier for application authentication and key management, and device information indicating the terminal device; as well as A component for receiving a response from the application function for establishing the application session.

32. An apparatus comprising: A component for receiving a device identifier request including a subscriber identifier from a network function, said network function including at least one of the following: an Authentication and Key Management AKMA anchor function for an application, or a network open function; A component used to determine whether the subscriber identifier corresponds to a registered device identifier; as well as A component for sending a device identifier response to the network function based on the determined result.

33. An apparatus comprising: A component for receiving a device identifier check request from a network function, including a first device identifier of the terminal device, wherein the network function includes at least one of the following: an authentication and key management AKMA anchor function for an application, or a network open function; Components for checking whether the terminal device is blocked from network access based on the first device identifier; as well as A component for sending a device identification check response to the network function based on the results of the check.

34. A computer-readable medium comprising instructions stored thereon, the instructions being configured to cause a device to perform at least the method of any one of claims 25 to 28.

Images