Communication method and communication apparatus

Abstract

The application relates to the communication field, in particular to a communication method and a communication device. In the method, a first network element receives a first request message sent by a communication device, the first request message requests to access a VPLMN, the first request message comprises challenge information and a digital identity of the communication device issued by an HPLMN of the communication device. Based on the first request message, the first network element verifies the digital identity of the communication device. After the verification is passed, the first network element sends a digital identity of the first network element issued by the HPLMN of the first network element and a challenge response to the communication device. The communication device first verifies the digital identity of the first network element, extracts a public key of the first network element after the verification is passed, verifies the challenge response by using the public key of the first network element, and indicates that the bidirectional verification between the VPLMN and the communication device is successful after the verification is passed, so that the communication device can safely access the VPLMN. In the case that the communication device does not have a shared key for safely communicating with the network, the method can realize the bidirectional verification between the communication device and the VPLMN.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to a communication method and a communication device. Background Technology

[0002] Operator networks can issue Subscriber Identity Module (SIM) cards to user-held terminal devices. The operator network that issues the SIM card is called the terminal device's Home Public Land Mobile Network (HPLMN). The SIM card stores a shared key between the terminal device and the HPLMN. After the terminal device installs the SIM card, it can use the shared key in the SIM card to achieve two-way authentication with the HPLMN. After successful authentication, the terminal device can access the HPLMN and obtain the services provided by the HPLMN.

[0003] If a terminal device roams to an area not covered by the HPLMN, it can obtain services by visiting the public land mobile network (VPLMN) that has a roaming protocol with the HPLMN. The authentication between the VPLMN and the terminal device is also achieved through the HPLMN. That is, the HPLMN and the terminal device perform bidirectional authentication based on the shared key in the SIM card. The VPLMN determines whether to allow the terminal to access the VPLMN based on the authentication result.

[0004] When a terminal device does not have a SIM card, for example, if the operator's network has not issued a SIM card for the terminal device, or if the terminal device cannot install a SIM card, how to achieve two-way authentication between the terminal device and the VPLMN in roaming scenarios is a problem that needs to be solved. Summary of the Invention

[0005] This application provides a communication method, communication device, communication system, computer-readable storage medium, and computer program product to achieve bidirectional verification between terminal equipment and VPLMN.

[0006] In a first aspect, a communication method is provided, the method comprising: receiving a first request message, the first request message including challenge information and a second digital identity from a communication device, the second digital identity being issued by the HPLMN of the communication device for the communication device; obtaining the public key of the HPLMN according to the first request message; verifying the second digital identity according to the public key of the HPLMN; and, if the verification of the second digital identity is successful, sending a challenge response and a first digital identity, the first digital identity being issued by the HPLMN for a first network element, the challenge response and the first digital identity being used by the communication device to verify the VPLMN.

[0007] For example, the communication method can be implemented by a first network element in the VPLMN of the communication device, or by a module, unit, processor, circuit, chip, or chip system included in the first network element. For example, the first network element is an identity management (IDM) network element, or the first network element can be other network elements that perform the same function. The embodiments of this application do not specifically limit the name of the first network element.

[0008] The method provided in this application involves a second digital identity (digital identity of the communication device) in the first request message, which is issued by the HPLMN (Virtual Platform Name System) for the communication device. A first network element uses the first request message to obtain the public key of the HPLMN and verifies the second digital identity using the public key. If the verification of the second digital identity is successful, the first network element successfully verifies the communication device, meaning the first network element allows the communication device to access the VPLMN. Next, the first network element signs the challenge information using its private key to obtain a challenge response. The first network element then sends the challenge response and the first digital identity (digital identity of the first network element), which is issued by the HPLMN for the first network element. This challenge response and the first digital identity can be used by the communication device to verify the VPLMN. This method enables bidirectional authentication between the communication device and the VPLMN without requiring a shared key between the communication device and the network, thus allowing communication devices without a SIM card or unable to install a SIM card to successfully access the VPLMN.

[0009] For example, the first request message may be sent by the communication device to the first network element, and the first request message may be used by the communication device to request access to the VPLMN.

[0010] The second digital identity includes the identification information of the communication device (also known as the first identification information of the communication device), the public key of the communication device, and a signature, which is obtained by signing the identification information of the communication device and the public key of the communication device using the private key of the HPLMN.

[0011] Optionally, the second digital identity may also include the public key of the HPLMN. The public key of the HPLMN is used to verify the signature obtained by the private key of the HPLMN. For example, the communication device can use the public key of the HPLMN in the second digital identity to verify the signature obtained by the private key of the HPLMN in the first digital identity of the first network element.

[0012] The identification information of the communication device is used to identify the communication device; for example, this identification information can be the communication device's ID (identifier). Optionally, the identification information of the communication device may also include the identification information of the HPLMN, which is used to identify the HPLMN of the communication device. The public key of the communication device can be used by the VPLMN to verify the first request message sent by the communication device, thereby determining whether the communication device is the sender of the first request message. The signature in the second digital identity is used to prove that the second digital identity was issued by the HPLMN.

[0013] The first digital identity includes the identification information of the first network element, the public key of the first network element, and a signature. The signature is obtained by signing the identification information of the first network element and the public key of the first network element using the private key of the HPLMN.

[0014] Optionally, the first digital identity may also contain the public key of the HPLMN. The public key of the HPLMN is used to verify the signature obtained by the private key of the HPLMN. For example, the first network element can use the public key of the HPLMN in the first digital identity to verify the signature obtained by the private key of the HPLMN in the second digital identity.

[0015] The identification information of the first network element is used to identify the first network element, such as the ID of the first network element; the public key of the first network element is used by the communication device to verify the VPLMN; the signature of the identification information and the public key of the first network element by the private key of the HPLMN is used to prove that the first digital identity is issued by the HPLMN, and the public key of the first network element in the first digital identity is trustworthy and can be used to verify the VPLMN.

[0016] Optionally, the identification information of the first network element may also include the identification information of the VPLMN, which is used to indicate that the first network element is a network element in the VPLMN.

[0017] Optionally, before sending the challenge response and the first digital identity, the above method further includes: signing the challenge information using the private key of the first network element to obtain the challenge response.

[0018] In some possible embodiments of the first aspect, the above method further includes: obtaining the identification information of the HPLMN according to the first request message; and obtaining the first digital identity according to the identification information of the HPLMN.

[0019] In this implementation, since the HPLMNs of different communication devices issue different digital identities for the first network element, when the first request message includes the identification information of the HPLMN, the first network element can accurately obtain the first digital identity issued by the HPLMN of the communication device for the first network element based on the identification information of the HPLMN.

[0020] In some possible embodiments of the first aspect, obtaining the public key of the HPLMN according to the first request message includes obtaining the identification information of the HPLMN according to the first request message and obtaining the public key of the HPLMN according to the identification information of the HPLMN.

[0021] Optionally, if the identification information of the communication device in the second digital identity carried in the first request message includes the identification information of the HPLMN, the first network element obtains the HPLMN of the communication device as the first digital identity issued by the first network element based on the identification information of the HPLMN contained in the identification information of the communication device. The first digital identity includes the public key of the HPLMN.

[0022] Optionally, if the first request message includes the identification information of the HPLMN, the first network element can obtain the first digital identity issued by the HPLMN of the communication device for the first network element based on the identification information of the HPLMN, and the first digital identity includes the public key of the HPLMN.

[0023] Optionally, if the first request message includes the HPLMN's identification information, the first network element requests the security edge protection proxy (SEPP) in the VPLMN to obtain the HPLMN's public key using the HPLMN's identification information as a parameter.

[0024] In some possible embodiments of the first aspect, before receiving the first request message, the above method further includes: receiving a first digital identity from the HPLMN, and storing the correspondence between the first digital identity and the identification information of the HPLMN; and obtaining the first digital identity based on the identification information of the HPLMN and the correspondence.

[0025] In this implementation, since the HPLMN of different communication devices issues different digital identities for the first network element, and the first network element stores the correspondence between the first digital identity and the identification information of the HPLMN, the first network element can obtain the first digital identity issued by the HPLMN of the communication device for the first network element based on the identification information of the HPLMN and the correspondence.

[0026] In some possible embodiments of the first aspect, the first request message further includes roaming information indicating at least one public land mobile network (PLMN) to which the communication device is permitted to roam, and the method further includes: verifying the roaming information based on the public key of the HPLMN, and sending a challenge response and a first digital identity if the verification of the second digital identity is successful, including: sending a challenge response and a first digital identity if the verification of the second digital identity is successful and the verification of the roaming information is successful.

[0027] In this implementation, roaming information is used to determine whether a communication device is allowed to access the VPLMN. The first network element can also verify the roaming information. If the roaming information is verified, it indicates that the communication device is a trustworthy device. Then, the first network element uses its private key to sign the challenge information, indicating that the first network element allows the communication device to access the VPLMN.

[0028] It should be noted that the roaming information includes: the identification information of the communication device (also known as the second identification information of the communication device), the identification information of at least one PLMN, and a signature, which is obtained by signing the identification information of the communication device and the identification information of at least one PLMN using the private key of the HPLMN.

[0029] The identification information of the communication device indicates that the roaming information is for the communication device. Specifically, the identification information of at least one PLMN included in the roaming information identifies a PLMN that the communication device is allowed to roam in, rather than a PLMN that other devices are allowed to roam in. The PLMN that the communication device is allowed to roam in can identify whether the communication device is allowed to roam to that PLMN, or whether the communication device is allowed to access that PLMN. It can also identify whether a roaming protocol exists between that PLMN and the communication device's HPLMN, indicating the PLMN that the communication device is allowed to roam in. The signature in the roaming information indicates that the roaming information was issued by the communication device's HPLMN.

[0030] It should be understood that the roaming information may be referred to as roaming control attributes, and the names of the roaming information are not specifically limited in the embodiments of this application.

[0031] In some possible embodiments of the first aspect, the roaming information includes a signature obtained based on the private key corresponding to the public key of the HPLMN, and the verification of the roaming information based on the public key of the HPLMN includes: verifying the signature based on the public key of the HPLMN.

[0032] In this implementation, the signature is verified using the public key of the HPLMN. If the verification is successful, it indicates that the roaming information was issued by the HPLMN.

[0033] The verification of roaming information includes: at least one PLMN includes a VPLMN.

[0034] In some possible embodiments of the first aspect, the second digital identity includes first identification information of the communication device, and the roaming information includes second identification information of the communication device. The method further includes: determining whether the first identification information and the second identification information match.

[0035] In this implementation, the first identification information in the second digital identity and the second identification information in the roaming information are used to determine whether the verification of the roaming information is successful. If the first identification information and the second identification information match, the verification of the roaming information is successful.

[0036] Roaming information can determine whether the HPLMN has authorized the communication device to access the VPLMN, or whether the HPLMN has authorized the communication device to access services within the VPLMN. This prevents unauthorized access to the VPLMN by communication devices, exceeding the scope of authorization granted by the HPLMN, thereby enhancing the security of communication devices accessing the VPLMN.

[0037] In some possible embodiments of the first aspect, the first request message further includes information about the first service, and, if the verification of the second digital identity is successful, the challenge information is signed using the private key of the first network element, including: if the verification of the second digital identity is successful and it is determined that the use of the first service in the VPLMN is permitted, the challenge information is signed using the private key of the first network element.

[0038] In this implementation, the first request message includes information about the first service, indicating that the communication device requests to use the first service in the VPLMN. When it is determined that the use of the first service in the VPLMN is permitted, it indicates that the communication device can access the VPLMN.

[0039] In some possible implementations, the information of the first service may be the identification information of the first service, or it may be the name of the first service. The information of the first service may also be a uniform resource identifier (URI), a uniform resource locator (URL), a uniform resource name (URN), a fully qualified domain name (FQDN), etc. The embodiments of this application do not specifically limit the type of information of the first service.

[0040] In some possible embodiments of the first aspect, the method further includes: sending a second request message, the second request message including: identification information of the VPLMN and information of the first service; receiving a second response message, the second response message indicating permission to use the first service in the VPLMN.

[0041] In this implementation, the first network element sends a second request message to the second network element to confirm whether the first service is allowed to be used on the VPLMN. When the second network element determines that the first service is allowed to be used on the VPLMN, the first network element receives a second response message sent by the second network element. Through the second response message, the first network element can determine that the first service is allowed to be used on the VPLMN.

[0042] It should be noted that the information of the first service in the second request message and the information of the first service in the first request message can be the same or different.

[0043] For example, the information about the first service in the first request message can be the identifier information of the first service, and the information about the first service in the second request message can be the name of the first service.

[0044] In some possible embodiments of the first aspect, before sending the second request message, the method further includes: receiving a third request message, the third request message being used to request the HPLMN to activate roaming services available in the VPLMN, the roaming services including a first service; and based on the third request message, sending a registration message to a second network element, the registration message being used to register roaming services available in the VPLMN, the registration message including the VPLMN's identification information and information about the first service.

[0045] In this implementation, after the first network element receives the roaming service that is available in the VPLMN and activates it in the HPLMN, it sends a registration message to the second network element to register the roaming service available in the VPLMN, so that the second network element can determine the roaming service that can be used in the VPLMN.

[0046] In some possible embodiments of the first aspect, the above method further includes a first network element sending a fifth request message, the fifth request message being used to request the HPLMN to issue a first digital identity for the first network element, the fifth request message including the public key of the first network element.

[0047] In some possible embodiments of the first aspect, the second digital identity is verified based on the public key of the HPLMN, including calculating the hash value of the second digital identity content to obtain a first result, and using the public key of the HPLMN to decrypt the signature of the second digital identity content using the private key of the HPLMN in the second digital identity to obtain a second result. Here, the second digital identity content refers to the identification information of the communication device and the public key of the communication device included within the second digital identity. If the first result and the second result are the same, the second digital identity verification is successful.

[0048] In some possible embodiments of the first aspect, the roaming information is verified based on the public key of the HPLMN, including calculating the hash value of the roaming information content to obtain a third result, and using the public key of the HPLMN to decrypt the signature of the roaming information content using the private key of the HPLMN to obtain a fourth result. If the third result and the fourth result are the same, the roaming information is verified successfully. Here, the roaming information content refers to the part of the roaming information other than the HPLMN's private key signature, for example, the roaming information content includes the identification information of the communication device and the identification information of at least one PLMN that allows the communication device to roam.

[0049] Secondly, a communication method is provided, the method comprising: sending a first request message, the first request message being used to request access to a VPLMN, the first request message including challenge information and a second digital identity issued by the HPLMN of the communication device for the communication device; receiving a first response message, the first response message including a challenge response and a first digital identity, the first digital identity being issued by the HPLMN for a first network element in the VPLMN; verifying the first digital identity based on the public key of the HPLMN; if the verification of the first digital identity is successful, obtaining the public key corresponding to the private key of the first network element from the first digital identity; and verifying the challenge response based on the public key of the first network element.

[0050] For example, the communication method can be implemented by a communication device, or by modules, units, processors, circuits, chips or chip systems included in the communication device.

[0051] In some embodiments, the communication device may be a device without a SIM card, for example, the operator network has not issued a SIM card for the communication device, or the communication device cannot install a SIM card. The communication device may be a robot, a cloud personal assistant, or a cloud code instance, etc. The communication device may also be other devices. The specific form of the communication device is not limited in the embodiments of this application.

[0052] The method provided in this application involves a communication device sending a first request message to a first network element in a VPLMN. This first request message is used to request access to the VPLMN. The challenge information in the first request message is used by the communication device to verify the VPLMN, and the second digital identity in the first request message is used by the VPLMN to verify the communication device. After the VPLMN successfully authenticates the communication device, it signs the challenge information to obtain a challenge response. The communication device can receive the challenge response and the first digital identity from the first network element. The communication device verifies the first digital identity, and after successful verification, obtains the public key of the trustworthy first network element. Finally, it uses the public key of the first network element to verify the challenge response. If the verification is successful, it means that the communication device has also successfully verified the VPLMN. This method can achieve bidirectional verification between the communication device and the VPLMN.

[0053] In some possible embodiments of the second aspect, the first request message may further include a signature of the communication device’s private key on the first request message, wherein the signature of the communication device’s private key on the first request message is used by the VPLMN to verify the identity of the communication device.

[0054] In some possible embodiments of the second aspect, the first digital identity includes the public key corresponding to the private key of the first network element.

[0055] In this implementation, when the communication device successfully authenticates the first digital identity, the communication device can obtain the public key corresponding to the private key of the first network element and use the public key to verify the challenge response.

[0056] In some possible embodiments of the second aspect, the second digital identity includes the public key of the HPLMN.

[0057] In this implementation, the public key of HPLMN can be used to verify the first digital identity, thereby verifying whether the first digital identity was issued by HPLMN.

[0058] Alternatively, the communication device stores the public key of the HPLMN. This application embodiment does not specifically limit the method of obtaining the public key of the HPLMN.

[0059] In some possible embodiments of the second aspect, the first request message includes roaming information indicating at least one PLMN for which the communication device allows roaming, the at least one PLMN including a VPLMN.

[0060] In this implementation, the first request message sent by the communication device carries roaming information, and the VPLMN can determine whether the communication device allows access based on the roaming information.

[0061] In some possible embodiments of the second aspect, the roaming information further includes: a signature obtained based on the private key corresponding to the public key of the HPLMN.

[0062] In this implementation, the signature is used by the VPLMN to verify roaming information; that is, the VPLMN uses the signature to verify whether the roaming information was issued by the HPLMN.

[0063] In some possible embodiments of the second aspect, the second digital identity includes first identification information of the communication device, and the roaming information includes second identification information of the communication device.

[0064] In this implementation, the first identification information and the second identification information are used by the VPLMN to determine whether to allow the communication device to access.

[0065] In some possible embodiments of the second aspect, the first request message is also used to request the use of the first service in the VPLMN.

[0066] In some possible embodiments of the second aspect, the first request message may also include information about the first service.

[0067] Optionally, the information of the first service may be the name of the first service or the identification information of the first service. This application embodiment does not specifically limit the information of the first service.

[0068] In this implementation, the information from the first service is used to determine whether the communication device is allowed to use the first service in the VPLMN.

[0069] Thirdly, a communication method is provided, the method comprising: receiving a second request message from a first network element in a VPLMN, the second request message including identification information of the VPLMN and information of a first service; and sending a second response message to indicate permission to use the first service in the VPLMN.

[0070] For example, the communication method can be implemented by a second network element, or by modules, units, processors, circuits, chips or chip systems included in the second network element.

[0071] For example, the second network element can be a unified data management (UDM) network element, or the second network element can be a network element that performs the same function. The embodiments of this application do not specifically limit the name of the second network element.

[0072] The method provided in this application allows a second network element to receive a second request message from a first network element in a VPLMN. The identification information of the VPLMN in the second request message is used to identify the VPLMN in which the communication device is roaming. The information of the first service in the second request message is used to indicate the service in the VPLMN that the communication device wants to access. The second network element sends a second response message based on the second request message. The second response message is used to indicate whether the use of the first service in the VPLMN is allowed. This method can determine the services of the VPLMN that the communication device can use.

[0073] In some possible embodiments of the third aspect, the use of the first service in the VPLMN is permitted based on the identification information of the VPLMN and the information of the first service.

[0074] For example, the second network element can search locally to see if there is a correspondence between the VPLMN's identification information and the information of the first service. If there is a correspondence between the VPLMN's identification information and the information of the first service, it can determine that the first service can be used in the VPLMN.

[0075] In some possible embodiments of the third aspect, before receiving the second request message from the first network element in the VPLMN, the above method further includes: receiving a registration message from the first network element, the registration message being used to register roaming services available in the VPLMN, the registration message including the identification information of the VPLMN and information of the first service.

[0076] In this implementation, when the first network element determines that it can open a roaming service available in the VPLMN to the HPLMN, the second network element receives a registration message sent by the first network element. The registration message includes the identification information of the VPLMN and the information of the first service. The second network element can save the identification information of the VPLMN and the information of the first service. Based on the saved information, the second network element can determine whether the first service can be used in the VPLMN.

[0077] Fourthly, a communication method is provided, the method comprising: receiving a fourth request message, the fourth request message including identification information of a communication device; and in response to the fourth request message, sending roaming information, the roaming information indicating at least one PLMN to which the communication device is permitted to roam.

[0078] For example, the communication method can be implemented by a third network element in the HPLMN of the communication device, or by a module, unit, processor, circuit, chip, or chip system included in the third network element. For example, the third network element is an IDM network element in the HPLMN, or the third network element can also be other network elements that perform the same function. The embodiments of this application do not specifically limit the name of the first network element.

[0079] The method provided in this application allows a third network element to obtain roaming information for a communication device based on the identification information of the communication device in a fourth request message, so that the communication device can use the roaming information to perform verification on the VPLMN side.

[0080] In some possible embodiments of the fourth aspect, the fourth request message includes a first PLMN list, which includes identification information of at least one PLMN. Before sending the roaming information, the method further includes: determining roaming information based on the first PLMN list, which includes the first PLMN list.

[0081] In this implementation, the first PLMN list represents a list of PLMNs that the user specifies and allows the communication device to roam. The third network element can determine the roaming information based on the first PLMN list carried in the fourth request message. The roaming information may specifically include the identification information of the communication device, the identification information of at least one PLMN that allows roaming, and the signature of the HPLMN's private key on the identification information of the communication device and the identification information of at least one PLMN that allows roaming.

[0082] In some possible embodiments of the fourth aspect, the fourth request message includes identification information of a terminal device, which is used to request roaming information for a communication device. Before sending the roaming information, the method further includes: obtaining a second PLMN list from a second network element based on the identification information of the terminal device, the second PLMN list including identification information of at least one PLMN, and determining roaming information based on the second PLMN list, the roaming information including the second PLMN list.

[0083] In this implementation, if the fourth request message does not carry the first PLMN list, the third network element can obtain the list of PLMNs that the terminal device is allowed to roam from the second network element based on the terminal device's identification information, and use the list of PLMNs that the terminal device is allowed to roam as the list of PLMNs that the communication device is allowed to roam.

[0084] Optionally, the identification information of the terminal device may be the terminal device number, or the terminal device's subscription permanent identifier (SUPI). Of course, it may also be other identification information of the terminal device. This application embodiment does not specifically limit this.

[0085] In some possible embodiments of the fourth aspect, the fourth request message further includes first indication information, obtaining a second PLMN list that allows the communication device to roam from the second network element based on the identification information of the terminal device, including: in response to the first indication information, obtaining a second PLMN list that allows the communication device to roam from the second network element based on the identification information of the terminal device.

[0086] In this implementation, the third network element can obtain a list of second PLMNs that allow the communication device to roam based on the first instruction information from the second network element.

[0087] Optionally, the first indication information may not be included in the fourth request message. That is, the third network element receives the first indication information, which is used to instruct the second network element to obtain a list of second PLMNs that allow the communication device to roam based on the identification information of the terminal device.

[0088] Fifthly, a communication method is provided, the method comprising: sending a fourth request message, the fourth request message including identification information of a communication device; receiving roaming information, the roaming information indicating at least one PLMN to which the communication device is permitted to roam; and sending the roaming information to the communication device.

[0089] For example, the communication method can be implemented by a terminal device, or by modules, units, processors, circuits, chips or chip systems included in the terminal device.

[0090] The method provided in this application allows a terminal device to obtain roaming information for a communication device, enabling the communication device to use the roaming information to perform verification on the VPLMN side, thereby determining whether the communication device can access the VPLMN.

[0091] It should be understood that the terminal device may belong to the same user as the communication device, or it may belong to different users. This application embodiment does not specifically limit this.

[0092] In some possible embodiments of the fifth aspect, the fourth request message includes a first PLMN list, the first PLMN list including identification information of at least one PLMN, and the roaming information includes the first PLMN list.

[0093] In some possible embodiments of the fifth aspect, the fourth request message includes identification information of a terminal device, the terminal device being used to request the roaming information for the communication device, the identification information being used to obtain a second PLMN list, the second PLMN list including identification information of the at least one PLMN, and the roaming information including the second PLMN list.

[0094] In some possible embodiments of the fifth aspect, a first indication message is sent, the first indication message being used to indicate a request for roaming service for the communication device.

[0095] In this implementation, the first indication information is used to trigger the third network element to request roaming service for the communication device based on the identification information of the terminal device.

[0096] A sixth aspect provides a communication method, the method comprising: receiving a first request message, the first request message including challenge information and a second digital identity from a communication device, the second digital identity being issued by the communication device's HPLMN to the communication device; obtaining the public key of the HPLMN according to the first request message, and verifying the second digital identity according to the public key of the HPLMN; if the second digital identity is verified, sending challenge information to a first network element; receiving a challenge response and a first digital identity from the first network element, the first digital identity being issued by the HPLMN to the first network element, the challenge response being obtained by signing the challenge information with the private key of the first network element, the challenge response and the first digital identity being used by the communication device to verify the VPLMN.

[0097] For example, the communication method can be implemented by a fourth network element, or by the modules, units, processors, circuits, chips or chip systems included in the fourth network element.

[0098] For example, the fourth network element can be an access gateway (AGW), or it can be a network element that performs the same function. In this application embodiment, the name of the fourth network element is not specifically limited.

[0099] The method provided in this application involves a fourth network element receiving a first request message from a communication device, which requests access to a VPLMN. This first request message includes a second digital identity (the communication device's digital identity) and challenge information (the communication device's challenge information to the VPLMN). The second digital identity in the first request message is issued by the communication device's HPLMN. The fourth network element uses the first request message to obtain the HPLMN's public key and verifies the second digital identity using the HPLMN's public key. If the second digital identity is verified, the fourth network element sends the challenge information to a first network element, which then signs the challenge information to obtain a challenge response. This challenge response is used by the communication device to verify the VPLMN. This method can achieve bidirectional authentication between the communication device and the VPLMN without requiring a shared key between the communication device and the network, thus enabling communication devices without a SIM card or unable to install a SIM card to successfully access the VPLMN.

[0100] Optionally, the first request message may also include a signature, which is obtained by signing the second digital identity and challenge information using the private key of the communication device.

[0101] Optionally, if the second digital identity verification is successful, the fourth network element uses the public key of the communication device in the second digital identity to verify the signature. If the signature verification is successful, it indicates that the fourth network element allows the communication device to access the VPLMN.

[0102] Optionally, the fourth network element may also send the identification information of the communication device and / or the identification information of the HPLMN to the first network element. The identification information of the communication device and / or the identification information of the HPLMN is used by the first network element to obtain the first digital identity issued by the HPLMN of the communication device for the first network element.

[0103] Optionally, the fourth network element may also send a second instruction message to the first network element, which is used to instruct the fourth network element to pass the second digital authentication.

[0104] In a seventh aspect, a communication method is provided, the method comprising: receiving challenge information from a fourth network element; signing the challenge information using the private key of the first network element to obtain a challenge response; and sending the challenge response and a first digital identity, wherein the first digital identity is issued by the HPLMN to the first network element, and the challenge response and the first digital identity are used by the communication device to verify the VPLMN.

[0105] For example, the communication method can be implemented by a first network element, or by modules, units, processors, circuits, chips or chip systems included in the first network element.

[0106] For example, the first network element can be an IDM network element in a VPLMN, or the first network element can be a network element that performs the same function. In this application embodiment, the name of the first network element is not specifically limited.

[0107] The method provided in this application involves a first network element receiving a challenge message from a fourth network element to a VPLMN, indicating that the VPLMN has successfully verified the digital identity (second digital identity) of the communication device. The first network element then uses its own private key to sign the challenge message to obtain a challenge response, and sends the challenge response and the first network element's digital identity (first digital identity) to enable the communication device to verify the VPLMN based on the challenge response and the first digital identity. This method can achieve bidirectional verification between the communication device and the VPLMN without the need for a shared key between the communication device and the network, thereby enabling communication devices without a SIM card or unable to install a SIM card to successfully access the VPLMN.

[0108] Optionally, when the fourth network element sends the HPLMN's identification information to the first network element, the first network element can obtain the first digital identity issued by the HPLMN for the first network element based on the HPLMN's identification information, and use the private key corresponding to the first network element's public key in the first digital identity to sign the challenge information.

[0109] Optionally, when the fourth network element sends the identification information of the communication device to the first network element, the first network element can determine the HPLMN of the communication device based on the identification information of the communication device, and further determine that the HPLMN is the first digital identity issued by the first network element, and use the private key corresponding to the public key of the first network element in the first digital identity to sign the challenge information.

[0110] Optionally, after receiving the second instruction information sent by the fourth network element, the first network element signs the challenge information using its private key to obtain a challenge response.

[0111] Eighthly, a communication apparatus is provided for performing the communication method in the first aspect or any possible implementation thereof. Exemplarily, the apparatus includes modules (e.g., a processing module and a communication module) for performing the steps in the first aspect or any possible implementation thereof. Alternatively, the apparatus is used to perform the communication method in the second aspect or any possible implementation thereof. Exemplarily, the apparatus includes modules (e.g., a processing module and a communication module) for performing the steps in the second aspect or any possible implementation thereof; or, the apparatus is used to perform the communication method in the third aspect or any possible implementation thereof. Exemplarily, the apparatus includes modules (e.g., a processing module and a communication module) for performing the steps in the third aspect or any possible implementation thereof; or, the apparatus is used to perform the communication method in the fourth aspect or any possible implementation thereof. Exemplarily, the apparatus includes modules (e.g., a processing module and a communication module) for performing the steps in the fourth aspect or any possible implementation thereof; or, the apparatus is used to perform the communication method in the fifth aspect or any possible implementation thereof. For example, the apparatus includes modules (e.g., processing modules and communication modules) for performing the steps of the fifth aspect or any possible implementation thereof, or the apparatus is used to perform the communication method of the sixth aspect or any possible implementation thereof. For example, the apparatus includes modules (e.g., processing modules and communication modules) for performing the steps of the sixth aspect or any possible implementation thereof, or the apparatus is used to perform the communication method of the seventh aspect or any possible implementation thereof. For example, the apparatus includes modules (e.g., processing modules and communication modules) for performing the steps of the seventh aspect or any possible implementation thereof.

[0112] A ninth aspect provides a communication apparatus comprising at least one processor, the at least one processor being configured to execute: the method of the first aspect or any possible implementation thereof, or the method of the second aspect or any possible implementation thereof, or to execute the method of the third aspect or any possible implementation thereof, or to execute the method of the fourth aspect or any possible implementation thereof, or to execute the method of the fifth aspect or any possible implementation thereof, or to execute the method of the sixth aspect or any possible implementation thereof, or to execute the method of the seventh aspect or any possible implementation thereof.

[0113] In one possible implementation, the communication device may further include a memory storing a computer program. At least one processor executes the method described in the first aspect or any possible implementation thereof by executing the computer program stored in the memory, or executes the method described in the second aspect or any possible implementation thereof, or executes the method described in the third aspect or any possible implementation thereof, or executes the method described in the fourth aspect or any possible implementation thereof, or executes the method described in the fifth aspect or any possible implementation thereof, or executes the method described in the sixth aspect or any possible implementation thereof, or executes the method described in the seventh aspect or any possible implementation thereof. Optionally, the processor and the memory may be integrated together.

[0114] In one possible implementation, at least one processor executes the method of the first aspect or any possible implementation of the first aspect through logic circuits or processing circuits, or executes the method of the second aspect or any possible implementation of the second aspect, or executes the method of the third aspect or any possible implementation of the third aspect, or executes the method of the fourth aspect or any possible implementation of the fourth aspect, or executes the method of the fifth aspect or any possible implementation of the fifth aspect, or executes the method of the sixth aspect or any possible implementation of the sixth aspect, or executes the method of the seventh aspect or any possible implementation of the seventh aspect.

[0115] In one possible implementation, the communication device may further include an interface circuit for performing specific signal transmission and reception. For example, the communication device may be a first network element, a component (chip, chip system, or processor) within the first network element, or a logic module or software capable of implementing all or part of the first network element.

[0116] For example, the communication device can be a communication device, a component (chip, chip system, or processor) in the communication device, or a logic node, logic module, or software that can realize all or part of the functions of the communication device.

[0117] In a tenth aspect, a computer program product is provided, comprising a computer program that, when executed by a processor in a communication device, causes the communication device to perform the method of the first aspect or any possible implementation thereof; or causes the communication device to perform the method of the second aspect or any possible implementation thereof; or causes the communication device to perform the method of the third aspect or any possible implementation thereof; or causes the communication device to perform the method of the fourth aspect or any possible implementation thereof; or causes the communication device to perform the method of the fifth aspect or any possible implementation thereof; or causes the communication device to perform the method of the sixth aspect or any possible implementation thereof; or causes the communication device to perform the method of the seventh aspect or any possible implementation thereof.

[0118] Eleventhly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a communication device, causes the communication device to perform the method of the first aspect or any possible implementation thereof; or causes the communication device to perform the method of the second aspect or any possible implementation thereof; or causes the communication device to perform the method of the third aspect or any possible implementation thereof; or causes the communication device to perform the method of the fourth aspect or any possible implementation thereof; or causes the communication device to perform the method of the fifth aspect or any possible implementation thereof; or causes the communication device to perform the method of the sixth aspect or any possible implementation thereof; or causes the communication device to perform the method of the seventh aspect or any possible implementation thereof.

[0119] In a twelfth aspect, a chip is provided, comprising: a processor for retrieving and running a computer program from a memory, causing a communication device on which the chip is mounted to perform the method of the first aspect or any possible implementation thereof; or, perform the method of the second aspect or any possible implementation thereof; or, perform the method of the third aspect or any possible implementation thereof; or, perform the method of the fourth aspect or any possible implementation thereof; or, perform the method of the fifth aspect or any possible implementation thereof; or, perform the method of the sixth aspect or any possible implementation thereof; or, perform the method of the seventh aspect or any possible implementation thereof.

[0120] In a thirteenth aspect, a communication system is provided, the communication system including the first network element described above, the first network element being used to perform the method in the first aspect or any possible implementation thereof.

[0121] In a fourteenth aspect, a communication system is provided, comprising the first network element and the fourth network element described above, wherein the first network element is used to perform the method in the seventh aspect or any possible implementation thereof, and the fourth network element is used to perform the method in the sixth aspect or any possible implementation thereof.

[0122] In a fifteenth aspect, a communication system is provided, comprising the second network element and the third network element described above, wherein the second network element is used to perform the method in the third aspect or any possible implementation thereof, and the third network element is used to perform the method in the fourth aspect or any possible implementation thereof. Attached Figure Description

[0123] Figure 1 A schematic diagram illustrating a 5G user terminal roaming example is shown.

[0124] Figure 2 A schematic diagram of a network architecture applicable to this application is shown.

[0125] Figure 3 A schematic interactive diagram of an example communication method provided in an embodiment of this application is shown.

[0126] Figure 4 A schematic flowchart illustrating the acquisition of roaming information by a communication device provided in an embodiment of this application is shown.

[0127] Figure 5 A schematic interactive diagram of an example communication method provided in an embodiment of this application is shown.

[0128] Figure 6A schematic interactive diagram of an example communication method provided in an embodiment of this application is shown.

[0129] Figure 7 A schematic interactive diagram of an example communication method provided in an embodiment of this application is shown.

[0130] Figure 8 A schematic interactive diagram of an example communication method provided in an embodiment of this application is shown.

[0131] Figure 9 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application.

[0132] Figure 10 This is a schematic diagram of another communication device provided in an embodiment of this application. Detailed Implementation

[0133] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0134] In the description of the embodiments of this application, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can represent A or B. "And / or" in the embodiments of this application is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. Furthermore, in the description of the embodiments of this application, unless otherwise stated, "multiple" refers to two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the words "first" and "second" do not limit the quantity or the order of execution, and that the words "first" and "second" do not necessarily imply that they are different.

[0135] In the various method embodiments of this application, the order of the sequence numbers does not imply the order of execution. The execution order should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0136] It is understood that in the embodiments of this application, descriptions such as "under the circumstances," "if," "when," and "if..." can be used interchangeably. Furthermore, these descriptions all refer to the corresponding processing that will be carried out under certain objective circumstances, and are not limited to a specific time, nor do they require any judgment action during implementation, nor do they imply any other limitations.

[0137] It is understood that some optional features in the embodiments of this application can be implemented independently in certain scenarios without relying on other features, such as the current solution on which they are based, to solve the corresponding technical problems and achieve the corresponding effects. Alternatively, they can be combined with other features as needed in certain scenarios. Correspondingly, the apparatus given in the embodiments of this application can also implement these features or functions, which will not be elaborated here.

[0138] In the embodiments of this application, unless otherwise specified, the same or similar parts between the various embodiments can be referred to each other. In the various embodiments of this application, and in the various implementation methods / methods / implementations within each embodiment, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments and between the various implementation methods / methods / implementations within each embodiment are consistent and can be mutually referenced. The technical features in different embodiments and the various implementation methods / methods / implementations within each embodiment can be combined according to their inherent logical relationships to form new embodiments, implementation methods, methods, or implementation approaches. The embodiments of this application described below do not constitute a limitation on the scope of protection of this application.

[0139] When a user subscribes to mobile communication network services, the operator network issues them a subscriber identity module (SIM) or user identity module (UIM) card and assigns them a user number for making and receiving calls. The operator network that issues the SIM / UIM card to the terminal device is called the terminal device's home public land mobile network (HPLMN). If the terminal device moves to an area not covered by the HPLMN, for example, when the user travels abroad and the HPLMN has no network coverage there, the terminal device can obtain service through a visited public land mobile network (VPLMN) with which the HPLMN has a roaming agreement.

[0140] It should be understood that the SIM card contains a shared key, which is only shared with the HPLMN that issued the SIM card. Secure communication based on the SIM card primarily relies on the key stored on the SIM card and the protocol between the terminal device and the mobile network. This protocol is used by the terminal device and the HPLMN to perform bidirectional authentication using the shared key and derive the key for secure communication.

[0141] Figure 1 An example of the fifth generation (5) is shown. th A diagram illustrating 5G (5G) user terminal roaming, as shown below. Figure 1 As shown, a VPLMN includes network repository function (NRF) network elements, policy control function (PCF) network elements, access and mobility management function (AMF) network elements, session management function (SMF) network elements, terminal equipment, radio access network (RAN), user plane function (UPF) network elements, and SEPP network elements. In VPLMN, the SMF is also called vSMF, and the SEPP is also called vSEPP.

[0142] HPLMN includes Unified Data Management (UDM) network elements, NRF network elements, Authentication Server Function (AUSF) network elements, PCF network elements, SMF network elements, UPF network elements, and SEPP network elements. In HPLMN, SMF is also called hSMF, and SEPP is also called hSEPP. vSEPP and hSEPP can exchange data through an IP exchange (IPX) network.

[0143] like Figure 1As shown, when a terminal device (or apparatus) accesses a VPLMN while roaming, it registers with the VPLMN via the AMF. During the network registration process, the VPLMN communicates with the HPLMN via vSEPP and hSEPP. The HPLMN verifies the user terminal's SIM / UIM card and sends the verification result to the VPLMN. The VPLMN then determines whether to allow the user terminal to register with the VPLMN based on the verification result from the HPLMN.

[0144] With the development of networks, a wider range of terminal forms are expected in the future. Besides traditional terminal devices with SIM / eSIM (embedded subscriber identification module), this may include terminal devices without SIM / eSIM, and even virtual terminal devices that cannot possess SIM / eSIM, such as intelligent agents deployed in the network or personal intelligent assistants deployed in the public cloud. These intelligent agents or personal intelligent assistants may be instances of artificial intelligence models or running programs, and cannot possess a physical SIM / eSIM. To enable these terminal devices without SIM / eSIM to access the operator's network and use related network services, an identity management element (IDM) is introduced into the relevant technologies. Users request the IDM to issue digital identity credentials for terminal devices without SIM / eSIM. When these terminal devices access the operator's network, the IDM in the operator's network is responsible for verifying the terminal devices without SIM / eSIM. Once the terminal device is verified, it is allowed to access the operator's network that issued its digital identity.

[0145] When a terminal device roams overseas, those without a SIM / eSIM need to register with a VPLMN to access the services provided by the VPLMN. In existing technologies, the authentication between the terminal device and the VPLMN relies on the shared key stored in the SIM / eSIM. For terminal devices without a SIM / eSIM, how to achieve two-way authentication with the VPLMN is a problem that needs to be solved.

[0146] In view of this, this application provides a communication method in which a network element in a VPLMN (hereinafter referred to as the first or fourth network element) receives a first request message. This first request message includes challenge information from a communication device and a second digital identity. The second digital identity is issued by the HPLMN of the communication device. The network element obtains the public key of the HPLMN based on the first request message, verifies the second digital identity using the public key, and then, if the verification of the second digital identity is successful, sends a challenge response and the first digital identity. The first digital identity is issued by the HPLMN to the first network element, and the challenge response is obtained by signing the challenge information with the private key of the first network element. The challenge response and the first digital identity are used by the communication device to verify the VPLMN. This method can achieve two-way authentication between a terminal device without a SIM / eSIM and the VPLMN.

[0147] Before introducing the communication method provided in this application, the network structure to which this application applies will be described first.

[0148] Figure 2 A schematic diagram of a network architecture applicable to this application is shown. For example... Figure 2 As shown, the network architecture may include communication devices and core network elements.

[0149] In some embodiments, the communication device may be a physical terminal device with wireless transceiver function, such as a chip or module in the physical terminal device, or a virtual terminal (e.g., a robot, a cloud-based personal assistant, or a cloud-based code instance) capable of participating in network communication or calling network services. The specific form of the communication device is not limited in the embodiments of this application.

[0150] Physical terminal devices can be deployed on land, including indoors or outdoors, handheld, wearable, or vehicle-mounted; they can also be deployed on water (such as ships); and they can be deployed in the air (such as airplanes, balloons, and satellites). These terminal devices can be mobile phones, tablets, computers with wireless transceiver capabilities, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, wireless terminals in self-driving vehicles, wireless terminals in remote medical care, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and so on. Virtual network terminals can be intelligent agents deployed in a network, personal intelligent assistants deployed in a public cloud, etc. The embodiments of this application do not limit the application scenarios, nor do they limit the specific technologies, device forms, or names used in the terminal devices.

[0151] Core network elements may include data management network elements, such as UDM and / or unified data repository (UDR) in 5G, identity management network elements, such as IDM network elements in 5G, agent communication network (ACN), SEPP, and access gateway (AGW).

[0152] UDM network elements include functions such as generating and storing user subscription data and managing authentication data, and support interaction with external third-party servers. They store and manage network terminal service subscription data, digital identity, and related attributes. In 5G communication systems, user data management network elements can be UDM network elements, database network elements, or other network elements. The embodiments of this application do not limit the specific implementation form of the database network element.

[0153] An IDM (Internet Data Center) network element is a network element that issues digital identities or related attributes to users, devices, network element terminals, or virtual terminals, and can verify that they hold legitimate digital identities or possess related attributes. The digital identity includes a unique identifier (i.e., identity information) for the user, device, or network terminal, the user's, device's, or network element terminal's public key, and the IDM's signature of the former two using its own private key. The digital identity may also include the IDM's own public key. Related attributes include the user's, device's, or network terminal's identity information, descriptions of its relevant characteristics, capabilities, permissions, or subscription information, and the IDM's signature of the former two using its own private key. In VPLMN, the IDM is also called vIDM, and in HPLMN, the IDM is also called hIDM.

[0154] An AGW (Access Gateway) is a gateway device that isolates the internet from carrier networks. It performs authentication and network access control for network devices accessing from the internet. When a network terminal accesses the internet via a mobile hotspot, the access gateway can also be a UPF (User-Defined Gateway) element, or it can be a standalone network device. The embodiments in this application do not specifically limit the specific implementation. In the embodiments of this application, the AGW can be a standalone network element or integrated with a vIDM (Virtual Internet Device).

[0155] ACN refers to a network architecture and protocol specifically designed for communication devices between intelligent agents (such as software instances, robots, or personal intelligent assistants).

[0156] SEPP (Service Provider Interface) refers to ensuring service continuity and security while complying with local regulations and standards when users roam across networks. In VPLMN, the SEPP is also called vSEPP, and in HPLMN, it's called hSEPP. Both HPLMN's hSEPP and VPLMN's vSEPP are pre-configured with a shared key. Communication messages between hSEPP and vSEPP use this shared key for integrity protection and encrypted transmission, allowing HPLMN to trust messages from vSEPP, and vice versa. Both vSEPP and hSEPP connect to an IP exchange network for data exchange (IP eXchange, IPX).

[0157] The communication method provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0158] It should be understood that the step numbers in the embodiments of this application are for illustrative purposes only and do not limit the order in which the steps occur.

[0159] The following is combined with Figure 3 This application provides a detailed description of an example communication method. Figure 3 A schematic interaction diagram of an example communication method provided in an embodiment of this application is shown, such as... Figure 3As shown, method 300 may include S310 to S380.

[0160] S310, the communication device sends a first request message to the first network element, and correspondingly, the first network element receives the first request message from the communication device.

[0161] The first request message includes challenge information and a second digital identity issued by the HPLMN for the communication device. This second digital identity is used by the VPLMN to verify the communication device. The first request message can be used by the communication device to request access to the VPLMN.

[0162] It should be understood that HPLMN refers to the network where the network element (e.g., the third network element mentioned below) that issues digital identities for communication devices resides.

[0163] Optionally, the challenge information may be a byte string randomly generated by the communication device, or the challenge information may be a timestamp when the communication device sends the first request message. The challenge information may also be other information. The specific form of the challenge information is not limited in the embodiments of this application.

[0164] The second digital identity may include the identification information of the communication device, the public key of the communication device, and a signature, which is obtained by signing the identification information of the communication device and the public key of the communication device using the private key of the HPLMN.

[0165] For example, the second digital identity includes a second digital identity content portion and a signature. The second digital identity content portion includes the identification information of the communication device and the public key of the communication device. The signature is obtained by signing the second digital identity content portion using the private key of the HPLMN. The signature is used to prove that the second digital identity was issued by the HPLMN.

[0166] The content portion of the second digital identity may also include other information. All information included in the content portion needs to be signed with the HPLMN's private key to prove that the second digital identity was issued by HPLMN.

[0167] The identification information of the communication device is used to identify the communication device; for example, this identification information can be the ID of the communication device. The public key of the communication device is used by the VPLMN to verify the first request message sent by the communication device, thereby determining whether the communication device is the sender of the first request message.

[0168] In one implementation, the first request message includes a content portion and a signature. The content portion includes challenge information and a second digital identity. The signature is obtained by signing the content portion of the first request message using the private key of the communication device. The content portion of the first request message may also include other information, which is not limited in this embodiment.

[0169] In this implementation, the public key of the communication device is used by the VPLMN to verify the first request message sent by the communication device, including: the public key of the communication device is used to verify the signature of the VPLMN (such as the first network element) in the first request message.

[0170] The first request message may include identification information of the HPLMN, which is used to identify the HPLMN of the communication device. For example, the second digital identity may also include the identification information of the HPLMN, or the identification information of the communication device may include the identification information of the HPLMN.

[0171] Optionally, the second digital identity may also contain the public key of the HPLMN. The public key of the HPLMN is used to verify the signature obtained by the private key of the HPLMN. That is, the communication device uses the public key of the HPLMN in the second digital identity to verify the signature of the private key of the HPLMN in the first digital identity of the first network element.

[0172] S320: The first network element obtains the public key of the HPLMN based on the first request message.

[0173] The first network element can obtain the HPLMN's identification information based on the first request message, and then obtain the HPLMN's public key based on the HPLMN's identification information.

[0174] For example, the second digital identity in the first request message includes the identification information of the HPLMN, and the first network element can obtain the identification information of the HPLMN from the second digital identity; or, the second digital identity in the first request message includes the identification information of the communication device, and the identification information of the communication device includes the identification information of the HPLMN, and the first network element can obtain the identification information of the HPLMN from the identification information of the communication device.

[0175] In some possible implementations, the first network element obtaining the public key of the HPLMN based on the HPLMN's identification information includes: the first network element obtaining a first digital identity issued by the HPLMN stored in the local communication device for the first network element based on the HPLMN's identification information, wherein the first digital identity includes the public key of the HPLMN.

[0176] For example, there is a correspondence between the identification information of the HPLMN of the communication device and the first digital identity. The first network element searches for the first digital identity corresponding to the identification information of the HPLMN based on the identification information of the HPLMN.

[0177] In this implementation, before the first network element receives the first request message, the method further includes: the first network element receiving the first digital identity from the HPLMN and saving the correspondence between the first digital identity and the identification information of the HPLMN.

[0178] In some other possible implementations, the first network element obtains the public key of the HPLMMN based on the HPLMMN's identification information by requesting the public key of the HPLMMN from vSEPP using the HPLMMN's identification information as a parameter.

[0179] For example, the first network element sends a request message to vSEPP, which includes the identification information of the HPLMN and is used to request the public key of the HPLMN. Correspondingly, vSEPP receives the request message from the first network element, determines the public key of the HPLMN based on the identification information, and then sends the public key of the HPLMN to the first network element.

[0180] S330, the first network element verifies the second digital identity based on the public key of the HPLMN.

[0181] For example, the second digital identity includes the HPLMN's private key pairing identification information of the communication device and the signature of the communication device's public key, and the first network element verifies the signature based on the HPLMN's public key.

[0182] For example, the first network element calculates the hash value of the parts of the second digital identity other than the signature. If the hash value is consistent with the calculation result obtained by the first network element using the public key of HPLMN to decrypt the signature in the second digital identity, then the second digital identity verification is successful.

[0183] The above process can be described as follows: The first network element calculates the hash value of the content portion of the second digital identity (such as the identification information of the communication device, the public key of the communication device) to obtain a first result. Then, it uses the public key of the HPLMN to decrypt the signature in the second digital identity using the private key of the HPLMN to obtain a second result. If the first and second results are identical, the second digital identity verification is successful.

[0184] Furthermore, if the second digital identity verification is successful, the first network element can also verify the first request message. For example, if the second digital identity verification is successful, the first network element obtains the public key of the communication device from the second digital identity, and then uses the public key of the communication device to verify the signature in the first request message. If the signature is verified successfully using the public key of the communication device, it indicates that the first request message was initiated by a legitimate device (communication device) holding the second digital identity, or it can indicate that the device initiating the first request message is the same as the device holding the second digital identity.

[0185] Optionally, the verification process of the first network element for the first request message is as follows: The first network element calculates the hash value of the content of the first request message (challenge information, second digital identity) to obtain result #1, and uses the public key of the communication device to decrypt the signature of the content of the first request message using the private key of the communication device to obtain result #2. If result #1 and result #2 are the same, the verification of the first request message is successful.

[0186] S340. If the verification of the second digital identity is successful, the first network element sends a challenge response and the first digital identity, and the communication device receives the challenge response and the first digital identity accordingly.

[0187] For example, if the first network element successfully verifies the second digital identity, the first network element uses its private key to perform a signature calculation on the challenge information in the first request message to obtain a challenge response.

[0188] The challenge response and the first digital identity are used by the communication device to verify the VPLMN. That is, the first network element sends a challenge response and the first digital identity to the communication device so that the communication device can verify the VPLMN.

[0189] The first digital identity includes the identification information of the first network element, the public key of the first network element, and a signature. The signature is obtained by signing the identification information of the first network element and the public key of the first network element using the private key of the HPLMN.

[0190] For example, the first digital identity includes a first digital identity content portion and a signature. The first digital identity content portion includes the identification information of the first network element and the public key of the first network element. The signature is obtained by signing the first digital identity content portion using the private key of the first network element. The signature is used to prove that the first digital identity was issued by HPLMN.

[0191] The content portion of the first digital identity may also include other information. All information included in the content portion needs to be signed with the HPLMN's private key to prove that the first digital identity was issued by HPLMN.

[0192] The identification information of the first network element is used to identify the first network element; for example, this identification information can be the ID of the first network element. The public key of the first network element can be used by the communication device to verify the challenge response.

[0193] Optionally, the first digital identity may also include the public key of the HPLMN. The public key of the HPLMN is used to verify the signature obtained by the private key of the HPLMN. For example, the first network element can use the public key of the HPLMN in the first digital identity to verify the signature of the private key of the HPLMN in the second digital identity of the communication device.

[0194] Optionally, the identification information of the first network element may also include the identification information of the VPLMN, which is used to indicate that the first network element is a network element in the VPLMN.

[0195] It should be noted that the timing of the first network element's verification of the second digital identity and the receipt of the challenge response is not limited in the embodiments of this application. For example, the challenge response may be obtained when the first network element successfully verifies the second digital identity, or the challenge response may be generated in advance and sent by the first network element when the second digital identity is successfully verified.

[0196] In some embodiments, the first request message sent by the communication device to the first network element further includes roaming information, which is used to indicate at least one PLMN that the communication device allows to roam.

[0197] Furthermore, when the first request message includes roaming information, the first network element can also verify the roaming information. If the verification of the second digital identity and the verification of the roaming information are both successful, the first network element's private key is used to sign the challenge information.

[0198] It should be noted that the roaming information includes: the identification information of the communication device (also known as the second identification information of the communication device), the identification information of at least one PLMN, and a signature, which is obtained by signing the identification information of the communication device and the identification information of at least one PLMN using the private key of the HPLMN.

[0199] The aforementioned roaming information can also be represented as follows: the roaming information includes a roaming information content portion and a signature. The roaming information content portion includes the identification information of the communication device and the identification information of at least one PLMN. The signature is obtained by signing the roaming information content portion using the private key of the HPLMN, and the signature is used to indicate that the roaming information was issued by the HPLMN.

[0200] It should also be noted that the roaming information content section may include other information. All information included in the content section needs to be signed with the HPLMN's private key to prove that the roaming information was issued by HPLMN.

[0201] The identification information of the communication device indicates that the roaming information is for the communication device. Specifically, it means that the identification information of at least one PLMN included in the roaming information identifies a PLMN that the communication device is allowed to roam in, rather than a PLMN that other devices are allowed to roam in. The PLMN that the communication device is allowed to roam in can mean that the communication device is allowed to roam to that PLMN, or that the communication device is allowed to access that PLMN, or that a roaming protocol exists between that PLMN and the communication device's HPLMN.

[0202] It should be understood that the roaming information may be referred to as roaming control attributes, and the names of the roaming information are not specifically limited in the embodiments of this application.

[0203] In some possible embodiments, the specific process by which the first network element verifies the roaming information based on the public key of the HPLMN is as follows:

[0204] The first network element calculates the hash value of the roaming information content (such as the identification information of the communication device and the identification information of at least one PLMN) to obtain the third result. It then uses the public key of the HPLMN to decrypt the signature in the roaming information to obtain the fourth result. If the third and fourth results are identical, the roaming information is verified.

[0205] Furthermore, the first network element can also verify the roaming information based on the first identification information of the communication device in the second digital identity and the second identification information of the communication device in the roaming information. For example, if the first identification information and the second identification information match, the roaming information is verified.

[0206] Furthermore, the first network element can also verify whether the identification information of at least one PLMN in the roaming information includes the identification information of a VPLMN. If the identification information of at least one PLMN includes the identification information of a VPLMN, the roaming information is verified.

[0207] It should be noted that the embodiments of this application do not specifically limit the verification order of roaming information.

[0208] The following is combined with Figure 4 The process by which a communication device acquires roaming information is illustrated by an example, such as... Figure 4 As shown, the method includes steps S3410-S3440.

[0209] S3410, The terminal device sends a fourth request message to the third network element, and the third network element receives the fourth request message from the terminal device accordingly.

[0210] It should be understood that issuing the fourth request message may include the identification information of the communication device, so that the third network element can determine the roaming information based on the identification information of the communication device.

[0211] In the embodiments of this application, the terminal device refers to a device that requests roaming information for a communication device. The terminal device may be a mobile phone, tablet computer, printer with wireless transceiver function, wearable device, vehicle, charging pile, airplane, ship, robot, robotic arm, or smart home device, etc. The embodiments of this application do not limit the specific device form of the terminal device.

[0212] It should be noted that the user requests roaming information for the communication device using a terminal device. The terminal device and the communication device may belong to the same user or different users. This application does not specifically limit this aspect.

[0213] In this embodiment, the third network element is a network element in the HPLMN of the communication device. The third network element is used to verify the user's identity. For example, the third network element can be an IDM network element, or the third network element can be a network element that performs the same function. This embodiment does not specifically limit the name of the third network element.

[0214] S3420 and the third network element determine roaming information based on the fourth request message.

[0215] In some possible implementations, when the fourth request message includes the identification information of the communication device, the third network element can send the identification information of the communication device to the second network element, obtain from the second network element a list of PLMNs that the terminal device is allowed to roam (the second PLMN list), the second PLMN list including the identification information of at least one PLMN, and then use the list of PLMNs that the terminal device is allowed to roam as the list of PLMNs that the communication device is allowed to roam. The third network element can determine roaming information based on the second PLMN list, which includes the second PLMN list.

[0216] For example, when a second network element receives identification information of a communication device from a third network element, it can determine the second PLMN list corresponding to the identification information of the communication device. For instance, the second network element locally stores the correspondence between the identification information of the communication device and the identification information of the terminal device. Based on the identification information of the communication device and this correspondence, the second network element determines the identification information of the terminal device, and then obtains the second PLMN list based on the identification information of the terminal device. For instance, when an HPLMN issues a second digital identity for a communication device, the second network element can store the correspondence between the identification information of the communication device and the identification information of the terminal device locally.

[0217] In some other possible implementations, the fourth request message may also include the identification information of the terminal device. The third network element may obtain the second PLMN list from the second network element based on the identification information of the terminal device. The second PLMN list includes the identification information of at least one PLMN. The third network element may determine roaming information based on the second PLMN list, which includes the second PLMN list.

[0218] In this implementation, the third network element can obtain the list of PLMNs that the terminal device is allowed to roam from the second network element based on the terminal device's identification information, and use the list of PLMNs that the terminal device is allowed to roam as the list of PLMNs that the communication device is allowed to roam.

[0219] In some other possible implementations, the fourth request message may also include a first PLMN list, which includes identification information of at least one PLMN that allows the communication device to roam. The third network element may determine roaming information based on the first PLMN list, which includes the first PLMN list.

[0220] It should be understood that the first PLMN list represents a list of PLMNs that the user has specified and that allow communication devices to roam.

[0221] In this embodiment of the application, the roaming information may include the identification information of the communication device, the identification information of at least one PLMN that is allowed to roam, and the signature of the HPLMN's private key to the identification information of the communication device and the identification information of at least one PLMN that is allowed to roam.

[0222] In this embodiment of the application, the second network element is a network element in the HPLMN that manages user data. For example, the network element may be a UDM network element, or it may be a network element that performs the same function. This embodiment of the application does not specifically limit the name of the second network element.

[0223] Optionally, the identification information of the terminal device can be the terminal device number or the terminal device SUPI. Of course, it can also be other identification information of the terminal device. This application embodiment does not specifically limit this.

[0224] In some embodiments, the roaming information may also include HPLMN identification information.

[0225] S3430 and the third network element send roaming information to the terminal device, and the terminal device receives the roaming information accordingly.

[0226] Roaming information is used to indicate at least one PLMN that the communication device allows to roam.

[0227] After determining the roaming information for the communication device, the third network element sends the roaming information to the terminal device that requested the roaming information for the communication device.

[0228] Accordingly, the terminal device receives roaming information.

[0229] In some embodiments, the third network element may also store the roaming information in the second network element.

[0230] S3440: The terminal device sends roaming information to the communication device, and the communication device receives the roaming information accordingly.

[0231] Finally, the terminal device can send roaming information to the communication device so that the communication device can obtain a list of PLMNs that are allowed to roam.

[0232] Alternatively, the communication device can also obtain the roaming information from the second network element through the terminal device.

[0233] For example, if the third network element stores the roaming information in the second network element in step S3430, the communication device can download the roaming information from the second network element through the terminal device. Figure 4 (Not shown in the image).

[0234] S350, The communication device verifies the first digital identity based on the public key of the HPLMN.

[0235] For example, the communication device verifies the first digital identity based on the public key of the HPLMN in the second digital identity.

[0236] For example, the communication device calculates the hash value of the parts of the first digital identity other than the signature. If the hash value is consistent with the calculation result obtained by the first network element using the public key of the HPLMN to decrypt the signature in the first digital identity, then the first digital identity verification is successful.

[0237] The above process can be described as follows: The first network element calculates the hash value of the content part of the first digital identity (such as the identification information of the first network element and the public key of the first network element) to obtain result #3, and uses the public key of the HPLMN to decrypt the signature in the first digital identity to obtain result #4. If result #3 and result #4 are the same, the first digital identity authentication is successful.

[0238] S360. If the verification of the first digital identity is successful, the communication device obtains the public key corresponding to the private key of the first network element from the first digital identity.

[0239] S370. Verify the challenge response based on the public key of the first network element.

[0240] For example, if the communication device successfully authenticates the first digital identity, it obtains the public key of the first network element from the first digital identity. Further, the communication device uses the public key of the first network element to verify the challenge response.

[0241] For example, the communication device uses the public key of the first network element to decrypt the challenge response. If the decryption result is consistent with the challenge information carried in the first request message, the verification of the challenge response is confirmed to be successful, and the verification of the VPLMN is completed.

[0242] The method provided in this application involves a first network element receiving a challenge message and a second digital identity from a communication device. The second digital identity (the communication device's digital identity) is issued by the HPLMN (Virtual Platform Name System) for the communication device. The first network element obtains the HPLMN's public key using a first request message and verifies the second digital identity using the HPLMN's public key. If the second digital identity verification is successful, the first network element successfully verifies the communication device, meaning the first network element allows the communication device to access the VPLMN. Next, the first network element signs the challenge message using its private key to obtain a challenge response. This signature indicates that the first network element is indeed the sender of the challenge response. Finally, the first network element sends the challenge response and a first digital identity (the first network element's digital identity), which is issued by the HPLMN for the first network element. This challenge response and first digital identity can be used by the communication device to verify the VPLMN. This method enables bidirectional verification between the communication device and the VPLMN, thereby allowing the communication device to access the VPLMN.

[0243] This application also provides another communication method in which the first network element registers the roaming service opened by the VPLMN for the user with the HPLMN, so that the first network element can confirm with the HPLMN whether the communication device is allowed to use the specific roaming service in the VPLMN.

[0244] The following is combined with Figure 5 This application provides a detailed description of an example communication method. Figure 5 A schematic interaction diagram of an example communication method provided in an embodiment of this application is shown, such as... Figure 5 As shown, method 500 may include S410 to S421.

[0245] S410, the communication device sends a first request message to the first network element, and the first network element receives the first request message accordingly.

[0246] The first request message is used to request access to the VPLMN. The first request message includes challenge information and the communication device's HPLMN as a second digital identity issued by the communication device.

[0247] In this embodiment of the application, the first request message in step S410 differs from that in step S310 in that the first request message is also used to request the use of the first service in the VPLMN.

[0248] In some possible implementations, the first request message includes information about the first service. This information may be the identifier of the first service or the name of the first service. Of course, the information about the first service may also be other information about the first service such as URI, URL, URN, FQDN, etc. This application embodiment does not specifically limit the type of information about the first service.

[0249] For example, the first service may be an ACN service, and the information of the first service may be the name of the ACN service.

[0250] S411. The first network element obtains the public key of the HPLMN based on the first request message.

[0251] S412. The first network element verifies the second digital identity based on the public key of the HPLMN.

[0252] The specific descriptions of steps S411-S412 can be found in steps S320-S330, and will not be repeated here.

[0253] S413. The first network element sends a second request message to the second network element, and the second network element receives the second request message accordingly.

[0254] The second request message may include: the VPLMN's identification information and the information of the first service.

[0255] In some embodiments, after the first network element successfully authenticates the second digital identity, it can also confirm whether the device in the HPLMN is allowed to access the first service of the VPLMN.

[0256] For example, the first network element sends a second request message to the second network element of the HPLMN via vSEEP and hSEEP. This second request message is used to determine whether the first service is allowed to be used in the VPLMN. S414, the second network element determines whether the first service is allowed to be used in the VPLMN based on the identification information of the VPLMN and the information of the first service.

[0257] In some possible implementations, the second network element searches locally whether a correspondence between the VPLMN identification information and the first service information is stored, based on the VPLMN identification information and the first service information in the second request message. If a correspondence between the VPLMN identification information and the first service information is stored locally, then it is determined that the first service can be used in the VPLMN.

[0258] Prior to S414, method 500 may also include the following step S414a:

[0259] S414a, the first network element sends a registration message to the second network element, and the second network element receives the registration message accordingly.

[0260] The registration message is used to register for roaming services available on the VPLMN. The registration message includes the VPLMN's identification information and the information of the first service.

[0261] Furthermore, the second network element can store the correspondence between the VPLMN's identification information and the information of the first service.

[0262] In some embodiments, the first network element can send a registration message to the second network element of the HPLMN via vSEEP and hSEEP. The registration message includes the identification information of the VPLMN and the information of the first service.

[0263] Optionally, before sending the second registration message, the first network element may also receive a third request message sent by the service gateway corresponding to the roaming service. The third request message is used to request the HPLMN to activate the roaming service available in the VPLMN, and the roaming service includes information about the first service.

[0264] In this implementation, the first network element sending a registration message to the second network element includes: the first network element responding to the third request message and sending a registration message to the second network element.

[0265] S415. The second network element sends a second response message to the first network element, and the first network element receives the second response message accordingly.

[0266] The second response message is used to indicate that the first service is permitted to be used in the VPLMN.

[0267] S416. If the verification of the second digital identity is successful and it is determined that the first service can be used in the VPLMN, the first network element uses its private key to sign the challenge information and obtain a challenge response.

[0268] If the first network element verifies the second digital identity, it indicates that the communication device is a trustworthy device, and determines that the first service can be used in the VPLMN, meaning that the communication device can use the first service in the VPLMN, then the first network element can allow the communication device to access the VPLMN.

[0269] S417. The first network element sends a challenge response and a first digital identity to the communication device, and the communication device receives the challenge response and the first digital identity accordingly.

[0270] The first digital identity is issued by the HPLMN for the first network element. The challenge response and the first digital identity are used by the communication device to verify the VPLMN.

[0271] S418. The communication device verifies the first digital identity based on the public key of the HPLMN.

[0272] S419. If the verification of the first digital identity is successful, the communication device obtains the public key corresponding to the private key of the first network element from the first digital identity.

[0273] S420: The communication device verifies the challenge response based on the public key of the first network element.

[0274] The specific descriptions of steps S417-S420 can be found in steps S340-S370, and will not be repeated here.

[0275] In methods 300 and 500 above, the verification of the second digital identity is performed by the first network element. However, the verification of the second digital identity can also be performed by the fourth network element. The following section will discuss this further. Figure 6 This application provides another example of a communication method 600, such as... Figure 6 As shown, method 600 may include S610 to S618.

[0276] S610, the communication device sends a first request message to the fourth network element, and correspondingly, the fourth network element receives the first request message from the communication device.

[0277] The first request message is used to request access to the VPLMN. The first request message includes challenge information and a second digital identity issued by the HPLMN for the communication device.

[0278] For example, in the embodiments of this application, the fourth network element can be an AGW, or it can be other network elements that can achieve the same function. The embodiments of this application do not specifically limit the name of the fourth network element.

[0279] The specific description of the first request message in step S610 can be found in the description of step S310, and will not be repeated here.

[0280] S611, the fourth network element obtains the public key of HPLMN based on the first request message.

[0281] The fourth network element can obtain the HPLMN's identification information based on the first request message, and then obtain the HPLMN's public key based on the HPLMN's identification information.

[0282] For example, the second digital identity in the first request message includes the identification information of the HPLMN, and the fourth network element can obtain the identification information of the HPLMN from the second digital identity; or, the second digital identity in the first request message includes the identification information of the communication device, and the identification information of the communication device includes the identification information of the HPLMN, and the fourth network element can obtain the identification information of the HPLMN from the identification information of the communication device.

[0283] In some possible implementations, the fourth network element obtains the public key of the HPLMMN based on the HPLMMN's identification information by requesting the public key of the HPLMMN from vSEPP using the HPLMMN's identification information as a parameter.

[0284] For example, the fourth network element sends a request message to vSEPP, which includes the identification information of the HPLMN and is used to request the public key of the HPLMN. Correspondingly, vSEPP receives the request message from the fourth network element, determines the public key of the HPLMN based on the identification information, and then sends the public key of the HPLMN to the fourth network element.

[0285] S612, the fourth network element verifies the second digital identity based on the public key of the HPLMN.

[0286] The specific process of the fourth network element verifying the second digital identity based on the public key of the HPLMN in step S612 can be referred to the process of the first network element verifying the second digital identity based on the public key of the HPLMN in step S330, and will not be repeated here.

[0287] S613. If the verification of the second digital identity is successful, the fourth network element sends a challenge message to the first network element, and the first network element receives the challenge message accordingly. For example, if the fourth network element successfully verifies the second digital identity, it means that the fourth network element allows the communication device to access the VPLMN, or it can mean that the VPLMN has successfully verified the communication device.

[0288] Furthermore, the fourth network element sends the challenge information from the first request message to the first network element. This challenge information is used by the communication device to verify the VPLMN.

[0289] Optionally, the fourth network element may also send the identification information of the communication device and / or the identification information of the HPLMN to the first network element. The identification information of the communication device and / or the identification information of the HPLMN is used by the first network element to obtain the first digital identity issued by the HPLMN of the communication device for the first network element.

[0290] Optionally, the fourth network element may also send a second indication message to the first network element, which is used to indicate that the second digital authentication has been passed.

[0291] S614. The first network element uses its private key to sign the challenge information and obtain a challenge response.

[0292] When the first network element receives the challenge information from the fourth network element regarding the communication device's challenge to the VPLMN, it indicates that the fourth network element's first digital authentication of the communication device has passed. The first network element can then use its private key to sign the challenge information and obtain a challenge response.

[0293] Optionally, when the fourth network element sends the HPLMN's identification information to the first network element, the first network element can obtain the first digital identity issued by the HPLMN for the first network element based on the HPLMN's identification information, and use the private key corresponding to the first network element's public key in the first digital identity to sign the challenge information.

[0294] Optionally, when the fourth network element sends the identification information of the communication device to the first network element, the first network element can determine the HPLMN of the communication device based on the identification information of the communication device, and further determine that the HPLMN is the first digital identity issued by the first network element, and use the private key corresponding to the public key of the first network element in the first digital identity to sign the challenge information.

[0295] Optionally, the first network element signs the challenge information using its private key based on the second instruction information to obtain a challenge response. Alternatively, triggered by the second instruction information, the first network element signs the challenge information using its private key to obtain a challenge response. For example, if the first network element determines that the verification of the communication device is successful based on the second instruction information, it then signs the challenge information using its private key.

[0296] S615, the first network element sends a challenge response and a first digital identity to the communication device, and the communication device receives the challenge response and the first digital identity accordingly.

[0297] The first digital identity is issued by the HPLMN for the first network element. The challenge response and the first digital identity are used by the communication device to verify the VPLMN.

[0298] For example, the first network element can directly send a challenge response and a first digital identity to the communication device. The first network element can also send a challenge response and a first digital identity to the fourth network element. After receiving the challenge response and the first digital identity, the fourth network element sends the challenge response and the first digital identity to the communication device. This application embodiment does not specifically limit this.

[0299] S616. The communication device verifies the first digital identity based on the public key of the HPLMN.

[0300] S617. If the verification of the first digital identity is successful, the communication device obtains the public key corresponding to the private key of the first network element from the first digital identity.

[0301] S618. Verify the challenge response based on the public key of the first network element.

[0302] Steps S616-S618 can be referred to the specific descriptions of steps S350-S370, and will not be repeated here.

[0303] The following describes the embodiments of this application in detail, taking the first network element as vIDM, the second network element as UDM, the third network element as hIDM, the communication device as a robot, and the terminal device as a mobile phone as an example. In this embodiment, the first request message carries roaming information. The following will be combined with... Figure 7 This application provides another example of a communication method. Figure 7 A schematic interaction diagram of an example communication method provided in an embodiment of this application is shown, such as... Figure 7 As shown, method 700 may include S710 to S722.

[0304] S710: The terminal device sends a digital identity request message to the hIDM network element, and the hIDM network element receives the digital identity request message accordingly.

[0305] The digital identity request message carries the robot's public key and the terminal device's identification information.

[0306] It should be understood that the digital identity request message in step S710 corresponds to the fourth request message in the above embodiments, that is, the fourth request message can also be used by the terminal device to request a digital identity for the communication device.

[0307] In this embodiment of the application, the digital identity request message may also include the robot's public key. The terminal device requests the hIDM network element to issue the robot's digital identity on behalf of the robot, and the robot's digital identity includes the robot's public key.

[0308] Optionally, the digital identity request message may also include a first PLMN list, which represents a list of PLMNs specified by the terminal device that allow the robot to roam.

[0309] For example, the first PLMN list includes identification information for at least one PLMN that allows communication devices to roam.

[0310] S711 and hIDM are used to issue digital identities and roaming control attributes for robots.

[0311] In some embodiments, after receiving a digital identity request message, hIDM queries the contract database UDM to see if a digital identity has been issued for the robot. If not, it issues a digital identity for the robot.

[0312] It should be noted that hIDM is the digital identity issued by the robot, corresponding to the second digital identity in the above embodiment.

[0313] It should be understood that the UDM stores the correspondence between the robot's public key and the robot's digital identity, and can be used to search for a digital identity that corresponds to the robot's public key.

[0314] In this embodiment of the application, the robot's digital identity includes: a byte string (i.e., the robot's identification information) assigned by the IDM that can uniquely identify the robot, the robot's public key, and a signature, which is obtained by signing the robot's identification information and the robot's public key using the HPLMN's private key.

[0315] Optionally, the robot's digital identity may also include HPLMN's identification information and HPLMN's public key.

[0316] Alternatively, the digital identity request message may contain the HPLMN's identification information and the HPLMN's public key.

[0317] In one possible implementation, the digital identity request message carries a first PLMN list, and hIDM determines roaming control attributes based on the first PLMN list.

[0318] The roaming control attributes include: robot identification information, a first PLMN list, and a signature, which is obtained by signing the robot identification information and the first PLMN list using the private key of the HPLMN.

[0319] It should be understood that this roaming control attribute corresponds to the roaming information in the above embodiments.

[0320] In another possible implementation, when the digital identity request message does not carry the first PLMN list mentioned above, the hIDM can also use the terminal device's identification information (e.g., mobile phone number or SUPI) to query the UDM for the second PLMN list that the terminal device is allowed to roam, and use it as the VPLMN list that the robot is allowed to roam.

[0321] The roaming control attributes include: robot identification information, a second PLMN list, and a signature, which is obtained by signing the robot identification information and the second PLMN list using the private key of the HPLMN.

[0322] It should be noted that if the robot's identification information does not include HPLMN identification information, the roaming control attributes may still include HPLMN identification information.

[0323] In some possible implementations, hIDM can also store the robot’s digital identity and roaming control attributes in UDM.

[0324] S712 and hIDM send a response to the terminal device confirming the successful application for digital identity and roaming control attributes.

[0325] Furthermore, the terminal device can provide further instructions to the robot.

[0326] S713. The robot downloads its digital identity and roaming control attributes from the UDM via a terminal device.

[0327] S714, vIDM obtains a digital identity issued by hIDM.

[0328] For example, vIDM sends a digital identity request message to hIDM, which carries vIDM's public key and vIDM's identification information.

[0329] In some embodiments, the vIDM of a vPLMN can send a digital identity request message to the hIDM of an HPLMMN via vSEPP and hSEPP. This digital identity request message can also be referred to as a fifth request message.

[0330] Optionally, the identification information of vIDM may also include the identification information of VPLMN.

[0331] Based on vIDM's request, hIDM issues a digital identity for vIDM, which includes vIDM's identification information, vIDM's public key, and a signature obtained by signing vIDM's identification information and vIDM's public key using HPLMN's private key.

[0332] It should be noted that the digital identity issued by hIDM corresponds to the first digital identity in the above embodiment.

[0333] Furthermore, hIDM can send response messages of digital identity to vPLMN's vIDM via vSEPP and hSEPP.

[0334] It should be understood that a vIDM can apply for a digital identity from multiple roaming protocols' HPLMNs, and hIDMs from different HPLMNs can issue digital certificates to a vIDM.

[0335] Therefore, in one possible implementation, vIDM can associate the HPLMN ID with the digital identity issued by hIDM and store it locally or in a database network element. This method makes it easy for vIDM to look up its corresponding digital identity issued by hIDM based on the HPLMN ID.

[0336] S715. The robot sends a network access request message to the access gateway, and the access gateway receives the network access request message accordingly.

[0337] The network access request message includes one or more of the following: the robot's digital identity, roaming control attributes, challenge information, and the robot's private key signing the above information.

[0338] It should be understood that this network access request message corresponds to the first request message in the above embodiments.

[0339] For example, when a robot roams overseas, it can connect to the VPLMN's access gateway via the hotspot of its terminal device or via the Internet.

[0340] It should be understood that this challenge information can be interpreted as the robot's challenge to the VPLMN. This challenge information can be a randomly generated byte string by the robot, or it can be a timestamp when the network access request is sent.

[0341] It should be noted that when the challenge information is the timestamp when the network access request is sent, the network access request may not include the timestamp of the current moment (when the network access request is sent). When the challenge information is not the timestamp when the network access request is sent, the network access request may include the timestamp of the current moment.

[0342] After receiving a network access request, the access gateway checks whether the current timestamp is within a valid time range and / or whether the VPLMN to which the access gateway belongs is in the VPLMN list of the roaming control attributes.

[0343] Optionally, if the deviation between the current timestamp and the time when the network access request message is received does not exceed a preset time, it is considered to be within the valid time range.

[0344] For example, the preset time can be 1 second, or the preset time can be other values. This application embodiment does not specifically limit the preset time.

[0345] Furthermore, if the current timestamp is within a valid time range and / or the VPLMN to which the access gateway belongs is in the VPLMN list of the roaming control attributes, then the check has passed.

[0346] S716. The access gateway sends an access authentication request message to the vIDM, and the vIDM receives the access authentication request message accordingly.

[0347] The access verification request message includes one or more of the following: the robot's digital identity, roaming control attributes, challenge information, and the robot's private key signing the above information.

[0348] In some embodiments, when the access gateway determines that the timestamp of the current moment is within a valid time range and / or the VPLMN to which the access gateway belongs is in the VPLMN list of the roaming control attributes, the content of the network access request message is sent to the vIDM as an access authentication request message. In other words, the content of the access authentication request message sent by the access gateway to the vIDM can be the same as the content of the first request message.

[0349] S717, vIDM verifies second digital identity and roaming control attributes.

[0350] For example, vIDM obtains the HPLMN's self-signed digital certificate from the HPLMN's identification information.

[0351] It should be understood that the vIDM can obtain the HPLMN's identification information from the digital identity request message mentioned in step S711 above, the robot's identification information, or the roaming control attributes.

[0352] In one possible implementation, vIDM can obtain the public key of HPLMN from the digital certificate issued by hIDM for itself, or vIDM can request the public key of HPLMN from vSEPP with the HPLMN's identification information as a parameter.

[0353] Furthermore, vIDM uses the public key of HPLMN to verify roaming control attributes.

[0354] For example, vIDM calculates the hash value of the parts of the roaming control attribute other than the signature. If the hash value is consistent with the calculation result obtained by vIDM using HPLMN's public key to decrypt the signature in the roaming control attribute, the roaming control attribute is verified and it can be guaranteed that the roaming control attribute was indeed issued by HPLMN for the robot.

[0355] Furthermore, vIDM uses HPLMN's public key to verify the robot's digital identity.

[0356] For example, first, vIDM uses the HPLMN's public key to verify the signature of the robot's digital identity's HPLMN private key. vIDM calculates the hash value of the remaining parts of the robot's digital identity besides the signature. If this hash value matches the result obtained by vIDM using the HPLMN's public key to decrypt the signature in the robot's digital identity, the robot's digital identity verification is successful, and vIDM obtains the robot's trustworthy public key from the robot's digital identity. Then, it uses the robot's public key to verify whether the robot's private key signature in the access verification request is correct. If correct, it indicates that the current network access request was initiated by a legitimate network terminal holding the digital identity, completing vPLMN's verification of the robot.

[0357] In some possible implementations, vIDM can also check whether the robot's identification information in the roaming control attributes is consistent with the identification information in the digital identity of the previously verified robot, and can also check whether the identification information of the VPLMN to which vIDM belongs is in the VPLMN ID list contained in the roaming control attributes.

[0358] After completing the above verification, vIDM uses its private key to perform a signature calculation on the challenge information in the access request message, thus obtaining the challenge response.

[0359] S718 and vIDM send access authentication response messages to the access gateway, and the access gateway receives the authentication response messages accordingly.

[0360] The access verification response message includes one or more of the following: the vIDM's digital identity, the challenge response, and a successful verification result. Based on the successful verification result in the access verification response message, the access gateway determines whether the VPLMN allows robot access.

[0361] S719. The access gateway sends a network access response message to the robot, and the robot receives the network access response accordingly.

[0362] Network access response messages include one or more of the following: vIDM digital identity, challenge response, and access permission indication.

[0363] S720, robot verification of vIDM's digital identity and challenge response.

[0364] First, the robot uses the public key of the VPLMN in the robot's digital identity to verify the digital identity of the vIDM. After successful verification, it obtains the public key of the trusted vIDM.

[0365] For example, the robot calculates the hash value of the parts of the vIDM digital identity other than the signature. If this hash value matches the hash value obtained by the robot using the HPLMN's public key to decrypt the signature in the vIDM digital identity, the robot determines that the vIDM digital identity verification is successful. The robot then obtains the vIDM's public key from the verified vIDM digital identity.

[0366] Furthermore, the bot uses vIDM's public key to verify the challenge response.

[0367] For example, the robot uses the vIDM's public key to decrypt the challenge response. If the decryption result matches the challenge information sent in step S615, the robot completes the verification of the VPLMN.

[0368] S721. The robot sends a service request message to the access gateway, and the access network element receives the service request message accordingly.

[0369] Once the robot and VPLMN have successfully authenticated each other, the robot can send a service request message to the access gateway. This service request message can carry the name of the service that the robot wants to access, such as the ACN service.

[0370] S722, The access gateway performs service routing based on the address resolved by the service request.

[0371] The access gateway resolves the address of the service control network element based on the service name in the service request message, and then routes the service message. By sending the service request message to the appropriate service network element, the robot can then use the service in the VPLMN.

[0372] For example, the access gateway can resolve the address of the ACN control network element based on the name of the ACN service in the service request message, and then perform service message routing to send the service request message to the appropriate ACN network element, so that the robot can use the ACN service in the VPLMN.

[0373] The following describes the embodiments of this application in detail, taking the first network element as vIDM, the second network element as UDM, the third network element as hIDM, the communication device as a personal intelligent assistant, the terminal device as a mobile phone, and the first service as ACN service. In this embodiment, the roaming information of the communication device is allowed to be stored in UDM. The following is combined with Figure 8 This application provides another example of a communication method. Figure 8 A schematic interaction diagram of an example communication method provided in an embodiment of this application is shown, such as... Figure 8 As shown, method 800 may include S810 to S822.

[0374] S810: Apply for a digital identity for the personal intelligent assistant and load the digital identity into the personal intelligent assistant.

[0375] It should be understood that applying for a digital identity for a personal intelligent assistant and loading the digital identity into the personal intelligent assistant is the same process as applying for a digital identity for a robot and loading the digital identity into the robot by the terminal device. Therefore, step S710 can refer to the description of applying for the robot's digital identity in steps S610-S613, and will not be repeated here.

[0376] It should be noted that the digital identity of the personal intelligent assistant corresponds to the second digital identity in the above embodiments.

[0377] S811 and vIDM obtain digital identities issued by hIDM.

[0378] The description of step S711 can refer to the description in step S614, and will not be repeated here.

[0379] S812, ACN requests vIDM to enable roaming service to HPLMN.

[0380] In this embodiment of the application, the ACN in the VPLMN requests the HPLMN to enable roaming services, so all devices connected to the HPLMN can use the ACN services in the VPLMN.

[0381] S813 and vIDM send a registration message to UDM, and UDM receives the registration message in response.

[0382] In this embodiment, the vIDM registers the available VPLMN services with the HPLMN's UDM through vSEPP and hSEPP, which carries the VPLMN's identification information and the name of the ACN service.

[0383] S814, The personal intelligent assistant sends a network access request message to the access gateway, and the access gateway receives the network access request message accordingly.

[0384] It should be noted that this network access request message corresponds to the first request message in the above embodiment.

[0385] The network access request message includes one or more of the following: the digital identity of the personal intelligent assistant, the name of the ACN service, challenge information, the timestamp of the current time, and the signature of the above information by the personal intelligent assistant's private key.

[0386] It should be understood that the current timestamp is the same as the timestamp when the network access request message was sent.

[0387] S815. The access gateway sends an access authentication request message to the vIDM, and the vIDM receives the access authentication request message accordingly.

[0388] Steps S714-S715 can be referred to the specific descriptions in steps S615-S616 above, and will not be repeated here.

[0389] S816, vIDM sends a roaming service control request message to UDM, and UDM receives the roaming service control request message accordingly.

[0390] It should be understood that the roaming service control request message corresponds to the second request message in the above embodiments.

[0391] The roaming service control request message may include the VPLMN's identification information and the name of the ACN service. This roaming service control request message is used to determine whether the use of the ACN service in the VPLMN is permitted.

[0392] S817, UDM sends a roaming service control response message to vIDM, and vIDM receives the roaming service control response accordingly.

[0393] It should be understood that the roaming service control response corresponds to the second response message in the above embodiments.

[0394] In this embodiment of the application, after receiving the roaming service control request message, the UDM searches locally whether the correspondence between the VPLMN identification information and the ACN service name is stored, based on the VPLMN identification information and the ACN service name in the roaming service control request message. If the correspondence between the VPLMN identification information and the ACN service name is stored locally, it is determined that the ACN service is allowed to be used in the VPLMN.

[0395] S818, vIDM verifies the digital identity of a personal intelligent assistant.

[0396] In this embodiment of the application, the vIDM obtains the hIDM that owns the HPLMN and issues its own digital identity based on the HPLMN's identification information in the personal intelligent assistant's identification information.

[0397] In one possible implementation, vIDM can obtain the HPLMN's public key from the vIDM's digital identity.

[0398] In another possible implementation, vIDM requests the public key of HPLMN from vSEPP with HPLMNID as the parameter.

[0399] Furthermore, vIDM uses HPLMN's public key to verify the digital identity of the personal intelligent assistant.

[0400] For example, vIDM uses the public key of the HPLMN to verify the signature of the HPLMN private key of the personal intelligent assistant's digital identity. vIDM calculates the hash value of the other parts of the personal intelligent assistant's digital identity excluding the signature. If the hash value matches the calculation result obtained by vIDM using the public key of the HPLMN to decrypt the signature in the personal intelligent assistant's digital identity, then the personal intelligent assistant's digital identity verification is successful.

[0401] Furthermore, the vIDM obtains the trusted public key of the personal intelligent assistant from the digital identity of the personal intelligent assistant. It uses the personal intelligent assistant's public key to verify the correctness of the personal intelligent assistant's private key signature in the access verification request. If correct, it indicates that the current network access request was initiated by a legitimate network terminal (personal intelligent assistant) holding a digital identity, and the vPLMN completes the verification of the personal intelligent assistant.

[0402] In some embodiments, after vIDM completes the above verification, it uses vIDM's private key to perform a signature calculation on the challenge information to obtain the challenge response.

[0403] S819, vIDM sends an access authentication response message to the access gateway, and the access gateway receives the access authentication response message accordingly.

[0404] The access verification response message includes one or more of the following: verification success result information, the name of the ACN service, the vIDM digital identity, and the challenge response.

[0405] Based on the successful authentication result information in the access authentication response message, the access gateway determines whether the VPLMN allows the personal intelligent assistant to access. Furthermore, the access gateway can resolve the ACN service address based on the ACN service name.

[0406] S820: The access gateway sends a network access response message to the personal intelligent assistant, and the personal intelligent assistant receives the network access response message accordingly.

[0407] The network access response message includes one or more of the following: access permission indication, ACN service address, vIDM digital identity, and challenge response.

[0408] S821, Personal Intelligent Assistant verifies vIDM's digital identity and challenges.

[0409] The description of step S821 can be found in step S720, and will not be repeated here.

[0410] S822, The personal intelligent assistant sends a service request message to the ACN.

[0411] In this embodiment of the application, the personal intelligent assistant sends a service request message to the ACN based on the ACN's service address.

[0412] The method embodiments provided by this application have been described above. The apparatus embodiments provided by this application will be described below. It should be understood that the description of the apparatus embodiments corresponds to the description of the method embodiments. Therefore, any content not described in detail can be referred to the method embodiments above. For the sake of brevity, it will not be repeated here.

[0413] Figure 9 This is a schematic block diagram of a communication device provided in an embodiment of this application. Figure 9 As shown, the communication device 900 may include a transceiver unit 910 and / or a processing unit 920. The transceiver unit 910 can implement corresponding communication functions, and the processing unit 920 is used for data processing. The transceiver unit 910 may also be referred to as a communication interface or communication unit. Optionally, the device 900 may further include a storage unit, which can be used to store instructions and / or data, and the processing unit 920 can read the instructions and / or data in the storage unit to enable the device to implement the aforementioned method embodiments.

[0414] In one possible design, the device 900 can be any network element in the above method embodiments. For example, the device can be a first network element, a second network element, a third network element, or a fourth network element; it can also be a chip, processor, or chip system that implements the functions of the first network element, the second network element, the third network element, or the fourth network element; or it can be a logical node, logical module, or software that can implement all or part of the functions of the first network element, the second network element, the third network element, or the fourth network element. The device 900 can be used to execute the steps or processes performed by the first network element, the second network element, the third network element, or the fourth network element in any of the above method embodiments.

[0415] For example, the transceiver unit 910 is configured to receive a first request message, the first request message including challenge information from the communication device and a second digital identity, the second digital identity being issued by the Home Public Land Mobile Network (HPLMN) of the communication device for the communication device; the processing unit 920 is configured to obtain the public key of the HPLMN according to the first request message; the processing unit 920 is further configured to verify the second digital identity according to the public key of the HPLMN.

[0416] The processing unit 920 is further configured to send the challenge response and the first digital identity through the transceiver unit 910 when the verification of the second digital identity is successful. The first digital identity is issued by the HPLMN for the first network element. The challenge response and the first digital identity are used by the communication device to verify the VPLMN.

[0417] Optionally, the first digital identity includes the public key corresponding to the private key of the first network element.

[0418] Optionally, the processing unit 920 is further configured to obtain the identification information of the HPLMN according to the first request message;

[0419] Optionally, the processing unit 920 is further configured to obtain the first digital identity based on the identification information of the HPLMN.

[0420] Optionally, the processing unit 920 is further configured to obtain the identification information of the HPLMN according to the first request message;

[0421] Optionally, the processing unit 920 is further configured to obtain the public key of the HPLMN based on the identification information of the HPLMN.

[0422] Optionally, the processing unit 920 is further configured to obtain the first digital identity based on the identification information of the HPLMN, wherein the first digital identity includes the public key of the HPLMN.

[0423] Optionally, the transceiver unit 910 is also configured to receive the first digital identity from the HPLMN;

[0424] Optionally, the processing unit 920 is also used to store the correspondence between the first digital identity and the identification information of the HPLMN;

[0425] Optionally, the processing unit 920 is further configured to obtain the first digital identity based on the identification information of the HPLMN and the correspondence.

[0426] Optionally, the processing unit 920 is further configured to verify the roaming information based on the public key of the HPLMN;

[0427] Optionally, the processing unit 920 is further configured to sign the challenge information using the private key of the first network element if the verification of the second digital identity and the verification of the roaming information are both successful.

[0428] Optionally, the processing unit 920 is further configured to verify the signature obtained by the private key corresponding to the public key of the HPLMMN based on the public key of the HPLMMN.

[0429] Optionally, the verification of the roaming information includes: the at least one PLMN includes the VPLMN.

[0430] Optionally, the second digital identity includes the first identification information of the communication device, the roaming information includes the second identification information of the communication device, and the processing unit 920 is further configured to determine whether the first identification information and the second identification information match.

[0431] Optionally, the first request message may also include information for indicating the first service, and the processing unit 920 may further be configured to sign the challenge information using the private key of the first network element if the verification of the second digital identity is successful and it is determined that the VPLMN is allowed to use the first service.

[0432] Optionally, the transceiver unit 910 is further configured to send a second request message, the second request message including: the identification information of the VPLMN and information for indicating the first service;

[0433] Optionally, the transceiver unit 910 is also configured to receive a second response message, the second response message being used to indicate permission to use the first service in the VPLMN.

[0434] Optionally, the transceiver unit 910 is further configured to receive a third request message, the third request message being used to request the HPLMN to activate roaming services available in the VPLMN, the roaming services including the first service;

[0435] Optionally, the processing unit 920 is further configured to send a registration message to the second network element based on the third request message. The registration message is used to register for roaming services available on the VPLMN, and the registration message includes the identification information of the VPLMN and the information of the first service.

[0436] Alternatively, the transceiver unit 910 in the device is used to receive challenge information from the fourth network element; the processing unit 920 is used to sign the challenge information using the private key of the first network element to obtain a challenge response; the transceiver unit 910 is also used to send the challenge response and a first digital identity, the first digital identity being issued by the HPLMN to the first network element, and the challenge response and the first digital identity being used by the communication device to verify the VPLMN.

[0437] In some other implementations, the transceiver unit 910 in the device is configured to receive a second request message from a first network element in the VPLMN, the second request message including identification information of the VPLMN and information of a first service; the transceiver unit 910 is also configured to send a second response message, the second response message indicating permission to use the first service in the VPLMN.

[0438] Optionally, the processing unit 920 is configured to determine whether to allow the use of the first service in the VPLMN based on the identification information of the VPLMN and the information indicating the first service.

[0439] Optionally, the processing unit 920 is configured to determine, if the correspondence between the identification information of the VPLMN and the information indicating the first service is stored locally, that the first service can be used in the VPLMN.

[0440] Optionally, the transceiver unit 910 is further configured to receive a registration message from the first network element, the registration message being used to register for roaming services available on the VPLMN, the registration message including the identification information of the VPLMN and information of the first service.

[0441] In some other implementations, the transceiver unit 910 in the device is configured to receive a fourth request message, the fourth request message including identification information of the communication device; the transceiver unit 910 is also configured to send roaming information in response to the fourth request message, the roaming information indicating at least one PLMN that the communication device is allowed to roam.

[0442] Optionally, the fourth request message includes a first PLMN list, which includes identification information of the at least one PLMN. The processing unit 920 is further configured to determine the roaming information based on the first PLMN list, wherein the roaming information includes the first PLMN list.

[0443] Optionally, the fourth request message includes identification information of the terminal device, which is used to request the roaming information for the communication device. The processing unit 920 is further used to obtain a second PLMN list from the second network element based on the identification information of the terminal device. The second PLMN list includes identification information of the at least one PLMN. The processing unit 920 is further used to determine the roaming information according to the second PLMN list. The roaming information includes the second PLMN list.

[0444] Optionally, the fourth request message may further include first indication information, and the processing unit 920 may further be configured to, in response to the first indication information, obtain a second PLMN list that allows the communication device to roam from the second network element based on the identification information of the terminal device.

[0445] In some other implementations, the transceiver unit 910 in the device is used to receive a first request message, which includes challenge information from the communication device and a second digital identity, the second digital identity being issued by the communication device's HPLMN to the communication device; the processing unit 920 is used to obtain the public key of the HPLMN according to the first request message, and the processing unit 920 is also used to verify the second digital identity according to the public key of the HPLMN; the processing unit 920 is also used to send challenge information through the transceiver unit 910 if the second digital identity is successfully verified.

[0446] In one possible design, the device 900 can be the communication device in the above method embodiments, or it can be a chip, processor, or chip system that implements the functions of the communication device, or it can be a logic node, logic module, or software that can implement all or part of the functions of the communication device. The device 900 can be used to execute the steps or processes performed by the communication device in any of the above method embodiments.

[0447] For example, the transceiver unit 910 is configured to send a first request message, which requests access to the VPLMN. The first request message includes challenge information and a second digital identity issued by the HPLMN for the communication device. The transceiver unit 910 is also configured to receive a first response message, which includes a challenge response and a first digital identity. The first digital identity is issued by the HPLMN for a first network element in the VPLMN, and the challenge response is obtained by signing the challenge information with the private key of the first network element. The processing unit 920 is configured to verify the first digital identity based on the public key of the HPLMN. The processing unit 920 is also configured to obtain the public key corresponding to the private key of the first network element from the first digital identity if the verification of the first digital identity is successful. The processing unit 920 is also configured to verify the challenge response based on the public key of the first network element.

[0448] Optionally, the first digital identity includes the public key corresponding to the private key of the first network element.

[0449] Optionally, the second digital identity includes the public key of the HPLMN.

[0450] Optionally, the first request message includes roaming information, which indicates at least one PLMN that the communication device allows to roam, and the at least one PLMN includes the VPLMN.

[0451] Optionally, the roaming information may further include: a signature obtained from the private key corresponding to the public key of the HPLMN.

[0452] Optionally, the second digital identity includes first identification information of the communication device, and the roaming information includes second identification information of the communication device.

[0453] Optionally, the first request message may also be used to request the use of the first service in the VPLMN.

[0454] Optionally, the first request message may also include information for instructing the first service.

[0455] In one possible design, the device 900 can be the terminal device in the above method embodiments, or it can be a chip, processor, or chip system that implements the functions of the terminal device, or it can be a logic node, logic module, or software that can implement all or part of the functions of the terminal device. The device 900 can be used to execute the steps or processes performed by the terminal device in any of the above method embodiments.

[0456] For example, the transceiver unit 910 is configured to send a fourth request message, the fourth request message including the identification information of the communication device; the transceiver unit 910 is also configured to receive roaming information, the roaming information indicating at least one PLMN that the communication device is allowed to roam; the transceiver unit 910 is also configured to send the roaming information to the communication device.

[0457] Optionally, the fourth request message includes a first PLMN list, which includes the identification information of the at least one PLMN, and the roaming information includes the first PLMN list.

[0458] Optionally, the fourth request message includes identification information of the terminal device, which is used to request the roaming information for the communication device. The identification information is used to obtain a second PLMN list, which includes identification information of the at least one PLMN. The roaming information includes the second PLMN list.

[0459] Optionally, the transceiver unit 910 is further configured to send first indication information, the first indication information being used to indicate a request for roaming service for the communication device.

[0460] It should be understood that the "unit" in device 900 can be implemented in hardware, software, or by hardware executing corresponding software. For example, the "unit" can refer to an application-specific integrated circuit (ASIC), electronic circuitry, a processor (e.g., a shared processor, a proprietary processor, or a group processor, etc.) and memory for executing one or more software or firmware programs, combined logic circuitry, and / or other suitable components supporting the described functions. As another example, transceiver unit 910 can be replaced by transceiver circuitry (e.g., may include receiving and transmitting circuitry), and processing unit 920 can be replaced by a processor or processing circuitry.

[0461] Figure 10 A schematic block diagram of another communication device provided in an embodiment of this application is shown. The communication device 1000 can be any of the above-mentioned network elements or devices. For example, the communication device can be a first network element, a second network element, a third network element, a communication device, or a terminal device. It can also be a chip, chip system, or processor, etc., in the first network element, second network element, third network element, communication device, or terminal device that implements the above-described method. This device can be used to implement the methods described in the above-described method embodiments; for details, please refer to the descriptions in the above-described method embodiments.

[0462] The communication device 1000 may include one or more processors 1010, which may also be referred to as processing units, and can implement certain control functions. The processor 1010 may be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit. The baseband processor can be used to process communication protocols and communication data, while the central processing unit can be used to control the communication device, execute software programs, and process data from the software programs.

[0463] In an alternative design, the processor 1010 may also store instructions and / or data that can be executed by the processor 1010 to cause the communication device 1000 to perform the methods described in the above method embodiments.

[0464] In another alternative design, the communication device 1000 may include a communication interface 1020 for implementing receiving and transmitting functions. For example, the communication interface 1020 may be a transceiver circuit, interface, interface circuit, or transceiver. The transceiver circuit, interface, interface circuit, or transceiver for implementing receiving and transmitting functions may be separate or integrated. The aforementioned transceiver circuit, interface, interface circuit, or transceiver may be used for reading and writing code / data, or it may be used for transmitting or relaying signals.

[0465] Optionally, the communication device 1000 may include one or more memories 1030, which may store instructions that can be executed on the processor 1010, causing the communication device 1000 to perform the methods described in the above method embodiments. Optionally, the memories 1030 may also store data. Optionally, the processor 1010 may also store instructions and / or data. The processor 1010 and the memories 1030 may be provided separately or integrated together.

[0466] It should be understood that, in one possible design, the steps in the method embodiments provided in this application can be implemented by integrated logic circuits in the processor's hardware or by instructions in software form. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are not provided here.

[0467] It should be noted that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiments can be completed by the integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0468] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0469] This application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute the various steps or processes performed by the network element / device / apparatus in any of the above method embodiments.

[0470] This application also provides a computer-readable storage medium storing program code that, when run on a computer, causes the computer to execute the various steps or processes performed by the network element / device / apparatus in any of the above method embodiments.

[0471] This application also provides a communication device, including a processor and an interface, the interface being used to send and / or receive signals, causing the processor to execute the various steps or processes performed by the network element / device / apparatus in any of the above method embodiments.

[0472] The above-described device and method embodiments are completely corresponding, with corresponding modules or units performing corresponding steps. For example, a communication unit or communication interface performs the receiving or sending steps in the method embodiment, while other steps besides sending and receiving can be performed by a processing unit or processor.

[0473] In the embodiments of this application, the terms and English abbreviations are exemplary examples given for ease of description and should not be construed as limiting the application in any way. The embodiments of this application do not preclude the possibility of defining other terms that can achieve the same or similar functions in existing or future agreements.

[0474] The terms “component,” “module,” “system,” etc., used in this specification are used to refer to computer-related network elements, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process and / or an execution thread, and components may be located on a single computer and / or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable storage media on which various data structures are stored. Components can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, such as the Internet interacting with other systems via signals).

[0475] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0476] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be based on the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0477] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0478] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0479] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0480] In the above embodiments, the functions of each functional unit can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs), etc.

[0481] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially or in other words, the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0482] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A communication method, characterized in that, The method is applied to a first network element in a visited public land mobile network (VPLMN) of a communication device, and the method includes: Receive a first request message, the first request message including challenge information from the communication device and a second digital identity, the second digital identity being issued by the communication device's Home Public Land Mobile Network (HPLMN); Obtain the public key of the HPLMN according to the first request message; The second digital identity is verified using the public key of the HPLMN; If the verification of the second digital identity is successful, a challenge response and a first digital identity are sent. The first digital identity is issued by the HPLMN to the first network element. The challenge response is obtained by signing the challenge information with the private key of the first network element. The challenge response and the first digital identity are used by the communication device to verify the VPLMN.

2. The method according to claim 1, characterized in that, The first digital identity includes the public key corresponding to the private key of the first network element.

3. The method according to claim 1 or 2, characterized in that, The method further includes: Obtain the identification information of the HPLMN according to the first request message; The first digital identity is obtained based on the identification information of the HPLMN.

4. The method according to claim 1 or 2, characterized in that, The step of obtaining the public key of the HPLMN according to the first request message includes: Obtain the identification information of the HPLMN according to the first request message; Obtain the public key of the HPLMN based on its identification information.

5. The method according to claim 4, characterized in that, The step of obtaining the public key of the HPLMN based on the HPLMN's identification information includes: The first digital identity is obtained based on the identification information of the HPLMN, and the first digital identity includes the public key of the HPLMN.

6. The method according to claim 3 or 5, characterized in that, Before receiving the first request message, the method further includes: Receive the first digital identity from the HPLMN; Save the correspondence between the first digital identity and the identification information of the HPLMN; The step of obtaining the first digital identity based on the identifier information of the HPLMN includes: The first digital identity is obtained based on the HPLMN's identification information and the corresponding relationship.

7. The method according to any one of claims 1-6, characterized in that, The first request message further includes roaming information, the roaming information being used to indicate at least one Public Land Mobile Network (PLMN) to which the communication device is permitted to roam, and the method further includes: The roaming information is verified using the public key of the HPLMN; Upon successful verification of the second digital identity, sending the challenge response and the first digital identity includes: If the verification of the second digital identity and the verification of the roaming information are both successful, the challenge response and the first digital identity are sent.

8. The method according to claim 7, characterized in that, The roaming information includes a signature obtained based on the private key corresponding to the public key of the HPLMN, and the verification of the roaming information based on the public key of the HPLMN includes: The signature is verified using the public key of the HPLMN.

9. The method according to claim 7 or 8, characterized in that, The verification of the roaming information includes: the at least one PLMN includes the VPLMN.

10. The method according to claim 8 or 9, characterized in that, The second digital identity includes the first identification information of the communication device, the roaming information includes the second identification information of the communication device, and the method further includes: Determine whether the first identification information and the second identification information match.

11. The method according to any one of claims 1-6, characterized in that, The first request message also includes information about the first service. The step of sending the challenge response and the first digital identity upon successful verification of the second digital identity includes: If the verification of the second digital identity is successful and it is determined that the VPLMN is permitted to use the first service, the challenge response and the first digital identity are sent.

12. The method according to claim 11, characterized in that, The method further includes: Send a second request message, the second request message including: the identification information of the VPLMN and information for indicating the first service; Receive a second response message, which indicates that the first service is permitted to be used in the VPLMN.

13. The method according to claim 12, characterized in that, Before sending the second request message, the method further includes: Receive a third request message, the third request message being used to request the HPLMN to activate roaming services available in the VPLMN, the roaming services including the first service; Based on the third request message, a registration message is sent to the second network element. The registration message is used to register for roaming services available on the VPLMN. The registration message includes the identification information of the VPLMN and the information of the first service.

14. A communication method, characterized in that, The method is applied to a communication device, and the method includes: Send a first request message, the first request message being used to request access to the VPLMN, the first request message including challenge information and the HPLMMN of the communication device being a second digital identity issued by the communication device; The system receives a challenge response and a first digital identity, wherein the first digital identity is issued by the HPLMN to the first network element in the VPLMN, and the challenge response is obtained by signing the challenge information with the private key of the first network element. The first digital identity is verified using the public key of the HPLMN; If the verification of the first digital identity is successful, the public key corresponding to the private key of the first network element is obtained from the first digital identity; The challenge response is verified using the public key of the first network element.

15. The method according to claim 14, characterized in that, The first digital identity includes the public key corresponding to the private key of the first network element.

16. The method according to claim 14 or 15, characterized in that, The second digital identity includes the public key of the HPLMN.

17. The method according to any one of claims 14-16, characterized in that, The first request message includes roaming information, which indicates at least one PLMN that the communication device allows to roam, and the at least one PLMN includes the VPLMN.

18. The method according to claim 17, characterized in that, The roaming information also includes a signature obtained from the private key corresponding to the public key of the HPLMN.

19. The method according to claim 17 or 18, characterized in that, The second digital identity includes the first identification information of the communication device, and the roaming information includes the second identification information of the communication device.

20. The method according to any one of claims 14-16, characterized in that, The first request message is also used to request the use of the first service in the VPLMN.

21. The method according to claim 20, characterized in that, The first request message also includes information about the first service.

22. A first network element, characterized in that, include: A module or unit for performing the method as described in any one of claims 1 to 13.

23. A communication device, characterized in that, include: A module or unit for performing the method as described in any one of claims 14 to 21.

24. A first network element, characterized in that, include: A processor coupled to a memory for storing a computer program, which, when executed by the processor, causes the first network element to perform the method as described in any one of claims 1 to 13.

25. A communication device, characterized in that, include: A processor coupled to a memory for storing a computer program, which, when executed by the processor, causes the apparatus to perform the method as described in any one of claims 14 to 21.

26. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed on a first network element, causes the first network element to perform the method as described in any one of claims 1 to 13; or, when executed on a communication device, causes the communication device to perform the method as described in any one of claims 14 to 21.

27. A computer program product, characterized in that, include: A computer program, when running on a first network element, causes the first network element to perform the method as described in any one of claims 1 to 13; or, when running on a communication device, causes the communication device to perform the method as described in any one of claims 14 to 21.

28. A communication system, characterized in that, include: A first network element is configured to perform the method as described in any one of claims 1 to 13.

Images