Communication method, apparatus, and readable storage medium

Abstract

The application relates to the technical field of communication, in particular to a communication method, device and readable storage medium, belonging to the technical field of communication. The method comprises the following steps: a first network element generates a first temporary identifier after encrypting a device identifier based on a first freshness parameter and a preconfigured key, and sends the first temporary identifier to a terminal-side device. Compared with the temporary identifier generated by the prior art and the air interface transmission method, the data amount in the air interface transmission can be reduced, the data writing power consumption overhead and storage cost of the terminal-side device can be reduced, and therefore the performance of the air interface transmission can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method, apparatus and readable storage medium. Background Technology

[0002] The 3rd generation partnership project (3GPP) defines an Ambient Internet of Things (AIoT) technology with extremely low power consumption and extremely low complexity.

[0003] To protect the privacy of AIoT (Internet of Things) services, temporary identifiers can be used during AIoT device-network data communication to prevent attackers from obtaining the true identifier of the AIoT device over the air interface, thus preventing attackers from tracking the AIoT device and causing privacy leaks. In a mobile communication application scenario, a Subscription Concealed Identifier (SUCI) can be used as a temporary identifier. However, SUCI involves a large amount of data during air interface transmission, leading to significant energy consumption and high storage costs when the AIoT device writes related data. It also increases data transmission latency and the probability of write failures.

[0004] Therefore, for low-power or low-complexity AIoT devices, a special format of temporary identifier needs to be designed to reduce the power consumption and storage costs of AIoT devices. Summary of the Invention

[0005] This application provides a communication method, apparatus, and readable storage medium that can reduce the power consumption and storage costs of AIoT devices while protecting their privacy.

[0006] The present application is described below from different aspects. It should be understood that the different implementation methods and beneficial effects described below can be referenced from each other.

[0007] In a first aspect, this application provides a communication method applied to a first network element (such as an environmental IoT data management network element), comprising: the first network element encrypting the device identifier of a terminal-side device based on a first freshness parameter and a key to generate a first temporary identifier; wherein the first temporary identifier includes encrypted first ciphertext; the first network element sending the first temporary identifier to the terminal-side device; the first network element receiving a second temporary identifier sent by the terminal-side device; wherein the second temporary identifier includes the first ciphertext in the first temporary identifier, and information in the first freshness parameter and / or the device identifier of the terminal-side device; the first network element decrypting the second temporary identifier according to the first freshness parameter and the key to obtain the device identifier of the terminal-side device.

[0008] In this technical solution, the first network element generates a first temporary identifier, the length of which is less than the length of the existing temporary identifier. The first network element sends the first temporary identifier to the terminal device. The terminal device reconstructs a second temporary identifier based on the first temporary identifier and sends it to the first network element. This reduces the amount of data transmitted over the air interface, thereby effectively improving air interface transmission performance while ensuring data communication security.

[0009] In one possible implementation, the first temporary identifier further includes the first freshness parameter.

[0010] In one possible implementation, the field used to characterize the first freshness parameter has a length of less than or equal to 128 bits.

[0011] In one possible implementation, the information in the device identifier of the terminal-side device includes the type of the device identifier of the terminal-side device and / or the identifier of the home network of the terminal-side device.

[0012] In one possible implementation, before the first network element encrypts the device identifier of the terminal-side device based on the first freshness parameter and the key to generate the first temporary identifier, the method further includes: the first network element generating the first freshness parameter.

[0013] In one possible implementation, the first freshness parameter includes one or more of a random number, a counter value, or a timestamp.

[0014] In one possible implementation, before the first network element encrypts the device identifier of the terminal-side device based on the first freshness parameter and the key to generate the first temporary identifier, the method further includes: the first network element receiving a first request message, the first request message including the first freshness parameter.

[0015] In one possible implementation, after the first network element receives the first request message, the method further includes: the first network element calculating a first authentication response parameter based on the long-term key and the first freshness parameter; wherein the first authentication response parameter is used for network authentication of the terminal-side device, and the long-term key is a long-term key of the terminal-side device pre-configured in the first network element.

[0016] In one possible implementation, the first network element sends the first temporary identifier to the terminal device, including: the first network element sends a first response message, the first response message including the first temporary identifier and the first authentication response parameters.

[0017] In one possible implementation, the first temporary identifier and the second temporary identifier further include a message authentication code; wherein the message authentication code is generated by the first network element based on the first ciphertext and the key.

[0018] In one possible implementation, the first temporary identifier and the second temporary identifier further include one or more of a routing indicator, a protection scheme identifier, or a key identifier; wherein the routing indicator is used for network addressing of the first network element, the protection scheme identifier is used to indicate an encryption scheme, and the key identifier is used to index the key.

[0019] In one possible implementation, after the first network element decrypts the second temporary identifier based on the first freshness parameter and the key to obtain the device identifier of the terminal-side device, the method further includes: the first network element encrypting the device identifier of the terminal-side device based on the second freshness parameter and the key to generate a third temporary identifier; wherein the third temporary identifier includes the encrypted second ciphertext; and the first network element sending the third temporary identifier to the terminal-side device.

[0020] In one possible implementation, the first network element is an environmental IoT data management network element, and the terminal-side device is an environmental IoT device or a module within the environmental IoT device.

[0021] Secondly, this application provides a communication method applied to an environmental IoT device or a module within the environmental IoT device. The method includes: a terminal-side device receiving a first temporary identifier sent by a first network element; wherein the first temporary identifier includes first ciphertext obtained by encrypting the device identifier of the terminal-side device based on a first freshness parameter and a key; the terminal-side device reconstructing a second temporary identifier based on the first temporary identifier; wherein the second temporary identifier includes the first ciphertext in the first temporary identifier, as well as information from the first freshness parameter and / or the device identifier of the terminal-side device; and the terminal-side device sending the second temporary identifier to the first network element.

[0022] In this technical solution, the terminal device receives a first temporary identifier, the length of which is shorter than the length of an existing temporary identifier. The terminal device reconstructs a second temporary identifier based on the first temporary identifier and sends it to the first network element. This reduces the amount of data transmitted over the air interface and the power consumption when writing the first temporary identifier, thereby effectively improving air interface transmission performance while ensuring data communication security.

[0023] In one possible implementation, the first temporary identifier further includes a first freshness parameter.

[0024] In one possible implementation, the field used to characterize the first freshness parameter has a length of less than or equal to 128 bits.

[0025] In one possible implementation, the first freshness parameter is stored locally on the terminal device.

[0026] In one possible implementation, the information in the device identifier of the terminal-side device includes the type of the device identifier of the terminal-side device and / or the identifier of the home network of the terminal-side device.

[0027] In one possible implementation, the first temporary identifier and the second temporary identifier further include one or more of a routing indicator, a protection scheme identifier, a key identifier, or a message authentication code; wherein the routing indicator is used for network addressing of the first network element, the protection scheme identifier is used to identify the encryption scheme, the key identifier is used to index the key, and the message authentication code is generated by the first network element based on the first ciphertext and the key.

[0028] In one possible implementation, the terminal-side device reconstructs the second temporary identifier based on the first temporary identifier, including: after receiving the second request message, the terminal-side device reconstructs the second temporary identifier based on the first temporary identifier.

[0029] In one possible implementation, the terminal-side device reconstructs the second temporary identifier based on the first temporary identifier, including: when the terminal-side device sends a first uplink message, it reconstructs the second temporary identifier based on the first temporary identifier.

[0030] In one possible implementation, the first network element is an environmental IoT data management network element, and the terminal-side device is an environmental IoT device or a module within the environmental IoT device.

[0031] Thirdly, this application provides a communication device, which may be a terminal-side device, a first network element, or a chip therein. The communication device includes units and / or modules for performing the methods provided by any one of the first to second aspects, or any possible implementation thereof, such as transceiver units and / or processing units. The transceiver units are used to transmit and receive various information or signaling, thus also achieving the beneficial effects (or advantages) of the methods provided by any one of the first to second aspects.

[0032] Fourthly, this application provides a communication device including a processor for executing the method shown in any one of the first to second aspects, or any possible implementation thereof. Alternatively, the processor is configured to execute a program stored in a memory, wherein when the program is executed, the method shown in any one of the first to second aspects, or any possible implementation thereof, is executed.

[0033] In conjunction with the fourth aspect, in one possible implementation, the memory is located outside the aforementioned communication device.

[0034] In conjunction with the fourth aspect, in one possible implementation, the memory is located within the aforementioned communication device.

[0035] In this application, the processor and memory can also be integrated into a single device, that is, the processor and memory can be integrated together.

[0036] In conjunction with the fourth aspect, in one possible implementation, the communication device further includes a transceiver for sending or receiving various messages.

[0037] Fifthly, this application provides a readable storage medium storing program instructions that, when executed on a communication device, cause the communication device to perform the communication method described in any one of the first to second aspects, or any possible implementation thereof.

[0038] Sixthly, this application provides a program product containing instructions that, when executed, cause the model licensing method described in any possible implementation of any of the first to second aspects above to be executed.

[0039] In a seventh aspect, this application provides a communication device, which can be implemented as a chip or as a device, including a processor. The processor is used to read and execute a program stored in a memory to execute one or more of the first to second aspects described above, or one or more of any possible implementations of any of these aspects, providing a communication method. Optionally, the device further includes a memory connected to the processor via a circuit. Further optionally, the device includes a communication interface to which the processor is connected. The communication interface is used to receive information and / or signaling to be processed, the processor obtains the information and / or signaling from the communication interface, processes the information and / or signaling, and outputs the processing result through the communication interface. The communication interface can be an input / output interface.

[0040] Optionally, the processor and memory mentioned above can be physically independent units, or the memory can be integrated with the processor.

[0041] Eighthly, this application provides a communication system including a terminal-side device and a first network element or a second network element. The terminal-side device is used to execute the method described in the second aspect or any possible implementation of the second aspect, and the first network element is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0042] The technical effects achieved in the above aspects can be referred to each other or to the beneficial effects in the method embodiments shown below, which will not be repeated here. Attached Figure Description

[0043] Figure 1a This is a schematic diagram of a network system architecture provided in an embodiment of this application;

[0044] Figure 1b This is a schematic diagram of the structure of a communication network provided in an embodiment of this application;

[0045] Figure 2 This is a flowchart illustrating a communication method provided in an embodiment of this application;

[0046] Figure 3 This is a flowchart illustrating another communication method provided in an embodiment of this application;

[0047] Figure 4 This is a flowchart illustrating another communication method provided in an embodiment of this application;

[0048] Figure 5 This is a flowchart illustrating another communication method provided in an embodiment of this application;

[0049] Figure 6 This is a schematic diagram of the communication device provided in an embodiment of this application;

[0050] Figure 7 This is another structural schematic diagram of the communication device provided in the embodiments of this application;

[0051] Figure 8 This is another structural schematic diagram of the communication device provided in the embodiments of this application. Detailed Implementation

[0052] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0053] In the description of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can represent: a, b, c; a and b; a and c; b and c; or a and b and c. Where a, b, and c can be single or multiple.

[0054] In the description of this application, the terms "first," "second," etc., are used only to distinguish different objects and do not limit the quantity or order of execution, nor do they imply that they are necessarily different. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0055] In this application, the words "exemplary" or "for example" are used to indicate that something is an example, illustration, or illustration. Any embodiment or design described as "exemplary," "for example," or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Rather, the use of the words "exemplary," "for example," or "for example" is intended to present the relevant concepts in a specific manner.

[0056] It should be understood that in this application, "when," "if," and "if" all refer to the device making a corresponding action under certain objective circumstances, and are not time-limited, nor do they require the device to make a judgment when it is implemented, nor do they imply any other limitations.

[0057] In this application, the use of singular designations for elements is intended to represent "one or more" rather than "one and only one," unless otherwise specified.

[0058] In addition, the terms “system” and “network” are often used interchangeably in this article.

[0059] It is understood that in the various embodiments of this application, expressions such as "B corresponding to A" or "A corresponds to / is associated with B" all indicate that there is a correspondence between A and B, and B can be determined based on A. It should also be understood that determining / generating B based on A does not mean that B is determined solely based on A; B can also be determined based on A and / or other information.

[0060] The network architecture of this application is briefly described below. It should be understood that the network architecture described in this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application.

[0061] The technical solutions provided in this application can be applied to wireless communication systems, including but not limited to a triple architecture of network side (such as core network), access network equipment, and terminal equipment (such as IoT devices). Examples include: 5th generation (5G) communication systems or new radio (NR), long term evolution (LTE) networks, MulteFire networks (creating new wireless networks by independently operating LTE technology on unlicensed spectrum (e.g., global 5GHz unlicensed spectrum), or home base station networks, mobile networks with wireless fidelity (Wi-Fi) access, wideband code division multiple access (WCDMA) networks, fixed-mobile converged networks (fixed access network accessing mobile network), and other future communication systems, such as 6th generation mobile communication systems.

[0062] See Figure 1a , Figure 1a This is a schematic diagram of a network system architecture provided in an embodiment of this application. The explanation uses a 5G network as an example. Figure 1aAs shown, Ambient Internet of Things (AIoT) terminal devices can access a wireless network to obtain data network (DN) services or communicate with other devices, such as other terminal devices. This wireless network includes a radio access network (RAN) and a 5G core network (5GC). 5GC devices can include Ambient Internet of Things Functions (AIoTF), Ambient IoT Data Management (ADM), or Unified Data Management (UDM). AIoT terminal devices can include passive tags, semi-passive tags, semi-active tags, and active tags. Servers can also be included, such as operation requesters (i.e., servers issuing commands or application functions (AF), which can be called operation requesters or third-party applications).

[0063] An AIoT Function (AIoTF) (also referred to as an Access and Mobility Management Function (AMF) device, AIoTF entity, AIoTF network element, mobility management device, mobility management network element, or mobility management entity) is a type of core network equipment. This equipment can be used to manage access control and mobility for the device. For example, in 5G, the AIoT Function can be an AMF network element. In future communications, such as 6G, the AMF network element can still be an AMF network element, or it may have other names; this application does not limit this. When the AMF network element is an AMF network element, the AMF can provide Namf services.

[0064] A network exposure function (NEF) (also known as a network exposure device) is a type of core network equipment. This device enables 3GPP to securely provide network service capabilities to third-party AFs (e.g., service capability servers (SCS), application servers (AS)). For example, in 5G, the network exposure element can be a network exposure function (NEF) element. In future communication systems, such as 6G, the network exposure element can still be a NEF element, or it may have other names; this application does not limit this. When the network exposure element is a NEF, the NEF can provide NEF services to other network function elements.

[0065] Ambient data management (ADM) (also known as unified data management device, unified data management network element, data management device, or unified data management entity) is used for processing environmental IoT device identification and access authentication. In 5G communication systems, environmental IoT data management can be a UDM or a unified data management device used for environmental IoT services. In future communication systems, environmental IoT data management can also be a UDM network element, or it can have other names; this application embodiment does not limit this. Environmental IoT data management can be a core network device.

[0066] Equipment: can be referred to as user equipment (label), terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication equipment, user agent, or user device. Tags can also be cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to a wireless modem, in-vehicle devices, wearable devices, terminal devices in 5G networks, or terminal devices in future evolved public land mobile networks (PLMNs) or non-terrestrial networks (NTNs). They can also be end devices, logical entities, smart devices such as mobile phones and smart terminals, or communication devices such as servers, gateways, base stations, and controllers, or IoT devices such as tags, passive tags, active tags, semi-active tags, sensors, electricity meters, water meters, and other Internet of Things (IoT) devices. They can also be unmanned aerial vehicles (UAVs) with communication capabilities. When the device is a passive or semi-active terminal or tag, it can acquire energy to receive or transmit data. Energy can be acquired through radio waves, solar energy, light energy, wind energy, hydropower, thermal energy, kinetic energy, etc. This application does not limit the energy acquisition method for passive or semi-active terminals. The embodiments of this application are not limited in this regard. It should be noted that the tags involved in this application can be in tag form, or, alternatively, any terminal form.

[0067] Operation requester: This can be a server or an application function. In this embodiment, the operation requester can be understood as a device that sends operation instructions, such as a server, a P-IoT server, an application function (AF), or other devices that send operation instructions. The operation requester can correspond to a certain type of user, which can include enterprises, tenants, third parties, or companies, without limitation. The fact that the operation requester corresponds to a certain type of user can be understood as the operation requester belonging to that type of user and being managed by that type of user.

[0068] The reader interacts with the tag via radio frequency signals or wireless signals. It should be understood that this application does not limit the name of the reader; for example, the reader may have the function of performing the operations described in this application on the terminal (e.g., the tag) (e.g., acquiring tag information, inventory operations, read operations, write operations, invalidation operations, or message interaction operations with the tag), acquiring billing-related information and / or billing information, and sending billing information to the CHF (CHF). In one possible implementation, the reader may send instructions from a server or application function to the tag, or the reader may send messages from the tag to a server or application function. In one possible implementation, the reader may acquire information stored in a specified tag according to instructions issued by the server. For example, in the case of an inventory operation (or storage operation), the reader acquires the tag's identification information; this identification information may be a unique identifier for the tag or a temporary identifier for the tag. For example, in the case of a read operation, the reader reads the data in the tag's storage area. Optionally, in situations where it is necessary to rewrite the information stored within the tag, the reader may also have a write function. For example, in the case of a write operation, the reader writes the data to the tag's storage area. In addition, the reader can also perform a deactivation operation on the tag. After the deactivation operation is performed, the tag becomes invalid and cannot be used for operations such as retrieving tag information, inventory operations, read operations, message interaction with the tag, or write operations. In one possible implementation, the inability to retrieve tag information due to tag invalidation can be understood as the reader being unable to retrieve the tag information of the invalid tag after it becomes invalid. In another possible implementation, the inability to perform message interaction with the tag due to tag invalidation can be understood as the reader being unable to interact with the invalid tag after it becomes invalid. In this application, the reader can be a terminal device, or an access network device, pole station, eNodeB, gNodeB, integrated access and backhaul (IAB) node, etc. This application does not limit the form of the reader.

[0069] The RAN may include one or more RAN devices (or access network devices). The interface between the access network device and the terminal device can be a Uu interface (or air interface). Of course, in communication evolved after 5G, the names of these interfaces may remain unchanged or may be replaced with other names; this application does not limit this.

[0070] Access network equipment refers to nodes or devices that connect terminal devices to a wireless network. Examples of access network equipment include, but are not limited to: next-generation node B (gNB), evolved node B (eNB), next-generation eNB (ng-eNB) in 5G communication systems, radio backhaul equipment, radio network controllers (RNC), node B (NB), home evolved node B (HeNB) or (home node B (HNB)), baseband unit (BBU), transmitting and receiving point (TRP), transmitting point (TP), mobile switching center, and equipment that performs base station functions in device-to-device (D2D), vehicle-to-everything (V2X), and machine-to-machine (M2M) communications. It can also include cloud radio access networks. Network equipment in centralized units (CUs) and distributed units (DUs) of a network (C-RAN) system, and in non-terrestrial network (NTN) communication systems, can be deployed on high-altitude platforms or satellites, etc., and this application does not specifically limit this. The RAN in this application can be a RAN for 5G or a RAN for 6G, and this application does not limit this.

[0071] The core network may include one or more core network devices (i.e., network element devices or network functions (NFs)). In the following text, core network devices will be collectively referred to as core network elements or network elements.

[0072] Please see Figure 1b , Figure 1b This is a schematic diagram of the structure of a communication network provided in this application. Figure 1bThe 5GC shown includes multiple core network devices: network slice selection function (NSSF), network exposure function (NEF), network function repository function (NRF), policy control function (PCF), unified data management (UDM), application function (AF), network control function (NCF), network slice specific authentication and authorization function (NSSAAF), authentication server function (AUSF), access and mobility management function (AMF), session management function (SMF), user plane function (UPF), service communication proxy (SCP), and network slice admission control function (NSACF). Among them:

[0073] AMF is a control plane function provided by the operator's network, responsible for access control and mobility management of terminal devices accessing the operator's network. It includes functions such as mobility state management, assigning temporary user identities, authenticating and authorizing users.

[0074] The SMF (Service Controller Function) is a control plane function provided by the operator's network, responsible for managing Protocol Data Unit (PDU) sessions of terminal equipment. A PDU session is a channel used to transmit PDUs; terminal equipment needs to exchange PDUs with the DN (Network Controller) through PDU sessions. The SMF is responsible for establishing, maintaining, and deleting PDU sessions. The SMF includes session management (such as session establishment, modification, and release, including tunnel maintenance between the UPF and RAN), UPF selection and control, service and session continuity (SSC) mode selection, roaming, and other session-related functions.

[0075] PCF (Control Plane Function) is a control plane function provided by the operator, including user subscription data management, policy control, billing policy control, and quality of service (QoS) control. It is primarily used to provide the SMF (Service Provider Function) with policies for PDU sessions. These policies can include billing-related policies, QoS-related policies, and authorization-related policies.

[0076] UPF is a gateway provided by the operator, serving as the gateway for communication between the operator's network and the DN. UPF includes user plane-related functions such as packet routing and transmission, packet inspection, quality of service (QoS) processing, uplink packet inspection, and downlink packet storage.

[0077] The User Data Management (UDM) is primarily used to manage user subscription and authentication data, as well as perform authentication and credit processing, user identification processing, access authorization, registration / mobility management, subscription management, and SMS management. In some embodiments, the UDM may also include a unified data repository (UDR). Alternatively, in other embodiments, the 3GPP SBA of the 5G system may also include a UDR. The UDR is used to provide storage and retrieval for PCF policies, storage and retrieval of open structured data, and storage of user information for application function requests.

[0078] NRF is mainly used for registering, managing, and monitoring the status of other NFs, enabling automated management of all NFs. Each NF must register with NRF upon startup to provide services. Registration information includes NF type, address, service list, etc.

[0079] The NEF is primarily used to support secure interaction between the network and third-party applications. The network can securely expose network capabilities and events to third parties through the NEF to enhance or improve the quality of application services. Furthermore, the network can securely obtain relevant data from third parties through the NEF to enhance the network's intelligent decision-making. At the same time, the NEF supports recovering structured data from the UDR or storing structured data in the UDR.

[0080] AF is primarily used to support interaction with the core network to provide services, such as influencing data routing decisions, policy control functions, or providing third-party services to the network side.

[0081] The aforementioned core network equipment can also be referred to as network elements or functional network elements. In a 5G communication system, each functional network element can be... Figure 1b The names of the various functional network elements shown can remain the same in communication systems evolving after 5G (such as 6G communication systems). Figure 1b The names of the various functional network elements shown may also have other names. For example, in a 5G communication system, the policy control network element may be PCF. In communication systems that evolve after 5G (such as 6G communication systems), the policy control function may still be PCF, or it may have other names. This application does not limit this.

[0082] Figure 1b In this context, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface sequence numbers. The meanings of these interface sequence numbers can be found in the relevant standard protocols and are not limited here.

[0083] See Figure 2 , Figure 2 This is a flowchart illustrating a communication method provided in an embodiment of this application, specifically an authentication process for AIoT devices used in inventory operations and / or command operations. Figure 2 As shown, the process includes the following steps. The ADM side pre-stores a long-term private and public key pair for the AIoT device; each time a temporary identifier for the AIoT device is calculated, an additional temporary public-private key pair needs to be generated. The network side shares the same long-term key K with the AIoT device.

[0084] Step 1: The operation requester (e.g., application function AF) sends a service operation request message to the core network element (AIoTF).

[0085] Optionally, the service operation request message may carry an Application Function ID (AF ID), a service type, and / or target device information (or device filtering information). For example, the target device information may be information representing the target device, and may include one or more of the following: regional location information, device group information, device identification information, etc.

[0086] The service types include two main categories of operations: inventory operations and command operations. Inventory operations (also known as stocktaking operations) involve checking the existing tags, or retrieving tag identification information. Command operations include read operations, write operations, and deactivation operations.

[0087] Step 2: In response to the service operation request message, the AIoTF network element sends a service response message to the AF.

[0088] Step 3: After receiving the service operation request message, AIoTF sends a service request message to the reader.

[0089] Specifically, the service request message includes the identification information of the device to be paged and a freshness parameter. Optionally, the freshness parameter can be generated by AIoTF to prevent replay attacks initiated by attackers.

[0090] Optionally, AIoTF receives a service operation request message and determines the identification information of the device to be paged based on the target device information in the service operation request message.

[0091] The identification information of the device to be paged can be an AIoT device identifier, or it can be a filter, a wildcard, etc. For example, the identification information of the device to be paged and the AIoT device identifier can have a one-to-many relationship. For example, if the identification information is ####1234, then the device identifier corresponding to this identification information has a length of 8 bits and the last 4 bits are 1234. That is, the identifier of the device to be paged satisfies the following: the identifier length is 8 bits, and the last 4 bits of the identifier are 1234. Alternatively, the identification information and the AIoT device identifier can also have a one-to-one relationship. For example, if the identification information is 12345678, then the device corresponding to this identification information is unique, and the device identifier is 12345678. In this case, the device to be paged is unique, and its identifier is 12345678.

[0092] Optionally, the AIoT device identifier can be an AIoT device permanent identifier or a user permanent identifier (SUPI).

[0093] In one possible implementation, when the reader is a base station, the AIoTF sends an N2 message; when the reader is a UE, the AIoTF sends a NAS message.

[0094] Step 4: The reader sends a broadcast message to the device. This message is a paging message, or a similar message, used to trigger the target device to access the device. The message includes the identification information of the device to be paged and the freshness parameter.

[0095] Step 5: The AIoT device receives a broadcast message. When the identifier of the AIoT device matches the identifier message carried in the broadcast message, the AIoT device performs random access.

[0096] Step 6: The AIoT device uses the long-term key K shared by the device identifier index, and then calculates the authentication response parameter RES based on the long-term key K and the freshness parameter; RES is used by the network to authenticate the AIoT device.

[0097] The AIoT device checks if it has a temporary identifier provided by the network. If not, it calculates a temporary identifier based on the null scheme. It's understood that if the AIoT device doesn't have a local temporary identifier, it indicates that the AIoT device is accessing the network for the first time and needs to perform null encryption on the device identifier based on the null scheme to obtain a temporary identifier. This temporary identifier can be a SUCI.

[0098] Step 7: The AIoT device sends an uplink message to the reader, which includes the temporary identifier and the authentication response parameter RES.

[0099] For example, the temporary identifier can be obtained by the AIoT device through encrypted calculation based on a null scheme; or, the temporary identifier can be received from the network by the AIoT device during its previous communication with the network.

[0100] Step 8: The reader sends a service response or service notification message to the AIoTF. The service response or service notification message includes the temporary identifier and the authentication response parameter RES.

[0101] Step 9: AIoTF sends an authentication request message to ADM, which requests the network to authenticate the AIoT device. The authentication request message carries the temporary identifier and the freshness parameter.

[0102] Step 10: The ADM indexes the shared long-term key K based on the device identifier, and then calculates the authentication response parameter XRES based on the long-term key K and the received freshness parameter. XRES is used to verify whether the authentication response parameter RES sent by the device matches. The ADM further deduces a session key Ks based on the shared long-term key, which is used for confidentiality and / or integrity protection of data transmitted in subsequent command flows.

[0103] In one possible implementation, when the terminal device first accesses the network, the ADM decrypts the temporary identifier based on the null scheme to obtain the device identifier.

[0104] In one possible implementation, ADM uses an asymmetric mechanism to decrypt the received temporary identifier SUCI to obtain the device identifier. For example, ADM decrypts the ciphertext in the temporary identifier using the long-term private key and the temporary public key within the temporary identifier, then performs an integrity check to obtain the device identifier.

[0105] In one possible implementation, the ADM generates a new temporary identifier based on the long-term public key. For example, the ADM regenerates a temporary public-private key pair, encrypts the device identifier using the long-term public key and the new temporary private key, and obtains the new temporary identifier. This new temporary identifier can be represented as SUCI'.

[0106] For example, a temporary identifier format may include: a SUPI Type field, a Home Network Identifier field, a Routing Indicator field, a Protection Scheme ID field, a Home Network Public Key ID field, and a Scheme output field. The SUPI Type field indicates the type of SUPI and has a value from 0 to 7. The Home Network Identifier field indicates the identifier of the home network. The Routing Indicator is recorded in the Universal Subscriber Identity Module (USIM). The Protection Scheme ID field indicates the protection algorithm ID of the SUPI. The Home Network Public Key ID field indicates the home network public key (i.e., the long-term public key) and has a value from 0 to 255. The Scheme output field indicates the SUPI ciphertext. This SUPI ciphertext is obtained by encrypting the SUPI using the home network public key. The Scheme output field may include: the public key, the ciphertext (Encrypted ID output), and the Message Authentication Code (MAC). The public key is a temporary public key used in the SUCI generation process, with a length of 256 bits or 264 bits; the Encrypted ID output is the ciphertext after encrypting the ID, which serves as the AIoT device identifier in an IoT environment; the MAC is used to verify whether the SUCI has been tampered with or forged. In the embodiments of this application, the ciphertext after encrypting the ID can be abbreviated as Cipher.

[0107] Step 11: ADM sends an authentication response message to AIoTF, which carries XRES, Ks, and SUCI'.

[0108] Step 12: AIoTF verifies whether the authentication response parameters RES and XRES sent by the AIoT device match. If they match, the network authentication of the device is successful; otherwise, the authentication of the device fails.

[0109] Steps 13-14: AIoTF sends a command request message to the device through the reader. The command request message includes a confidentiality-protected and / or integrity-protected command message (including SUCI') and a message authentication code (MAC).

[0110] Step 15: The device deduces the session key Ks based on the shared long-term key, performs integrity verification and / or decryption operations to obtain SUCI', and then updates SUCI to SUCI'.

[0111] Furthermore, after the device receives a new paging message, it continues to execute the next step of the process, from step 6 to step 15.

[0112] Based on the aforementioned AIoT service transmission protection process and temporary identifier construction method, it is known that SUPI encryption and decryption utilize long-term public-private keys on the network side and are implemented using an asymmetric mechanism. However, ADM's asymmetric encryption and decryption of SUCI requires maintaining two public-private key pairs: one pre-configured long-term public-private key pair and one generated temporary public-private key pair. This results in high computational complexity and significant overhead on the network side. Furthermore, the excessively long format of the generated SUCI leads to a large amount of data transmitted over the air interface, resulting in substantial energy and storage costs for AIoT devices writing related data. Moreover, environmental IoT devices have limited capabilities, and transmitting large amounts of data can easily lead to transmission failures and increased latency. Therefore, existing security mechanisms cannot address these issues for low-power and / or low-complexity environmental IoT AIoT devices.

[0113] Based on this, this application provides a communication method, apparatus, and readable storage medium that protects device identifiers through symmetric encryption and constructs a new temporary identifier. This reduces network-side computational overhead and the amount of data transmitted over the air interface, thereby simultaneously meeting the energy consumption and security requirements of low-power IoT devices.

[0114] In one possible implementation, the low-power IoT device in this application can also be other low-power or low-complexity devices.

[0115] The technical solution provided in this application will be described in detail below with reference to more accompanying drawings.

[0116] The technical solutions provided in this application are illustrated through multiple embodiments, with specific reference to the descriptions of the various embodiments below. The same or similar parts between the various embodiments or implementations can be referred to mutually. In the various embodiments of this application, and in the various implementation methods / methods / implementations within each embodiment, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments and between the various implementation methods / methods / implementations within each embodiment are consistent and can be mutually referenced. The technical features in different embodiments and the various implementation methods / methods / implementations within each embodiment can be combined according to their inherent logical relationships to form new embodiments, implementation methods, methods, or implementation approaches. The embodiments described below do not constitute a limitation on the scope of protection of this application.

[0117] In one possible implementation, the terminal device of this application can be an Internet of Things (IoT) device, such as an AIoT (Ambient Internet of Things) device, a Passive IoT (P-IoT) device, a smart tag, a passive tag, an active tag, an industrial control component, etc. The IoT device in this application can be low-power, low-computing-power, or have limited energy storage capacity. The first network element in this application can be an ADM or UDM; the second network element can be an AIoTF, or an AMF, or a tag management function (TMF). It should be understood that the AIoTF can be an independently configured network element or it can be co-configured with other network elements (such as an AMF network element).

[0118] In one possible implementation, this application also relates to a key storage network element, which can be used to store and retrieve keys or key-related information. The key storage network element can be a standalone network element, or it can be combined with an AMF / AIoTF, or it can be combined with an AF, depending on whether key management is handled by a third party or the operator. If the operator manages the keys, the key storage network element can be located in an ADM / UDM, or combined with an AMF / AIoTF. If a third party manages the keys, the key storage network element can be combined with an AF.

[0119] In the embodiments of this application, "network element A sends information A to network element B" can be understood as the destination of information A being network element B and the source being network element A. There may be intermediate network elements forwarding the information A along its transmission path from source to destination. The embodiments of this application only show the source and destination of information A. It is understood that the information may undergo necessary processing between the source and destination, such as format changes, but the destination can understand the valid information from the source. Similar expressions in this application can be understood in a similar way and will not be elaborated upon here.

[0120] The various embodiments will be described in detail below.

[0121] See Figure 3 , Figure 3 This is another flowchart illustrating the communication method 300 provided in this application embodiment. The method mainly describes how a first network element generates a new temporary identifier using a pre-configured symmetric key, a freshness parameter, and a device identifier. The downlink message sent by the first network element to the terminal device includes the new temporary identifier. Then, the uplink message sent by the terminal device includes the complete temporary identifier. It can be understood that symmetric key encryption is also called private key encryption or shared key encryption, meaning that the key used by the data sender to encrypt plaintext is the same as the key used by the data receiver to decrypt the corresponding ciphertext.

[0122] like Figure 3 As shown, the communication method includes, but is not limited to, the following steps:

[0123] Step S310: The first network element encrypts the device identifier of the terminal-side device based on the first freshness parameter and the key to generate a first temporary identifier; wherein, the first temporary identifier includes the encrypted first ciphertext.

[0124] The first network element can be an ADM network element; the terminal-side device can be an AIoT device, or a module / chip in an AIoT device, etc.

[0125] The first freshness parameter may include one or more of a random number, a counter value, or a timestamp.

[0126] The first network element acquires the first freshness parameter. Specifically, the first network element may generate the first freshness parameter, or it may receive it from other network elements.

[0127] For example, the first network element receives a first request message, which includes the first freshness parameter.

[0128] As another example, the first network element can receive the first request message from the second network element, whereby the first request message can be an authentication request message. The second network element can be an AIoTF network element.

[0129] The first network element saves the first freshness parameter locally. That is, the first network element can save the received first freshness parameter locally, or it can save the generated first freshness parameter locally.

[0130] Optionally, the first request message may further include a first authentication response parameter, which is used for network authentication of the terminal-side device.

[0131] The key can be a pre-configured symmetric key. It is understood that the first network element can use a symmetric encryption algorithm to encrypt the device identifier. For example, the first network element may have a long-term symmetric key pre-configured locally, and encrypt the device identifier based on this symmetric key.

[0132] In one possible implementation, the first network element uses the first freshness parameter, the device identifier, and the symmetric key as input parameters to calculate the encrypted first ciphertext (Encrypted ID output). Specifically, the first ciphertext is the ciphertext obtained by encrypting the device identifier of the AIoT device in an IoT environment. It can be understood that the encrypted first ciphertext is the ciphertext obtained by encrypting the AIoT device identifier.

[0133] In one possible implementation, the first network element performs an integrity protection operation on the encrypted first ciphertext based on the symmetric key to obtain a first message authentication code (MAC). It is understood that the MAC can be used to verify whether the temporary identifier has been tampered with.

[0134] In one possible implementation, the first network element takes the first freshness parameter, the device identifier, and the symmetric key as input parameters, performs an integrity protection operation to obtain a first message authentication code, and then takes the first freshness parameter, the device identifier, the first message authentication code, and the symmetric key as input parameters to calculate the encrypted first ciphertext.

[0135] In one possible implementation, the first temporary identifier includes a scheme output field, which includes the encrypted first ciphertext. It can be understood that the first temporary identifier includes first ciphertext obtained by encrypting the device identifier of the terminal-side device based on a first freshness parameter and a key.

[0136] In one possible implementation, the first network element can generate the first temporary identifier by splicing together components.

[0137] In one possible implementation, the scheme output field may further include a field carrying the first freshness parameter. That is, the first temporary identifier may also include the encrypted first ciphertext and the first freshness parameter. For example, ADM concatenates the first ciphertext and the first freshness parameter to obtain the first temporary identifier, where the first temporary identifier = {first freshness parameter || first ciphertext}. Here, the symbol “||” represents the “concatenation” operation, which will not be elaborated further below.

[0138] In one possible implementation, the length of the field carrying the first freshness parameter is less than or equal to 128 bits.

[0139] In one possible implementation, the scheme output field may further include a field carrying the first message authentication code. That is, the first temporary identifier includes the encrypted first ciphertext, the first freshness parameter, and the first message authentication code. For example, ADM concatenates the first ciphertext, the first freshness parameter, and the first message authentication code to obtain the first temporary identifier, where the first temporary identifier = {first freshness parameter || first ciphertext || first message authentication code}.

[0140] Optionally, the first temporary identifier may further include one or more of the following fields: ID Type, network identifier, routing indicator, protection scheme identifier, and key identifier. Specifically, the ID Type indicates the type of the device identifier; the network identifier indicates the network identifier of the terminal device; the routing indicator routes to the first network element, and optionally, it can also route to the first network element together with the network identifier; the protection scheme identifier is the identifier of the encryption scheme used in the encryption process of the device identifier; and the key identifier indexes the key used to encrypt the device identifier, for example, to index a pre-configured symmetric key. It is understood that in specific application scenarios, if only one fixed encryption mechanism is used, such as a symmetric encryption mechanism, and a long-term symmetric key is pre-configured in the network, the first temporary identifier may not include the protection scheme identifier and the key identifier; if only one ADM is deployed on the network side, or if other fields can complete network identification and routing, the routing indicator may also not be included in the first temporary identifier.

[0141] Optionally, the temporary identifier can be represented as TID (Temporary Identifier); or Temporary AIoT Identifier (Temp AIoT ID); it can also be represented as the user-hidden identifier SUCI; or the AIoT concealed identifier AICI; etc. Other representations are not limited. In the embodiments of this application, the first temporary identifier can be represented as TID#1, which is only an example and not intended to limit its specific representation.

[0142] In one possible implementation, the first network element can also generate a session key to protect downlink command messages. Specifically, the first network element ADM generates the session key based on a shared long-term key K.

[0143] In one possible implementation, the first network element (ADM) can also generate a confidentiality key and an integrity key to protect downlink command messages. Specifically, the first network element (ADM) generates a confidentiality key Kenc and an integrity key Kint based on a shared long-term key K. It is understood that the confidentiality key can also be described as a cryptographic key CK (CipherKey).

[0144] In one possible implementation, before the first network generates the first temporary identifier, the process may further include: the first network element generating first expected authentication response parameters. Specifically, the first network element generates the first expected authentication response parameters based on the first freshness parameter and the shared long-term key K in the authentication request message.

[0145] Optionally, if the first request message includes a first authentication response parameter, the first network element can further authenticate the terminal-side device based on the first expected authentication response parameter and the first authentication response parameter. For example, the ADM compares whether the calculated first expected authentication response parameter is consistent with the received first authentication response parameter. If they are consistent, the network is considered to have successfully authenticated the terminal-side device; otherwise, authentication fails.

[0146] S320, the first network element sends the first temporary identifier to the terminal-side device. Correspondingly, the terminal-side device receives the first temporary identifier sent by the first network element.

[0147] In specific implementation, the first network element sends a first response message to the second network element. After receiving the first response message, the second network element sends a second request message to the terminal-side device. Both the first response message and the second request message carry the first temporary identifier, and the second request message can be a command request message. It can be understood that the first network element, in response to the received first request message, sends the first response message to the second network element.

[0148] For example, ADM sends an authentication response message to AIoTF, which includes the first temporary identifier and the session key; AIoTF sends a command request message to the AIoT device, which includes the session key and the second message authentication code, and the command message CM includes the first temporary identifier. In this embodiment, AIoTF performs encryption and integrity protection operations on the command message based on the session key to obtain the encrypted command message ECM and the second message authentication code MAC#2.

[0149] For example, ADM sends an authentication response message to AIoTF, which includes the first temporary identifier, the Kenc, and the Kint. AIoTF sends a Command Request Message to the AIoT device, which includes an encrypted Command Message (ECM) and a second message authentication code. The Command Message (CM) includes the first temporary identifier. In this embodiment, AIoTF performs encryption and integrity protection operations on the Command Message based on the Kenc and Kint to obtain the encrypted Command Message ECM and the second message authentication code MAC#2.

[0150] In one possible implementation, the command message includes the first temporary identifier, and the second network element encapsulates the first temporary identifier into the command message.

[0151] In one possible implementation, after receiving the first response message, the second network element sends the second request message to the reader, and the reader forwards the second request message to the terminal-side device. The reader can be a base station, etc.

[0152] Optionally, if the first request message in step S310 does not include the first authentication response parameter, the first response message may further include the first expected authentication response parameter, and the second network element may authenticate the terminal-side device based on the first expected authentication response parameter.

[0153] S330, the terminal device reconstructs a second temporary identifier based on the first temporary identifier; wherein the second temporary identifier includes the first temporary identifier, as well as the information in the first freshness parameter and / or the device identifier of the terminal device.

[0154] In a specific implementation, the terminal device receives a second request message and reconstructs a second temporary identifier based on the first temporary identifier in the second request message. Specifically, after performing integrity verification and decryption on the second request message, the terminal device obtains the first temporary identifier and reconstructs the second temporary identifier based on the first temporary identifier.

[0155] The device identifier of the terminal-side device includes the identifier type and the network identifier.

[0156] The terminal-side device reconstructs the second temporary identifier based on the first temporary identifier, which may include the following scenarios:

[0157] Scenario 1: The first temporary identifier includes the encrypted first ciphertext.

[0158] In one possible implementation, the terminal device reconstructs the second temporary identifier based on information from the first temporary identifier and the device identifier of the terminal device. Specifically, the reconstructed second temporary identifier includes the first ciphertext, the identifier type, and the network identifier. It is understood that the device identifier of the terminal device includes an identifier type field and a network identifier field. When reconstructing the second temporary identifier, the terminal device copies the identifier type and the network identifier and uses them to construct the second temporary identifier with the first temporary identifier.

[0159] In one possible implementation, the terminal-side device reconstructs the second temporary identifier based on the first temporary identifier, the first freshness parameter stored locally on the terminal-side device, and information from the device identifier of the terminal-side device. Specifically, the reconstructed second temporary identifier includes the first ciphertext, the first freshness parameter, the identifier type, and the network identifier. The locally stored first freshness parameter is received from the second network element and stored locally by the terminal-side device during network authentication. That is, during network authentication, the terminal-side device generates the first authentication response parameter based on the shared long-term key and the first freshness parameter. The terminal-side device sends the first authentication response parameter to the second network element, and the second network element sends an authentication request message to the first network element. This authentication request message includes the first authentication response parameter and the first freshness parameter. The first network element then generates encrypted first ciphertext based on the first freshness parameter. It is understood that, in this implementation, the first freshness parameter that the terminal-side device needs to reconstruct is the same as the first freshness parameter used by the terminal-side device in the network authentication process before the first network element sends the first temporary identifier, and the first freshness parameter used by the first network element when generating the encrypted first ciphertext.

[0160] Scenario 2: The first temporary identifier includes the encrypted first ciphertext and the first freshness parameter.

[0161] The terminal device reconstructs the second temporary identifier based on information from the first temporary identifier and the device identifier of the terminal device. Specifically, the reconstructed second temporary identifier includes the first ciphertext, the first freshness parameter, the identifier type, and the network identifier.

[0162] Based on scenario 1 or scenario 2 above, the first temporary identifier and the second temporary identifier may further include a first message authentication code.

[0163] In addition, the first temporary identifier may also include one or more of a routing indicator, a protection scheme identifier, or a key identifier.

[0164] In one possible implementation, the second request message includes an encrypted command message and a second message authentication code. The terminal device obtains the command message based on the encrypted command message and acquires the first temporary identifier within the command message. For example, the AIoT device obtains the first temporary identifier after performing a security decryption operation on the command message.

[0165] In one possible implementation, the terminal device performs integrity verification and decryption on the encrypted command message based on the session key Ks to obtain the command message. Specifically, the terminal device can first obtain the Ks; for example, the AIoT device derives the session key Ks based on the shared long-term key K.

[0166] In one possible implementation, the terminal device performs integrity verification and decryption on the encrypted command message based on the integrity key Kint and the confidentiality key Kenc to obtain the command message. Specifically, the terminal device can first obtain the Kint and Kenc; for example, the AIoT device derives the Kint and Kenc based on the shared long-term key K.

[0167] In one possible implementation, the terminal device may also update the locally stored temporary identifier to the first temporary identifier, wherein the locally stored temporary identifier is the temporary identifier used by the terminal device and the network in the previous communication process.

[0168] In one possible implementation, after receiving the second request message, the terminal device reconstructs the second temporary identifier based on the first temporary identifier. Specifically, after receiving the command request message, the terminal device reconstructs the second temporary identifier based on the first temporary identifier.

[0169] In one possible implementation, when the terminal device sends the first uplink message, it reconstructs the second temporary identifier based on the first temporary identifier.

[0170] S340, the terminal-side device sends the second temporary identifier to the first network element, and the first network element receives the second temporary identifier accordingly.

[0171] In a specific implementation, the terminal-side device sends a first uplink message to the first network element, the first uplink message including the second temporary identifier. Specifically, the terminal-side device can send the first uplink message to the first network element after receiving a new paging message.

[0172] In one possible implementation, before sending the second temporary identifier, the terminal device can also check whether it has a temporary identifier provided by the network stored locally. If not, it can generate a temporary identifier based on an empty encryption scheme. It is understood that when the terminal device first accesses the network, if the network does not allocate a temporary identifier to the terminal device, the terminal device can generate a temporary identifier based on an empty encryption scheme. In this embodiment, the fact that the terminal device stores the first temporary identifier indicates that it has already stored a temporary identifier provided by the network locally.

[0173] In one possible implementation, the terminal device sends the first uplink message to the second network element, and the second network element sends a second authentication request message to the first network element, the second authentication request message including the second temporary identifier.

[0174] Optionally, the terminal device sends the first uplink message to the reader, and the reader sends a service response message to the second network element, the service response message including the second temporary identifier.

[0175] S350. The first network element decrypts the second temporary identifier according to the first freshness parameter and the key to obtain the device identifier of the terminal-side device.

[0176] In a specific implementation, the first network element obtains the first ciphertext from the second temporary identifier, and decrypts the first ciphertext according to the first freshness parameter and the key to obtain the device identifier of the terminal-side device. For example, the first network element uses the locally stored first freshness parameter, a pre-configured symmetric key, and the first ciphertext from the second temporary identifier as input parameters to decrypt and obtain the device identifier of the terminal-side device. It is understood that in this implementation, the locally stored first freshness parameter is the one stored in the aforementioned step S310, and this first freshness parameter can come from the second network element or be generated by the first network element.

[0177] In one possible implementation, the first network element obtains the encrypted first ciphertext and the first freshness parameter from the second temporary identifier, and decrypts the obtained first ciphertext according to the first freshness parameter and the key to obtain the device identifier of the terminal-side device. Specifically, the first network element can obtain the first ciphertext and the first freshness parameter by splitting the second temporary identifier. It can be understood that the second temporary identifier includes the first ciphertext and the first freshness parameter, and the second network element decrypts the first ciphertext according to a locally pre-configured symmetric key and the first freshness parameter to obtain the device identifier of the terminal-side device.

[0178] In one possible implementation, the first network element obtains the encrypted first ciphertext, first freshness parameter, and first message authentication code from the second temporary identifier. Based on the first freshness parameter, the first message authentication code, and the key, it decrypts and verifies the integrity of the first ciphertext to obtain the device identifier of the terminal-side device. Specifically, the first freshness parameter, the first ciphertext, the first message authentication code, and a pre-configured symmetric key are used as input parameters to decrypt and obtain the device identifier of the terminal-side device. The integrity of the device identifier is then verified based on the symmetric key and the first message authentication code. If the verification passes, the device identifier of the terminal-side device is obtained.

[0179] In one possible implementation, after decrypting to obtain the device identifier of the terminal-side device, the method may further include: the first network element encrypting the device identifier of the terminal-side device based on the second freshness parameter and the key to generate a third temporary identifier; wherein the third temporary identifier includes the encrypted second ciphertext. For example, the device identifier of the terminal-side device is encrypted based on a pre-configured symmetric key and the second freshness parameter to obtain the encrypted second ciphertext. That is, the first network element can first obtain the second freshness parameter and then generate the third temporary identifier. The first network element can also save the obtained second freshness parameter locally.

[0180] In one possible implementation, the first network element can obtain the second freshness parameter from a message sent by the second network element, or the first network element can generate the second freshness parameter. Specifically, the first network element can obtain the second freshness parameter from a received second authentication request message, which includes the second freshness parameter.

[0181] In one possible implementation, the first network element may also calculate the second expected authentication response parameter based on the shared long-term key and the received second freshness parameter.

[0182] In one possible implementation, the first network element generates a third temporary identifier based on the second freshness parameter, the third temporary identifier including the encrypted second ciphertext. In this implementation, if the terminal device does not need to reconstruct the second freshness parameter, the second freshness parameter can be received from the second network element or generated by the first network element. If the terminal device needs to reconstruct the second freshness parameter, the second freshness parameter needs to be received from the second network element.

[0183] In one possible implementation, the first network element generates a third temporary identifier based on the second freshness parameter. The third temporary identifier includes encrypted second ciphertext and the second freshness parameter. In this implementation, since the third temporary identifier carries the second freshness parameter, the terminal-side device does not need to reconstruct the second freshness parameter. Therefore, the second freshness parameter can be received from the second network element or generated by the first network element.

[0184] In one possible implementation, when the first network element generates the second freshness parameter, it can also receive a third freshness parameter from the second network element, which is used during the terminal-side device's network authentication process. Furthermore, the first network element can also generate the second expected authentication response parameter based on the third freshness parameter and a shared long-term key.

[0185] In one possible implementation, the first network element sends the third temporary identifier to the terminal-side device.

[0186] In the embodiments of this application, a new temporary identifier is constructed, which reduces the length of the temporary identifier compared to the temporary identifier transmitted in the prior art, effectively reducing the amount of data in the air interface transmission process and improving the performance of air interface transmission.

[0187] See Figure 4 , Figure 4 This is another flowchart illustrating the communication method 400 provided in this application embodiment. In this embodiment, the first network element is an ADM network element, the second network element is an AIoTF network element, and the terminal device is an AIoT device. The ADM network element generates a first temporary identifier and sends it to the AIoT device. The AIoT device reconstructs a second temporary identifier based on the first temporary identifier and sends it to the ADM network element.

[0188] like Figure 4 As shown, the communication method 400 includes, but is not limited to, the following steps:

[0189] Step S410: The ADM network element encrypts the device identifier of the AIoT device according to the first freshness parameter and the key, and generates a first temporary identifier.

[0190] In specific implementation, the ADM network element performs encryption and integrity protection operations on the device identifier of the AIoT device based on the first freshness parameter and the pre-configured symmetric key to obtain the encrypted first ciphertext and the first message authentication code. Then, it generates a first temporary identifier based on the first freshness parameter, the first ciphertext, and the first message authentication code. For example, the ADM network element concatenates the first freshness parameter (such as R#1), the first ciphertext, and the first message authentication code to obtain the first temporary identifier.

[0191] The first freshness parameter can be generated by the ADM network element or received by the ADM network element from the AIoTF network element.

[0192] In one implementation, the ADM network element can also deduce the session key based on the shared long-term key K.

[0193] Step S420: The ADM network element sends a first message to the AIoTF network element. The first message includes a first temporary identifier. Correspondingly, the AIoTF network element receives the first message from the ADM network element.

[0194] The first message may also include a session key.

[0195] Optionally, the first message can be an authentication response message, or it can be other types of messages, without specific limitations.

[0196] Step S430: Based on the received first message, the AIoTF network element generates a command message, which includes a first temporary identifier.

[0197] In practice, the AIoTF network element encapsulates the first temporary identifier into the command message, and then performs encryption and integrity protection operations on the command message based on the session key to obtain the encrypted command message and the second message authentication code.

[0198] For example, the session key may include Kenc and Kint; the AIoTF network element encapsulates the first temporary identifier into the command message, performs confidentiality protection on the command message based on Kenc to obtain the encrypted command message, and performs integrity protection operation on the encrypted command message based on Kint to obtain the second message authentication code.

[0199] In step S440, the AIoTF network element sends a command request message to the AIoT device. This command request message includes an encrypted command message and a second message authentication code. The AIoT device then receives the command request message.

[0200] In practice, the AIoTF network element can first send the command request message to the reader, and then the reader forwards the command request message to the AIoT device.

[0201] Step S450: The AIoT device obtains the first temporary identifier in the command request message and reconstructs the second temporary identifier based on the first temporary identifier.

[0202] In specific implementation, the AIoT device performs integrity verification and decryption on the received command request message based on the session key to obtain a first temporary identifier. This first temporary identifier includes a first freshness parameter, a first ciphertext, and a first message authentication code. The session key is derived by the AIoT device from a shared long-term key K using the same method as ADM.

[0203] For example, the AIoT device receives a command request message and obtains the encrypted command message and the second message authentication code from the command request message; the AIoT device derives the key Kenc and the key Kint based on the shared long-term key K, first performs integrity verification on the encrypted command message based on Kint and the second message authentication code, then decrypts the encrypted command message based on Kenc to obtain the command message; and then performs a security operation on the command message to obtain the first temporary identifier.

[0204] Furthermore, the AIoT device reconstructs a second temporary identifier based on the first temporary identifier. Specifically, the AIoT device reconstructs the second temporary identifier based on the information in the first temporary identifier and the device identifier of the AIoT device. For example, the AIoT device copies the identifier type and network identifier from the device identifier of the AIoT device, and constructs the second temporary identifier with a first freshness parameter, a first ciphertext, and a first message authentication code. It can be understood that the reconstructed second temporary identifier includes the identifier type, network identifier, first freshness parameter, first ciphertext, and first message authentication code.

[0205] Optionally, AIoT devices can also update the locally stored temporary identifier to the first temporary identifier.

[0206] In one possible implementation, after receiving a command request message or sending a first uplink message, the AIoT device reconstructs a second temporary identifier based on the first temporary identifier.

[0207] In one possible implementation, after the AIoT device successfully verifies the integrity of the received command request message, it reconstructs the second temporary identifier based on the first temporary identifier in the command request message.

[0208] Step S460: The AIoT device sends a first uplink message to the AIoTF network element, the first uplink message including a second temporary identifier.

[0209] In specific implementation, after receiving the first downlink message, the AIoT device sends a first uplink message to the AIoTF network element. Specifically, the first downlink message can be a paging message. For example, the AIoTF network element sends a service request message to the reader, the reader sends a paging message to the AIoT device, then the AIoT device sends the first uplink message to the reader, and the reader sends a service response message to the AIoTF network element, wherein the service response message includes a second temporary identifier.

[0210] In step S470, the AIoTF network element sends a second message to the ADM network element, the second message including a second temporary identifier. Correspondingly, the ADM network element receives the authentication request message.

[0211] In step S480, the ADM network element decrypts the received second temporary identifier to obtain the device identifier of the AIoT device.

[0212] In its implementation, the ADM network element decrypts and verifies the integrity of the encrypted first ciphertext based on a pre-configured symmetric key, a first freshness parameter, and a first message authentication code to obtain the device identifier of the AIoT device. Specifically, the ADM network element splits the second temporary identifier to obtain the first freshness parameter, the encrypted first ciphertext, and the first message authentication code; after verifying the integrity of the encrypted first ciphertext based on the pre-configured symmetric key, the first freshness parameter, and the first message authentication code, it decrypts the encrypted first ciphertext again based on the pre-configured symmetric key to obtain the device identifier of the AIoT device.

[0213] In step S410', the ADM network element encrypts the device identifier of the AIoT device according to the second freshness parameter and the key, and generates a third temporary identifier.

[0214] In a specific implementation, the ADM network element can first obtain the second freshness parameter. For example, the ADM can generate the second freshness parameter or receive it from the AIoTF network element. For instance, the ADM network element receives the authentication request message from the AIoTF network element, and this authentication request message may also include the second freshness parameter.

[0215] Furthermore, the ADM network element sends an authentication response message to the AIoTF network element, which includes a third temporary identifier.

[0216] In the embodiments of this application, the ADM network element generates a first temporary identifier based on a pre-configured symmetric encryption mechanism, according to a freshness parameter and a device identifier, and sends it to the AIoT device. The AIoT device then sends a reconstructed second temporary identifier to the ADM network element. Compared to existing temporary identifier transmission protection mechanisms, this reduces the length of the temporary identifier, lowers the power consumption and storage costs of data writing on the device side, and effectively improves the performance of air interface transmission while ensuring data transmission security.

[0217] See Figure 5 , Figure 5 This is another flowchart of the communication method 500 provided in the embodiments of this application.

[0218] like Figure 5 As shown, the communication method 500 includes, but is not limited to, the following steps:

[0219] In step S510, the ADM network element encrypts the device identifier of the AIoT device according to the first freshness parameter and the key, and generates a first temporary identifier.

[0220] In specific implementation, the ADM network element performs encryption and integrity protection operations on the device identifier of the AIoT device based on the first freshness parameter and the pre-configured symmetric key to obtain the encrypted first ciphertext and the first message authentication code. Then, it generates a first temporary identifier based on the first ciphertext and the first message authentication code. For example, the ADM network element concatenates the first ciphertext and the first message authentication code to obtain the first temporary identifier.

[0221] The first freshness parameter is obtained by the ADM network element from the AIoTF network element.

[0222] In a specific implementation, the ADM network element can also generate a first expected authentication response parameter (such as a first XRES) based on the shared long-term key K and a first freshness parameter. It is understood that if the authentication request message from the AIoTF includes a first authentication response message, the ADM can authenticate the AIoT device by comparing the consistency of the first RES with the first XRES.

[0223] Specifically, before step S510, there is also step S500, which includes the following steps:

[0224] In step S500a, AIoTF sends a service request message to the reader, which includes a first freshness parameter.

[0225] Step S500b: The reader sends a paging message to the AIoT device, which includes a first freshness parameter.

[0226] In step S500c, the AIoT device calculates a first authentication response parameter (such as a first RES) based on the received first freshness parameter and the shared long-term key K, and simultaneously stores the received first freshness parameter in a volatile storage area. Specifically, if the AIoT device is accessing the network for the first time, it can generate an initial temporary identifier based on a null encryption scheme, or the network can pre-allocate an initial temporary identifier.

[0227] In step S500d, the AIoT device sends an uplink message to the reader, which includes the first authentication response parameters and the initial temporary identifier.

[0228] In step S500e, the reader sends a service response message to the AIoTF network element, which includes the first authentication response parameters and the initial temporary identifier.

[0229] In step S500f, the AIoTF network element sends an authentication request message to the ADM network element. This authentication request message includes the initial temporary identifier and a first freshness parameter. Optionally, the authentication request message may also include a first authentication response parameter.

[0230] In step S500g, the ADM network element can also obtain the device identifier of the AIoT device based on the initial temporary identifier.

[0231] Other implementation details are similar to those in step S410 above, and will not be repeated here.

[0232] Step S520: The ADM network element sends an authentication response message to the AIoTF network element. The authentication response message includes a first temporary identifier. Correspondingly, the AIoTF network element receives the authentication response message from the ADM network element.

[0233] Optionally, if the authentication request message in the aforementioned step S410 does not include the first authentication response parameter, the authentication response message may further include the first expected authentication response parameter.

[0234] Other implementation details are similar to those in step S420 above, and will not be repeated here.

[0235] Step S530: Based on the received authentication response message, the AIoTF network element generates an encrypted command message, which includes a first temporary identifier.

[0236] Optionally, if the authentication response message includes a first expected authentication response parameter, the AIoTF network element can also authenticate the AIoT device by comparing the consistency of the first RES with the first XRES.

[0237] Other implementation details are similar to those in step S430 above, and will not be repeated here.

[0238] In step S540, the AIoTF network element sends a command request message to the AIoT device. This command request message includes an encrypted command message and a second message authentication code. The AIoT device then receives the command request message.

[0239] Similar to step S440 mentioned above, it will not be repeated here.

[0240] Step S550: The AIoT device obtains the first temporary identifier in the command request message and reconstructs the second temporary identifier based on the first temporary identifier.

[0241] In practice, after the AIoT device performs integrity verification and decryption on the received command request message, it obtains a first temporary identifier, which includes a first ciphertext and a first message authentication code.

[0242] Furthermore, the AIoT device reconstructs the second temporary identifier based on the first temporary identifier. Specifically, the AIoT device reconstructs the second temporary identifier based on the first temporary identifier and a first freshness parameter stored locally. For example, the AIoT device reads the first freshness parameter from the volatile storage area and constructs the second temporary identifier with the first ciphertext and the first message authentication code. It can be understood that the reconstructed second temporary identifier includes the first freshness parameter, the first ciphertext, and the first message authentication code.

[0243] Other implementation details are similar to those in step S450 above, and will not be repeated here.

[0244] Step S560: The AIoT device sends a first uplink message to the AIoTF network element. The first uplink message includes a second authentication response parameter and a second temporary identifier.

[0245] In specific implementation, after receiving the first downlink message, the AIoT device sends a first uplink message to the AIoTF network element. Specifically, the AIoT device receives the first downlink message, which includes a second freshness parameter; the AIoT device sends the first uplink message to the AIoTF network element, which includes a second authentication response parameter and a second temporary identifier. For example, the AIoTF network element sends a service request message to the reader, which includes the second freshness parameter; the reader sends a paging message to the AIoT device, which also includes the second freshness parameter; after receiving the paging message, the AIoT device sends the first uplink message to the reader; the reader then sends a service response message to the AIoTF network element, wherein the first uplink message and the service response message include the second authentication response parameter and the second temporary identifier.

[0246] More specifically, AIoT devices can also generate a second authentication response parameter (such as a second RES) based on the shared long-term key K and the received second freshness parameter.

[0247] In step S570, the AIoTF network element sends an authentication request message to the ADM network element. This authentication request message includes a second temporary identifier and a second freshness parameter. Correspondingly, the ADM network element receives the authentication request message.

[0248] In step S580, the ADM network element decrypts the received second temporary identifier to obtain the device identifier of the AIoT device.

[0249] Similar to step S480 mentioned above, it will not be repeated here.

[0250] In step S510', the ADM network element encrypts the device identifier of the AIoT device according to the second freshness parameter and the key, and generates a third temporary identifier.

[0251] In a specific implementation, the ADM network element can first obtain the second freshness parameter. For example, the ADM network element receives the authentication request message from the AIoTF network element, and the authentication request message also includes the second freshness parameter.

[0252] Furthermore, the ADM network element sends an authentication response message to the AIoTF network element, which includes a third temporary identifier.

[0253] In the embodiments of this application, the ADM, based on a pre-configured symmetric encryption mechanism, generates a first temporary identifier and sends it to the AIoT device according to the freshness parameters and device identifier during the AIoT device authentication process. The AIoT device then reconstructs a second temporary identifier based on the freshness parameters saved during the authentication process and sends it to the ADM network element. Compared to existing temporary identifier transmission protection mechanisms, this reduces the length of the temporary identifier, lowers the power consumption overhead and storage cost of data writing on the device side, and effectively improves the performance of air interface transmission while ensuring data transmission security.

[0254] In an embodiment of this application, a flowchart of a communication method 600 is provided. The ADM is pre-configured with a pair of long-term home network public and private keys. When calculating a temporary identifier, a pair of temporary public and private keys is generated, and the temporary public key is associated with and stored locally. After the ADM encrypts the device identifier based on an asymmetric encryption algorithm, it constructs a temporary identifier with the temporary public key identifier. Specifically, this includes the following steps.

[0255] This communication method includes, but is not limited to, the following steps:

[0256] Step S610: The ADM network element generates a first temporary identifier.

[0257] In specific implementation, the second network element (such as ADM) encrypts and performs integrity calculations on the device identifier using an asymmetric algorithm to obtain the first ciphertext and the first message authentication code. Then, it generates a first temporary identifier based on the temporary public key identifier, the first ciphertext, and the first message authentication code. For example, the ADM generates a first temporary public key and a first temporary private key, and stores the first temporary public key associated with the temporary public key identifier locally. The ADM encrypts and calculates the device identifier using the pre-configured home network public key and the first temporary private key to obtain the encrypted first ciphertext and the first message authentication code. Then, it generates a first temporary identifier based on the temporary public key identifier, the first ciphertext, and the first message authentication code.

[0258] In practice, the temporary public key identifier is used to index the associated temporary public key, and its length can be 128 bits, 64 bits, or shorter.

[0259] The generated first temporary identifier can include the following formats: ID Type field, Network Identifier field, Routing Indicator field, Protecting Scheme ID field, Home Network Public Key ID field, and Scheme output field. The Scheme output field can include: Temp Public Key ID, Encrypted ID output, and Message Authentication Code (MAC). In essence, the first temporary identifier can include ID Type, Network Identifier, Routing Indicator, Protecting Scheme ID, Home Network Public Key ID, Temporary Public Key ID, First Encrypted ID, and First Message Authentication Code.

[0260] In its implementation, ADM derives the confidentiality key Kenc and the integrity key Kint based on the shared long-term key K. It is understood that the confidentiality key Kenc and the integrity key Kint are used for confidentiality and integrity protection in subsequent data communication processes.

[0261] Step S620: The ADM network element sends an authentication response message to the AIoTF network element, which includes a first temporary identifier.

[0262] Similar to step S420 mentioned above, it will not be repeated here.

[0263] Step S630: Based on the received authentication response message, the AIoTF network element generates an encrypted command message, which includes a first temporary identifier.

[0264] Similar to step S430 mentioned above, it will not be repeated here.

[0265] In step S640, the AIoTF network element sends a command request message to the AIoT device. This command request message includes an encrypted command message and a second message authentication code. The AIoT device then receives the command request message.

[0266] Similar to step S440 mentioned above, it will not be repeated here.

[0267] Step S650: The AIoT device obtains the first temporary identifier from the command request message.

[0268] In practice, the AIoT device performs integrity verification and decryption on the received command request message to obtain the first temporary identifier.

[0269] Step S660: The AIoT device sends a first uplink message to the AIoTF network element, the first uplink message including a first temporary identifier.

[0270] Step S670: The AIoTF network element sends an authentication request message to the ADM network element. The authentication request message includes a first temporary identifier.

[0271] In step S680, the ADM network element decrypts the received first temporary identifier to obtain the device identifier of the AIoT device.

[0272] For example, ADM obtains the second temporary identifier from the authentication request message, splits the second temporary identifier to obtain the identifier type, network identifier, routing indicator, protection scheme identifier, home network public key identifier, temporary public key identifier, first ciphertext, and first message authentication code; it indexes the corresponding home network private key based on the home network public key identifier and the associated stored first temporary public key based on the temporary public key identifier, and then uses the first temporary public key, the first ciphertext, the first message authentication code, and the home network private key as input parameters to decrypt and obtain the device identifier. Then, it verifies the integrity of the device identifier based on the first message verification code. If the verification passes, the device identifier of the AIoT device is obtained.

[0273] Figure 6 This is a schematic block diagram of a communication device 10 provided in an embodiment of this application. The device 10 includes a processing module 11. Optionally, the device 10 may further include a transceiver module 11. The processing module 11 is used for data processing, and the transceiver module 12 can implement corresponding communication functions; that is, the transceiver module 12 is used to perform receiving and sending related operations, while the processing module 11 is used to perform other operations besides receiving and sending. The transceiver module 12 may also be referred to as a communication interface or a communication unit.

[0274] Optionally, the device 10 may further include a storage module (not shown in the figure), which can be used to store instructions and / or data. The processing module 11 can read the instructions and / or data in the storage module so that the device can perform the operation of the device or network element in the aforementioned method embodiments.

[0275] In the first design, the device 10 may correspond to the terminal-side device in the above method embodiments, or a component of a network device (such as a chip), such as an environmental IoT management function (such as ADM) or an environmental IoT function (such as AIoTF).

[0276] The device 10 can implement the steps or processes corresponding to the environmental IoT management function (such as ADM) in the above method embodiments. The processing module 11 can be used to perform processing-related operations of the environmental IoT management function (such as ADM) in the above method embodiments, and the transceiver module 12 can be used to perform transceiver-related operations of the environmental IoT management function (such as ADM) in the above method embodiments.

[0277] Exemplarily, the device 10 may correspond to the first network element or ADM in methods 300, 400, and 500 of the embodiments of this application. The device 10 may include tools for performing... Figures 3 to 5 The modules in the device 10 are those that execute methods for environmental IoT management functions (such as ADM). Furthermore, each module in the device 10 and the other operations and / or functions described above are respectively designed to implement... Figures 3 to 5 The corresponding flow of the method shown.

[0278] The device 10 can implement the steps or processes corresponding to the environmental Internet of Things (such as AIoTF) functions in the above method embodiments. The transceiver module 12 can be used to perform the transceiver-related operations of the environmental Internet of Things (such as AIoTF) functions in the above method embodiments, and the processing module 11 can be used to perform the processing-related operations of the environmental Internet of Things (such as AIoTF) functions in the above method embodiments.

[0279] For example, the device 10 may correspond to the environmental Internet of Things (IoT) function (such as AIoTF) in methods 300, 400, and 500 of the embodiments of this application. The device 10 may include functions for performing... Figures 3 to 5 The modules in the device 10 are those that execute methods for environmental IoT functions (such as AIoTF). Furthermore, each module in the device 10 and the other operations and / or functions described above are respectively for implementing... Figures 3 to 5 The corresponding flow of the method shown.

[0280] It should be understood that the specific process of each module performing the above-mentioned corresponding steps has been described in detail in the above-mentioned method embodiments, and will not be repeated here for the sake of brevity.

[0281] It should also be understood that the device 10 here is embodied in the form of a functional module. The term "module" here can refer to an application-specific integrated circuit (ASIC), electronic circuitry, a processor (e.g., a shared processor, a proprietary processor, or a group processor, etc.) and memory for executing one or more software or firmware programs, integrated logic circuitry, and / or other suitable components supporting the described functions. In an alternative example, those skilled in the art will understand that the device 10 may specifically be a mobility management network element in the above embodiments, and may be used to execute the various processes and / or steps corresponding to the mobility management network element in the above method embodiments; or, the device 10 may specifically be a terminal-side device in the above embodiments, or a unit or module (such as a chip) within a terminal-side device, and may be used to execute the various processes and / or steps corresponding to the terminal device in the above method embodiments. To avoid repetition, further details are omitted here.

[0282] The apparatus 10 of each of the above-described schemes has the function of implementing the corresponding steps performed by the network device (such as environmental IoT management function, or environmental IoT function) or terminal device in the above-described methods. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described functions; for example, the transceiver module can be replaced by a transceiver (for example, the sending unit in the transceiver module can be replaced by a transmitter, and the receiving unit in the transceiver module can be replaced by a receiver), and other units, such as processing modules, can be replaced by processors, which respectively execute the transceiver operations and related processing operations in each method embodiment.

[0283] In addition, the transceiver module 12 can also be a transceiver circuit (for example, it may include a receiving circuit and a transmitting circuit), and the processing module can be a processing circuit.

[0284] It should be pointed out that, Figure 7 The device mentioned can be the network element or equipment in the foregoing embodiments, or it can be a chip or chip system, such as a system on chip (SoC). The transceiver module can be an input / output circuit or a communication interface; the processing module is a processor, microprocessor, or integrated circuit integrated on the chip. No limitations are imposed here.

[0285] According to the aforementioned method, Figure 7 This is a schematic diagram of the communication device 20 provided in an embodiment of this application. In one possible design, the device 20 may correspond to the environmental IoT management function (or ADM) in the above method embodiment; in another possible design, the device 10 may correspond to the environmental IoT function (or AIoTF) in the above method embodiment.

[0286] The device 20 may include a processor 21 (i.e., an example of a processing module), which is used to perform... Figures 3 to 5 The corresponding method includes the environmental IoT management function (or ADM) or the environmental IoT function (or AIoTF) performing the operation. Optionally, the device 20 may include a memory 22, and the processor 21 may execute instructions stored in the memory 22 to cause the device 20 to perform the operation as described above. Figures 3 to 5 The corresponding method is the operation performed by the environmental IoT management function (or ADM) or the environmental IoT function (or AIoTF).

[0287] Furthermore, the device 20 may also include a transceiver 23 (i.e., an example of a transceiver module). Furthermore, the processor 21, memory 22, and transceiver 23 can communicate with each other via internal connections to transmit control and / or data signals. The memory 22 stores computer programs, and the processor 21 can retrieve and run these programs from the memory 22 to control the transceiver 23 to receive and transmit signals, thus completing the steps of the terminal device or network device described above. The memory 22 may be integrated into the processor 21 or disposed separately from it.

[0288] Optionally, if the communication device 20 is a communication equipment, the transceiver 23 may include an input port and an output port, that is, the transceiver 23 may be divided into a receiver and a transmitter. The receiver and transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively referred to as transceivers.

[0289] Optionally, if the communication device 20 is a chip or circuit, the input port is an input interface and the output port is an output interface.

[0290] As one implementation method, the transceiver 23 can be implemented using a transceiver circuit or a dedicated transceiver chip. The processor 21 can be implemented using a dedicated processing chip, processing circuit, processor, or general-purpose chip.

[0291] As another implementation method, the communication device provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code that implements the functions of processor 21 and transceiver 23 is stored in memory 22, and the general-purpose processor implements the functions of processor 21 and transceiver 23 by executing the code in memory 22.

[0292] For the concepts, explanations, detailed descriptions, and other steps related to the technical solutions provided in the embodiments of this application involved in the device 20, please refer to the descriptions of these contents in the foregoing methods or other embodiments, which will not be repeated here.

[0293] Figure 8A simplified schematic diagram of a network device 30 is shown. The network device includes parts 31 and 32. Part 31 is mainly used for transmitting and receiving radio frequency signals and converting radio frequency signals to baseband signals; part 32 is mainly used for baseband processing and controlling the network device. Part 31 can generally be referred to as a transceiver module, transceiver, transceiver circuit, or transceiver unit. Part 32 is usually the control center of the network device, often referred to as a processing module, used to control the network device to perform the processing operations on the network device side in the above method embodiments.

[0294] The transceiver module in section 31, also known as a transceiver unit or transceiver, includes an antenna and radio frequency (RF) circuitry, with the RF circuitry primarily used for RF processing. For example, the device in section 31 that performs the receiving function can be considered a receiving module, and the device that performs the transmitting function can be considered a transmitting module; that is, section 31 includes both a receiving module and a transmitting module. The receiving module can also be called a receiver, receiver circuit, or receiving unit, while the transmitting module can be called a transmitter, transmitter, or transmitting circuit.

[0295] Part 32 may include one or more single boards, each single board may include one or more processors and one or more memories. The processor is used to read and execute programs in the memory to implement baseband processing functions and control network devices. If multiple single boards exist, they can be interconnected to enhance processing capabilities. As an optional implementation, multiple single boards may share one or more processors, or multiple single boards may share one or more memories, or multiple single boards may simultaneously share one or more processors.

[0296] For example, in one implementation, Figure 8 The network device shown can be Figures 3 to 5 The method shown can be any network device, such as an ADM network element or an AIoTF network element.

[0297] The transceiver module in section 31 is used for execution Figures 3 to 5 The method shown includes any network device's transmit / receive related steps; section 32 is used for execution. Figures 3 to 5 The steps related to the processing of any network device in the method shown.

[0298] When the device 30 is a chip, the chip includes a transceiver module and a processing module. The transceiver module can be an input / output circuit or a communication interface; the processing module is a processor, microprocessor, or integrated circuit integrated on the chip.

[0299] This application also provides a computer-readable storage medium storing computer instructions for implementing the methods executed by a network device in the above method embodiments.

[0300] For example, when the computer program is executed by the computer, it enables the computer to implement the method executed by the first network element in the above method embodiment.

[0301] This application also provides a computer program product containing instructions that, when executed by a computer, cause the computer to implement the method executed by the terminal device in the above method embodiments.

[0302] This application also provides a communication system, which includes the network device described in the above embodiments.

[0303] The explanations and beneficial effects of the relevant contents in any of the devices provided above can be found in the corresponding method embodiments provided above, and will not be repeated here.

[0304] In this embodiment, the network device may include a hardware layer, an operating system layer running on top of the hardware layer, and an application layer running on top of the operating system layer. The hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also known as main memory). The operating system layer may be any one or more computer operating systems that implement business processing through processes, such as Linux, Unix, Android, iOS, or Windows. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

[0305] This application does not impose any particular limitation on the specific structure of the execution subject of the method provided in this application embodiment. As long as it is possible to communicate according to the method provided in this application embodiment by running a program that records the code of the method provided in this application embodiment. For example, the execution subject of the method provided in this application embodiment can be a network device, or a functional module in a network device that can call and execute a program.

[0306] Various aspects or features of this application can be implemented as methods, apparatus, or articles of manufacture using standard programming and / or engineering techniques. As used herein, the term "article of manufacture" can encompass a computer program accessible from any computer-readable device, carrier, or medium. For example, computer-readable media can include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes), optical discs (e.g., compact discs (CDs), digital versatile discs (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memory (EPROMs), cards, sticks, or key drives, etc.).

[0307] The various storage media described herein may represent one or more devices and / or other machine-readable media used for storing information. The term "machine-readable media" may include, but is not limited to, wireless channels and various other media capable of storing, containing and / or carrying instructions and / or data.

[0308] It should be understood that the processor mentioned in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0309] It should also be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM can include a variety of forms, such as: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0310] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0311] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0312] Those skilled in the art will recognize that the units and steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of protection of this application.

[0313] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described apparatus and unit can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0314] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of apparatus or units may be electrical, mechanical, or other forms.

[0315] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to implement the solution provided in this application, depending on actual needs.

[0316] In addition, the functional units in the various embodiments of this application can be integrated into one unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0317] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)). For example, the aforementioned available media may include, but are not limited to, various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0318] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims and the specification.

Claims

1. A communication method, characterized in that, The method includes: The first network element encrypts the device identifier of the terminal-side device based on the first freshness parameter and the key to generate a first temporary identifier; wherein, the first temporary identifier includes the encrypted first ciphertext; The first network element sends the first temporary identifier to the terminal-side device; The first network element receives a second temporary identifier sent by the terminal-side device; wherein the second temporary identifier includes the first ciphertext in the first temporary identifier, and the first freshness parameter and / or information in the device identifier of the terminal-side device; The first network element decrypts the second temporary identifier based on the first freshness parameter and the key to obtain the device identifier of the terminal-side device.

2. The method according to claim 1, characterized in that, The first temporary identifier also includes the first freshness parameter.

3. The method according to claim 2, characterized in that, The field used to characterize the first freshness parameter has a length of less than or equal to 128 bits.

4. The method according to any one of claims 1-3, characterized in that, The information in the device identifier of the terminal-side device includes the type of the device identifier and / or the identifier of the home network of the terminal-side device.

5. The method according to any one of claims 1-4, characterized in that, Before the first network element encrypts the device identifier of the terminal-side device based on the first freshness parameter and the key to generate the first temporary identifier, the method further includes: The first network element generates the first freshness parameter; wherein the first freshness parameter includes one or more of a random number, a counter value, or a timestamp.

6. The method according to any one of claims 1-4, characterized in that, Before the first network element encrypts the device identifier of the terminal-side device based on the first freshness parameter and the key to generate the first temporary identifier, the method further includes: The first network element receives a first request message, which includes the first freshness parameter; wherein the first freshness parameter includes one or more of a random number, a counter value, or a timestamp.

7. The method according to claim 6, characterized in that, After the first network element receives the first request message, the method further includes: The first network element calculates a first authentication response parameter based on the long-term key and the first freshness parameter; wherein, the first authentication response parameter is used for network authentication of the terminal-side device, and the long-term key is a long-term key of the terminal-side device pre-configured in the first network element.

8. The method according to claim 6, characterized in that, The first network element sends the first temporary identifier to the terminal-side device, including: The first network element sends a first response message, which includes the first temporary identifier and the first authentication response parameters.

9. The method according to any one of claims 1-8, characterized in that, The first temporary identifier and the second temporary identifier further include a message authentication code; wherein the message authentication code is generated by the first network element based on the first ciphertext and the key.

10. The method according to any one of claims 1-9, characterized in that, The first temporary identifier and the second temporary identifier further include one or more of a routing indicator, a protection scheme identifier, or a key identifier; wherein the routing indicator is used for network addressing of the first network element, the protection scheme identifier is used to indicate an encryption scheme, and the key identifier is used to index the key.

11. The method according to any one of claims 1-10, characterized in that, After the first network element decrypts the second temporary identifier according to the first freshness parameter and the key to obtain the device identifier of the terminal-side device, the method further includes: The first network element encrypts the device identifier of the terminal-side device based on the second freshness parameter and the key, generating a third temporary identifier; wherein, the third temporary identifier includes the encrypted second ciphertext; and The first network element sends the third temporary identifier to the terminal-side device.

12. The method according to any one of claims 1-11, characterized in that, The first network element is an environmental IoT data management network element, and the terminal-side device is an environmental IoT device or a module in the environmental IoT device.

13. A communication method, characterized in that, The method includes: The terminal-side device receives a first temporary identifier sent by a first network element; wherein, the first temporary identifier includes a first ciphertext obtained by encrypting the device identifier of the terminal-side device based on a first freshness parameter and a key; The terminal device reconstructs a second temporary identifier based on the first temporary identifier; wherein the second temporary identifier includes the first ciphertext in the first temporary identifier, as well as the first freshness parameter and / or information in the device identifier of the terminal device; The terminal-side device sends the second temporary identifier to the first network element.

14. The method according to claim 13, characterized in that, The first temporary identifier also includes a first freshness parameter.

15. The method according to claim 14, characterized in that, The field used to characterize the first freshness parameter has a length of less than or equal to 128 bits.

16. The method according to claim 13, characterized in that, The terminal-side device receives the first freshness parameter sent by the second network element and stores the first freshness parameter.

17. The method according to any one of claims 13-16, characterized in that, The information in the device identifier of the terminal-side device includes the type of the device identifier and / or the identifier of the home network of the terminal-side device.

18. The method according to any one of claims 13-17, characterized in that, The first temporary identifier and the second temporary identifier further include one or more of a routing indicator, a protection scheme identifier, a key identifier, or a message authentication code; wherein, the routing indicator is used for network addressing of the first network element, the protection scheme identifier is used to identify the encryption scheme, the key identifier is used to index the key, and the message authentication code is generated by the first network element based on the first ciphertext and the key.

19. The method according to any one of claims 13-18, characterized in that, The terminal-side device reconstructs the second temporary identifier based on the first temporary identifier, including: After receiving the second request message, the terminal device reconstructs the second temporary identifier based on the first temporary identifier.

20. The method according to any one of claims 13-18, characterized in that, The terminal-side device reconstructs the second temporary identifier based on the first temporary identifier, including: When the terminal device sends the first uplink message, it reconstructs the second temporary identifier based on the first temporary identifier.

21. The method according to any one of claims 13-20, characterized in that, The first network element is an environmental IoT data management network element, and the terminal-side device is an environmental IoT device or a module in the environmental IoT device.

22. A communication device, characterized in that, Includes units or modules for performing the method according to any one of claims 1 to 21.

23. A readable storage medium, characterized in that, The readable storage medium stores program instructions that, when executed on the communication device, cause the communication device to perform the method as described in any one of claims 1 to 21.

24. A communication system, characterized in that, include: A first network element used to perform the method according to any one of claims 1 to 12; And / or, a terminal-side device for performing the method of any one of claims 13 to 21.

Images