Authentication and / or key management method, first device, terminal and communication device

Abstract

The present disclosure discloses an authentication and / or key management method, a first device, a terminal, and a communication device, where the method includes: a first device receiving a session establishment request message, the session establishment request message being sent by a user equipment (UE) and carrying a key identifier; and the first device obtaining a first key between the UE and the first device based on the key identifier.

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This disclosure is based on and claims priority to Chinese patent applications having application number 202111681982.1 filed on December 31, 2021 and Chinese patent application having application number 202210701819.5 filed on June 20, 2022, the entire contents of which are incorporated herein by reference.

[0002] The present disclosure relates to the technical field of communication technology, and in particular to an authentication and / or key management method, a first device, a terminal and a communication device. [Background technology]

[0003] Currently, based on 3GPP certification in 5G (fifth generation mobile communication technology), there exists an architecture and process for providing authentication and key management capabilities to higher layer applications. As shown in Figures 1 to 4, this includes the basic network model of AKMA (Authentication and Key Management for Applications), the AKMA inference and anchoring process, and the AKMA application key (K). AF ) inference procedure is included.

[0004] When a UE (User Equipment, also called a terminal or user in Japanese) needs to generate an application layer shared key using AKMA with multiple AFs (Application Functions) at the same time, the following problem exists. If an AF does not support AKMA, the AKMA application key inference procedure as shown in Figure 4 cannot be used to generate an application key between the UE and the AF. In addition, if all AFs belong to the same trust domain, once one UE establishes an AKMA for each AF, the AUSF (Authentication Server Function) and AAnF (AKMA Anchor Function) can infer the AKMA layer between each UE and AF. AKMA (AKMA Anchor Key, AKMA Anchor Key) and K AF This would require the UE to generate an AKMA Application Key (AKMA Application Key) separately, consuming AUSF and AAnF resources and causing network bandwidth consumption. Furthermore, an attacker could use a malicious UE to intentionally initiate the AKMA procedure, thereby causing AUSF and AAnF resources to be consumed. Summary of the Invention [Problem to be solved by the invention]

[0005] To solve the related technical problems, in the embodiments of the present disclosure, an authentication and / or key management method, a terminal, and a communication device are provided. [Means for solving the problem]

[0006] The technical means of the embodiments of the present disclosure are realized as follows.

[0007] In an embodiment of the present disclosure, there is provided an authentication and / or key management method, comprising: receiving, by a first device, a session establishment request message originated by the UE, the session establishment request message carrying a key identifier; and obtaining, by the first device, a first key between the first device and the UE based on the key identifier. Authentication and / or key management methods are provided.

[0008] In the above technical means, the method further includes: the first device generating a second key between the UE and the second device for the second device based on the first key.

[0009] In the above technical means, the first device generates a second key between the UE and the second device for the second device based on the first key, The first device generates a second key based on the first key and identifier information of the second device.

[0010] In the above technical means, the method comprises: receiving data protected based on a third key from the UE, and transmitting the data to a second device, by the first device; and / or The first device further includes receiving data transmitted from a second device, protecting the data based on the first key, and transmitting the data to the UE; The third key is generated by the UE and is the same as the first key.

[0011] In the above technical means, obtaining a first key between the UE and the device based on the key identifier includes: The first device locally obtains a first key corresponding to the key identifier based on the key identifier; or The first device obtains a first key corresponding to the key identifier from the AAnF based on the key identifier.

[0012] In the above technical means, the method further includes the first device providing, to the UE, a list of second devices that the UE can access.

[0013] In the above technical means, the method further includes: the first device establishing a TLS (Transport Layer Security) secure channel with the UE.

[0014] In the above technical means, the first device establishes a TLS secure channel with the UE, The first device generates a pre-master key or an external pre-shared key for the TLS secure channel based on the first key or a derivative of the first key.

[0015] In the above technical means, the method comprises: The method further includes the first device transmitting first protected data to the UE, the first protected data including data protected by the first device based on the first key or a derived key of the first key.

[0016] In the above technical means, the method comprises: The method further includes the first device receiving data sent from the UE that is protected based on the third key or a derived key of the third key, the third key being the same key as the first key generated by the UE.

[0017] In the above technical solution, the first device is used to represent a set of AF / AS (Application Server), or AF / AS in the same trust domain.

[0018] In the above technical means, the first device includes an AAP / AP (AAP is an abbreviation for AKMA Application Proxy or AKMA Authentication Proxy, and AP is an abbreviation for Authentication Proxy).

[0019] In an embodiment of the present disclosure, there is provided an authentication and / or key management method, comprising: The UE sends a session establishment request message carrying a key identifier to the first device; receiving, by the UE, first protection data transmitted from the first device; the first protected data includes data protected by the first device based on a first key or a derived key of the first key, the first key being obtained by the first device based on the key identifier; Authentication and / or key management methods are also provided.

[0020] In the above technical means, the method comprises: The UE generates a third key that is the same as the first key, and transmits data protected based on the third key or a derived key of the third key to the first device, so that the first device transmits the data to a second device; and / or The UE generates a fourth key that is the same as the second key, and receives second protected data transmitted from the second device; and / or The method further includes receiving, by the UE, data protected and forwarded by the first device based on the first key; The second protected data includes data protected by the second device based on the second key, the second key being generated by the first device for the second device based on the first key.

[0021] In the above technical means, the method further includes: the UE obtaining, from the first device, a list of second devices that the UE can access.

[0022] In the above technical means, the method further includes: the UE establishing a TLS secure channel with the first device.

[0023] In the above technical means, the UE establishing a TLS secure channel with the first device includes: The UE generating a third key that is the same as the first key; The UE generates a pre-master key or an outer pre-shared key for the TLS secure channel based on the third key or a derived key of the third key.

[0024] In the above technical means, the first device is used to represent a set of AF / AS or AF / AS in the same trust domain.

[0025] In the above technical means, the first device includes an AAP / AP.

[0026] In an embodiment of the present disclosure, there is provided a first device used for authentication and / or key management, comprising: A first processing module configured to receive a session establishment request message originated by a UE, the session establishment request message carrying a key identifier; and a first obtaining module configured to obtain a first key between the UE and the first key obtaining module based on the key identifier. A first device is also provided.

[0027] In the above technical means, the first device further includes a generating module configured to generate a second key between the UE and the second device for the second device based on the first key.

[0028] In the above technical means, the generation module is further configured to generate a second key based on the first key and identifier information of the second device.

[0029] In the above technical means, the first processing module further comprises: receiving data protected based on a third key from the UE, and transmitting the data to a second device; and / or configured to receive data transmitted from a second device, protect the data based on the first key, and transmit the data to the UE; The third key is generated by the UE and is the same as the first key.

[0030] In the above technical means, the first acquisition module further comprises: and obtaining, locally, a first key corresponding to the key identifier based on the key identifier; or It is configured to obtain a first key corresponding to the key identifier from the AAnF based on the key identifier.

[0031] In the above technical means, the first processing module further comprises: The device is configured to provide the UE with a list of second devices accessible by the UE.

[0032] In the above technical means, the first processing module is further configured to establish a TLS secure channel with the UE.

[0033] In the above technical means, the first processing module is further configured to generate a pre-master key or an external pre-shared key of the TLS secure channel based on the first key or a derived key of the first key.

[0034] In the above technical means, the first processing module is further configured to send first protection data to the UE; The first protected data includes data protected by the first device based on the first key or a derived key of the first key.

[0035] In the above technical means, the first processing module is further configured to receive data sent from the UE and protected based on a third key or a derived key of the third key, and the third key is the same key as the first key generated by the UE.

[0036] In the above technical means, the first device is used to represent a set of AF / AS or AF / AS in the same trust domain.

[0037] In the above technical means, the first device includes an AAP / AP.

[0038] In an embodiment of the present disclosure, a terminal used for authentication and / or key management, a second processing module configured to send a session establishment request message carrying a key identifier to the first device; a first receiving module configured to receive first protected data transmitted from the first device; the first protected data includes data protected by the first device based on the first key or a derived key of the first key, the first key being obtained by the first device based on the key identifier; A terminal is also provided.

[0039] In the above technical means, the terminal a third processing module configured to generate a third key identical to the first key, and to transmit data protected under the third key or a derivative of the third key to the first device, and the first device transmits the data to a second device; a fourth processing module configured to generate a fourth key, the fourth key being identical to the second key; a second receiving module configured to receive second protected data transmitted from the second device, the second protected data including data protected by the second device based on the second key, the second key being generated for the second device by the first device based on the first key; and / or and a second receiving module configured to receive data protected and transmitted by the first device based on the first key.

[0040] In the above technical means, the terminal further includes a second acquisition module configured to acquire a list of second devices accessible by the UE from the first device.

[0041] In the above technical means, the second processing module is further configured to establish a TLS secure channel with the first device.

[0042] In the above technical means, the second processing module further comprises: generating a third key that is identical to the first key; generating a pre-master key or an external pre-shared key for the TLS secure channel based on the third key or a derivative of the third key.

[0043] In the above technical means, the first device is used to represent a set of AF / AS or AF / AS in the same trust domain.

[0044] In the above technical means, the first device includes an AAP / AP.

[0045] In an embodiment of the present disclosure, there is provided a communication device, comprising: There is further provided a communications device comprising a memory, a processor and a program stored in the memory and executable on the processor, the communications device realizing the above-mentioned authentication and / or key management method when the processor executes the program.

[0046] In an embodiment of the present disclosure, a computer-readable storage medium having a computer program stored thereon, the computer program implementing the steps of the authentication and / or key management method described above when executed by a processor. Effect of the Invention

[0047] The above technical means of the present disclosure have at least the following beneficial effects.

[0048] In the authentication and / or key management method, the first device, and the communication device according to the embodiments of the present disclosure, an AAP / AP (i.e., the first device, where AAP refers to an AKMA application proxy or an AKMA authentication proxy, and AP refers to an authentication proxy) is introduced into the AKMA basic network model, and the AAP / AP can be a proxy for an AF / AS in a set or the same trust domain, or a specific AF / AS in a set or the same trust domain can be the AAP / AP. That is, the AAP / AP can apply for an AKMA application key on behalf of one or more AF / AS. The AF / AS trusts the AAP / AP. This reduces the resources required by the AUSF and the AAnF to establish an AKMA application key for the UE and the AF / AS, reduces the delay in obtaining the AKMA key, and meets the service needs of low-latency scenarios. In addition, it also solves the problem in the related art that the AF does not support the AKMA basic network model, but still needs to use the AKMA to realize the application layer authentication and key provisioning. [Brief description of the drawings]

[0049] [Figure 1] FIG. 1 is a schematic diagram of a basic network model of AKMA in the related art. [Figure 2a] FIG. 1 is a schematic diagram of a network model of an AKMA reference point when the AF is within a core network in the related art. [Figure 2b] FIG. 1 is a schematic diagram of a network model of an AKMA reference point when the AF in the related art is outside the core network. [Diagram 3] 1 is a flowchart of the inference and anchoring procedure of KAKMA in the related art. [Figure 4] FIG. 1 is a schematic diagram of an AKMA application key derivation procedure in the related art. [Diagram 5] 1 is a schematic diagram of an AKMA network model in which an AAP / AP according to an embodiment of the present disclosure is introduced. [Figure 6a]A schematic diagram of a network model of an AKMA reference point when an AF / AS in which an AAP / AP according to an embodiment of the present disclosure is introduced is located in a core network. [Figure 6b] A schematic diagram of a network model of an AKMA reference point when an AF / AS in which an AAP / AP is introduced is outside the core network according to an embodiment of the present disclosure. [Figure 7] 1 is a flowchart of an authentication and / or key management method according to an embodiment of the present disclosure. [Figure 8] 11 is a flowchart of another authentication and / or key management method according to an embodiment of the present disclosure. [Figure 9] 1 is a schematic diagram of an authentication and / or key management method according to an embodiment of the present disclosure. [Figure 10] 11 is a flowchart of another authentication and / or key management method according to an embodiment of the present disclosure. [Figure 11] FIG. 2 is a schematic diagram of a structure of a first device according to an embodiment of the present disclosure. [Figure 12] FIG. 2 is a schematic diagram of the structure of a terminal according to an embodiment of the present disclosure. [Figure 13] FIG. 1 is a schematic diagram of an AAP / AP deployment in a low-latency scenario in an edge cloud system according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0050] In order to make the technical problems, technical means and advantages of the present disclosure clearer, the following detailed description will be given with reference to the drawings and specific embodiments.

[0051] As shown in FIG. 5, FIG. 6a, and FIG. 6b, in an embodiment of the present disclosure, a schematic diagram of an AKMA basic network model in which an AAP / AP is introduced, a schematic diagram of a network model of an AKMA reference point when an AF / AS in which an AAP / AP is introduced is in a core network, and a schematic diagram of a network model of an AKMA reference point when an AF / AS in which an AAP / AP is introduced is outside the core network are provided. The AAP / AP is an entity newly added to the related architecture, where the AAP refers to an AKMA Application Proxy or an AKMA Authentication Proxy, and the AP refers to an Authentication Proxy. The AAP / AP may be a proxy for an AF / AS in a set or the same trust domain, or a specific AF / AS in a set or the same trust domain may be the AAP / AP. The AAP / AP can apply for an AKMA application key on behalf of one or more AF / AS. The AF / AS trusts the AAP / AP, and each AF / AS may belong to the same trust domain, for example, a set of applications in the same vertical industry. Furthermore, it will be understood that an AF is a name defined according to a network function, similar to other network functions (or network elements) in a 5G system, whereas an AS is defined according to a service level and is classified by a service function. Thus, although an AS is generally not visible from the network layer, an AF may be realized by an AS in general. That is, in some cases, an AF and an AS may be equivalent concepts.

[0052] In the embodiment of the present disclosure, K after AAP / AP is introduced AKMA The inference and anchoring process of is the same as the original standard process. As shown in the process in Figure 3, both UE and AAnF AKMA at which point the AKMA application key inference procedure takes place.

[0053] Before communication between the UE and the AAP / AP begins, the UE and the AAP / AP need to know whether AKMA is available and which AF / AS and application keys the UE can generate through the AAP / AP. This is either implicit in the specific application of the UE and the AAP / AP, or the AAP / AP instructs the UE. For example, when a user initiates access, the AAP / AP returns an AKMA Activate message through the Ua* protocol and a list of AF / AS that the UE can access through the AAP / AP. The AF / AS list includes the identifiers of each AF / AS. Here, the identifiers of the AF / AS maintained by one AAP / AP are unique.

[0054] As shown in FIG. 7, in an embodiment of the present disclosure, an authentication and / or key management method is provided, and the method includes step 701 and step 702.

[0055] Step 701: a first device receives a session establishment request message sent by a user equipment UE, the session establishment request message carrying a key identifier.

[0056] Here, the first device may include an AAP / AP, specifically, an AAP / AP inside a carrier network, or an AAP / AP outside a carrier network, and when the AAP / AP is outside the carrier network, the AAP / AP communicates with a network element of a core network through a NEF.

[0057] The key identifier included in the session establishment request message may be an AKMA key identifier A-KID.

[0058] In practical application, after being authenticated and authorized by the carrier network, the AAP / AP transmits the AKMA application key K to the AAnF through the AKMA key identifier A-KID. AFAn AAP / AP can be a proxy for AF / ASs in a set or in the same trust domain, or a specific AF / AS among a set or in the same trust domain can assume the role of an AAP / AP and request K for these AF / ASs. AF Infer the AKMA key from

[0059] Step 702, the first device obtains a first key between the first device and the UE based on the key identifier.

[0060] In this step, the first device obtains a first key between the first device and the UE according to the key identifier, and the first key is an AKMA application key K AF and the first device may then be able to derive AKMA keys for other AF / AS in the set or in the same trust domain based on the first key.

[0061] Specifically, obtaining a first key between the UE and the first key terminal according to the key identifier includes: The first device locally obtains a first key corresponding to the key identifier based on the key identifier; or The first device obtains a first key corresponding to the key identifier from an AAnF based on the key identifier.

[0062] In an embodiment of the present disclosure, a first device may be a proxy of an AF / AS in a pair or the same trust domain. When being a proxy of an AF / AS in the same trust domain, the first device may generate a second key between the UE and the second device for the second device based on the first key. Specifically, the first device may generate a second key based on the first key and identifier information of the second device, where the second device and the first device are in the same trust domain.

[0063] In an embodiment of the present disclosure, data transmission is performed between the first device and a second device or a UE. Specifically, the first device receives data protected based on a third key from a UE and transmits the data to a second device. The third key is generated by the UE and is the same as the first key, and / or the first device receives data transmitted from a second device, protects the data based on the first key, and transmits the data (i.e., the data protected based on the first key) to the UE.

[0064] In practical application, the first device can provide the UE with a list of second devices that the UE can access, where the list may include an identifier of each second device, and the identifiers of the second devices are unique.

[0065] In one embodiment, the method may include the first device establishing a TLS secure channel with the UE, such that the first device and the UE are capable of secure transmission over the TLS secure channel.

[0066] As can be appreciated by those skilled in the art, the essence of establishing a secure channel is that the first device and the UE each derive a pair of symmetric keys and use the symmetric keys to encrypt and / or integrity protect data.

[0067] In the embodiment of the present disclosure, the first device establishing a TLS secure channel with the UE may specifically include the first device generating a pre-master key or an external pre-shared key of the TLS secure channel based on the first key or a derived key of the first key. That is, in the embodiment of the present disclosure, the first key or its derived key generated based on the AKMA technology may be used as a pre-shared key (pre-shared key / secret or pre-shared key / secret) for establishing a TLS channel to generate a pre-master key (premaster key / secret) or an external pre-shared key (external pre-shared key / secret, PSK) of the TLS secure channel. (The concepts of the pre-master key and the external pre-shared key are equivalent, and for the sake of simplicity, they will be referred to as the pre-master key hereinafter.) Subsequently, data encryption and / or integrity protection can be performed based on the pre-master key or the derived key of the pre-master key. In this way, the first key or its derivative key generated by the AKMA mechanism is skillfully used to solve the problem of pre-shared key configuration of the TLS channel, and the TLS secure channel mechanism can be used to effectively ensure the security of the communication between the first device and the UE. This solution does not require additional complex operations or large-scale device modifications, is simple and easy to implement, and is suitable for large-scale deployment and popularization.

[0068] In some embodiments, the method comprises: The method may further include the first device transmitting first protected data to the UE, the first protected data including data protected by the first device based on the first key or a derived key of the first key.

[0069] In some embodiments, the method comprises: The first device may further include receiving data protected based on a third key or a derived key of a third key sent from the UE, the third key being generated by the UE and being the same key as the first key.

[0070] When the first device and the UE use a TLS secure channel to protect communication security, the first key or a derived key of the first key here is, i.e., a pre-master key of the TLS channel or a derived key of the pre-master key, and data security is performed using the pre-master key or a derived key of the pre-master key.

[0071] Similarly, when the first device and the UE use a TLS secure channel to secure communication, the third key or a derived key of the third key here is a pre-master key or a derived key of the TLS channel, and the pre-master key or a derived key of the pre-master key is used to secure data.

[0072] The derived key here refers to a key obtained through one or more derivations based on the first key / third key, where the derived key derived from the first key n times can be used as a pre-shared key for the TLS channel, the derived key derived from the first key m times can be used as a pre-master key for the TLS channel, and the derived key of the third key is treated similarly to the derived key of the first key.

[0073] Below, we will describe the technical means of this proposal in line with the development of the network.

[0074] As shown in FIGS. 8 and 9, in an embodiment of the present disclosure, an authentication and / or key management method is provided, and the method includes steps 801-803.

[0075] Step 801, the AAP / AP receives a session establishment request message sent by the UE, which is accompanied by an AKMA key identifier.

[0076] Here, the official name of A-KID is AKMA Key IDentifier, and it is abbreviated as AKMA key identifier.

[0077] Specifically, in practical application, before this step, AUSF From K AKMA and A-KID can be inferred.

[0078] When the UE initiates communication with the AAP / AP, it includes the A-KID parameter in the Application Session Establishment Request message. Before or after sending the message, the UE AKMA and / or K AF It is possible to infer the following.

[0079] Step 802, based on the AKMA key identifier, AF Get the.

[0080] In practical application, the AAP / AP selects an AAnF to send a key request message, and receives an AKMA application key K AF can be received.

[0081] Here, if the AAP / AP does not have an activated context associated with the A-KID, the AAP / AP selects one AAnF and sends an Naanf_AKMA_ApplicationKey_Get Request message (i.e., a key request message) to the AAnF to obtain the UE’s K AF The AAP / AP may select one AAnF according to the process defined in the related art.

[0082] Here, the key request message is accompanied by the A-KID and an identifier of the AF / AS (e.g., AF_ID). The AF_ID may include the FQDN (Fully Qualified Domain Name) of the AF and a security protocol identifier, which may be represented as a Ua* protocol identifier. Here, the Ua* protocol identifier is used to identify the security protocol used between the AAP / AP and the UE.

[0083] In practical application, the AAnF can check whether to provide services to the AAP / AP based on the configured local policy or the authorization information or policy provided by the NRF (Network Repository Function). Specifically, the AAnF checks whether to provide services to the AAP / AP by: The AAnF checks whether the AAnF can provide service to the AAP / AP based on the identifier of the AF / AS; If the check result shows that the AAnF can provide service to the AAP / AP, a valid K AKMA Check whether there is a K effective for the AAnF AKMA determining, if any, the AKMA that the user may be permitted to use; K effective for the AAnF AKMA does not exist, issuing an error response.

[0084] As shown in Figure 9, AAnF has K AF If there is no, AAnF is K AKMA from the UE's AKMA application key K AF Infer that.

[0085] Specific K AF The inference procedure of can be performed according to the definition in the related art, and will not be repeated in the embodiments of the present disclosure.

[0086] As shown in FIG. 9, the AAnF can send a Naanf_AKMA_ApplicationKey_Get Response message (i.e., a key response message) to the AAP / AP, and the key response message includes K AF In other words, the AAP / AP receives the AKMA application key K of the UE attached to the key response message sent from the AAnF. AF and receive life cycle.

[0087] Step 803, send an application layer session establishment response message to the UE.

[0088] Combining Figures 8 and 9, when the AAP / AP sends an Application Session Establishment Response message to the UE, if the information in the fourth step of Figure 9 indicates that the AKMA key request failed, the AAP / AP should reject the application session establishment request and attach the error cause in this step. Then, the UE may send a new application session establishment request to the AAP / AP with the latest A-KID.

[0089] In practical application, if the AAP / AP is outside the carrier network, the AAP / AP can transmit the K from the AAnF via the NEF (Network Exposure Function). AF and life cycle.

[0090] Between UE and AAP / AP AF After having K, the AAP / AP can infer a key based on the AF / AS associated with the AAP / AP. AF and the identifier of the AF / AS as input to deduce an application key between the UE and the AF / AS. The UE generates an application key between the UE and the AF / AS based on the same algorithm. When the UE sends an application request to the AF / AS, the AF / AS requests an application key from the AAP / AP, and then subsequent authentication or session protection can be performed with the UE based on the key.

[0091] In practical application, the AAP / AP does not need to infer a separate key for the AF / AS. In this case, when the UE communicates with the AF / AS, it can send the AF / AS's identifier to the AAP / AP in the service message, which the AAP / AP will forward to the AF / AS. Since authentication and data transmission protection are performed between the UE and the AAP / AP, and mutual trust-based secure protocol communication is performed between the AAP / AP and the AF / AS, sequential security protection of the application layer from the UE to the AAP / AP and from the AAP / AP to the AF / AS can be realized. This realizes the security of data transmission from the UE to each AF / AS.

[0092] In the authentication and / or key management method according to the embodiment of the present disclosure, an AAP / AP is introduced into the AKMA basic network model, and the AAP / AP can be a proxy for an AF / AS in a set or the same trust domain, or a specific AF / AS among the set or the same trust domain can be the AAP / AP. That is, the AAP / AP can apply for an AKMA application key on behalf of one or more AF / AS. The AF / AS trusts the AAP / AP. This reduces the resources required by the AUSF and the AAnF to establish an AKMA application key for the UE and the AF / AS, reduces the delay in obtaining the AKMA key, and meets the service needs of low-latency scenarios.

[0093] As shown in FIG. 10 , in an embodiment of the present disclosure, an authentication and / or key management method is provided, and the method includes steps 1001 and 1002.

[0094] Step 1001: The UE sends a session establishment request message carrying a key identifier to a first device.

[0095] Here, the first device may include an AAP / AP, specifically, an AAP / AP inside a carrier network, or an AAP / AP outside a carrier network. When the AAP / AP is outside a carrier network, the AAP / AP can communicate with a network element of a core network through a NEF.

[0096] Step 1002, the UE receives first protection data sent from a first device.

[0097] Specifically, the first protected data includes data protected by the first device based on a first key or a derived key of the first key, the first key being obtained by the first device based on a key identifier, and the first key being an AKMA application key K AF may be also possible.

[0098] For the first device, after the first device obtains the first key as a proxy for a set of AF / AS or AF / ASs in the same trust domain, it issues K AF The first device can infer an AKMA key from the first key, which is obtained by the first device based on the key identifier. Specifically, the first device can obtain the first key corresponding to the key identifier locally based on the key identifier. Alternatively, the first device can obtain the first key corresponding to the key identifier from the AAnF based on the key identifier.

[0099] On the other hand, for the UE, the UE can generate a third key that is the same as the first key and a fourth key that is the same as the second key. That is, the UE generates the AKMA application key on the UE side by itself, and generates the third key and the fourth key used for communication with the first device and the second device, respectively, and the third key and the fourth key are the same as the first key and the second key, respectively. The AKMA application key of the AF / AS is generated by the AAP / AP. As described above, the second key is generated based on the first key and the identification information of the second device.

[0100] In an embodiment of the present disclosure, data transmission is performed between the first device and a second device or a UE, and specifically, the UE may send data protected based on the third key or a derived key of the third key to the first device, and the first device may send the data to the second device; and / or the UE may receive second protected data transmitted from the second device, the second protected data including data protected by the second device based on the second key, the second key being generated for the second device by the first device based on the first key; And / or the UE may receive data protected and forwarded by the first device based on the first key.

[0101] In some embodiments, the method further includes the UE establishing a TLS secure channel with the first device.

[0102] In some embodiments, the UE establishing a TLS secure channel with the first device specifically includes: The UE generating a third key that is the same as the first key; The UE may generate a pre-master key or an external pre-shared key of the TLS secure channel according to the third key or a derived key of the third key. The content of this part related to the UE has already been described in the above content related to the first device, and will not be repeated here.

[0103] In practical application, the first device can provide the UE with a list of second devices that the UE can access, that is, the UE can obtain a list of second devices that the UE can access from the first device, where the list may include an identifier of each second device, and the identifiers of the second devices are not duplicated.

[0104] In the authentication and / or key management method according to the embodiment of the present disclosure, an AAP / AP is introduced into the AKMA basic network model, and the AAP / AP can apply for an AKMA application key on behalf of one or more AF / ASs. The AF / AS trusts the AAP / AP, and the UE obtains a first key between the AAP / AP through interaction with the AAP / AP, thereby reducing the resources required for AUSF and AAnF to establish an AKMA application key for the UE and the AF / AS, reducing the delay in obtaining the AKMA key, and meeting the service needs of low-latency scenarios.

[0105] As shown in FIG. 11 , in an embodiment of the present disclosure, a first device used for authentication and / or key management is provided, which includes: a first processing module 1101 and a first obtaining module 1102 .

[0106] The first processing module 1101 is configured to receive a session establishment request message originated by a UE, the session establishment request message carrying a key identifier; The first obtaining module 1102 is configured to obtain a first key between the UE based on the key identifier.

[0107] In one embodiment, the first device may further include a generating module. The generation module is configured to generate a second key between the UE and the second device for a second device based on the first key.

[0108] In one embodiment, the generation module is further configured to generate a second key based on the first key and identifier information of the second device.

[0109] In one embodiment, the first processing module 1101 further comprises: receiving data protected based on a third key from the UE, and transmitting the data to a second device; and / or configured to receive data transmitted from a second device, protect the data based on the first key, and transmit the data to the UE; The third key is generated by the UE and is the same as the first key.

[0110] In one embodiment, the first acquisition module 1102 further comprises: and obtaining, locally, a first key corresponding to the key identifier based on the key identifier; or It is configured to obtain a first key corresponding to the key identifier from the AAnF based on the key identifier.

[0111] In one embodiment, the first processing module 1101 is further configured to provide, to the UE, a list of second devices accessible by the UE.

[0112] In one embodiment, the first processing module 1101 is further configured to establish a TLS secure channel with the UE.

[0113] In one embodiment, the first processing module 1101 is further configured to generate a pre-master key or an external pre-shared key for the TLS secure channel based on the first key or a derivative of the first key.

[0114] In one embodiment, the first processing module 1101 is further configured to transmit first protected data to the UE, the first protected data including data protected by the first device based on the first key or a derived key of the first key.

[0115] In one embodiment, the first processing module 1101 is further configured to receive data sent from the UE that is protected based on a third key or a derived key of a third key, the third key being the same key as the first key generated by the UE.

[0116] In the first device according to the embodiment of the present disclosure, the first device can apply for an AKMA application key on behalf of one or more AF / ASs that trust the first device and may belong to the same trust domain, thereby reducing the resources required by the AUSF and the AAnF to establish AKMA application keys for the UE and the AF / ASs, reducing the delay in obtaining the AKMA key to a certain extent, and meeting the service needs of low-latency scenarios.

[0117] In addition, the first device in the embodiments of the present disclosure is a device capable of executing the above-mentioned authentication and / or key management method, and therefore all embodiments of the above-mentioned authentication and / or key management method can be applied to the first device and achieve the same or similar beneficial effects.

[0118] As shown in FIG. 12, in an embodiment of the present disclosure, a terminal used for authentication and / or key management is further provided, the terminal including: a second processing module 1201 and a first receiving module 1202; a second processing module 1201 configured to send a session establishment request message carrying the key identifier to the first device; a first receiving module 1202 configured to receive first protected data transmitted from the first device; The first protected data includes data protected by the first device based on a first key or a derived key of the first key, the first key being obtained by the first device based on the key identifier.

[0119] In one embodiment, the terminal a third processing module configured to generate a third key identical to the first key, and to transmit data protected under the third key or a derivative of the third key to the first device, and the first device transmits the data to a second device; a fourth processing module configured to generate a fourth key, the fourth key being identical to the second key; a second receiving module configured to receive second protected data transmitted from the second device, the second protected data including data protected by the second device based on the second key, the second key being generated for the second device by the first device based on the first key; and / or and a second receiving module configured to receive data protected and transmitted by the first device based on the first key.

[0120] In one embodiment, the terminal may further include a second obtaining module configured to obtain, from the first device, a list of second devices accessible by the UE.

[0121] In one embodiment, the second processing module 1201 is further configured to establish a TLS secure channel with the first device.

[0122] In one embodiment, the second processing module 1201 further comprises: generating a third key that is identical to the first key; generating a pre-master key or an external pre-shared key for the TLS secure channel based on the third key or a derivative of the third key.

[0123] In the terminal according to the embodiment of the present disclosure, an AAP / AP is introduced into the AKMA basic network model, and the AAP / AP can subscribe to an AKMA application key on behalf of one or more AF / AS. The AF / AS trusts the AAP / AP, and the UE obtains a first key between the AAP / AP through interaction with the AAP / AP, thereby reducing the resources required for AUSF and AAnF to establish an AKMA application key for the UE and the AF / AS, reducing the delay in obtaining the AKMA key, and meeting the service needs of low-latency scenarios.

[0124] In addition, a terminal according to an embodiment of the present disclosure is a device capable of executing the above-mentioned authentication and / or key management method, and therefore, all embodiments of the above-mentioned authentication and / or key management method can be applied to the terminal and achieve the same or similar beneficial effects.

[0125] When applying the related AKMA network model to edge computing scenarios, one manufacturer may have multiple APPs (Applications). These APPs are considered as AF / AS, and when using the AKMA application key as the shared key between the UE and the APP to infer the key for subsequent application layer protection, each APP needs to request the AKMA application key from the AAnF in the core network. For delay-sensitive services, the generation time of the application layer shared key may not be able to meet the low-latency requirement.

[0126] As shown in FIG. 13, in an embodiment of the present disclosure, an AAP / AP deployment architecture for a low-latency scenario in an edge cloud system is provided. Multiple APPs (e.g., APP1, APP2, etc.) with strict latency requirements are deployed on the edge cloud, and these APPs are designated as AF / AS. In this case, the AAP / AP interacts with the NEF and AAnF of the core cloud in advance to obtain keys, so that all APPs can use this secure channel, and there is no need to obtain keys from the core cloud for each individual APP. As a result, an application layer secure channel between the UE and the APP can be established to meet the requirement of low latency.

[0127] In an embodiment of the present disclosure, a communication device is further provided, which includes a memory, a processor, and a program stored in the memory and executable on the processor, and when the processor executes the program, it realizes each procedure in the above-mentioned authentication and / or key management method embodiment and can achieve the same technical effect, which will not be repeated here to avoid duplication.

[0128] In an embodiment of the present disclosure, a computer-readable storage medium is further provided, which, when executed by a processor, realizes each procedure in the above-mentioned authentication and / or key management method embodiment and achieves the same technical effect, and will not be described again here to avoid duplication, where the computer-readable storage medium is, for example, a read-only memory (abbreviated as ROM), a random access memory (abbreviated as RAM), a magnetic disk, or an optical disk.

[0129] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as a method, a system, or a computer program product. Thus, the present disclosure may be realized in the form of a completely hardware-based embodiment, a completely software-based embodiment, or an embodiment that combines hardware and software. The present disclosure may also be realized in the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, magnetic memory, optical memory, etc.) that includes computer usable code.

[0130] The present disclosure has been described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present disclosure. It will be understood that each process and / or block in the flowcharts and / or block diagrams, and combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor, or other programmable data processing device to generate a machine that, through the instructions executed by the processor of the computer or other programmable data processing device, implements the functionality specified in one or more processes in the flowcharts and / or one or more blocks in the block diagrams.

[0131] These computer program instructions are stored on a computer-readable storage medium that instruct a computer or other programmable data processing device to operate in a particular manner, and the instructions stored on the computer-readable storage medium configure a command apparatus, including a paper product, to perform the functions specified in one or more processes in the flowcharts and / or one or more blocks in the block diagrams.

[0132] These computer program instructions can be loaded into a computer or other programmable data processing device and cause a series of operational steps to be executed on the computer or other programmable device to generate a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowcharts and / or one or more blocks in the block diagrams.

[0133] The above are some embodiments of the present disclosure. However, those skilled in the art can make many improvements and modifications without departing from the principles of the present disclosure, which should also be considered as the protection scope of the present disclosure. [Explanation of symbols]

[0134] 1101 First Processing Module 1102 First Acquisition Module 1201 Second Processing Module 1202 First receiving module

Claims

1. 1. An authentication and / or key management method, comprising: receiving, by a first device, a session establishment request message originating from a user equipment (UE), the session establishment request message carrying a key identifier; and obtaining, by the first device, a first key between the first device and the UE based on the key identifier. Authentication and / or key management methods.

2. The method comprises: The method of claim 1 , further comprising the first device generating, for a second device, a second key between the UE and the second device based on the first key.

3. generating, by the first device, a second key between the UE and the second device for a second device based on the first key; The method of claim 2 , further comprising the first device generating a second key based on the first key and identifier information of the second device.

4. The method comprises: receiving, by the first device, data protected based on a third key from the UE, and transmitting the data to a second device; and / or The first device further includes receiving data transmitted from a second device, protecting the data based on the first key, and transmitting the data to the UE; The method of claim 1 , wherein the third key is generated by the UE and is the same as the first key.

5. Obtaining a first key between the UE based on the key identifier, The first device locally obtains a first key corresponding to the key identifier based on the key identifier; or 2. The method of claim 1, comprising: the first device obtaining, based on the key identifier, a first key corresponding to the key identifier from an application layer authentication and key management anchor function (AAnF).

6. The method comprises: The method of claim 1 , further comprising the first device providing to the UE a list of second devices accessible to the UE.

7. The method comprises: The method of claim 1 , further comprising the first device establishing a Transport Layer Security (TLS) secure channel with the UE.

8. Establishing a TLS secure channel with the UE by the first device, The method of claim 7 , comprising the first device generating a pre-master key or an external pre-shared key for the TLS secure channel based on the first key or a derivative of the first key.

9. The method comprises: The method further includes the first device transmitting first protection data to a UE; 9. The method of claim 1, 7, or 8, wherein the first protected data includes data protected by the first device under the first key or a derivative of the first key.

10. The method comprises:

9. The method of claim 1, further comprising the first device receiving data sent from the UE that is protected based on a third key or a derivative of a third key, the third key being the same key as the first key generated by the UE.

11. The method of claim 1 , wherein the first device is used to represent a set of Application Functions (AF) / Application Servers (AS) or AFs / ASs that are in the same trust domain.

12. The method of claim 1 , wherein the first device comprises an Application Layer Authentication and Key Management (AKMA) application proxy, or an authentication proxy, or an AKMA authentication proxy.

13. 1. An authentication and / or key management method, comprising: The UE sends a session establishment request message carrying the key identifier to the first device; receiving, by the UE, first protection data transmitted from the first device; 11. An authentication and / or key management method, wherein the first protected data includes data protected by the first device based on a first key or a derived key of the first key, and the first key was obtained by the first device based on the key identifier.

14. The method comprises: the UE generating a third key identical to the first key, and transmitting data protected under the third key or a derived key of the third key to the first device, so that the first device transmits the data to a second device; and / or The UE generates a fourth key that is the same as the second key, and receives second protected data sent from the second device; and / or The method further includes receiving data protected and forwarded by the first device based on the first key, 14. The method of claim 13, wherein the second protected data includes data protected by the second device under the second key, the second key being generated by the first device for the second device under the first key.

15. The method comprises: The method of claim 13 , further comprising the UE obtaining, from the first device, a list of second devices accessible to the UE.

16. The method comprises: The method of claim 13, further comprising the UE establishing a TLS secure channel with the first device.

17. Establishing a TLS secure channel with the first device by the UE, the UE generating a third key that is identical to the first key; The method of claim 13, comprising: the UE generating a pre-master key or an external pre-shared key for the TLS secure channel based on the third key or a derivative of the third key.

18. The method of claim 13 , wherein the first device is used to represent a set of AF / AS or AF / AS that are in the same trust domain.

19. The method of claim 13 , wherein the first device comprises an AKMA application proxy, or an authentication proxy, or an AKMA authentication proxy.

20. A first device used for authentication and / or key management, A first processing module configured to receive a session establishment request message originated by a UE, the session establishment request message carrying a key identifier; a first obtaining module configured to obtain a first key between the UE based on the key identifier.

21. A terminal used for authentication and / or key management, a second processing module configured to send a session establishment request message carrying the key identifier to the first device; a first receiving module configured to receive first protected data transmitted from the first device; A terminal, wherein the first protected data includes data protected by the first device based on a first key or a derived key of the first key, and the first key is obtained by the first device based on the key identifier.

22. A communication device, A communications device comprising a memory, a processor, and a program stored in the memory and executable on the processor, the communications device realizing an authentication and / or key management method according to any one of claims 1 to 12, or an authentication and / or key management method according to any one of claims 13 to 19, when the processor executes the program.

23. A computer-readable storage medium having a computer program stored thereon, the computer program implementing, when executed by a processor, steps of an authentication and / or key management method according to any one of claims 1 to 12, or steps of an authentication and / or key management method according to any one of claims 13 to 19.

Images