Method and apparatus for transmitting a user identifier

Abstract

This application provides a method and apparatus for transmitting a user identifier. The method includes: an ME receiving USIM card information from a UICC in a cloud card pool via a first communication connection; the ME receiving an identity request from a 5G SA network, the identity request being for requesting acquisition of an SUCI; the ME acquiring the SUCI based on the identity request and the USIM card information, the USIM card information indicating that the SUCI generation device is the ME or the UICC; and the ME transmitting the SUCI to the 5G SA network, the SUCI being used to establish a second communication connection. The SUCI may be generated on the ME side or on the UICC side. The first communication connection may be a roaming communication connection, and the second communication connection may be a non-roaming communication connection. The method allows a non-roaming 5G communication connection to be established in a cloud communication scenario, thereby saving user fees.

Description

[Technical field]

[0001] The present application relates to the field of communications, and in particular to a method and apparatus for transmitting a user identifier. [Background technology]

[0002] Cloud communication is a method for establishing a communication connection without using a subscriber identity module (SIM) card. A terminal device establishes a first communication connection using a subscriber or virtual SIM card, obtains cloud SIM card information from a cloud end through the first communication connection, and establishes a second communication connection based on the cloud SIM card information. This eliminates the need to install two card slots in the terminal device, thereby reducing the cost of the terminal device.

[0003] When the second communication connection is a communication connection of a standalone (SA) network in a 5th generation (5G) mobile communication system, the establishment of the second communication connection requires the terminal device to verify its identity in the SA network. How can the terminal device verify its identity in the SA network to establish a second communication connection in a cloud communication scenario is a problem to be solved at present. Summary of the Invention [Problem to be solved by the invention]

[0004] The present application aims to provide a method and apparatus for transmitting a user identifier, which can verify an identity in an SA network and establish a second communication connection in a cloud communication scenario. [Means for solving the problem]

[0005] A first aspect provides a method for transmitting a user identifier, including: a mobile equipment (ME) receiving universal subscriber identity module (USIM) card information from a universal integrated circuit card (UICC) in a cloud card pool via a first communication connection; the ME receiving an identity request to request to obtain a subscriber concealed identifier (SUCI) from a 5G SA network; the ME obtaining the SUCI to indicate that a generating device of the SUCI is the ME or the UICC based on the identity request and the USIM card information; and the ME transmitting the SUCI to the 5G SA network for establishing a second communication connection.

[0006] The SUCI may be generated on the ME side or on the UICC side. In some cases, the USIM card information instructs the ME side to generate the SUCI, and the ME generates the SUCI locally, thereby avoiding the delay of obtaining the SUCI from the UICC, and thus the second communication connection can be established quickly. In other cases, the USIM card information instructs the UICC side to generate the SUCI, and thus, for example, when the USIM card information lacks 124 service and 125 service, the ME can obtain the SUCI from the UICC, and thus the second communication connection can be established successfully.

[0007] A second aspect provides an apparatus for transmitting a user identifier, comprising means for performing any one of the methods in the first aspect.

[0008] A third aspect provides an apparatus for transmitting a user identifier, the apparatus comprising a processor and a memory for storing a computer program, the processor retrieving and executing the computer program from the memory, thereby causing the apparatus to perform any one of the methods of the first aspect.

[0009] A fourth aspect provides a computer program product comprising computer program code which, when transmitted to a device of a user identifier and executed, causes the device to perform any one of the methods of the first aspect.

[0010] A fifth aspect provides a computer readable medium having program code stored thereon, the program code including instructions for performing any one of the methods of the first aspect. Effect of the Invention

[0011] The method and device for transmitting a user identifier according to the present application can verify an identity in an SA network in a cloud communication scenario, and can establish a second communication connection to an independent network of a mobile communication system in 5G. [Brief description of the drawings]

[0012] [Figure 1] 1 is a schematic diagram showing a communication system provided by the present application; [Diagram 2] FIG. 2 is a schematic diagram showing a method for transmitting a user identifier provided by the present application; [Diagram 3] FIG. 13 is a schematic diagram showing another method for transmitting a user identifier provided by the present application; [Figure 4] FIG. 2 is a schematic diagram showing another method of transmitting a user identifier provided by the present application; [Diagram 5] FIG. 2 is a schematic diagram showing an apparatus for transmitting a user identifier provided by the present application; [Figure 6]FIG. 2 is a schematic diagram showing an apparatus for transmitting a user identifier provided by the present application; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] The technical means of the present application will be described below with reference to the drawings.

[0014] First, a scene in which the present invention is applied will be introduced. FIG. 1 is a schematic diagram showing a communication system in which the present invention is applied.

[0015] The communication system 100 includes a network device 110, a network device 120, and a terminal device 130. In this application, the network device 110 is a base station defined in 3GPP (registered trademark), and may be, for example, a base station (gNB) in a 5G communication system. The network device 110 may also be a relay station, an access point, an in-vehicle device, a wearable device, and other types of communication devices.

[0016] The network device 120 may be a server that provides information required for establishing a communication connection to the terminal device 130. For example, the server includes at least a UICC and provides an authentication service required for establishing a communication connection when the terminal device 130 attempts to establish a communication connection with the network device 110. Therefore, the network device 120 is also called a remote authentication module or a cloud card pool.

[0017] The terminal device 130 communicates with the network device 110 and the network device 120. The terminal device 130 may include a handheld device, an in-vehicle device, or a wearable device having a wireless communication function, such as a user equipment (UE), a mobile station (MS), or an ME defined in the 3rd generation partnership project (3GPP). Although the communication system 100 has been described as an example, the communication system applied to the present application is not limited to this. For example, the communication system 100 may include many network devices.

[0018] In order to ensure security in the network, when the terminal device 130 attempts to establish a communication connection with the network device 110, it is necessary for the network device 110 to verify the identity of the terminal device 130, that is, the network device 110 needs to obtain the SUCI of the terminal device 130. The SUCI may be generated in the terminal device 130 or in the network device 120. When the terminal device 130 obtains the SUCI, it transmits the SUCI to the network device 110, and the network device 110 verifies the security of the SUCI before establishing a communication connection.

[0019] The method for transmitting a user identifier provided in the present application is described in detail below. As shown in Figure 2, the method 200 includes the following steps: S210, the ME receives USIM card information from a UICC in the cloud card pool via a first communication connection.

[0020] The first communication connection may be a wireless connection, for example, a cellular network connection or a Wi-Fi connection. The first communication connection may be a wired connection. The present application is not limited to a specific form of the first communication connection. In the present application, adjectives such as "first" and "second" are intended to indicate different individuals of the same type of object, for example, the first communication connection and the second communication connection mentioned below indicate two different communication connections. The USIM card information may be an EFust file (i.e., a USIM service table) or other information. The present application is not limited to a specific content of the USIM card information. The USIM card information is for establishing a second communication connection, and when the ME obtains the USIM card information, it establishes a radio resource control (RRC) link with the 5G SA network, and sends a registration request including a globally unique temporary identifier (GUTI) to the 5G SA network through the RRC link. When the 5G SA network receives the registration request and sends an identity request to the ME, the ME performs the following steps:

[0021] S220: The ME receives a status request from a 5G SA network, the status request being to request to obtain a SUCI. In step S230, the ME obtains the SUCI based on the status request and the USIM card information, which is for indicating that the generating device of the SUCI is the ME or the UICC.

[0022] The SUCI may be generated on the ME side or on the UICC side. In some cases, if the USIM card information instructs the ME side to generate the SUCI, the ME will generate the SUCI locally, which can avoid the delay of obtaining the SUCI from the UICC and quickly establish the second communication connection. In other cases, if the USIM card information instructs the UICC side to generate the SUCI, for example, if the USIM card information lacks 124 service and 125 service, the ME will obtain the SUCI from the UICC, which ensures the successful establishment of the second communication connection.

[0023] Table 1 shows some cases in which the ME obtains a SUCI. [Table 1] In Table 1, client means a business operator.

[0024] The client determines whether the ME obtains the SUCI locally based on the identity request when the information implementing the non-cryptographic scheme is placed in the USIM card information and the USIM card information satisfies any one of the four conditions in Table 1. The client determines whether the information implementing the non-cryptographic scheme is placed in the USIM card information and the USIM card information satisfies any one of the four conditions in Table 1. too If not satisfied (ie, the meaning shown as "N / A" in Table 1), the ME obtains a SUCI from the UICC based on the status request.

[0025] The four conditions in Table 1 are as follows: The USIM card information shall include configuration information that the operator requests the ME to generate a SUCI. The USIM card information includes configuration information for unauthorised emergency conversation. The USIM card information is from a card before R15. The USIM card information is that of an R15 card, but is arranged so that the R15 card is a non-encrypted card.

[0026] When information for performing an encryption scheme is placed in the USIM card information, the client specifies the manner of generating SUCI according to whether the ME includes 124 service and 125 service in the EFust file, where the encryption scheme may be, for example, an elliptic curve integrate encryption scheme (ECIES).

[0027] For example, if the EFust file does not include the 124 and 125 services, the ME generates a SUCI locally, and if the EFust file includes the 124 and 125 services, the ME obtains the SUCI from the UICC. When the ME obtains a SUCI from the UICC according to the status request, the ME sends a SUCI obtainment request to the UICC via the first communication connection, and receives the SUCI from the UICC via the first communication connection. When the ME obtains the SUCI, it performs the following steps:

[0028] S240, the ME sends the SUCI to the 5G SA network, the SUCI is for establishing a second communication connection. The first communication connection may be a roaming communication connection. The second communication connection may be a non-roaming communication connection. According to the method 200, a non-roaming 5G communication connection can be established in a cloud communication scenario, and the user can save fees.

[0029] The flow of establishing the second communication connection will be described below with reference to FIGS. As shown in Figure 3, when the ME establishes a first communication connection, it establishes an RRC link with the 5G SA network. Then, the ME receives an identity request from the 5G SA network through the RRC link, and identifies and obtains an SUCI according to the identity request.

[0030] The ME determines whether to execute a non-cryptographic scheme based on the USIM card information. If the non-cryptographic scheme is executed, the ME obtains SUCI from the UICC. If the non-cryptographic scheme is not executed, the ME executes ECIES and identifies the mode of generating SUCI depending on whether the EFust file includes 124 service and 125 service.

[0031] If the EFust file does not include the 124 and 125 services, the ME generates a SUCI locally. If the EFust file includes the 124 and 125 services, the ME obtains the SUCI from the UICC.

[0032] When the ME acquires the SUCI, it transmits a response including the SUCI to the 5G SA network via the RRC link. Then, it receives an authentication request from the 5G SA network via the RRC link. The ME transfers the authentication request to the UICC, and upon receiving the authentication response sent by the UICC, it transfers the authentication response to the 5G SA network via the RRC link. This establishes a communication connection with the 5G SA network (i.e., a second communication connection).

[0033] FIG. 4 is another schematic diagram of establishing a second communication connection. The steps before the ME transmits the authentication response to the 5G core network (5G core, 5GC) are the same as those in Fig. 3, so they will not be described here repeatedly. Among them, the authentication request may include 5G authentication and key agreement (AKA) information, or may include extensible authentication protocol (EAP)-AKA information. After completing the authentication task, the 5GC sends a non-access stratum (NAS) security mode command to the ME via the radio access network (RAN). Upon receiving the NAS security mode command, the ME executes the NAS security mode and sends a NAS security mode completion message to the 5GC via the RAN.

[0034] Next, the RAN sends an access stratum (AS) security mode command to the ME, and upon receiving the AS security mode command, the ME executes the AS security mode and sends an AS security mode complete message to the RAN.

[0035] The RAN further transmits a 5G capability query message to the ME, and the ME transmits a 5G capability report message to the RAN upon receiving the 5G capability query message. Next, the 5GC transmits a registration receipt message to the ME via the RAN, and receives a registration completion message from the ME via the RAN, thereby establishing a second communication connection.

[0036] The above is a detailed description of an example of the method for transmitting a user identifier provided by the present application. It should be understood that the device for transmitting a user identifier includes hardware and / or software modules corresponding to performing each function to achieve the above functions. It is easily understood by those skilled in the art that, with reference to the means, algorithms and steps of each example described based on the embodiments disclosed in this specification, the present application can also be realized in the form of hardware and a combination of hardware and computer software. Whether a function is performed in the form of hardware or in the form of computer software driving the hardware is determined by the specific application and design limitations of the technical means. A technical expert can realize the described functions using different methods for a specific application, but this realization should not exceed the scope of the present application.

[0037] The present application divides the functional means of the device for transmitting a user identifier according to the above method example, for example, by dividing each function into a separate functional means, or by integrating two or more functions into one processing means. The above-mentioned integrated means may be realized by means not exceeding the scope, or may be realized in the form of software functional means. It should be noted that the division into means in the present application is exemplary and merely a logical division of functions, and other divisions may be used in actual implementation.

[0038] 5 is a schematic diagram showing the configuration of a device for transmitting a user identifier provided by the present application. The device 500 includes a processing means 510, a receiving means 520, and a transmitting means 530. The processing means 510 realizes a receiving function by the receiving means 520, and further realizes a transmitting function by the transmitting means 530.

[0039] The receiving means 520 is for receiving USIM card information from a UICC in a cloud card pool through a first communication connection, and receiving a status request from a 5G SA network, the status request being for requesting to obtain a SUCI. The processing means 510 is for obtaining the SUCI according to the identity request and the USIM card information, the USIM card information being for indicating that the generating device of the SUCI is the device 500 or the UICC. The sending means 530 is for sending the SUCI to the 5G SA network, the SUCI is for establishing a second communication connection.

[0040] Preferably, the processing means 510 is specifically used for: If the USIM card information includes encryption instruction information and the USIM card configuration information does not include 124 service and 125 service, obtain the SUCI locally according to the identity request. Or, when the USIM card information includes encryption instruction information and the USIM card configuration information includes 124 service and 125 service, the SUCI is obtained from the UICC according to the status request.

[0041] Preferably, the processing means 510 is specifically used for: Send a SUCI acquisition request to the UICC via the first communication connection according to the status request. Acquire the SUCI from the UICC via the first communication connection.

[0042] Preferably, the processing means 510 is specifically used for: The USIM card information does not include encryption instruction information, and the USIM card information satisfies any of the following four conditions: too If the USIM card information does not include encryption instruction information, the SUCI is obtained from the UICC based on the status request. Alternatively, if the USIM card information does not include encryption instruction information and the USIM card information satisfies any one of the following four conditions, the SUCI is obtained locally based on the status request: The four conditions are that the USIM card information includes configuration information in which the operator requests the device 500 to generate the SUCI, that the USIM card information includes configuration information for an unauthorised emergency conversation, that the USIM card information is information of a pre-R15 card, and that the USIM card information is information of an R15 card but is configured such that the R15 card is an unencrypted card.

[0043] Preferably, the processing means 510 is specifically used for: sending a SUCI acquisition request to the UICC through the first communication connection according to the identity request, and acquiring the SUCI from the UICC through the first communication connection. The specific forms and beneficial effects of the apparatus 500 and the execution method 200 may refer to the relevant descriptions in the above method embodiments.

[0044] 6 is a schematic diagram showing the configuration of a device for transmitting a user identifier provided by the present application. Wherein, the dotted lines indicate that the corresponding modules or means are optional. The device 600 is for implementing the method described in the above method embodiment. The device 600 may be a chip or a terminal device. The device 600 includes one or more processors 601 that can support the device 600 to implement the method of the method embodiment corresponding to FIG. 2. The processor 601 may be a general-purpose processor or a special-purpose processor. For example, the processor 601 may be a central processing unit (CPU) or a baseband processor. The baseband processor is for processing communication data (e.g., SUCI). The CPU is for controlling the device 600 and for executing software programs or for processing data of the software programs.

[0045] The device 600 includes a transceiver means 605 and an antenna 606 for realizing input (reception) and output (transmission) of signals. For example, the device 600 may be a chip. The transceiver means 605 may be an input and / or output circuit of the chip, or a communication interface of the chip. The chip may be an integral part of a terminal device or other wireless communication device.

[0046] The device 600 includes one or more memories 602, in which a program 604 is stored. When the program 604 is executed by the processor 601, it generates instructions 603, and the processor 601 performs the method described in the above method embodiment based on the instructions 603. Preferably, the memory 602 further stores data. Preferably, the processor 601 further reads the data stored in the memory 602. The data may be stored in the same memory address as the program 604 or in a different memory address than the program 604. The processor 601 and the memory 602 may be located separately or may be integrated. For example, it may be integrated in a system on chip (SOC).

[0047] It should be understood that in the above method embodiments, each step may be performed by a logical circuit in the form of hardware or an instruction in the form of software in the processor 601. The processor 601 may be a CPU, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, such as transistor gates, transistor logic devices, or independent hardware means. The device 600 and the implementation method 200 may refer to the relevant descriptions in the above method embodiments for their specific forms and beneficial effects.

[0048] The present application further provides a computer program product, which, when executed by the processor 601, implements the communication method as set forth in any one of the method embodiments herein.

[0049] The computer program product may be stored in the memory 602 as, for example, a program 604. The program 604 is converted into an executable target file that can be executed by the processor 601 through processes such as initial processing, compiling, assembling, and linking.

[0050] The present application further provides a computer readable medium having a computer program stored thereon, the computer program being operable, when executed by a computer, to implement the communication method as described in any one of the method embodiments herein, the computer program being either a high level program or an executable target program.

[0051] The computer readable storage medium may be, for example, memory 602. Memory 602 may be a volatile memory or a non-volatile memory. Alternatively, memory 602 may include both volatile and non-volatile memory. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM) used as an external cache memory. Many types of RAM may be used, as described by way of example and without limitation. For example, static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous linked dynamic random access memory (synchlink DRAM, SLDRAM), and direct rambus random access memory (direct rambus RAM, DR RAM) may be used.

[0052] As will be clearly understood by those skilled in the art, for convenience and brevity of explanation, the detailed operation processes of the above-described systems, devices and means may be referred to the corresponding processes in the embodiments of the method, and therefore will not be described here repeatedly.

[0053] The systems, devices, and methods according to some embodiments provided in the present application may be realized in other forms. For example, some features of the above-described methods may be ignored or not performed. The above-described devices are merely exemplary, and the division of the means is only based on logic and function, and may be divided in other ways when actually realized. A plurality of means or components may be combined or integrated into other systems. Furthermore, the coupling of each means or each component may be direct coupling or indirect coupling. The above coupling may be electrical, mechanical, or other form of connection.

[0054] It should be understood that in each embodiment of the present application, the size of the numbers of each process does not indicate the order of execution. The order of execution of each process should be specified according to its function and inherent logic, but they do not limit the implementation of the embodiments of the present application. In addition, the expressions "system" and "network" are sometimes used interchangeably in this specification. The term "and / or" referred to in this specification is merely a relational relationship expressing related objects, and means that there are three relations. For example, A and / or B means three cases, that is, only A exists, A and B exist at the same time, and only B exists. In addition, in this specification, the symbol " / " generally indicates an "or" relationship between related objects before and after. In short, what has been described above is a preferred embodiment of the technical means of the present application, and does not limit the scope of protection of the present application. Any modifications, equivalent replacements, and improvements within the spirit and principles of the present application are all included in the scope of protection of the present application.

Claims

1. The mobile device ME receives USIM card information from a universal integrated circuit card UICC in the cloud card pool through a first communication connection; The ME receives an identity request from a fifth generation 5G independent SA network to request to obtain a user cryptographic identifier (SUCI); The ME obtains the SUCI based on the identity request and the USIM card information, the USIM card information being for indicating that the SUCI generation device is the ME or the UICC; and The ME transmits the SUCI to the 5G SA network for establishing a second communication connection.

2. The ME obtains the SUCI based on the status request and the USIM card information, If the USIM card information includes encryption instruction information, and the USIM card configuration information does not include 124 service and 125 service, the ME obtains the SUCI locally according to the status request; or The method for transmitting a user identifier as described in claim 1, further comprising: when the USIM card information includes encryption instruction information and when the USIM card configuration information includes 124 service and 125 service, the ME obtains the SUCI from the UICC based on the status request.

3. The ME obtaining the SUCI from the UICC based on the status request, the ME sending a SUCI acquisition request to the UICC via the first communication connection based on the status request; and The method of claim 2 , further comprising: the ME obtaining the SUCI from the UICC via the first communication connection.

4. The ME obtains the SUCI based on the status request and the USIM card information, If the USIM card information does not include encryption instruction information, and the USIM card information does not satisfy any of the following four conditions, the ME obtains the SUCI from the UICC based on the status request; or If the USIM card information does not include encryption instruction information, and if the USIM card information satisfies any one of the following four conditions, the ME locally obtains the SUCI based on the status request: The method for transmitting a user identifier as described in claim 1, characterized in that the four conditions are that the USIM card information includes configuration information in which an operator requests the ME to generate the SUCI, that the USIM card information includes configuration information for an emergency conversation without authorization, that the USIM card information is information of a pre-R15 card, and that the USIM card information is information of an R15 card but is configured such that the R15 card is an unencrypted card.

5. The ME obtaining the SUCI from the UICC based on the status request, the ME sending a SUCI acquisition request to the UICC via the first communication connection based on the status request; and The method of claim 4 , further comprising: the ME obtaining the SUCI from the UICC via the first communication connection.

6. A sending user identifier device, comprising: A receiving means, a processing means and a transmitting means are included, The receiving means is for receiving global user identity module USIM card information from a universal integrated circuit card UICC in a cloud card pool through a first communication connection, and receiving an identity request from a fifth generation 5G independent SA network, the identity request being for requesting to obtain a user encryption identifier SUCI; the processing means is for obtaining the SUCI based on the identity request and the USIM card information, the USIM card information being for indicating that a generating device of the SUCI is a device of the sending user identifier or the UICC; The transmitting means is for transmitting the SUCI to the 5G SA network, and the SUCI is for establishing a second communication connection.

7. Specifically, the processing means When the USIM card information includes encryption instruction information and the USIM card configuration information does not include 124 service and 125 service, locally obtain the SUCI according to the identity request; or The sending user identifier device according to claim 6, characterized in that, when the USIM card information includes encryption instruction information and the USIM card configuration information includes 124 service and 125 service, the sending user identifier device is for obtaining the SUCI from the UICC based on the status request.

8. Specifically, the processing means sending a SUCI acquisition request to the UICC via the first communication connection based on the status request; and 8. The apparatus of claim 7, for obtaining the SUCI from the UICC via the first communication connection.

9. Specifically, the processing means When the USIM card information does not include encryption instruction information and the USIM card information does not satisfy any of the following four conditions, obtain the SUCI from the UICC based on the status request; or The USIM card information does not include encryption instruction information and is for locally obtaining the SUCI based on the identity request when the USIM card information satisfies any one of the following four conditions: The sending user identifier device of claim 6, characterized in that the four conditions are that the USIM card information includes configuration information in which an operator requests the device to generate the SUCI, that the USIM card information includes configuration information for an unauthorized emergency conversation, that the USIM card information is information of a card before R15, and that the USIM card information is information of an R15 card but is configured so that the R15 card is an unencrypted card.

10. Specifically, the processing means sending a SUCI acquisition request to the UICC via the first communication connection based on the status request; and 10. The apparatus of claim 9, for obtaining the SUCI from the UICC via the first communication connection.

Images