Method and apparatus for handling non-access stratum context - Patents.com

Abstract

The embodiments of the present application provide a method and apparatus for processing non-access stratum context, which relate to the field of communication technologies and solve the problem of increased signaling overhead due to the NAS security context stored in a terminal device being inconsistent with the NAS security context stored in a PLMN. A specific solution is as follows: a terminal device sends a registration request message to a first public land mobile network (PLMN); the terminal device receives a registration accept message from the first PLMN; and when the terminal device deregisters from the first PLMN via the first access network, the terminal device stores, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device. The embodiments of the present application are used for processing non-access stratum context.

Description

[Technical field]

[0001] This application claims priority to Chinese Patent Application No. 202011013180.9, filed with the State Intellectual Property Office of China on September 23, 2020, entitled "METHOD AND APPARATUS FOR PROCESSING NON-ACCESS STRATA CONTEXT", and Chinese Patent Application No. 202011163930.0, filed with the State Intellectual Property Office of China on October 27, 2020, entitled "METHOD AND APPARATUS FOR PROCESSING NON-ACCESS STRATA CONTEXT", each of which is incorporated by reference in its entirety herein.

[0002] FIELD OF THE DISCLOSURE Embodiments of the present application relate to the field of communication technologies, and in particular to a method and apparatus for processing non-access stratum context. [Background technology]

[0003] A terminal device may simultaneously establish two non-access stratum (NAS) connections between the terminal device and a public land mobile network (PLMN): a 3GPP NAS connection and a non-3GPP NAS connection, via two different types of access networks, i.e., a 3rd generation partnership project (3GPP) access network and a non-3GPP access network. As shown in FIG. 1(a), the terminal device may simultaneously register to a PLMN via two NAS connections, and the same access and mobility management node of the PLMN serves the terminal device. Alternatively, the terminal device may register to different PLMNs via the two NAS connections, respectively. As shown in FIG. 1(b), the terminal device establishes a 3GPP NAS connection with PLMN-A, and the terminal device establishes a non-3GPP NAS connection with PLMN-B.

[0004] When a terminal device deregisters from a PLMN, both the terminal device and the PLMN (or the access and mobility management node of the PLMN) need to store the current native NAS security context (the most recently activated native NAS security context) of the terminal device. However, the NAS security context stored in the terminal device may be inconsistent with the NAS security context stored in the PLMN. If the terminal device protects a registration request (RR) message using a NAS security context stored in the terminal device and the PLMN validates the RR message using a NAS security context different from the NAS security context stored in the terminal device, the PLMN fails to validate the RR message and the PLMN initiates primary authentication. Primary authentication causes extra signaling overhead.

[0005] Below are some examples: (1) A terminal device registers to PLMN-A via a 3GPP® access network and a non-3GPP® access network. An access and mobility management node of PLMN-A provides services to the terminal device. In this case, PLMN-A stores a 3GPP® NAS security context and a non-3GPP® NAS security context. (2) A terminal device deregisters from PLMN-A via a non-3GPP® access network. In this case, the terminal device stores the terminal device's non-3GPP® NAS security context with PLMN-A in a storage medium of the terminal device. (3) A terminal device registers to PLMN-B via a non-3GPP® access network, and the terminal device establishes a non-3GPP® NAS security context with PLMN-B. (4) A terminal device deregisters from PLMN-B via a non-3GPP® access network. In this case, the non-3GPP NAS security context with PLMN-A stored in the terminal device is overwritten, and the non-3GPP NAS security context corresponding to PLMN-B is stored after overwriting. (5) The terminal device registers to PLMN-A via the non-3GPP access network. In this case, the terminal device sends an RR message to PLMN-A via the non-3GPP access network. Before sending the RR message, the terminal device reads the non-3GPP NAS security context stored in the storage medium. The non-3GPP NAS security context has been established between the terminal device and PLMN-B. The terminal device protects the RR message using the non-3GPP NAS security context corresponding to PLMN-B.However, after receiving the RR message sent by the terminal device via the non-3GPP access network, PLMN-A validates the RR message by using the non-3GPP NAS security context stored in (1) established by the terminal device with PLMN-A. As a result, the non-3GPP NAS security context stored in the terminal device conflicts with the non-3GPP NAS security context stored in PLMN-A, and PLMN-A fails to validate the RR message. In this case, PLMN-A initiates primary authentication, which causes extra signaling overhead. Summary of the Invention

[0006] In this application, the NAS security context with a PLMN established by a terminal device or the NAS security context of a terminal device with a PLMN may also be referred to as NAS security context for short. The NAS security context with a PLMN established by a terminal device corresponding to a non-3GPP access network or the NAS security context of a terminal device with a PLMN corresponding to a non-3GPP access network may also be referred to as non-3GPP NAS security context for short. The NAS security context with a PLMN established by a terminal device corresponding to a 3GPP access network or the NAS security context of a terminal device with a PLMN corresponding to a 3GPP access network may also be referred to as 3GPP NAS security context for short.

[0007] In this application document, the storage medium of the terminal device is the USIM of the terminal device, the non-volatile memory of the mobile device, or the non-volatile memory of the terminal device.

[0008] The embodiments of the present application provide a method and apparatus for processing non-access stratum context, and solve the problem of increased signaling overhead due to the NAS security context stored in the terminal device being inconsistent with the NAS security context stored in the PLMN.

[0009] In order to achieve the aforementioned objectives, the following technical solutions are used in the embodiments of this application.

[0010] According to a first aspect, a method for processing a non-access stratum context is provided. The method comprises: a terminal device sending a first registration request message to a first public land mobile network (PLMN). The terminal device receives a registration accept message from the first PLMN. When the terminal device deregisters from the first PLMN via the first access network, the terminal device stores, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device.

[0011] In the prior art, the terminal device stores a NAS security context based on the type of access network. However, if the terminal device does not store a PLMN identifier, the NAS security context stored in the file of the type of access network to be registered may not be the NAS security context of the PLMN to be registered. That is, the NAS security context selected by the terminal device is inconsistent with the NAS security context of the terminal device stored in the PLMN. Therefore, in the present application, when storing the first NAS security context, the terminal device may also store the first PLMN identifier of the first PLMN to establish the first NAS security context. In this way, when registering again with the first PLMN, the terminal device may select the NAS security context to be established with the first PLMN based on the identifier of the first PLMN to protect the second registration request message. When the first PLMN receives the second registration request message, the first PLMN may obtain the NAS security context to be established with the terminal device stored on the network side to process the registration request message sent by the terminal device. In this way, the primary authentication process that is initiated when the NAS security context stored in the PLMN is inconsistent with the NAS security context used by the terminal device to protect the second registration request message can be avoided, and thus additional signaling overhead can be avoided. In addition, in the prior art, the additional signaling overhead also has a large impact on some IoT devices. In the present application, the primary authentication can be avoided while reducing the impact on the IoT device. In addition, in the prior art, after performing the primary authentication, the PLMN further needs to generate a new key, which the PLMN further needs to activate when connecting to the access network, and further needs to generate and activate a new key for protecting user data based on the new key. This affects the continuity of the service.However, in this application, when primary authentication is avoided, the PLMN does not need to activate new keys and does not affect service continuity since new keys do not need to be generated.

[0012] In one possible design example, after the terminal device deregisters from the first PLMN via the first access network, the method further comprises: if the terminal device intends to register again to the first PLMN via the first access network, before the terminal device sends a second registration request message to the first PLMN, the terminal device determines a first NAS security context with the first PLMN, which is established by the terminal device, based on the first PLMN identifier. The terminal device protects the second registration request message by using the first NAS security context. The terminal device sends the second registration request message, which is protected by using the first NAS security context, to the first PLMN via the first access network. That is, to ensure that the NAS security context used when the terminal device sends the second registration request message is consistent with the NAS security context stored on the PLMN side, the terminal device may determine the NAS security context of the terminal device and the first PLMN to which the terminal device intends to register, based on the first PLMN identifier.

[0013] In one possible design example, the terminal device storing in a storage medium of the terminal device a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device comprises: if the USIM of the terminal device supports storage of registration management parameters, the terminal device stores the first NAS security context and the first PLMN identifier in the USIM. If the USIM does not support storage of registration management parameters, the terminal device stores the first NAS security context and the first PLMN identifier in a non-volatile storage medium of the terminal device. In this specification, if the USIM card is removed from the terminal device and inserted into another new terminal device, the new terminal device can still use the data stored in the USIM, so the data is preferentially stored in the USIM.

[0014] In one possible design example, the method further comprises the terminal device validating the first NAS security context and the first PLMN identifier. Specifically, each time the terminal device stores a new first NAS security context, the terminal device may validly set the newly stored first NAS security context, and may use the valid NAS security context in a subsequent registration process.

[0015] In one possible design example, the terminal device storing in a storage medium of the terminal device a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device comprises the terminal device storing in the storage medium of the terminal device a first NAS security file and the first PLMN identifier if the storage medium of the terminal device does not store a NAS security context with the first PLMN established by the terminal device. If the storage medium of the terminal device already stores a NAS security context with the first PLMN established by the terminal device, the terminal device replaces the stored NAS security context with the first NAS security context. In this case, it can be understood that in the storage medium, each PLMN corresponds to one PLMN identifier, and each PLMN identifier corresponds to one file used to store the NAS security context of the PLMN. The file may include multiple NAS security contexts with PLMNs established by the terminal device by using multiple access network types. For example, the file corresponding to the first PLMN identifier stores a 3GPP NAS security context and a non-3GPP NAS security context of the first PLMN. In this way, when the terminal device intends to register with the first PLMN, the terminal device may select the first NAS security context from the file corresponding to the first PLMN identifier to protect the second registration request message, so that the first NAS security context selected by the terminal device is consistent with the NAS security context stored on the first PLMN side, thereby avoiding primary authentication initiated by the PLMN when the first NAS security context selected by the terminal device conflicts with the NAS security context stored on the first PLMN side.

[0016] In one possible design example, the terminal device storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device comprises: if the storage medium of the terminal device does not store a NAS security context corresponding to the first access network, the terminal device stores, in the storage medium of the terminal device, the first NAS security context and the first PLMN identifier. In this way, when the terminal device intends to register with the first PLMN through the first access network, the terminal device may obtain the first NAS security context from the storage medium to protect the second registration request message, so that the first NAS security context selected by the terminal device is consistent with the NAS security context stored on the first PLMN side, thereby avoiding primary authentication initiated by the PLMN when the first NAS security context selected by the terminal device is inconsistent with the NAS security context stored on the first PLMN side.

[0017] If the storage medium of the terminal device already stores a NAS security context corresponding to the first access network, the terminal device replaces the stored NAS security context corresponding to the first access network with the first NAS security context and stores the first PLMN identifier. Thus, when the terminal device intends to register in the first PLMN via the first access network, the terminal device may retrieve the first NAS security context from the storage medium to ensure that the NAS security context selected by the terminal device matches the NAS security context stored in the first PLMN with which the terminal device intends to register.

[0018] In one possible design example, the terminal device storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device comprises: if the storage medium of the terminal device does not store the NAS security context of the terminal device with the first PLMN, the terminal device stores the first NAS security context and the first PLMN identifier in the storage medium of the terminal device. In this way, when the terminal device intends to register with the first PLMN through the first access network, the terminal device may obtain the first NAS security context from the storage medium to protect the second registration request message, so that the first NAS security context selected by the terminal device is consistent with the NAS security context stored on the first PLMN side, thereby avoiding primary authentication initiated by the PLMN when the first NAS security context selected by the terminal device is inconsistent with the NAS security context stored on the first PLMN side.

[0019] If the storage medium of the terminal device already stores the first PLMN identifier and the NAS security context of the terminal device with the first PLMN, the terminal device replaces the stored NAS security context of the terminal device with the first PLMN with the first NAS security context and stores the first PLMN identifier. Thus, when the terminal device intends to register with the first PLMN via the first access network, the terminal device may retrieve the first NAS security context from the storage medium to ensure that the NAS security context selected by the terminal device matches the NAS security context stored in the first PLMN with which the terminal device intends to register.

[0020] In a possible design example, before the terminal device stores the first PLMN identifier of the first PLMN and the first NAS security context with the first PLMN established by the terminal device in the storage medium of the terminal device, the method further includes the terminal device deregistering from the first PLMN via all access networks. In this way, in the case where the terminal device establishes multiple connections with the first PLMN via multiple access networks, if the terminal device still registers with the first PLMN via the second access network after the terminal device deregisters from the first PLMN via the first access network, the terminal device may first store in the memory the first NAS security context that needs to be stored when deregistering from the first PLMN via the first access network. If the terminal device also deregisters from the first PLMN via the second access network, the terminal device determines to deregister from the first PLMN via all access networks. In this case, the terminal device stores the first NAS security context and the first PLMN identifier in the storage medium, and stores the security context established when registering with the first PLMN via the second access network and the first PLMN identifier in the storage medium, in this way, the number of times the terminal device accesses the storage medium and the number of times the stored NAS security context is updated can be reduced.

[0021] In a possible design example, the method further includes the terminal device storing first time information, where the first time information is a time when the terminal device last used the first NAS security context, a time when the terminal device deregisters from the first PLMN, a time when the terminal device stores the first NAS security context, or a validity period of the first NAS security context. Thus, when selecting a NAS security context, the terminal device may determine, based on the first time information, whether the first NAS security context has been used recently, whether the first NAS security context is a context that was most recently deregistered from the first PLMN, whether the first NAS context is a context that was most recently stored, or whether the first NAS context is still valid. It can also be understood that the terminal device may determine whether to select a first NAS security context based on the first time information, such that when selecting a NAS security context corresponding to the first PLMN identifier, the terminal device may select the latest NAS security context corresponding to the first PLMN identifier, and when the terminal device registers again to the first PLMN, the NAS security context selected by the terminal device will match the security context stored in the first PLMN.

[0022] In a possible design example, the method further comprises the terminal device determining, based on the first time information, that the first NAS security context is invalid. The terminal device deletes the first NAS security context stored in the storage medium of the terminal device or sets the first NAS security context to invalid. For example, the first NAS security context has been stored for a long time but has not been used. In this case, the first NAS security context may be deleted or set to invalid. The first NAS security context set to invalid is replaced with a new NAS security context that is stored. In this way, the storage space of the storage medium can be used more efficiently.

[0023] In a possible design example, the method further comprises the terminal device deleting the first PLMN identifier from a storage medium of the terminal device or setting the first PLMN identifier to invalid. For example, the terminal device determines based on the first time information that the first PLMN identifier has been stored for a long time but has not been used. In this case, the first PLMN identifier corresponding to the first NAS security context may also be deleted or set to invalid. The first PLMN identifier set to invalid is replaced with a new PLMN identifier that is stored. In this way, the storage space of the storage medium can be used more efficiently.

[0024] The terminal device determining that the first NAS security context is invalid based on the first time information may comprise, if the first time information is a time when the terminal device last used the first NAS security context, a time when the terminal device deregisters from the first PLMN, or a time when the terminal device stores the first NAS security context, the terminal device determining that the first NAS security context is invalid after a period of time after a time indicated by the first time information. If the first time information is a validity period of the first NAS security context, the terminal device determines that the first NAS security context is invalid after the validity period of the first NAS security context.

[0025] In a possible design example, the method further comprises the terminal device storing an identifier of the first access network in a storage medium of the terminal device. Specifically, when storing the first NAS security context and the first PLMN identifier, the terminal device may further store a corresponding identifier of the first access network. In this way, when the terminal device re-registers with the first PLMN through the first access network, the terminal device may select a first NAS security context corresponding to the first access network and the first PLMN based on the first PLMN identifier and the identifier of the first access network. In this way, the speed of selecting the first NAS security context by the terminal device can be further improved while the first NAS security context selected by the terminal device is consistent with the NAS security context stored in the first PLMN.

[0026] In a possible design example, after sending the first registration request message to the first public land mobile network PLMN, the terminal device receives a first GUTI assigned by the first PLMN. The first GUTI is used to identify the terminal device. The terminal device stores the first GUTI in a storage medium of the terminal device. Specifically, it can be understood that before the terminal device deregisters from the first PLMN through the first access network, the method further comprises the terminal device receiving a first globally unique temporary identifier GUTI assigned by the first PLMN. The first GUTI is used to identify the terminal device. The first GUTI includes the first PLMN identifier. If the storage medium of the terminal device has already stored the second GUTI, the terminal device deletes the second GUTI and stores the first GUTI, or replaces the second GUTI with the first GUTI. If the storage medium of the terminal device does not store the second GUTI, the terminal device stores the first GUTI. The second GUTI is sent to the terminal device before the first PLMN assigns the first GUTI, and the second GUTI includes the first PLMN identifier.

[0027] In the prior art, the GUTI is stored in different files based on different access networks. When the terminal device registers to the first PLMN through the second access network, the first PLMN assigns GUTI-2 (second GUTI) to the terminal device. After the terminal device deregisters from the first PLMN, the terminal device stores GUTI-2 in a file used to store GUTI or location information corresponding to the second access network. Then, when the terminal device registers to the first PLMN through the first access network, the first PLMN assigns GUTI-1 (first GUTI) to the terminal device. In this case, the terminal device stores GUTI-1 in a file used to store GUTI or location information corresponding to the first access network. However, the first PLMN stores GUTI-1 newly assigned to the terminal device. When the terminal device registers to the first PLMN again through the second access network, the terminal device may select a GUTI that is not the newly assigned GUTI, i.e., the stored GUTI-2 is selected. However, the first PLMN cannot identify GUTI-2. Therefore, the first PLMN initiates primary authentication. However, in this application, the terminal device may delete the pre-stored GUTI-2 assigned by the first PLMN, or replace the GUTI-2 with the GUTI-1 newly assigned by the first PLMN. Thus, when registering again with the first PLMN via the second access network, the terminal device selects GUTI-1 and includes the GUTI-1 in the registration request message. The GUTI-1 is the same as the GUTI-1 newly assigned to the terminal device and stored in the first PLMN, to avoid the first PLMN being unable to identify the GUTI in the registration request message and performing the prior art primary authentication.

[0028] In a possible design example, after the terminal device sends the first registration request message to the first public land mobile network PLMN, the method further includes the terminal device receiving from the first PLMN a second PLMN identifier of a second PLMN equivalent to the first PLMN, and the terminal device stores the second PLMN identifier in a storage medium of the terminal device.

[0029] In the prior art, the terminal device does not store the equivalent PLMN identifier of the equivalent PLMN. Therefore, the terminal device cannot determine whether the GUTI is assigned by the equivalent PLMN of the PLMN to which the terminal device intends to register, the terminal device cannot select the GUTI assigned by the equivalent PLMN, and the PLMN cannot obtain the context of the terminal device from the equivalent PLMN. However, in the present application, the second PLMN identifier of the second PLMN equivalent to the first PLMN may be stored in a storage medium. In this case, if the second PLMN used as the equivalent PLMN assigns a GUTI, the terminal device may include the GUTI assigned by the second PLMN used as the equivalent PLMN in the registration request message. In this way, the first PLMN may obtain the context of the terminal device from the second PLMN based on the GUTI assigned by the equivalent PLMN, so that the case where the first PLMN cannot obtain the context from the equivalent PLMN can be avoided, and the first PLMN does not need to initiate primary authentication.

[0030] In a possible design example, after the terminal device deregisters from the first PLMN through the first access network, the method further comprises: when the terminal device intends to register again with the first PLMN, the terminal device acquires a third GUTI allocated by the second PLMN based on the stored second PLMN identifier. The terminal device includes the third GUTI in a third registration request message. The terminal device sends the third registration request message to the first PLMN. In this specification, the third GUTI is understood as a GUTI allocated by an equivalent PLMN. When the terminal device sends the third registration request message carrying the third GUTI to the first PLMN, the first PLMN may acquire a context of the terminal device from the second PLMN based on a GUTI (i.e., the third GUTI) allocated by the equivalent PLMN (the second PLMN), so as to avoid a case where the first PLMN cannot acquire a context from the equivalent PLMN, and the first PLMN does not need to initiate primary authentication.

[0031] In some embodiments, before the terminal device stores the first GUTI in the storage medium of the terminal device, the method further comprises the terminal device determining whether the terminal device deregisters from the first PLMN through all access networks. If the terminal device determines to deregister from the first PLMN through all access networks, the terminal device determines to store the first GUTI in the storage medium of the terminal device. In the present application, the first GUTI can be stored after the terminal device deregisters from the first PLMN through all access networks, similar to the principle that the terminal device stores the first PLMN identifier only after the terminal device deregisters through all access networks. In this way, the number of times the terminal device updates the GUTI in the storage medium can be reduced. Otherwise, the terminal device needs to update the GUTI in the storage medium every time the first PLMN assigns a new GUTI.

[0032] In some embodiments, the terminal device storing the first GUTI in the storage medium of the terminal device comprises: when the terminal device determines that the terminal device has stored the second GUTI assigned by the first PLMN in a file used to store the second access network, and the second GUTI is assigned when the terminal device registers with the first PLMN via the second access network, the terminal device deletes the second GUTI and / or stores the first GUTI in the file used to store the second access network. In this way, the GUTI stored in the terminal device and assigned by the first PLMN is the latest GUTI and matches the latest GUTI stored on the first PLMN side.

[0033] In some embodiments, the terminal device storing the first GUTI in the storage medium of the terminal device further comprises the terminal device further storing second time information in the storage medium of the terminal device. The second time information is a time when the first PLMN assigned the first GUTI, or a time when the terminal device stored the first GUTI, or a time when the terminal device or the first PLMN last used the first GUTI. The second time information is used by the terminal device when registering with the first PLMN. The terminal device selects a GUTI newly assigned by the first PLMN, a GUTI assigned by the first PLMN and recently used by the terminal device or the first PLMN, or a GUTI assigned by the first PLMN and recently stored by the terminal device based on the second time information, and includes the selected GUTI in a registration request message sent by the terminal device to the first PLMN. That is, the terminal device may select a recently used GUTI associated with the first PLMN based on the second time information, and the first PLMN also stores the latest GUTI newly assigned to the terminal device, so that the first PLMN can identify the GUTI in the registration request message sent by the terminal device, and the first PLMN can avoid initiating primary authentication because the first PLMN cannot identify the GUTI in the registration request message.

[0034] In some embodiments, the terminal device storing the first GUTI in a storage medium of the terminal device comprises the terminal device determining a fourth GUTI on the terminal device. The terminal device deletes the fourth GUTI and / or stores the first GUTI in a file storing the fourth GUTI. The fourth GUTI is the oldest GUTI stored in the storage medium of the terminal device. The oldest stored GUTI may be different from the GUTI newly assigned to the terminal device by the first PLMN. Thus, the terminal device may replace the oldest assigned fourth GUTI with the newly assigned first GUTI, so that the GUTI of the terminal device matches the GUTI newly assigned to the terminal device by the first PLMN, and avoid the first PLMN initiating primary authentication because the first PLMN cannot identify the GUTI in the registration request message.

[0035] In some embodiments, before the terminal device sends the second registration request message to the first PLMN, the method further comprises: the terminal device sequentially reading a plurality of files storing a plurality of GUTIs, and if the read GUTI is assigned by the first PLMN, the terminal device includes the GUTI in the second registration request message. It can be understood that if the read GUTI is associated with the first PLMN identifier, the terminal device includes the GUTI in the second registration request message.

[0036] In one possible design example, the terminal device storing, in a storage medium of the terminal device, the first PLMN identifier of the first PLMN and the first NAS security context with the first PLMN established by the terminal device comprises: if a file used to store the NAS security context of the first access network stores the NAS security context and the PLMN identifier before the first NAS security context and the first PLMN identifier are stored, or if a file used to store the NAS security context corresponding to the first access network already stores the NAS security context and the PLMN identifier but the NAS security context and the PLMN identifier are set to invalid, the terminal device replacing the stored NAS security context with the first NAS security context and replacing the stored PLMN identifier with the first PLMN identifier. This design may also be understood as storing the first PLMN identifier and the first NAS security context based on a type of access network. Each file of a type of access network stores an identifier of the PLMN and a NAS security context of the type of access network.

[0037] In one possible design example, the terminal device storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device comprises the terminal device storing the first NAS security file and the first PLMN identifier in a file used to store the NAS security context of the first access network if the file used to store the NAS security context of the first access network does not store a NAS security context of the first PLMN and the terminal device before the first NAS security context and the first PLMN identifier are stored. In this manner, it may be understood that when the first PLMN identifier and the first NAS security context are stored based on a type of access network, the file of the access network may include multiple PLMN identifiers and corresponding NAS security files.

[0038] If the file already stores the NAS security context of the first PLMN and the terminal device with the first PLMN identifier before the first NAS security context and the first PLMN identifier are stored, or if the NAS security context and the first PLMN identifier of the first PLMN stored in the file are set to invalid, the terminal device replaces the stored NAS security context of the first PLMN and the terminal device with the first NAS security context. Thus, when the first PLMN identifier and the first NAS security context are stored based on the type of the access network, it can be understood that the file of the access network may include one PLMN identifier and one NAS security file.

[0039] In one possible design example, the terminal device storing in a storage medium of the terminal device a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device comprises the terminal device storing the first NAS security file and the first PLMN identifier in the file if the file used to store the NAS security context of the first PLMN does not store a NAS security context or a NAS security context corresponding to the first access network before the first NAS security context and the first PLMN identifier are stored. If the file used to store the NAS security context of the first PLMN already stores a NAS security context or a NAS security context corresponding to the first access network before the first NAS security context and the first PLMN identifier are stored, or the NAS security context or the NAS security context corresponding to the first access network stored in the file used to store the NAS security context of the first PLMN is set to invalid, the terminal device replaces the NAS security context stored in the file with the first NAS security context. Alternatively, the stored NAS security context corresponding to the first access network is replaced with the first NAS security context. Optionally, the terminal device stores the first PLMN identifier. Thus, each PLMN may have a file used to store the NAS security context of the PLMN, the file comprising the security context of the first access network and the security context of the other access network. For example, the first access network corresponds to a 3GPP NAS security context and the other access network corresponds to a non-3GPP NAS security context.

[0040] In one possible design example, the terminal device storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device comprises a file used by the terminal device to store a NAS security context of a first access network of the first PLMN storing the first NAS security context and the first PLMN identifier. In this manner, each PLMN may have two files for storing the NAS security context of the PLMN, e.g., one file for storing the 3GPP NAS security context of the PLMN and the other file for storing the non-3GPP NAS security context of the PLMN.

[0041] According to a second aspect, a method for processing a non-access stratum context is provided. The method comprises: before the terminal device transmits a registration request message to a first public land mobile network PLMN via a first access network, the terminal device obtains a first NAS security context with the first PLMN, the first NAS security context being established by the terminal device based on a first PLMN identifier of the first PLMN from a storage medium of the terminal device. The terminal device protects the registration request message by using the first NAS security context. The terminal device transmits the registration request message, protected by using the first NAS security context, to the first PLMN via the first access network.

[0042] Similarly to the first aspect, when storing the first NAS security context, the terminal device also stores the first PLMN identifier of the first PLMN for which the first NAS security context is established. In this way, when registering again with the first PLMN, the terminal device may select a NAS security context to be established with the first PLMN based on the identifier of the first PLMN to protect the registration request message. When the first PLMN receives the registration request message, the first PLMN may process the registration request message sent by the terminal device based on the NAS security context to be established with the terminal device stored by the first PLMN. In this way, a primary authentication process that is initiated when the NAS security context stored in the PLMN conflicts with the NAS security context used by the terminal device to protect the registration request message can be avoided, thereby avoiding additional signaling overhead. In addition, the impact on the IoT device can be reduced while avoiding the primary authentication. In addition, when avoiding the primary authentication, the PLMN does not need to activate a new key and does not affect the continuity of the service because there is no need to generate a new key.

[0043] In one possible design example, the terminal device acquiring a first NAS security context with the first PLMN established by the terminal device based on a first PLMN identifier of the first PLMN from a storage medium of the terminal device comprises: if the USIM of the terminal device supports storage of registration management parameters, the terminal device reads the first NAS security context from the USIM based on the first PLMN identifier. If the USIM does not support storage of registration management parameters, the terminal device reads the first NAS security context from the non-volatile storage medium of the terminal device based on the identifier of the first PLMN. That is, the terminal device preferentially attempts to read the NAS security context from the USIM based on the first PLMN identifier. If the terminal device fails to read the NAS security context from the USIM, the terminal device reads the first NAS security context corresponding to the first PLMN identifier from the non-volatile storage medium. This is because if the USIM card is removed from the terminal device and inserted into another new terminal device, the new terminal device can still use the data stored in the USIM.

[0044] In one possible design example, the terminal device acquiring a first NAS security context with the first PLMN established by the terminal device based on a first PLMN identifier of the first PLMN from a storage medium of the terminal device comprises the terminal device acquiring the first NAS security context from a file used to store a NAS security context corresponding to the first access network, in the storage medium of the terminal device, based on the first PLMN identifier, or the terminal device acquiring the first NAS security context from a file used to store a NAS security context of the terminal device with the first PLMN, based on the first PLMN identifier, or the terminal device acquiring the first NAS security context from a file corresponding to the first access network used to store a NAS security context of the terminal device with the first PLMN, based on the first PLMN identifier. In this way, the first NAS security context determined by the terminal device can match a NAS security context stored in the first PLMN where the terminal device intends to register, so that the first PLMN does not need to perform primary authentication.

[0045] In one possible design example, before the terminal device sends the registration request message to the first PLMN, the method further includes the terminal device obtaining, from a storage medium of the terminal device, a second PLMN identifier of a second PLMN equivalent to the first PLMN. The terminal device obtains a second globally unique temporary identifier GUTI assigned by the second PLMN based on the second PLMN identifier from the storage medium of the terminal device. The terminal device includes the second GUTI in the registration request message.

[0046] The storage medium of the terminal device stores a second PLMN identifier of a second PLMN equivalent to the first PLMN. In this case, when the second PLMN used as the equivalent PLMN assigns a second GUTI, the terminal device may include the second GUTI assigned by the second PLMN used as the equivalent PLMN in the registration request message. In this way, the first PLMN may obtain the context of the terminal device from the second PLMN based on the second GUTI of the equivalent PLMN, so that the case where the first PLMN cannot obtain the context from the equivalent PLMN can be avoided, and the first PLMN does not need to initiate primary authentication.

[0047] In a possible design example, before the terminal device sends the registration request message to the first PLMN, the method further includes the terminal device acquiring a first GUTI assigned by the first PLMN based on the first PLMN identifier from the storage medium of the terminal device. The terminal device includes the first GUTI in the registration request message. In this case, the first PLMN may acquire a NAS security context established by the first PLMN and the terminal device based on the first GUTI.

[0048] According to a third aspect, there is provided a terminal device comprising the following modules: a sending module configured to send a first registration request message to a first public land mobile network PLMN, a receiving module configured to receive a registration accept message from the first PLMN, and a processing module configured to store, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device when the terminal device deregisters from the first PLMN via the first access network.

[0049] In one possible design example, after the terminal device deregisters from the first PLMN via the first access network, the processing module is further configured to determine a first NAS security context with the first PLMN established by the terminal device based on the first PLMN identifier and protect the second registration request message by using the first NAS security context before the transmitting module is configured to transmit the second registration request message, protected by using the first NAS security context, to the first PLMN via the first access network.

[0050] In one possible design example, the processing module is configured to store the first NAS security context and the first PLMN identifier on a universal subscriber identity module USIM of the terminal device if the USIM supports storage of registration management parameters, or to store the first NAS security context and the first PLMN identifier in a non-volatile storage medium of the terminal device if the USIM does not support storage of registration management parameters.

[0051] In one possible design example, the processing module is further configured to set the first NAS security context to valid.

[0052] In one possible design example, the processing module is configured to store a first NAS security file and a first PLMN identifier in a storage medium of the terminal device if the storage medium of the terminal device does not store a NAS security context with the first PLMN established by the terminal device, or to replace the stored NAS security context with the first NAS security context if the storage medium of the terminal device already stores the first PLMN identifier and a NAS security context with the first PLMN established by the terminal device.

[0053] In one possible design example, the processing module is configured to store a first NAS security context in a storage medium of the terminal device and store a first PLMN identifier if the storage medium of the terminal device does not store a NAS security context corresponding to the first access network.

[0054] In one possible design, the processing module is further configured to deregister from the first PLMN via all access networks.

[0055] In one possible design example, the processing module is further configured to store first time information, where the first time information is the time when the terminal device last used the first NAS security context, the time when the terminal device deregisters from the first PLMN, the time when the terminal device stores the first NAS security context, or the validity period of the first NAS security context.

[0056] In a possible design example, the processing module is further configured to determine that the first NAS security context is invalid based on the first time information, and to delete the first NAS security context stored in the storage medium of the terminal device or set the first NAS security context to invalid.

[0057] In one possible design example, the processing module is further configured to delete the first PLMN identifier from a storage medium of the terminal device or set the first PLMN identifier to invalid.

[0058] In one possible design example, the processing module is further configured to store the identifier of the first access network in a storage medium of the terminal device.

[0059] In one possible design example, the receiving module is further configured to receive a first globally unique temporary identifier GUTI assigned by the first PLMN, the first GUTI being used to identify the terminal device, and the first GUTI including the first PLMN identifier. The processing module is further configured to delete the second GUTI and store the first GUTI if the storage medium of the terminal device already stores the second GUTI, or replace the second GUTI with the first GUTI, or store the first GUTI if the storage medium of the terminal device does not store the second GUTI. The second GUTI is sent to the terminal device before the first PLMN assigns the first GUTI, and the second GUTI includes the first PLMN identifier.

[0060] In one possible design example, the receiving module is further configured to receive from the first PLMN a second PLMN identifier of a second PLMN equivalent to the first PLMN, and the processing module is further configured to store the second PLMN identifier in a storage medium of the terminal device.

[0061] In one possible design example, the processing module is further configured to obtain a third GUTI assigned by the second PLMN based on the second PLMN identifier, and include the third GUTI in the third registration request message. The sending module is further configured to send the third registration request message to the first PLMN.

[0062] According to a fourth aspect, there is provided a terminal device comprising the following modules: the processing module is configured to obtain a first NAS security context with the first PLMN established by the terminal device based on a first PLMN identifier of the first PLMN from a storage medium of the terminal device and to protect the registration request message by using the first NAS security context before the terminal device sends a registration request message to a first public land mobile network PLMN via a first access network; and the sending module is configured to send the registration request message protected by using the first NAS security context to the first PLMN via the first access network.

[0063] In one possible design example, the processing module is configured to read the first NAS security context from the universal subscriber identity module USIM of the terminal device based on the first PLMN identifier if the USIM supports storage of registration management parameters, or to read the first NAS security context from the non-volatile storage medium of the terminal device based on the identifier of the first PLMN if the USIM does not support storage of registration management parameters.

[0064] In one possible design example, the processing module is configured to retrieve, based on the first PLMN identifier and the identifier of the first access network, a first NAS security context with the first PLMN established by the terminal device, corresponding to the first access network, from a storage medium of the terminal device.

[0065] In one possible design example, the processing module is configured to obtain a second PLMN identifier of a second PLMN equivalent to the first PLMN from a storage medium of the terminal device, obtain a second globally unique temporary identifier GUTI assigned by the second PLMN based on the second PLMN identifier from the storage medium of the terminal device, and include the second GUTI in the registration request message.

[0066] In one possible design example, the processing module is further configured to obtain a first GUTI assigned by the first PLMN based on the first PLMN identifier from the storage medium of the terminal device, and include the first GUTI in the registration request message.

[0067] According to a fifth aspect, an embodiment of the present application provides a computer-readable storage medium including computer instructions, which, when run on an electronic device, enable the electronic device to execute a method for processing a non-access stratum context in any one of the above aspects and possible implementations.

[0068] According to a sixth aspect, an embodiment of the present application provides a computer program product, which, when run on a computer, enables the computer to execute a method for processing a non-access stratum context in any one of the above aspects and possible implementations.

[0069] According to a seventh aspect, an embodiment of the present application provides a system, which may include a terminal device and a PLMN in any one of the possible implementations of the above-mentioned aspects. The terminal device and the PLMN may execute a method for processing a non-access stratum context in any one of the above-mentioned aspects and possible implementations. [Brief description of the drawings]

[0070] [Figure 1] FIG. 2 is a schematic diagram of a scenario in which a terminal device registers via different access networks according to an embodiment of the present application;

[0071] [Diagram 2] FIG. 1 is a schematic diagram of a network architecture according to an embodiment of the present application.

[0072] [Diagram 3]2 is a schematic flowchart of a method for processing a non-access stratum context according to an embodiment of the present application;

[0073] [Figure 4] 2 is a schematic flowchart of a method for processing a non-access stratum context according to an embodiment of the present application;

[0074] [Diagram 5] 2 is a schematic flowchart of a method for processing a non-access stratum context according to an embodiment of the present application;

[0075] [Figure 6] FIG. 2 is a schematic diagram of the structure of a terminal device according to an embodiment of the present application;

[0076] [Figure 7] FIG. 2 is a schematic diagram of the structure of a terminal device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0077] For ease of understanding, some principles related to the embodiments of the present application are described for reference by using several examples. The details are given as follows:

[0078] 3GPP® Access Network: Includes next generation radio access network (NG-RAN), which includes next generation Node B (NR NodeB, gNB) and Next Generation Evolved Node B (ng-eNB).

[0079] Non-3GPP® access network: For example, a wireless local area network (WLAN) access network is a non-3GPP® access network, which may include an untrusted non-3GPP® access network, a trusted non-3GPP® access network, and a wireline access network.

[0080] [Storage and processing of security context in a scenario where an end device registers via multiple different access networks]

[0081] There are two scenarios in which an end device registers via multiple different access networks.

[0082] Scenario 1 of registration via different access networks: A terminal device registers to the same PLMN via a 3GPP® access network and a non-3GPP® access network, and the same access and mobility management node (e.g., AMF (Access and Mobility Management Function)) of the PLMN serves the terminal device. The terminal device establishes a non-3GPP® NAS connection and a 3GPP® NAS connection with the PLMN (in this application, the PLMN may be an access and mobility management node). As shown in (a) in FIG. 1, a terminal device registers to a PLMN via a 3GPP® access network, and a 3GPP® NAS connection is established between the terminal device and the PLMN. A terminal device registers to a PLMN via a non-3GPP® access network, and a non-3GPP® NAS connection is established between the terminal device and the PLMN.

[0083] Scenario 2 of registration via different access networks: A terminal device registers to two different PLMNs via a 3GPP® access network and a non-3GPP® access network, respectively, and the terminal device establishes a NAS connection with each of the two PLMNs (or two access and mobility management nodes). As shown in (b) in Figure 1, the terminal device registers to PLMN-A via a 3GPP® access network, and a 3GPP® NAS connection is established between the terminal device and PLMN-A. The terminal device registers to PLMN-B via a non-3GPP® access network, and a non-3GPP® NAS connection is established between the terminal device and PLMN-B.

[0084] In scenario 1 of registration via multiple different access networks, the NAS security context established by the terminal device with the PLMN may comprise: a key Kamf and a key identifier ngKSI for key Kamf, the key Kamf being used to generate a NAS encryption key and a NAS integrity key, the NAS encryption key being used to encrypt NAS messages and the NAS integrity key being used to protect the integrity of NAS messages; The selected NAS encryption and integrity algorithm (or algorithm identifier); and An identifier of a 3GPP (registered trademark) NAS connection and a NAS COUNT for the 3GPP (registered trademark) NAS connection, including an uplink NAS COUNT and a downlink NAS COUNT, and / or an identifier of a non-3GPP (registered trademark) NAS connection and a NAS COUNT for the non-3GPP (registered trademark) NAS connection, including an uplink NAS COUNT and a downlink NAS COUNT.

[0085] It should be noted that the 3GPP® NAS connection and the non-3GPP® NAS connection use the same key Kamf, the same key identifier ngKSI of the key Kamf, and the same selected NAS encryption and integrity algorithms (or algorithm identifiers), but use different NAS connection identifiers and NAS COUNTs. Specifically, the 3GPP® NAS connection uses the 3GPP® NAS connection identifier and the 3GPP® NAS connection NAS COUNT; and the non-3GPP® NAS connection uses the non-3GPP® NAS connection identifier and the non-3GPP® NAS connection NAS COUNT.

[0086] In scenario 2 of registration via multiple different access networks, the terminal device may establish NAS security contexts with two PLMNs (e.g., PLMN-A and PLMN-B shown in (b) in FIG. 1), i.e., a 3GPP® NAS security context (including key Kamf, and a key identifier ngKSI for key Kamf, a selected NAS encryption and integrity algorithm (or algorithm identifier), an identifier for the 3GPP® NAS connection, and a NAS COUNT for the 3GPP® NAS connection) and a non-3GPP® NAS security context (including key Kamf, a key identifier ngKSI for key Kamf, a selected NAS encryption and integrity algorithm (or algorithm identifier), an identifier for the non-3GPP® NAS connection, and a NAS COUNT for the non-3GPP® NAS connection).

[0087] When a terminal device deregisters from a PLMN, both the terminal device and the PLMN need to store the current NAS security context of the terminal device. (The current NAS security context refers to the most recently activated NAS security context.)

[0088] The specifications for NAS security context storage on the terminal device may be specifically as follows:

[0089] If the universal subscription identity module (UMTS (universal mobile telecommunications system) subscriber identity module, USIM) of the terminal device supports the storage of registration management parameters, the terminal device stores the current NAS security context on the USIM, marks the NAS security context stored on the USIM as valid, and does not store the NAS security context in non-volatile memory of the mobile equipment (ME). Both the USIM and the ME are part of the terminal device.

[0090] If the USIM does not support storage of subscription management parameters, the NAS security context is stored in non-volatile memory of the mobile device and the NAS security context stored in non-volatile memory is marked as valid.

[0091] [Allocation of 5th generation mobile networks-globally unique temporary UE Identity (5G-GUTI)]

[0092] When a terminal device registers with a PLMN through an access network, the access and mobility management node of the PLMN may assign a GUTI to the terminal device to identify the terminal device. The access and mobility management nodes of the PLMN and the terminal device store the GUTI. The GUTI includes a PLMN identifier (ID) used to identify the PLMN. The PLMN identifier included in the GUTI indicates that the GUTI is assigned by the PLMN. The GUTI is further used by the network side to obtain a context of the terminal device based on the GUTI. The context of the terminal device includes a NAS security context.

[0093] For a PLMN, the terminal device needs to store the latest GUTI assigned by the PLMN. For example, if the terminal device first accesses the PLMN via access network 1, the PLMN may assign a GUTI, e.g., GUTI-A1, to the terminal device. If the terminal device accesses the same PLMN via access network 2, the PLMN may assign a GUTI, e.g., GUTI-A2, to the terminal device. In this case, both the terminal device and the access and mobility management node of the PLMN need to store and use the newly assigned GUTI, i.e., GUTI-A2.

[0094] When a terminal device registers with multiple PLMNs, the terminal device needs to store the latest GUTI assigned by each PLMN. For example, when a terminal device first accesses PLMN-A through access network 1, PLMN-A may assign a GUTI, e.g., GUTI-A1, to the terminal device. When a terminal device accesses PLMN-B through access network 2, PLMN-B may assign a GUTI, e.g., GUTI-B1, to the terminal device. In this case, the terminal device needs to store GUTI-A1 and GUTI-A2.

[0095] Specifically, the specifications for storing GUTI on a terminal device are as follows:

[0096] If the USIM in the terminal device supports the storage of subscription management parameters, the GUTI is stored on the USIM.

[0097] If the USIM in the terminal device does not support the storage of enrollment management parameters, the GUTI is stored in the non-volatile memory of the mobile device.

[0098] An implementation in which the terminal device stores the GUTI in a non-volatile memory of the USIM or ME may be as follows: the terminal device stores the GUTI after receiving the GUTI assigned by the PLMN; or the terminal device stores the GUTI when deregistering from the PLMN.

[0099] When the terminal device intends to register with the PLMN, the terminal device sends a registration request message to the PLMN, and the terminal device includes a GUTI in the registration request message. When the terminal device selects the GUTI to be included:

[0100] If the GUTI stored in the non-volatile memory or in the USIM of the ME of the terminal device is assigned by the PLMN to which the terminal device intends to register, the terminal device selects the GUTI; otherwise, if all GUTIs stored in the non-volatile memory or in the USIM of the ME of the terminal device are not assigned by the PLMN to which the terminal device intends to register, the terminal device selects a GUTI assigned by another PLMN.

[0101] If the GUTI stored in the non-volatile memory or in the USIM of the ME of the terminal device is assigned by a PLMN equivalent to the PLMN to which the terminal device intends to register, the terminal device selects a GUTI to include in the registration request message; otherwise, if all GUTIs stored in the non-volatile memory or in the USIM of the ME of the terminal device are not assigned by any PLMN equivalent to the PLMN, the terminal device selects a GUTI assigned by another PLMN.

[0102] [Specific implementation for processing and storing the NAS security context and GUTI of the terminal device]

[0103] If the USIM of the terminal device does not support the storage of subscription management parameters:

[0104] an EF on the USIM for storing a 3GPP NAS security context including a key Kamf, a key identifier ngKSI for the key Kamf, a NAS COUNT of the 3GPP NAS connection, a selected NAS integrity algorithm identifier, and a selected NAS encryption algorithm identifier; 5GS3GPP(登録商標)NSC The file is used.

[0105] an EF on the USIM for storing a non-3GPP NAS security context including a key Kamf, a key identifier ngKSI for the key Kamf, a NAS COUNT of the non-3GPP NAS connection, a selected NAS integrity algorithm identifier, and a selected NAS encryption algorithm identifier; 5GSN3GPP(登録商標)NSC The file is used.

[0106] If a terminal device registers to the same PLMN through two access networks, two files (EF 5GS3GPP(登録商標)NSC and E.F. 5GSN3GPP(登録商標)NSCThe multiple keys Kamf, multiple key identifiers ngKSI of the multiple keys Kamf, selected NAS integrity algorithm identifier, and selected NAS encryption algorithm identifier in the two files are the same, but the NAS COUNT in the two files may be different. When a terminal device registers with different PLMNs via two access networks, respectively, the multiple keys Kamf, multiple key identifiers ngKSI of the multiple keys Kamf, NAS COUNT, selected NAS integrity algorithm identifier, and selected NAS encryption algorithm identifier in the two files may all be different.

[0107] If the USIM of the terminal device supports the storage of subscription management parameters:

[0108] EF on the USIM of the terminal device 5GS3GPP(登録商標)LOCI The file (the file is used to store location information of the 3GPP NAS connection) stores the GUTI received on the 3GPP NAS connection.

[0109] EF on the USIM of the terminal device 5GSN3GPP(登録商標)LOCI The file (the file is used to store location information of non-3GPP NAS connections) stores GUTI received on non-3GPP NAS connections.

[0110] However, based on the foregoing description, when a terminal device registers with a PLMN, the following technical problems may arise.

[0111] [Technical issue 1: The NAS security context stored on the terminal device side does not match the NAS security context stored on the network side.]

[0112] For example, the following scenario: Step 11: A terminal device registers in PLMN-A via access network 1 and access network 2. An access and mobility management node AMF1 in PLMN-A provides services to the terminal device.

[0113] Step 12: The terminal device deregisters from PLMN-A via access network 2.

[0114] Step 13: The terminal device registers with PLMN-B via access network 2, and then the terminal device deregisters from PLMN-B via access network 2.

[0115] Step 14: The terminal device registers in PLMN-A via access network 2.

[0116] In step 14, the terminal device sends a registration request (RR) message to AMF1 in PLMN-A via access network 2. The registration request message is protected by carrying the GUTI and using a NAS security context. However, since the NAS security contexts stored in the terminal device and AMF1 are different, AMF1 fails to validate the registration request message. The terminal device stores the NAS security context established when the terminal device registers to PLMN-B via access network 2, and PLMN-A stores the NAS security context established when the terminal device registers to PLMN-A via access network 2.

[0117] In the following description, for illustration purposes, an example is used in which access network 2 is a non-3GPP® access network and access network 1 is a 3GPP® access network.

[0118] Step 21: The terminal device registers to PLMN-A via access network 1 (e.g., a 3GPP® access network) and access network 2 (e.g., a non-3GPP® access network), and then the terminal device deregisters from PLMN-A via access network 2.

[0119] After the terminal device registers to PLMN-A via both access network 1 and access network 2, PLMN-A (or an access and mobility management node of PLMN-A) and the terminal device establish a NAS security context. On the terminal device, the NAS security context is stored in a memory. When the terminal device deregisters from PLMN-A via a non-3GPP access network:

[0120] If the USIM of the terminal device supports the storage of registration management parameters, the terminal device may store the non-3GPP NAS security context in the EF in the USIM. 5GSN3GPP(登録商標)NSC Store in a file.

[0121] If the USIM does not support storage of registration management parameters, the terminal device stores the non-3GPP NAS security context in non-volatile memory in the ME.

[0122] The PLMN-A (ie, the access and mobility management node of the PLMN-A) stores NAS security contexts, including 3GPP® NAS security contexts and non-3GPP® NAS security contexts.

[0123] Step 22: The terminal device registers with PLMN-B via the non-3GPP™ access network, and then the terminal device deregisters from PLMN-B via the non-3GPP™ access network.

[0124] After the terminal device registers with PLMN-B via the non-3GPP access network, the terminal device and PLMN-B establish a non-3GPP NAS security context.

[0125] If the terminal device subsequently deregisters from PLMN-B via the non-3GPP access network:

[0126] If the USIM of the terminal device supports the storage of subscription management parameters, the terminal device may store the non-3GPP NAS security context of the PLMN-B in the EF in the USIM. 5GSN3GPP(登録商標)NSC Store it in a file. In this case, EF 5GSN3GPP(登録商標)NSC Any non-3GPP NAS security context for PLMN-A stored in the file is overwritten or deleted.

[0127] If the USIM of the terminal device does not support the storage of registration management parameters, the terminal device stores the non-3GPP NAS security context of PLMN-B in the non-volatile memory of the ME, in which case the non-3GPP NAS security context of PLMN-A stored in the non-volatile memory of the ME may also be overwritten or deleted.

[0128] Step 23: The terminal device registers in PLMN-A via the non-3GPP access network.

[0129] In this case, the terminal device sends a registration request message to the PLMN-A via the non-3GPP access network. Before sending the registration request message, the terminal device may check the EF in the USIM based on the non-3GPP access network. 5GSN3GPP(登録商標)NSCAlternatively, the non-3GPP NAS security context stored in the non-volatile memory of the ME is read, and a NAS security context is established between the terminal device and PLMN-B. The terminal device protects the registration request message by using the non-3GPP NAS security context of PLMN-B.

[0130] However, after receiving the registration request message of the terminal device via the non-3GPP access network, PLMN-A (or the access and mobility management node of PLMN-A) verifies RR by using the NAS security context (i.e., the NAS security context with PLMN-A established by the terminal device) stored in step 21. The terminal device has protected the registration request message using the non-3GPP NAS security context of the terminal device and PLMN-B, while PLMN-A uses the non-3GPP NAS security context of the terminal device and PLMN-A. As a result, PLMN-A (or the access and mobility management node of PLMN-A) fails to verify the RR message. PLMN-A initiates primary authentication. Primary authentication causes additional signaling overhead, which has a significant impact on some internet of things (IoT) devices. In addition, after performing primary authentication, PLMN-A generates a new key Kamf. PLMN-A also needs to activate a new key Kamf on the 3GPP NAS connection and further needs to generate and activate new keys for protecting user data based on the new key Kamf, which affects service continuity.

[0131] For another example, there is another scenario in which PLMN-A fails to verify the RR message sent by the terminal device. For example, the terminal device first registers to PLMN-A via access network 1 and then deregisters from PLMN-A. The terminal device then registers to PLMN-B via access network 1 and then deregisters from PLMN-B. In this case, the storage medium of the terminal device stores the NAS security context of the registration to PLMN-B via access network 1. If the terminal device re-registers to PLMN-A via access network 1, PLMN-A initiates primary authentication. This is because PLMN-A still stores the NAS security context established when the terminal device registers to PLMN-A via access network 1.

[0132] In the above scenario, the NAS security context stored on the terminal device is inconsistent with the NAS security context stored on the PLMN, so the PLMN-A fails to validate the registration request message of the terminal device, because when the terminal device side stores the NAS security context, the NAS security context can only be stored for each 3GPP® access network and non-3GPP® access network, and does not include PLMN information.

[0133] Technical issue 2: The network side cannot obtain the context of the terminal device.

[0134] In the following scenario, a 3GPP access network is used as an example.

[0135] Step 31: The terminal device registers with PLMN-A via the 3GPP® access network. The PLMN-A assigns a GUTI, for example denoted as GUTI-1, to the terminal device. The terminal device then deregisters from PLMN-A via the 3GPP® access network.

[0136] The terminal device transmits GUTI-1 to the USIM (i.e., EF 5GS3GPP(登録商標)LOCI file) or in non-volatile memory of the ME.

[0137] Step 32: The terminal device registers with PLMN-B via the 3GPP® access network. The PLMN-B assigns a GUTI, for example denoted as GUTI-2, to the terminal device. The terminal device then deregisters from PLMN-B via the 3GPP® access network.

[0138] The terminal device uses GUTI-2 with a USIM (i.e. EF 5GS3GPP(登録商標)LOCI In this case, the GUTI-1 assigned to the terminal device by PLMN-A has already been overwritten by GUTI-2, or GUTI-1 has been deleted and GUTI-2 has been stored.

[0139] Step 33: The terminal device registers in PLMN-A via the 3GPP access network.

[0140] In this case, the terminal device uses the USIM (i.e. EF 5GS3GPP(登録商標)LOCI) or the GUTI obtained from the non-volatile memory of the ME is GUTI-2. The terminal device sends a registration request message carrying GUTI-2 to PLMN-A via the 3GPP access network. After receiving the registration request message, PLMN-A (or the access and mobility management function of PLMN-A) obtains the context of the terminal device based on the GUTI carried in the registration request message. However, GUTI-2 in the registration request message is assigned by PLMN-B, and PLMN-A does not recognize GUTI-2. As a result, PLMN-A cannot obtain the context of the terminal device. Therefore, PLMN-A can only initiate primary authentication and then re-establish the context of the terminal device. This increases the signaling overhead and affects the speed at which the terminal device can use the service, especially for some IoT devices.

[0141] It can be understood that the reason why the PLMN-A cannot obtain the context of the terminal device is mainly that, on the terminal device side, the GUTI is stored independently based on different access networks. In some scenarios, the GUTI may be lost.

[0142] Use the following scenario as an example.

[0143] Step 41: The terminal device registers with PLMN-A via the 3GPP® access network. The PLMN-A assigns a GUTI, denoted as GUTI-1, to the terminal device. The terminal device deregisters from PLMN-A via the 3GPP® access network.

[0144] In this case, the terminal device transfers GUTI-1 to the USIM (specifically, the EF 5GS3GPP(登録商標)LOCI file) or in the non-volatile memory of the ME.

[0145] Step 42: The terminal device registers with PLMN-A via the non-3GPP access network. The PLMN-A assigns a GUTI, denoted as GUTI-2, to the terminal device. The terminal device deregisters from PLMN-A via the non-3GPP access network.

[0146] In this case, the terminal device transfers GUTI-2 to the USIM (specifically, the EF 5GSN3GPP(登録商標)LOCI file) or in the non-volatile memory of the ME. GUTI-2 is the most recent GUTI assigned to the terminal device by PLMN-A. In this case, only GUTI-2 is stored in PLMN-A (or in the access and mobility management device of PLMN-A) and GUTI-1 is deleted.

[0147] Step 43: The terminal device registers in PLMN-A via the 3GPP access network.

[0148] During registration, when the terminal device obtains the GUTI from the USIM, the EF 5GS3GPP(登録商標)LOCI Files and EF 5GSN3GPP(登録商標)LOCIBoth files store the GUTI assigned to the terminal device by PLMN-A. However, the terminal device cannot determine which file is the newly assigned GUTI. If the terminal device selects GUTI-1, the registration request message sent by the terminal device to PLMN-A holds GUTI-1, while PLMN-A stores GUTI-2. PLMN-A cannot determine the context of the terminal device based on GUTI-1. As a result, PLMN-A can only initiate primary authentication to establish the context of the terminal device. Such an impact is similar to the impact described in the previous scenario. Specifically, primary authentication causes additional signaling overhead, and the additional signaling overhead has a large impact on some IoT devices. In addition, after performing primary authentication, PLMN-A generates a new key Kamf. PLMN-A further needs to activate the new key Kamf on the 3GPP NAS connection, and further needs to generate and activate a new key for protecting user data based on the new key Kamf. This affects the continuity of the service.

[0149] Technical problem 3: A terminal device cannot select a GUTI assigned by an equivalent PLMN, and a network side cannot obtain a context of the terminal device from the equivalent network.

[0150] When the terminal device intends to register with the PLMN, the terminal device sends a registration request message to the PLMN, and the terminal device includes a GUTI in the registration request message. The implementation of the terminal device obtaining the GUTI may be as follows.

[0151] If the GUTI stored in the non-volatile memory or USIM of the ME of the terminal device has been assigned by the PLMN to which the terminal device intends to register, the terminal device selects a GUTI, otherwise, if all stored GUTIs have not been assigned by the PLMN, it performs the following steps.

[0152] If the GUTI stored in the ME's non-volatile memory or in the USIM is assigned by a PLMN equivalent to the PLMN to which the terminal device intends to register, the terminal device selects a GUTI, otherwise, if all stored GUTIs are not assigned by any of the PLMN's equivalents, the terminal device performs the following steps.

[0153] The terminal device selects a GUTI assigned by another PLMN.

[0154] If the GUTI selected by the terminal device is a GUTI assigned by an equivalent PLMN, after the PLMN receives a registration request message including the GUTI, the PLMN may obtain a context of the terminal device from the equivalent PLMN based on the GUTI.

[0155] However, when a terminal device deregisters from a PLMN, the terminal device does not store information about the equivalent PLMN. Therefore, it cannot determine whether the GUTI is assigned by the equivalent PLMN. As a result, the terminal device cannot select a GUTI assigned by the equivalent PLMN, and the network side cannot obtain the context of the terminal device from the equivalent PLMN. The network side can only perform primary authentication to establish the context of the terminal device. The impact is similar to that described above. Additional signaling overhead is added. The additional signaling overhead has a significant impact on some IoT devices, and service continuity is affected during primary authentication. Details are described above.

[0156] If the ME's non-volatile memory or USIM stores GUTIs assigned by multiple equivalent PLMNs, the existing standards do not define how the terminal device selects a GUTI.

[0157] If a terminal device selects a GUTI assigned by another PLMN, the existing standards do not define how the terminal device selects a GUTI if the non-volatile memory of the ME or the USIM has multiple GUTIs assigned by PLMNs.

[0158] Regarding the above problem, the present application provides a method for processing non-access stratum context. The method may be applied to the process of a terminal device registering to a PLMN and the process of a terminal device deregistering from a PLMN. According to the method, the problem that the terminal device's context (including GUTI and NAS security context) stored by the terminal device is inconsistent with the terminal device's context stored on the network side can be solved, and additional primary authentication between the network side and the terminal device side is avoided, so as to avoid additional signaling overhead. The method also solves the problem of selecting a GUTI by the terminal device.

[0159] 2, the network architecture in the present application may include a terminal device 21, an access network 22, and a core network 23. The access network 22 may include, for example, a 3GPP access network and a non-3GPP access network. The core network 23 may include a PLMN, which may include an AMF.

[0160] The terminal device 21 in this embodiment of the present application may be a user-side entity such as a UE configured to receive or transmit a signal. The terminal device may also be referred to as a terminal, a UE, a mobile station (MS), a mobile terminal (MT), etc. The terminal device may be a mobile phone, a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical surgery, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The specific technology used by the terminal device and the formation of the specific device are not limited to the embodiments of the present application.

[0161] Based on the above network architecture, the solution provided in the present application for the above technical problem 1 may be as follows: When the terminal device deregisters from the PLMN, the NAS security context with the PLMN established by the terminal device and the PLMN identifier are stored in the storage medium of the terminal device. In this way, when the terminal device registers to the PLMN next time, the terminal device may determine the NAS security context of the PLMN and the terminal device based on the PLMN identifier, and protect the registration request message sent to the PLMN by using the NAS security context of the PLMN and the terminal device. In this way, the terminal device may obtain the NAS security context established by the PLMN and the terminal device based on the stored PLMN identifier, so that the NAS security context used by the terminal device when sending the registration request message is consistent with the NAS security context stored in the PLMN. This avoids the additional signaling overhead caused by the primary authentication performed by the PLMN when the NAS security context stored in the PLMN is inconsistent with the NAS security context stored in the terminal device, thereby reducing the impact on the IoT device. This also avoids the need for generation of new keys after the primary authentication performed by the PLMN and the need for activation of new keys to protect user data, thus reducing the impact on service continuity.

[0162] Based on the above network architecture, the solution provided in the present application for the above technical problem 2 may be as follows: when the terminal device deregisters from the PLMN, the storage medium stores the GUTI assigned to the terminal device by the PLMN. In this case, if the storage medium already stores the GUTI assigned by the PLMN, the terminal device deletes or updates the previously stored GUTI and stores the GUTI assigned this time. In this way, the terminal device side may store only the GUTI newly assigned by the PLMN this time. Since the PLMN side also stores only the latest GUTI assigned to the terminal device, when the terminal device registers again to the PLMN, the PLMN can identify the GUTI in the registration request message sent by the terminal device. This avoids additional signaling overhead caused by the mismatch between the GUTI in the registration request message sent by the terminal device and the GUTI stored in the PLMN, and reduces the impact on the IoT device. This also avoids the need for new key generation after the primary authentication performed by the PLMN and the need for activation of the new key to protect user data, thus reducing the impact on the continuity of the service.

[0163] Based on the above network architecture, the solution provided in the present application for the above technical problem 3 may be as follows: When registering to a PLMN, the terminal device receives an identifier of the equivalent PLMN, which is allocated by the PLMN. When the terminal device deregisters from the PLMN, the terminal device may store the equivalent PLMN identifier of the equivalent PLMN of the PLMN in a storage medium. In this way, when the terminal device determines that the GUTI stored in the storage medium is not allocated by the PLMN, if the terminal device can determine based on the equivalent PLMN identifier that the GUTI is allocated by the equivalent PLMN of the PLMN, the terminal device may include the GUTI in a registration request message when the terminal device registers to the PLMN again. The GUTI includes the equivalent PLMN identifier. In this way, when receiving a registration request message, the PLMN may obtain a context of the terminal device from the equivalent PLMN based on the GUTI. This avoids the problem in the prior art that the terminal device cannot select a GUTI assigned by an equivalent PLMN because the terminal device does not store an equivalent PLMN identifier of the equivalent PLMN, and therefore the network side cannot obtain the context of the terminal device from the equivalent network. For technical problem 3, the solution of the present application further provides a GUTI selection method. When the terminal device stores multiple GUTIs assigned by a PLMN, or an equivalent PLMN, or another PLMN, the terminal device selects a GUTI that is most recently assigned, or the terminal device selects a GUTI based on the access network used for registration.

[0164] First, a solution to the above-mentioned technical problem 1 will be described below. [Embodiment 1]

[0165] The present application provides a method for processing a non-access stratum context. As shown in Figure 3, the method may include the following steps:

[0166] 301: The terminal device sends a first registration request message to a first PLMN through a first access network. The first PLMN sends a registration accept message to the terminal device.

[0167] The first access network may be a 3GPP® access network or a non-3GPP® access network.

[0168] 302: When the terminal device deregisters from the first PLMN via the first access network, the terminal device stores, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device.

[0169] In this application document, the NAS security context includes a key Kamf, a key identifier ngKSI of the key Kamf, a selected NAS encryption and integrity algorithm (or algorithm identifier), and security parameters related to the 3GPP NAS connection. Alternatively, the first NAS security context includes a key Kamf, a key identifier ngKSI of the key Kamf, a selected NAS encryption and integrity algorithm (or algorithm identifier), and security parameters related to the 3GPP NAS connection. Alternatively, the first NAS security context includes a key Kamf, a key identifier ngKSI of the key Kamf, a selected NAS encryption and integrity algorithm (or algorithm identifier), security parameters related to the 3GPP NAS connection, and security parameters related to the non-3GPP NAS connection. The key Kamf is used to generate a NAS encryption key and a NAS integrity key. The NAS encryption key is used to encrypt NAS messages, and the NAS integrity key is used to protect the integrity of the NAS messages. The security parameters associated with the 3GPP® NAS connection include an identifier of the 3GPP® NAS connection and a NAS COUNT of the 3GPP® NAS connection. The security parameters associated with the non-3GPP® NAS connection include an identifier of the non-3GPP® NAS connection and a NAS COUNT of the non-3GPP® NAS connection. The NAS COUNT includes an uplink NAS COUNT and a downlink NAS COUNT. The NAS security context corresponding to the 3GPP® access network includes a key Kamf, a key identifier ngKSI of the key Kamf, a selected NAS encryption and integrity algorithm (or algorithm identifier), and security parameters associated with the 3GPP® NAS connection.The NAS security context corresponding to the non-3GPP access network includes a key Kamf, a key identifier ngKSI for the key Kamf, a selected NAS encryption and integrity algorithm (or algorithm identifier), and security parameters related to the non-3GPP NAS connection. The first NAS security context is a NAS security context with a first PLMN established by the terminal device, or a NAS security context with a first PLMN established by the terminal device corresponding to the first access network.

[0170] In this application document, a connection identifier is an identifier of a 3GPP NAS connection or an identifier of a non-3GPP NAS connection.

[0171] In this application document, the 3GPP® NAS security context includes the key Kamf, a key identifier ngKSI for the key Kamf, the selected NAS encryption and integrity algorithms (or algorithm identifiers), and security parameters associated with the 3GPP® NAS connection.

[0172] In this application document, the non-3GPP® NAS security context includes the key Kamf, a key identifier ngKSI for the key Kamf, the selected NAS encryption and integrity algorithms (or algorithm identifiers), and security parameters associated with the non-3GPP® NAS connection.

[0173] In this application document, the storage medium of the terminal device is the USIM of the terminal device, the non-volatile memory of the mobile device, or the non-volatile memory of the terminal device.

[0174] In this application document, a case in which a terminal device deregisters from a first PLMN via a first access network may be considered as "when the registration state of the terminal device on the first access network changes from a registered state to a deregistered state", "after the registration state of the terminal device on the first access network changes from a registered state to a deregistered state", "when the terminal device receives a deregistration accept message", "after the terminal device receives a deregistration accept message", "when the terminal device sends a deregistration request message", or "after the terminal device sends a deregistration request message".

[0175] In some embodiments, if the USIM of the terminal device does not support storage of registration management parameters, the terminal device stores a first NAS security context and a first PLMN identifier on the USIM, where the first PLMN identifier corresponds to the first NAS security context.

[0176] If the USIM does not support storage of registration management parameters, the terminal device stores the first NAS security context and the first PLMN identifier in a non-volatile storage medium of the terminal device, where the first PLMN identifier corresponds to the first NAS security context.

[0177] In some embodiments, the terminal device stores the first NAS security context and the first PLMN identifier in a storage medium of the terminal device and sets the first NAS security context to be valid.

[0178] In some embodiments, the terminal device may store the first NAS security context and the first PLMN identifier in the following manner.

[0179] [Method 1]

[0180] In some embodiments, the terminal device may store the first NAS security context and the first PLMN identifier based on the PLMN. Thus, the terminal device may store the first NAS security context and the first PLMN identifier in a file used to store the NAS security context of the first PLMN. Optionally, the terminal device further stores an identifier of the first access network in a file used to store the NAS security context of the first PLMN.

[0181] The terminal device storing the first NAS security context and the first PLMN identifier in a file used to store the NAS security context of the first PLMN includes:

[0182] If the storage medium of the terminal device does not store a NAS security context with the first PLMN established by the terminal device, or does not store a NAS security context with the first PLMN established by the terminal device that corresponds to the first access network, the terminal device stores the first NAS security file and the first PLMN identifier in the storage medium of the terminal device.

[0183] If the storage medium of the terminal device already stores a NAS security context with the first PLMN established by the terminal device or a NAS security context with the first PLMN established by the terminal device that corresponds to the first access network, the terminal device replaces the stored NAS security context of the terminal device with the first PLMN or the stored NAS security context of the terminal device with the first PLMN established by the terminal device that corresponds to the first access network with the first NAS security context and stores the first PLMN identifier, i.e., if the storage medium of the terminal device already stores a NAS security context corresponding to the first access network of the first PLMN, the terminal device replaces the stored NAS security context with the first NAS security context and optionally stores the first PLMN identifier.

[0184] Thus, in the storage medium of the terminal device, each PLMN corresponds to a file used to store the NAS security context of the PLMN, the NAS security context including a 3GPP® NAS security context and a non-3GPP® NAS security context.

[0185] For example, if a file used to store the NAS security context of the first PLMN does not store a NAS security context or a NAS security context corresponding to the first access network before the first NAS security context and the first PLMN identifier are stored, the terminal device stores the first NAS security context and the first PLMN identifier in the file.

[0186] If, before the first NAS security context and the first PLMN identifier are stored, the file used to store the NAS security context of the first PLMN already stores a NAS security context or a NAS security context corresponding to the first access network, or if the NAS security context stored in the file or the NAS security context corresponding to the first access network stored in the file is set to invalid, the terminal device replaces the NAS security context stored in the file with the first NAS security context, or replaces the stored NAS security context corresponding to the first access network with the first NAS security context. Optionally, the terminal device stores the first PLMN identifier.

[0187] Thus, if the first access network is a 3GPP® access network, the storage medium of the terminal device includes a file used to store a NAS security context of the first PLMN, the file used to store the NAS security context of the first PLMN including a first NAS security context established by the terminal device with the first PLMN corresponding to the 3GPP® access network and a first PLMN identifier of the first PLMN. If the first access network is a non-3GPP® access network, the file used to store the NAS security context of the first PLMN includes a first NAS security context established by the terminal device with the first PLMN corresponding to the non-3GPP® access network and a first PLMN identifier of the first PLMN.

[0188] In some embodiments, the terminal device further stores a connection identifier of the first access network in a file used to store a NAS security context of the first PLMN, for example, a connection identifier of a 3GPP access network or a non-3GPP access network.

[0189] [Method 2]

[0190] In some embodiments, the terminal device may store the first NAS security context and the first PLMN identifier based on the type of the access network. Thus, the terminal device may store the first NAS security context and the first PLMN identifier in a file in a storage medium of the terminal device that is used to store the NAS security context of the first access network.

[0191] If the storage medium of the terminal device does not store a NAS security context corresponding to the first access network, the terminal device stores the first NAS security context and the first PLMN identifier in the storage medium of the terminal device.

[0192] If the storage medium of the terminal device already stores a NAS security context corresponding to the first access network, the terminal device replaces the stored NAS security context corresponding to the first access network with the first NAS security context and stores the first PLMN identifier.

[0193] That is, after the file used to store the NAS security context of the first access network has stored the first NAS security context, only the first NAS security context exists and then the first PLMN identifier is stored.

[0194] In addition, thus, if the types of access networks include a 3GPP® access network and a non-3GPP® access network, there may be two files in the storage medium of the terminal device used to store the NAS security context: one file is used to store the NAS security context corresponding to the 3GPP® access network, and the other file is used to store the NAS security context corresponding to the non-3GPP® access network.

[0195] For example, if a file used to store the NAS security context of the first access network does not store the NAS security context of the first PLMN and the terminal device before the first NAS security context and the first PLMN identifier are stored, the terminal device stores the first NAS security context and the first PLMN identifier in the file.

[0196] For example, if the first access network is a 3GPP® access network, if the file used to store the NAS security context corresponding to the 3GPP® access network does not store the NAS security context of the first PLMN and the terminal device, the terminal device stores the first NAS security context and the first PLMN identifier in a file used to store the NAS security context of the 3GPP® access network. In another example, if the first access network is a non-3GPP® access network, if the file used to store the security context corresponding to the non-3GPP® access network does not store the NAS security context of the first PLMN and the terminal device, the terminal device stores the first NAS security context and the first PLMN identifier in a file used to store the NAS security context of the non-3GPP® access network.

[0197] If, before the first NAS security context and the first PLMN identifier are stored, the file used to store the NAS security context of the first access network already stores the NAS security context of the first PLMN and the terminal device and the first PLMN identifier, or if the file used to store the NAS security context of the first access network already stores the NAS security context of the first PLMN and the terminal device and the first PLMN identifier but the NAS security context and the first PLMN identifier are set to disabled, the terminal device replaces the stored NAS security context of the first PLMN and the terminal device with the first NAS security context and, optionally, stores the first PLMN identifier.

[0198] In this manner, a file used to store a NAS security context corresponding to a first access network may store multiple PLMN identifiers and multiple NAS security contexts of a terminal device and multiple PLMNs. For example, a file used to store a NAS security context of a 3GPP access network may simultaneously store multiple 3GPP NAS security contexts of multiple PLMNs and terminal devices, or a file used to store a NAS security context of a non-3GPP access network may simultaneously store multiple non-3GPP NAS security contexts of multiple PLMNs and terminal devices. In another example, if the file used to store a NAS security context corresponding to a first access network does not include a NAS security context and a PLMN identifier before the first NAS security context and the first PLMN identifier are stored, the terminal device stores the first NAS security context and the first PLMN identifier in the file.

[0199] If, before the first NAS security context and the first PLMN identifier are stored, the file used to store the NAS security context corresponding to the first access network already stores the NAS security context and the PLMN identifier, or if the file used to store the NAS security context corresponding to the first access network already stores the NAS security context and the PLMN identifier but the NAS security context and the PLMN identifier are set to invalid, the terminal device replaces the stored NAS security context with the first NAS security context and replaces the stored PLMN identifier with the first PLMN identifier.

[0200] In this specification, a stored NAS security context may be understood as a NAS security context with the first PLMN or another PLMN established by the terminal device via the first access network.

[0201] For example, if the first access network is a 3GPP® access network, and the file used to store the NAS security context of the 3GPP® access network already stores a NAS security context and a PLMN identifier, the terminal device replaces the NAS security context stored in the file used to store the NAS security context of the 3GPP® access network with the first NAS security context and replaces the stored PLMN identifier with the first PLMN identifier.

[0202] For example, if the first access network is a non-3GPP® access network, and the file used to store the NAS security context of the non-3GPP® access network already stores a NAS security context and a PLMN identifier, the terminal device replaces the NAS security context stored in the file used to store the NAS security context of the non-3GPP® access network with the first NAS security context and replaces the stored PLMN identifier with the first PLMN identifier.

[0203] In this case, only one NAS security context and one PLMN identifier are stored in a file corresponding to one access network, which is used to store the NAS security context corresponding to said access network, in a file in the storage medium of the terminal device. For example, a file used to store the NAS security context of a first access network may be understood to store only one PLMN identifier and the corresponding NAS security context. For example, a file used to store the NAS security context of a 3GPP access network stores only one 3GPP NAS security context of one PLMN, or a file used to store the NAS security context of a non-3GPP access network stores only one non-3GPP NAS security context of one PLMN.

[0204] [Method 3]

[0205] In some embodiments, the terminal device may store the first NAS security context and the first PLMN identifier based on the type of PLMN and access network. Thus, the terminal device may store the first NAS security context and the first PLMN identifier in a file used to store the NAS security context of the first PLMN and the terminal device corresponding to the first access network.

[0206] Thus, if the types of access networks accessed by the terminal device include 3GPP® access networks and non-3GPP® access networks, in the storage medium of the terminal device, each PLMN may correspond to two files used to store the NAS security context of the PLMN and the terminal device: one file is used to store the NAS security context of the PLMN and the terminal device corresponding to the identifiers of the 3GPP® access network and the PLMN, and the other file is used to store the NAS security context of the PLMN and the terminal device corresponding to the identifiers of the non-3GPP® access network and the PLMN.

[0207] In the above schemes, before the first NAS security context and the first PLMN identifier are stored in the storage medium of the terminal device, the method further comprises the terminal device deregistering from the first PLMN via all access networks. For example, if the terminal device further registers with the first PLMN via a second access network after the terminal device deregisters from the first PLMN via the first access network, the terminal device stores in the storage medium of the terminal device the first PLMN identifier of the first PLMN and the first NAS security context with the first PLMN established by the terminal device only after the terminal device also deregisters from the first PLMN via the second access network. In this way, the process of the terminal device storing the NAS security context and the PLMN identifier in the storage medium can be simplified.

[0208] Specifically, it may be understood that the terminal device stores the first NAS security context and the first PLMN identifier after the terminal device deregisters via all access networks (e.g., 3GPP® access network and non-3GPP® access network) (i.e., all NAS connections of the terminal device in the first PLMN are in a deregistered state). For example, if the terminal device deregisters from the first PLMN via a 3GPP® access network, and the terminal device is still registered with the first PLMN via another access network (e.g., non-3GPP® access network) (i.e., the terminal device is still in a registered state in the first PLMN on the non-3GPP® access network), the terminal device stores the current first NAS security context and the first PLMN identifier only after the terminal device deregisters from the other access network (e.g., non-3GPP® access network).

[0209] In some embodiments, the method may further comprise the steps of:

[0210] The terminal device may further store first time information, the first time information being a time when the terminal device last used the first NAS security context, a time when the terminal device deregisters from the first PLMN via the first access network, a time when the terminal device stores the first NAS security context, or a validity period of the first NAS security context.

[0211] In this way, the terminal device may determine that the first NAS security context is invalid based on the first time information, and may delete the first NAS security context stored in the storage medium of the terminal device, or may set the first NAS security context to invalid. The invalid first NAS security context may be replaced with a NAS security context stored later. In this way, storage space of the storage medium of the terminal device can be saved.

[0212] In addition, when the terminal device deletes the first NAS security context stored in the storage medium of the terminal device or sets the first NAS security context to invalid based on the first time information, the terminal device deletes the first PLMN identifier in the storage medium of the terminal device or sets the first PLMN identifier to invalid.

[0213] If the terminal device needs to register again to the first PLMN via the first access network, the method further comprises the following steps.

[0214] 303: Before the terminal device sends a second registration request message to the first PLMN, the terminal device obtains a first NAS security context of the first PLMN and the terminal device based on a first PLMN identifier of the first PLMN, and protects the second registration request message sent to the first PLMN by using the first NAS security context.

[0215] The terminal device obtains a NAS security context of the first PLMN and the terminal device from a storage medium of the terminal device based on the first PLMN identifier. In some embodiments, if the USIM of the terminal device supports storage of registration management parameters, the terminal device retrieves the first NAS security context from the USIM based on the first PLMN identifier. If the USIM does not support storage of registration management parameters, the terminal device retrieves the first NAS security context from a non-volatile storage medium of the terminal device based on the identifier of the first PLMN.

[0216] The terminal device obtaining the first NAS security context of the first PLMN and the terminal device based on the first PLMN identifier includes the following embodiments.

[0217] In some embodiments, the terminal device retrieves a PLMN identifier and a NAS security context corresponding to the first access network and stored in a storage medium of the terminal device. If the retrieved NAS security context corresponding to the first access network is a NAS security context with the first PLMN established by the terminal device (i.e., the retrieved PLMN identifier is the first PLMN identifier), the terminal device obtains a NAS security context corresponding to the first access network to protect the second registration request message.

[0218] That is, the terminal device may obtain the first NAS security context by comparing the first PLMN identifier with a storage identifier in a file used to store the NAS security context of the first access network.

[0219] For example, if the first access network is a 3GPP® access network, the terminal device reads the NAS security context and the PLMN identifier in a file used to store the NAS security context of the 3GPP® access network. If the PLMN identifier is the same as the first PLMN identifier, the terminal device obtains the NAS security context and protects the registration request message by using the NAS security context. If the first access network is a non-3GPP® access network, the terminal device reads the NAS security context and the PLMN identifier in a file used to store the NAS security context of the non-3GPP® access network. If the PLMN identifier is the same as the first PLMN identifier, the terminal device obtains the NAS security context and protects the registration request message by using the NAS security context.

[0220] In some other embodiments, the terminal device retrieves a NAS security context and a PLMN identifier for the terminal device and the PLMN stored in a storage medium of the terminal device, and if the PLMN identifier is the same as the first PLMN identifier, the terminal device obtains the stored NAS security context to protect the second registration request message.

[0221] For example, the terminal device reads a file in a storage medium used to store the PLMN and the NAS security context of the terminal device, and if the PLMN identifier in the file is the same as the first PLMN identifier, the terminal device obtains the stored NAS security context and protects the second registration request message by using the stored NAS security context.

[0222] In some other embodiments, the terminal device reads the PLMN identifier, the connection identifier, and the NAS security context stored in the storage medium, and if the stored PLMN identifier is the same as the first PLMN identifier and the stored connection identifier is the same as the connection identifier corresponding to the first access network, the terminal device obtains the stored NAS security context and protects the second registration request message by using the stored NAS security context.

[0223] For example, the terminal device reads a file in a storage medium used to store the PLMN and the NAS security context of the terminal device, and if the PLMN identifier in the file is the same as the first PLMN identifier and the connection identifier in the file is the same as the connection identifier corresponding to the first access network, the terminal device obtains the stored NAS security context and protects the second registration request message by using the NAS security context.

[0224] In some other embodiments, if the storage medium of the terminal device does not include a NAS security context of the terminal device with the first PLMN, the terminal device obtains a most recently stored NAS security context based on the stored NAS security context and the stored time information, and protects the second registration request message by using the NAS security context, where the time information is the time when the terminal device last used the stored NAS security context, the time when the terminal device stored the stored NAS security context, or the validity period of the stored NAS security context.

[0225] In some embodiments, the method may further include: the terminal device obtains a first GUTI on a storage medium of the terminal device, and includes the first GUTI in the second registration request message. The first GUTI includes a first PLMN identifier.

[0226] 304: The terminal device sends a second registration request message, protected by using the first NAS security context, to the first PLMN via the first access network.

[0227] In the following, a process in which a terminal device deregisters from a first PLMN and then registers with the first PLMN again is used as an example for explanation.

[0228] For example, in the following scenario:

[0229] For the purpose of explanation, an example is used in which Access Network 1 is a 3GPP access network, and Access Network 2 is a non-3GPP access network.

[0230] Step 51: The terminal device registers with PLMN-A via access network 1 (a 3GPP access network) and access network 2 (a non-3GPP access network), and then the terminal device deregisters from PLMN-A via access network 2.

[0231] After the terminal device registers to PLMN-A via access network 1 and access network 2, PLMN-A (or an access and mobility management node of PLMN-A) and the terminal device establish a NAS security context.

[0232] When a terminal device deregisters from PLMN-A via a non-3GPP access network:

[0233] If the NAS security context and the PLMN identifier are stored based on the access type, the terminal device may store the PLMN-A identifier and the NAS security context with the PLMN-A established by the terminal device in a file used for storing NAS security contexts corresponding to non-3GPP® access networks, or the terminal device may store the PLMN-A identifier and the NAS security context with the PLMN-A established by the terminal device, which corresponds to the non-3GPP® access network, in a file used for storing NAS security contexts corresponding to non-3GPP® access networks.

[0234] Alternatively, if the storage medium of the terminal device stores the NAS security context and the PLMN identifier based on the PLMN type, the terminal device may store the NAS security context with PLMN-A established by the terminal device via the non-3GPP access network and the PLMN-A identifier in a file used for storing the NAS security context of PLMN-A and the terminal, or may store the PLMN-A identifier and the NAS security context with PLMN-A established by the terminal device via the non-3GPP access network that corresponds to the non-3GPP. The terminal device may further store a connection identifier corresponding to the non-3GPP access network in a file used for storing the NAS security context of PLMN-A and the terminal.

[0235] Alternatively, if the NAS security context and the PLMN identifier are stored based on the PLMN type and the access type, in the storage medium of the terminal device, a file used to store the NAS security context of the terminal device and PLMN-A corresponding to the non-3GPP access network stores the PLMN-A identifier and the NAS security context with PLMN-A established by the terminal device.

[0236] In some embodiments, when a terminal device deregisters from PLMN-A via a non-3GPP access network:

[0237] If the USIM of the terminal device supports the storage of registration management parameters, the terminal device stores the NAS security context corresponding to the non-3GPP access network and the PLMN-A identifier in the USIM. If the USIM does not support the storage of registration management parameters, the terminal device stores the NAS security context corresponding to the non-3GPP access network and the PLMN-A identifier in a non-volatile storage medium of the ME. The storage manner may be based on the PLMN type, the access type, or the PLMN type and the access type.

[0238] For PLMN-A, PLMN-A (i.e., the access and mobility management node of PLMN-A) stores 3GPP® NAS security contexts with PLMN-A established by the terminal device via a 3GPP® access network, and non-3GPP® NAS security contexts with PLMN-A established by the terminal device via a non-3GPP® access network.

[0239] Step 52: The terminal device registers with PLMN-B via the non-3GPP™ access network, and thereafter the terminal device deregisters from PLMN-B via the non-3GPP™ access network.

[0240] After the terminal device registers with PLMN-B via the non-3GPP access network, the terminal device and PLMN-B establish a non-3GPP NAS security context.

[0241] If the terminal device subsequently deregisters from PLMN-B via the non-3GPP access network:

[0242] If the USIM of the terminal device supports the storage of registration management parameters, the terminal device stores in the USIM a NAS security context with PLMN-B established by the terminal device, which corresponds to a non-3GPP access network, and a PLMN-B identifier. If the USIM of the terminal device does not support the storage of registration management parameters, the terminal device stores in the non-volatile memory of the ME a NAS security context with PLMN-B established by the terminal device, which corresponds to a non-3GPP access network, and a PLMN-B identifier.

[0243] Step 53: The terminal device registers in PLMN-A via the non-3GPP access network.

[0244] When the terminal device registers again to PLMN-A via a non-3GPP access network, the terminal device may perform one of the following operations.

[0245] Operation 1: If the USIM or the non-volatile storage medium of the terminal device stores a NAS security context corresponding to the non-3GPP access network and a PLMN-A identifier, the terminal device obtains a security context with PLMN-A established by the terminal device, which corresponds to the non-3GPP access network, based on the PLMN-A identifier. The terminal device protects the second registration request message by using the NAS security context corresponding to the non-3GPP access network.

[0246] Operation 2: If the volatile storage medium of the terminal device includes a common NAS security context with PLMN-A established by the terminal device, and the non-volatile storage medium or USIM of the terminal device includes a NAS security context with PLMN-A established by the terminal device that corresponds to a non-3GPP access network, the terminal device obtains, based on the PLMN-A identifier, a NAS security context with PLMN-A established by the terminal device that corresponds to the non-3GPP access network in the non-volatile storage medium or USIM of the terminal device, and protects the second registration request message by using the NAS security context corresponding to the non-3GPP access network.

[0247] Operation 3: If the volatile storage medium of the terminal device includes a common NAS security context with PLMN-A established by the terminal device, and the non-volatile storage medium or USIM of the terminal device includes a NAS security context with PLMN-A established by the terminal device corresponding to a non-3GPP (registered trademark) access network, and the NAS security context corresponding to the non-3GPP (registered trademark) access network is valid, the terminal device obtains, based on the PLMN-A identifier, a NAS security context with PLMN-A established by the terminal device corresponding to the non-3GPP (registered trademark) access network in the non-volatile storage medium or USIM of the terminal device, and protects the second registration request message by using the NAS security context corresponding to the non-3GPP (registered trademark) access network.

[0248] Operation 4: If the volatile storage medium of the terminal device includes a common NAS security context with PLMN-A established by the terminal device, and the non-volatile storage medium or USIM of the terminal device includes a NAS security context with PLMN-A established by the terminal device that corresponds to a non-3GPP® access network, but the NAS security context corresponding to the non-3GPP® access network is invalid, the terminal device obtains a common NAS security context in the volatile storage medium of the terminal device based on the PLMN-A identifier, and protects the second registration request message by using the common NAS security context and uplink NAS COUNT and downlink NAS COUNT that are equal to the value 0.

[0249] Operation 5: If the volatile storage medium of the terminal device includes a common NAS security context with PLMN-A established by the terminal device, but the non-volatile storage medium or USIM of the terminal device does not include a NAS security context with PLMN-A established by the terminal device that corresponds to a non-3GPP access network, the terminal device obtains a common NAS security context in the volatile storage medium of the terminal device based on the PLMN-A identifier, and protects the second registration request message by using the common NAS security context and uplink NAS COUNT and downlink NAS COUNT that are equal to the value 0.

[0250] Operation 6: If the volatile storage medium of the terminal device does not have a NAS security context with PLMN-A established by the terminal device, but the non-volatile storage medium of the terminal device or the USIM includes a NAS security context with PLMN-A established by the terminal device that corresponds to a non-3GPP® access network, and the NAS security context corresponding to the non-3GPP® access network is valid, the terminal device obtains a NAS security context corresponding to the non-3GPP® access network based on the PLMN-A identifier, and protects the second registration request message by using the NAS security context corresponding to the non-3GPP® access network.

[0251] In the present application, the common NAS security context with the PLMN established by the terminal device includes one or more of the following: a key Kamf, a key identifier ngKSI, a selected NAS encryption and integrity algorithm (or algorithm identifier), a NAS encryption key, and a NAS integrity key. For example, the common NAS security context with the PLMN established by the terminal device includes a key identifier ngKSI, a selected NAS encryption and integrity algorithm (or algorithm identifier), a NAS encryption key, and a NAS integrity key. In another example, the common NAS security context with the PLMN established by the terminal device includes a key Kamf, a key identifier ngKSI, and a selected NAS encryption and integrity algorithm (or algorithm identifier).

[0252] Since the PLMN-A stores the NAS security context with the PLMN-A established by the terminal device corresponding to the non-3GPP access network, after the terminal device protects the registration request message by using the non-3GPP NAS security context corresponding to the PLMN-A identifier, the PLMN-A may process the registration request message based on the non-3GPP NAS security context stored in the PLMN-A, thereby avoiding the PLMN-A from performing primary authentication due to a mismatch between the NAS security context stored in the PLMN-A and the NAS security context stored in the terminal device, thus avoiding additional signaling overhead.

[0253] In another example, in a non-multiple registration scenario, the terminal device first registers to PLMN-A via access network 1 and then deregisters from PLMN-A. In this case, the terminal device may store the NAS security context established when the terminal device registers to PLMN-A and the PLMN-A identifier. PLMN-A stores the NAS security context established when the terminal device registers to PLMN-A via access network 1.

[0254] The terminal device then registers to PLMN-B via access network 1 and then deregisters from PLMN-B. In this case, the storage medium of the terminal device may store a NAS security context established when the terminal device registers to PLMN-B via access network 1 and a PLMN-B identifier. The PLMN-B stores the NAS security context established when the terminal device registers to PLMN-B via access network 1.

[0255] If the terminal device re-registers with PLMN-A via access network 1, the terminal device may obtain a NAS security context with PLMN-A established by the terminal device, which is stored in the terminal device based on the PLMN-A identifier, and PLMN-A still stores the NAS security context established when the terminal device registers with PLMN-A via access network 1. In this way, after the terminal device protects the registration request message by using the NAS security context corresponding to the PLMN-A identifier, PLMN-A may process the registration request message based on the NAS security context stored in PLMN-A. This avoids PLMN-A performing primary authentication due to a mismatch between the NAS security context stored in PLMN-A and the NAS security context stored in the terminal device, thus avoiding additional signaling overhead.

[0256] The following further describes a means for solving the above-mentioned technical problem 2. [Embodiment 2]

[0257] The present application provides a method for processing a non-access stratum context. As shown in Figure 4, the method may include the following steps.

[0258] 401: A terminal device sends a first registration request message to a first PLMN via a first access network, and the terminal device receives a first GUTI assigned by the first PLMN, where the first GUTI is used to identify the terminal device, and the first GUTI includes a first PLMN identifier.

[0259] 402: When the terminal device deregisters from the first PLMN via the first access network, the terminal device stores the first GUTI in a storage medium of the terminal device.

[0260] In this case, if the USIM of the terminal device supports storage of registration management parameters, the terminal device stores the first GUTI in the USIM, and if the USIM does not support storage of registration management parameters, the terminal device stores the first GUTI in non-volatile memory.

[0261] In some embodiments, when a terminal device stores a first GUTI in a storage medium of the terminal device, if the storage medium of the terminal device already stores a second GUTI, the terminal device deletes the second GUTI and stores the first GUTI, or replaces the second GUTI with the first GUTI.

[0262] It can be understood that the second GUTI is transmitted to the terminal device by the first PLMN before the first PLMN assigns the first GUTI, that is, if the terminal device has already stored the second GUTI assigned by the first PLMN in a storage medium, the terminal device deletes the second GUTI, or the terminal device replaces the first GUTI with the second GUTI.

[0263] For example, if the first access network is a 3GPP® access network, the first GUTI is stored in a file used to store location information or GUTIs of 3GPP® access networks. In addition, if a second GUTI already exists in a file used to store location information or GUTIs of non-3GPP® access networks and the second GUTI is also assigned by the first PLMN, the terminal device deletes the second GUTI and / or replaces the second GUTI with the first GUTI.

[0264] For example, if the first access network is a non-3GPP access network, the first GUTI is stored in a file used to store location information or GUTI of the non-3GPP access network. In addition, if a second GUTI already exists in the file used to store location information or GUTI of the 3GPP access network and the second GUTI is also assigned by the first PLMN, the terminal device deletes the second GUTI and / or replaces the second GUTI with the first GUTI.

[0265] In some embodiments, when the terminal device stores the first GUTI in the storage medium of the terminal device, if the storage medium of the terminal device does not store the second GUTI (i.e., the storage medium of the terminal device does not store the GUTI assigned by the first PLMN), the terminal device stores the first GUTI. The second GUTI is transmitted to the terminal device by the first PLMN before the first GUTI.

[0266] For example, if the first access network is a 3GPP (registered trademark) access network, and the storage medium of the terminal device does not store the second GUTI assigned to the terminal device by the first PLMN, and the second GUTI is assigned when the terminal device registers with the first PLMN via a non-3GPP (registered trademark) access network, the terminal device stores the first GUTI in the storage medium.

[0267] In some embodiments, the terminal device may store the first GUTI in a storage medium of the terminal device in the following manner.

[0268] The terminal device determines the oldest GUTI stored in the storage medium of the terminal device, and the terminal device deletes the oldest stored GUTI and / or stores the first GUTI in the file used to store the oldest GUTI. The oldest stored GUTI may be an invalid GUTI. Thus, the terminal device may replace the oldest stored GUTI with the newly assigned first GUTI.

[0269] In some embodiments, the terminal device may store the first GUTI after the terminal device receives the first GUTI transmitted by the first PLMN or after the terminal device deregisters from the first PLMN via the first access network (i.e., after the terminal device enters a deregistered state in a NAS connection between the terminal device and the first PLMN that is established via the first access network).

[0270] Alternatively, in some embodiments, if the terminal device deregisters from the first PLMN via all access networks, the terminal device determines to store the first GUTI in a storage medium of the terminal device.

[0271] In some embodiments, the method may further include the terminal device further storing second time information in a storage medium of the terminal device, the second time information being the time when the first PLMN assigns the first GUTI or the time when the terminal device stores the first GUTI.

[0272] The second time information is used by the terminal device when registering with the first PLMN. The terminal device selects a GUTI newly assigned by the first PLMN, a GUTI assigned by the first PLMN and recently used by the terminal device or the first PLMN, or a GUTI assigned by the first PLMN and recently stored by the terminal device based on the second time information, and includes the selected GUTI in a registration request message sent by the terminal device to the first PLMN. In this way, the GUTI selected based on the second time information may match the GUTI stored in the first PLMN when the terminal device registers with the first PLMN again.

[0273] When the terminal device re-registers with the first PLMN after deregistering from the first PLMN, the method may further include the following steps.

[0274] 403: Perhaps when registering with the first PLMN again, the terminal device obtains the first GUTI on a storage medium of the terminal device and sends a second registration request message to the first PLMN, where the second registration request message carries the first GUTI.

[0275] For example, when a terminal device registers to a first PLMN via a first access network (e.g., a 3GPP® access network or a non-3GPP® access network), the terminal device sends a second registration request message to the first PLMN. Before sending the second registration request message, the terminal device first obtains a first GUTI assigned to the terminal device by the first PLMN and a NAS security context stored by the terminal device and established with the first PLMN via the first access network, includes the first GUTI in the second registration request message, and protects the second registration request message by using the NAS security context.

[0276] In some embodiments, before the terminal device sends the second registration request message, the manner of obtaining the first GUTI may be as follows: the terminal device reads all GUTIs stored in a storage medium, selects a GUTI allocated by the first PLMN, and includes the GUTI in the second registration request message. The GUTI allocated by the first PLMN is the first GUTI.

[0277] If the storage medium of the terminal device stores multiple GUTIs allocated by the first PLMN, the terminal device may select a GUTI that is most recently allocated by the first PLMN based on time information corresponding to each GUTI. Alternatively, the terminal device may select a GUTI based on a type of access network. In this specification, the meaning of the time information is the same as that of the second time information.

[0278] For example, if the storage medium of the terminal device stores a plurality of GUTIs allocated by the first PLMN, the terminal device selects a GUTI corresponding to the first access network from the plurality of GUTIs, and includes the GUTI corresponding to the first access network in the second registration request message. In this case, the determined GUTI corresponding to the first access network may be understood as the selected first GUTI. For example, if the first access network is a 3GPP® access network, the terminal device selects a GUTI stored in a file used to store location information or GUTI of the 3GPP® access network as the first GUTI. If the first access network is a non-3GPP® access network, the terminal device selects a GUTI stored in a file used to store location information or GUTI of the non-3GPP® access network as the first GUTI.

[0279] In another example, if the storage medium of the terminal device stores multiple GUTIs assigned by the first PLMN, the terminal device determines a GUTI most recently assigned by the first PLMN or a GUTI most recently stored in the terminal device and assigned by the first PLMN based on time information corresponding to each GUTI, and the terminal device includes the most recently stored GUTI or the most recently assigned GUTI in the second registration request message, and the most recently stored GUTI or the most recently assigned GUTI is the first GUTI.

[0280] In some embodiments, before the terminal device sends the second registration request message, the manner in which the terminal device selects the first GUTI may further be as follows.

[0281] The terminal device sequentially reads out a plurality of files storing GUTI from the storage medium. If the read GUTI is assigned by the first PLMN, i.e., if the read GUTI includes the first PLMN identifier of the first PLMN, the terminal device stops reading the files of GUTI and includes the GUTI in the second registration request message.

[0282] In the following, by using an example, a scenario is described in which the first access network is a 3GPP access network. The implementation in this scenario may include the following steps:

[0283] Step 61: The terminal device registers with PLMN-A via the 3GPP® access network. The PLMN-A assigns a GUTI, denoted as GUTI-1, to the terminal device. The terminal device then deregisters from PLMN-A via the 3GPP® access network.

[0284] The terminal device may store the GUTI-1 in the USIM or non-volatile memory to store the PLMN-A identifier.

[0285] Step 62: The terminal device registers with PLMN-B via the 3GPP® access network. The PLMN-B assigns a GUTI, denoted as GUTI-2, to the terminal device. The terminal device then deregisters from PLMN-B via the 3GPP® access network.

[0286] The terminal device stores GUTI-2 in USIM or non-volatile memory and stores PLMN-B identifier. In this case, since GUTI-1 and GUTI-2 are assigned by different PLMNs, GUTI-1 assigned to the terminal device by PLMN-A and PLMN-A identifier are still stored in the 3GPP access network, and the terminal device further stores GUTI-2 in the 3GPP access network. That is, when GUTI is stored in this application, since PLMN identifier is further stored, not only the type of access network is considered, but also the PLMN. If the GUTI that the terminal device currently intends to store and the stored GUTI are not assigned by the same PLMN, the GUTI that the terminal device currently intends to store and the stored GUTI are assigned when the terminal device registers to the PLMN via the same access network type, and the GUTI assigned by the next PLMN must still be stored, and the GUTI previously stored in the file of the same access network type cannot be overwritten.

[0287] Step 63: The terminal device registers in PLMN-A via the 3GPP® access network. In this case, in step 63, after the terminal device deregisters from PLMN-A via the 3GPP® access network in step 61, the terminal device re-registers in PLMN-A via the 3GPP® access network.

[0288] In this case, the terminal device obtains the GUTI assigned to the terminal device by PLMN-A through the 3GPP® access network from the USIM in the non-volatile memory, and the GUTI is GUTI-1. In this way, when the terminal device sends a registration request message to PLMN-A through the 3GPP® access network, GUTI-1 is included. After receiving the registration request message, PLMN-A (or the access and mobility management node of PLMN-A that holds GUTI-1 and the registration request message) obtains the context of the terminal device based on the GUTI-1 held in the registration request message. Since the GUTI-1 in the registration request message is assigned by PLMN-A, PLMN-A can identify GUTI-1, and PLMN-A obtains the NAS security context based on GUTI-1 when the terminal device registers to PLMN-A through the 3GPP® access network. This avoids the additional signaling overhead that would occur if the PLMN-A were to initiate the primary authentication because it cannot identify the GUTI sent by the terminal device, and therefore increases the speed at which the service can be used by the terminal device. Furthermore, the impact on some IoT devices is reduced.

[0289] The following scenario is also used as an example.

[0290] Step 71: The terminal device registers with PLMN-A via the 3GPP® access network. The PLMN-A assigns a GUTI, denoted as GUTI-1, to the terminal device. The terminal device deregisters from PLMN-A via the 3GPP® access network.

[0291] In this case, the terminal device stores GUTI-1 in the USIM or non-volatile memory. Specifically, GUTI-1 allocated by PLMN-A may be stored in a file of the 3GPP® access network. In this case, it is assumed that the file of the 3GPP® access network does not store another GUTI allocated by PLMN-A in advance.

[0292] Step 72: The terminal device registers with PLMN-A via a non-3GPP access network. The PLMN-A assigns a GUTI, denoted as GUTI-2, to the terminal device. The terminal device deregisters from PLMN-A via the non-3GPP access network.

[0293] In this case, the terminal device stores GUTI-2 in USIM or non-volatile memory. Different from the prior art, the terminal device may delete GUTI-1 stored in the file of the 3GPP access network and store GUTI-2 in the file of the non-3GPP access network. Alternatively, the terminal device may delete GUTI-1 stored in the file of the 3GPP access network and store GUTI-2 in the file of the 3GPP access network. In this case, the terminal device stores GUTI-2 newly assigned by PLMN-A, and at the same time, the PLMN-A side also replaces GUTI-1 with GUTI-2.

[0294] Alternatively, when the time information of GUTI is stored, both GUTI-1 and GUTI-2 may be stored in the file. Since both GUTI-1 and GUTI-2 are assigned by PLMN-A, the terminal device may alternatively select GUTI-2, which is most recently assigned by PLMN-A, based on the time information.

[0295] Step 73: The terminal device registers in PLMN-A via the 3GPP access network.

[0296] During registration, if the terminal device can obtain the GUTI from the USIM, the file of the non-3GPP access network or the file of the 3GPP access network stores the newly assigned GUTI-2, or the terminal device selects the newly assigned GUTI-2 based on the time information. If the registration request message sent by the terminal device to the PLMN-A carries the GUTI-2, the PLMN-A may determine the context of the terminal device based on the GUTI-2, since the PLMN-A also stores the GUTI-2. This can thus avoid the primary authentication caused by the PLMN-A being unable to identify the GUTI sent by the terminal device, thus avoiding additional signaling overhead, reducing the impact on some IoT devices, and further reducing the impact on service continuity.

[0297] The following further describes a means for solving the above-mentioned technical problem 3. [Embodiment 3]

[0298] The present application provides a method for processing a non-access stratum context. As shown in Figure 5, the method may include the following steps:

[0299] 501: After a terminal device sends a first registration request message to a first public land mobile network PLMN via a first access network, the terminal device receives a second PLMN identifier of a second PLMN equivalent to the first PLMN from the first PLMN.

[0300] 502: The terminal device stores the second PLMN identifier in a storage medium.

[0301] If the second PLMN identifier of the received equivalent PLMN (i.e. the second PLMN) is stored:

[0302] If the USIM of the terminal device supports storage of the equivalent PLMN, the terminal device may store the second PLMN identifier on the USIM. If the USIM does not support storage of the equivalent PLMN, the terminal device stores the second PLMN identifier in a non-volatile memory.

[0303] 503: The terminal device deregisters from the first PLMN.

[0304] The deregistration process may be initiated by the terminal device or by the first PLMN.

[0305] If the terminal device needs to initiate registration with the third PLMN after step 503, the terminal device sends a registration request message to the third PLMN, and the registration request message includes the first GUTI. Before sending the registration request message, the terminal device obtains the first GUTI from a storage medium of the terminal device. The third PLMN may be the first PLMN in step 501, or may be a different PLMN.

[0306] 504: The terminal device acquires a first GUTI stored in a storage medium of the terminal device.

[0307] In some embodiments, the terminal device obtains, from a storage medium, a fourth PLMN identifier of a PLMN (i.e., a fourth PLMN) equivalent to the third PLMN, and obtains, from the storage medium, a GUTI assigned by the fourth PLMN, i.e., a GUTI including the fourth PLMN identifier, based on the fourth PLMN identifier. The GUTI is the first GUTI. Perhaps, if the storage medium of the terminal device includes multiple GUTIs assigned by a PLMN equivalent to the third PLMN: the terminal device randomly selects a GUTI assigned by the PLMN equivalent to the third PLMN, and the GUTI is the first GUTI; the terminal device selects a GUTI recently assigned by the PLMN equivalent to the third PLMN, or a GUTI recently stored by the terminal device and recently assigned by the PLMN equivalent to the third PLMN, and the GUTI is the first GUTI, and in this specification, the meaning of the time information is similar to the meaning of the second time information in embodiment 2; or, based on an access network accessing the third PLMN, the terminal device selects a GUTI assigned by the PLMN equivalent to the third PLMN via the access network, and the GUTI is the first GUTI.

[0308] In this way, the terminal device may identify that the GUTI is assigned by the equivalent PLMN based on the equivalent PLMN identifier. If the GUTI includes an equivalent PLMN identifier of the PLMN to which the terminal device intends to register, the terminal device may select a GUTI, and the selected GUTI includes an equivalent PLMN identifier. If the PLMN to which the terminal device intends to register receives the GUTI, the terminal device may obtain the NAS security context of the terminal device from the equivalent PLMN based on the equivalent PLMN identifier in the GUTI. This avoids additional signaling overhead caused by the primary authentication performed by the PLMN, because the terminal device cannot determine whether the GUTI is assigned by the equivalent PLMN and cannot select a GUTI assigned by the equivalent PLMN in the prior art.

[0309] In some embodiments, if the storage medium of the terminal device does not have a GUTI assigned by the third PLMN or a GUTI assigned by an equivalent network of the third PLMN, the terminal device selects a GUTI assigned by another PLMN (specifically, a PLMN other than the third PLMN and equivalent to the third PLMN). Possibly, if the storage medium of the terminal device includes multiple GUTIs assigned by another PLMN: the terminal device selects any GUTI assigned by another PLMN, the GUTI being the first GUTI; the terminal device selects a GUTI assigned by another PLMN through an access network based on an access network accessing the third PLMN, the GUTI being the first GUTI; the terminal selects a GUTI recently assigned by another PLMN; or the terminal device generates a subscription concealed identifier (SUCI), the SUCI being used as the first GUTI. The SUCI is a temporary identifier used to hide a subscription permanent identifier (SUPI). It can encrypt the SUPI to prevent the SUPI from being transmitted over the air interface. In this way, when receiving the SUCI, the first PLMN may obtain a SUPI based on the SUCI, identify the terminal device based on the SUPI, and find out a NAS security context corresponding to the terminal device.

[0310] In the above description, the terminal device selecting a GUTI recently assigned by another PLMN or the terminal device selecting a GUTI recently assigned by a PLMN equivalent to the third PLMN may be selecting a GUTI recently assigned based on time information. In this specification, the time information is the time when the PLMN assigns a GUTI or the terminal device stores a GUTI. The terminal device selecting a GUTI recently assigned by a PLMN equivalent to the third PLMN may be selecting a GUTI based on a TAG. The TAG indicates a GUTI recently assigned by a PLMN or a GUTI recently stored in the terminal device. In this way, when the terminal device stores a first GUTI, the terminal device may add a TAG to the first GUTI to indicate that the first GUTI is a GUTI recently assigned by a PLMN or a GUTI recently stored in the terminal device.

[0311] In some embodiments, the terminal device reads a GUTI stored in a storage medium, the GUTI being assigned by using a 3GPP access network or a non-3GPP access network, and if the two GUTIs are the same, the terminal device selects the stored GUTI assigned by using an access network to access a third PLMN, and the GUTI is the first GUTI.

[0312] In some embodiments, after the terminal device obtains the first GUTI according to the above description, if the first GUTI is assigned by using an access network to access the third PLMN, the terminal device protects the registration request message by using a NAS security context corresponding to the first GUTI. Otherwise, the terminal device protects the registration request message by using a NAS COUNT with a value of 0.

[0313] 505: The terminal device sends a fourth registration request message to the third PLMN, where the fourth registration request message includes the first GUTI.

[0314] 506: The third PLMN obtains a NAS security context of the terminal device based on the received first GUTI, and processes a fourth registration request message sent by the terminal device based on the NAS security context.

[0315] In embodiment 3, when the terminal device performs deregistration, the terminal device may store the equivalent PLMN identifier of the equivalent PLMN, and the terminal device may determine whether the GUTI is assigned by the equivalent PLMN. Thus, the terminal device may select the GUTI assigned by the equivalent PLMN, and the network side may also obtain the context of the terminal device from the equivalent network. In this way, the primary authentication process performed because the network side cannot obtain the context of the terminal device can be avoided, and additional signaling overhead can be avoided.

[0316] It can be understood that in order to implement the aforementioned functions, the terminal device has corresponding hardware and / or software modules for performing each function. In combination with the exemplary algorithm steps described in the embodiments disclosed herein, the present application may be implemented by hardware, or a combination of hardware and computer software. Whether the functions are performed by hardware or by hardware driven by computer software depends on the specific application and design constraints of the technical solution. Those skilled in the art may refer to the embodiments and use different methods to implement the described functions for each specific application, but such implementation should not be considered as going beyond the scope of the present application.

[0317] In an embodiment, the terminal device may be divided into multiple functional modules according to the above method example, for example, each functional module may be obtained by division according to its corresponding function, or two or more functions may be integrated into one processing module. The integrated module may be implemented in the form of hardware. It should be noted that in an embodiment, the division into multiple modules is an example, and is merely a logical functional division. In actual implementation, other division methods may be used.

[0318] When each functional module is obtained by division based on its corresponding function, Fig. 6 is a possible schematic configuration diagram of the terminal device 60 in the above embodiment. As shown in Fig. 6, the terminal device 60 may include a sending unit 601, a receiving unit 602, a storage unit 603 and a processing unit 604.

[0319] The transmitting unit 601 may be configured to support the terminal device 60 in performing steps 301, 304, 401, 501, 505, etc., and / or other processes of the techniques described herein.

[0320] The receiving unit 602 may be configured to support the terminal device 60 in performing steps such as step 502 above and / or other processes of the techniques described herein.

[0321] The storage unit 603 may be configured to support the terminal device 60 in performing steps 302, 402, 502, etc., and / or other processes of the techniques described herein.

[0322] The processing unit 604 may be configured to support the terminal device 60 in performing steps 303, 403, 503, 504, 506, etc., and / or other processing of the techniques described herein.

[0323] It should be noted that all relevant contents of the multiple steps in the above method embodiments may be cited in the functional descriptions of the corresponding functional modules, and details will not be described again in this specification.

[0324] The terminal device 60 provided in this embodiment is configured to execute the above-mentioned method for processing non-access stratum context, and thus can achieve the same effects as the above-mentioned implementation method.

[0325] If an integrated unit is used, the terminal device 60 may comprise a processing module, a storage module and a communication module. The processing module may be configured to control and manage the actions of the terminal device 60, for example to support the terminal device 60 in executing the steps performed by the processing unit 604. The storage module may be configured to support the terminal device 60 in storing program codes, data, etc., and may further be configured to support the terminal device 60 in executing the actions of the storage unit 603. The communication module may be configured to support communication between the terminal device 60 and another device, and may have a transmitting unit 601 and a receiving unit 602. For example, the communication module may be configured to support communication with a PLMN.

[0326] The processing module may be a processor or a controller. The processing module may implement or execute various exemplary logic blocks, modules and circuits described with reference to the disclosure of this application. Alternatively, the processor may be a combination for implementing computing functions, such as one or more microprocessors, or a combination including a combination of a digital signal processing (DSP) and a microprocessor. The storage module may be a memory. The communication module may specifically be a device, such as a radio frequency circuit, a Bluetooth chip, or a Wi-Fi chip, that communicates with another electronic device.

[0327] In one embodiment, when the processing module is a processor, the storage module is a memory, and the communication module is a transceiver, the terminal device in this embodiment may be an electronic device 70 having the structure shown in FIG.

[0328] An embodiment of the present application further provides an electronic device including one or more processors and one or more memories. The one or more memories are coupled to the one or more processors. The one or more memories are configured to store computer program code, and the computer program code includes computer instructions. When the one or more processors execute the computer instructions, the electronic device is enabled to execute the relevant method steps described above to implement the method for processing non-access stratum context in the above embodiment.

[0329] An embodiment of the present application further provides a computer storage medium, which stores computer instructions, which, when run on an electronic device, enable the electronic device to execute the relevant method steps described above to implement the method for processing non-access stratum context in the above embodiment.

[0330] An embodiment of the present application further provides a computer program product, which, when run on a computer, enables the computer to execute the relevant steps described above to implement the method for processing non-access stratum context executed by the electronic device in the above embodiment.

[0331] In addition, an embodiment of the present application further provides an apparatus. The apparatus may be specifically a chip, a component or a module. The apparatus may include a processor and a memory connected to each other. The memory is configured to store computer-executable instructions. When the apparatus operates, the processor may execute the computer-executable instructions stored in the memory, so that the chip executes the method of processing non-access layer context executed by the electronic device in the embodiment of the method described above.

[0332] The electronic device, computer storage medium, computer program product, or chip provided in several embodiments is configured to execute the corresponding method provided above. Therefore, for the beneficial effects that can be realized, please refer to the beneficial effects of the corresponding method provided above. Details are not described again in this specification.

[0333] Another embodiment of the present application provides a system, which may include a terminal device and a device such as an AMF in a PLMN, and may be configured to implement the aforementioned method for processing non-access stratum context.

[0334] Based on the above description of the implementation, those skilled in the art can understand that the above division into multiple functional modules is only used as an example for description, for the purpose of convenient and simple description. In actual application, the above functions can be allocated to multiple different functional modules for implementation based on requirements, that is, the internal structure of the device is divided into multiple different functional modules to implement all or part of the above-described multiple functions.

[0335] In some embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the described apparatus embodiment is merely an example. For example, the division into multiple modules or units is merely a logical functional division. In actual implementation, other division ways may exist. For example, multiple units or components may be combined or integrated into another apparatus, or some features may be ignored or not implemented. In addition, the shown or described interconnections or direct connections or communication connections may be implemented through some interfaces. Indirect couplings or communication connections between apparatuses or units may be implemented in electronic, mechanical, or other forms.

[0336] The units described as separate components may or may not be physically separate, and the components shown as units may be one or more physical units, i.e., located in one location or distributed in multiple different locations. Some or all of the units may be selected based on actual requirements to achieve the objectives of the solutions of the embodiments.

[0337] In addition, the functional units in the embodiments of the present application may be integrated into one processing unit, each of the multiple units may exist physically alone, or two or more units may be integrated into one unit. The integrated unit may be implemented in the form of hardware or a software functional unit.

[0338] When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, the integrated unit may be stored in a readable storage medium. Based on such understanding, the technical solutions in the embodiments of the present application may be essentially implemented in the form of a software product, or the part that contributes to the prior art, or all or a part of the technical solutions. The software product is stored in a storage medium and has some instructions for instructing a device or a processor (which may be a single-chip microprocessor, chip, etc.) to execute all or a part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium includes any medium that can store program code, such as a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0339] The above description is merely a specific implementation example of the present application, and is not intended to limit the scope of protection of the present application. Any variations or replacements that are easily conceived by those skilled in the art within the technical scope disclosed in this application shall be included in the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the scope of protection of the claims. [Other possible items] [Item 1] 1. A method for processing a non-access stratum context, comprising: sending, by the terminal device, a first registration request message to a first public land mobile network (PLMN); receiving, by the terminal device, a registration accept message from the first PLMN; and storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device when the terminal device deregisters from the first PLMN via a first access network. A method for providing the above. [Item 2] After the terminal device deregisters from the first PLMN via the first access network, the method further comprises: before the terminal device sends a second registration request message to the first PLMN, the terminal device determines, based on the first PLMN identifier, the first NAS security context with the first PLMN established by the terminal device; the terminal device protecting the second registration request message by using the first NAS security context; and the terminal device sending the second registration request message, the second registration request message being protected by using the first NAS security context, to the first PLMN via the first access network. The method of item 1, comprising: [Item 3] The step of storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, comprises: if the Universal Subscriber Identity Module USIM of the terminal device supports the storage of registration management parameters, the terminal device storing the first NAS security context and the first PLMN identifier on the USIM; or if the USIM does not support storage of subscription management parameters, storing, by the terminal device, the first NAS security context and the first PLMN identifier in a non-volatile storage medium of the terminal device. 3. The method according to item 1 or 2, comprising the steps of: [Item 4] The method according to any one of items 1 to 3, further comprising a step in which the terminal device sets the first NAS security context to be valid. [Item 5] The step of storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, comprises: if the storage medium of the terminal device does not store a NAS security context with the first PLMN established by the terminal device, the terminal device storing a first NAS security file and the first PLMN identifier in the storage medium of the terminal device; or if the storage medium of the terminal device already stores the first PLMN identifier and a NAS security context with the first PLMN established by the terminal device, the terminal device replacing the stored NAS security context with the first NAS security context. 5. The method according to any one of items 1 to 4, comprising: [Item 6] The step of storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, comprises: if the storage medium of the terminal device does not store a NAS security context corresponding to the first access network, the terminal device storing the first NAS security context and the first PLMN identifier in the storage medium of the terminal device; or if the storage medium of the terminal device already stores a NAS security context corresponding to the first access network, the terminal device replacing the stored NAS security context corresponding to the first access network with the first NAS security context and storing the first PLMN identifier. 5. The method according to any one of items 1 to 4, comprising: [Item 7] Prior to the step of the terminal device storing in a storage medium of the terminal device a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, the method further comprises: the terminal device deregistering from the first PLMN via all access networks. 7. The method according to any one of items 1 to 6, comprising: [Item 8] The method further comprises: the terminal device storing first time information, where the first time information is a time when the terminal device last used the first NAS security context, a time when the terminal device deregisters from the first PLMN, a time when the terminal device stores the first NAS security context, or a validity period of the first NAS security context. 8. The method according to any one of items 1 to 7, comprising: [Item 9] The method further comprises: determining, by the terminal device, that the first NAS security context is invalid based on the first time information; and the terminal device deleting the first NAS security context stored in the storage medium of the terminal device or setting the first NAS security context to invalid. The method of claim 8, comprising: [Item 10] The method further comprises: the terminal device deleting the first PLMN identifier from the storage medium of the terminal device or setting the first PLMN identifier to invalid. 10. The method of claim 9, comprising: [Item 11] The method further comprises: storing, by the terminal device, an identifier of the first access network in the storage medium of the terminal device; 11. The method according to any one of items 1 to 10, comprising: [Item 12] Before the terminal device deregisters from the first PLMN via the first access network, the method further comprises: receiving, by the terminal device, a first globally unique temporary user equipment identifier (GUTI) assigned by the first PLMN, where the first GUTI is used to identify the terminal device, and the first GUTI includes the first PLMN identifier; and If the storage medium of the terminal device already stores a second GUTI, the terminal device deletes the second GUTI and stores the first GUTI, or replaces the first GUTI with the second GUTI; or If the storage medium of the terminal device does not store a second GUTI, the terminal device stores the first GUTI. Equipped with The second GUTI is transmitted to the terminal device before the first PLMN assigns the first GUTI, and the second GUTI includes the first PLMN identifier. 12. The method according to any one of items 1 to 11. [Item 13] After the step of the terminal device sending a first registration request message to a first public land mobile network (PLMN), the method further comprises: receiving, by the terminal device, from the first PLMN, a second PLMN identifier of a second PLMN equivalent to the first PLMN; and storing, by the terminal device, the second PLMN identifier in the storage medium of the terminal device; 13. The method according to any one of items 1 to 12, comprising: [Item 14] After the terminal device deregisters from the first PLMN via the first access network, the method further comprises: the terminal device obtaining a third GUTI assigned by the second PLMN based on the second PLMN identifier; the terminal device including the third GUTI in a third registration request message; and the terminal device sending the third registration request message to the first PLMN. Item 14. The method of item 13, comprising: [Item 15] 1. A method for processing a non-access stratum context, comprising: before the terminal device sends a registration request message to a first public land mobile network PLMN via a first access network, the terminal device obtains, from a storage medium of the terminal device based on a first PLMN identifier of the first PLMN, a first NAS security context with the first PLMN established by the terminal device; the terminal device protecting the registration request message by using the first NAS security context; and the terminal device sending the registration request message, the registration request message being protected by using the first NAS security context, to the first PLMN via the first access network. A method for providing the above. [Item 16] The step of the terminal device obtaining, based on a first PLMN identifier, from a storage medium of the terminal device, a first NAS security context with the first PLMN established by the terminal device, comprises: If the Universal Subscriber Identity Module (USIM) of the terminal device supports storage of subscription management parameters, the terminal device reads the first NAS security context from the USIM based on the first PLMN identifier; or if the USIM does not support storage of subscription management parameters, the terminal device retrieving the first NAS security context from a non-volatile storage medium of the terminal device based on the identifier of the first PLMN. Item 16. The method according to item 15, comprising the steps of: [Item 17] The step of the terminal device obtaining a first NAS security context with the first PLMN established by the terminal device from a storage medium of the terminal device based on a first PLMN identifier of the first PLMN, includes: and the terminal device obtaining, based on the first PLMN identifier and an identifier of the first access network, from the storage medium of the terminal device, the first NAS security context corresponding to the first access network, the first NAS security context being established by the terminal device with the first PLMN. 17. The method according to item 15 or 16. [Item 18] Before the terminal device sends the registration request message to the first PLMN, the method further comprises: obtaining, by the terminal device, from the storage medium of the terminal device, a second PLMN identifier of a second PLMN equivalent to the first PLMN; The terminal device obtains a second globally unique temporary user equipment identifier (GUTI) assigned by the second PLMN based on the second PLMN identifier from the storage medium of the terminal device; and the terminal device including the second GUTI in the registration request message. Item 16. The method of item 15, comprising: [Item 19] Before the terminal device sends the registration request message to the first PLMN, the method further comprises: The terminal device obtains a first GUTI assigned by the first PLMN based on the first PLMN identifier from the storage medium of the terminal device; and the terminal device including the first GUTI in the registration request message; 18. The method according to any one of items 15 to 17, comprising: [Item 20] A terminal device, comprising: a transmitting module configured to transmit a first registration request message to a first public land mobile network (PLMN); a receiving module configured to receive a registration accept message from the first PLMN; and a processing module configured to store, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device when the terminal device deregisters from the first PLMN via a first access network. A terminal device comprising: [Item 21] The processing module further comprises: Before the sending module sends a second registration request message to the first PLMN, determining the first NAS security context with the first PLMN to be established by the terminal device based on the first PLMN identifier; and Protecting the second registration request message by using the first NAS security context. and The transmission module further comprises: configured to transmit the second registration request message, the second registration request message being protected by using the first NAS security context, to the first PLMN via the first access network. Item 21. A terminal device according to item 20. [Item 22] The processing module includes: storing the first NAS security context and the first PLMN identifier on a universal subscriber identity module (USIM) of the terminal device if the universal subscriber identity module (USIM) supports the storage of subscription management parameters; or If the USIM does not support storage of subscription management parameters, storing the first NAS security context and the first PLMN identifier in a non-volatile storage medium of the terminal device. 22. The terminal device according to item 20 or 21, configured to: [Item 23] The terminal device according to any one of items 20 to 22, wherein the processing module is further configured to set the first NAS security context to valid. [Item 24] The processing module includes: If the storage medium of the terminal device does not store a NAS security context with the first PLMN established by the terminal device, storing the first NAS security file and the first PLMN identifier in the storage medium of the terminal device; or If the storage medium of the terminal device already stores the first PLMN identifier and the NAS security context with the first PLMN established by the terminal device, replacing the stored NAS security context with the first NAS security context. 24. A terminal device according to any one of items 20 to 23, configured to: [Item 25] The processing module includes: if the storage medium of the terminal device does not store a NAS security context corresponding to the first access network, storing the first NAS security context and the first PLMN identifier in the storage medium of the terminal device; or If the storage medium of the terminal device already stores a NAS security context corresponding to the first access network, replace the stored NAS security context corresponding to the first access network with the first NAS security context and store the first PLMN identifier. 25. A terminal device according to any one of items 20 to 24, configured to: [Item 26] The processing module further comprises: deregistering from the first PLMN via all access networks 26. A terminal device according to any one of items 20 to 25, configured to: [Item 27] The processing module further comprises: and storing first time information, where the first time information is a time when the terminal device last used the first NAS security context, a time when the terminal device deregisters from the first PLMN, a time when the terminal device stores the first NAS security context, or a validity period of the first NAS security context. A terminal device according to any one of items 20 to 26. [Item 28] The processing module further comprises: Determine that the first NAS security context is invalid based on the first time information, and delete the first NAS security context stored in the storage medium of the terminal device or set the first NAS security context to invalid. Item 28. A terminal device according to item 27, configured to: [Item 29] The processing module further comprises: Deleting the first PLMN identifier from the storage medium of the terminal device or setting the first PLMN identifier to invalid. Item 29. The terminal device according to item 28, configured to: [Item 30] The processing module further comprises: storing an identifier of the first access network in the storage medium of the terminal device; 30. A terminal device according to any one of items 20 to 29, configured to: [Item 31] The receiving module further comprises: configured to receive a first globally unique temporary user equipment identifier (GUTI) assigned by the first PLMN, where the first GUTI is used to identify the terminal device, and the first GUTI includes the first PLMN identifier; and The processing module further comprises: If the storage medium of the terminal device already stores a second GUTI, delete the second GUTI and store the first GUTI, or replace the second GUTI with the first GUTI; or If the storage medium of the terminal device does not store the second GUTI, the storage medium stores the first GUTI. It is configured as follows: The second GUTI is transmitted to the terminal device before the first PLMN assigns the first GUTI, and the second GUTI includes the first PLMN identifier. A terminal device according to any one of items 20 to 30. [Item 32] The receiving module further comprises: configured to receive, from the first PLMN, a second PLMN identifier of a second PLMN equivalent to the first PLMN; and the processing module is further configured to store the second PLMN identifier in the storage medium of the terminal device. A terminal device according to any one of items 20 to 31. [Item 33] The processing module further comprises: Obtaining a third GUTI assigned by the second PLMN based on the second PLMN identifier; and The third GUTI is included in the third registration request message. and the transmitting module is further configured to transmit the third registration request message to the first PLMN. Item 33. A terminal device according to item 32. [Item 34] A terminal device, comprising: a processing module configured to obtain, from a storage medium of the terminal device based on a first PLMN identifier of a first PLMN, a first NAS security context with the first PLMN established by the terminal device before the terminal device sends a registration request message to the first public land mobile network PLMN via a first access network; and to protect the registration request message by using the first NAS security context; and a transmitting module configured to transmit the registration request message, the registration request message being protected by using the first NAS security context, to the first PLMN via the first access network; A terminal device comprising: [Item 35] The processing module includes: If the Universal Subscriber Identity Module (USIM) of the terminal device supports the storage of subscription management parameters, retrieving the first NAS security context from the USIM based on the first PLMN identifier; or If the USIM does not support storage of subscription management parameters, reading the first NAS security context from a non-volatile storage medium of the terminal device based on the identifier of the first PLMN. Item 35. A terminal device according to item 34, configured to: [Item 36] The processing module includes: Retrieving, from the storage medium of the terminal device, the first NAS security context corresponding to the first access network, the first NAS security context with the first PLMN established by the terminal device, based on the first PLMN identifier and an identifier of the first access network. 36. A terminal device according to item 34 or 35, configured to: [Item 37] The processing module includes: obtaining, from the storage medium of the terminal device, a second PLMN identifier of a second PLMN equivalent to the first PLMN; Obtaining a second globally unique temporary user equipment identifier (GUTI) assigned by the second PLMN based on the second PLMN identifier from the storage medium of the terminal device; and The second GUTI is included in the registration request message. Item 35. A terminal device according to item 34, configured to: [Item 38] The processing module further comprises: Obtaining a first GUTI assigned by the first PLMN based on the first PLMN identifier from the storage medium of the terminal device; and The first GUTI is included in the registration request message. 37. A terminal device according to any one of items 34 to 36, configured to: [Item 39] 20. A computer-readable storage medium storing computer instructions, the computer instructions being operable, when executed on an electronic device, to enable the electronic device to perform the method according to any one of items 1 to 19.

Claims

1. A method for processing a non-access stratum context applied to a terminal device or a chip in the terminal device, comprising: sending a first registration request message to a first public land mobile network (PLMN) (first PLMN); receiving a registration accept message from the first PLMN; and storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device when the terminal device deregisters from the first PLMN via a first access network. A method for providing the above.

2. After the terminal device deregisters from the first PLMN via the first access network, the method further comprises: determining the first NAS security context with the first PLMN to be established by the terminal device based on the first PLMN identifier before the terminal device sends a second registration request message to the first PLMN; protecting the second registration request message by using the first NAS security context; and sending the second registration request message, the second registration request message being protected by using the first NAS security context, to the first PLMN via the first access network; The method of claim 1 , comprising:

3. The step of storing in a storage medium of the terminal device a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, comprising: storing the first NAS security context and the first PLMN identifier on a Universal Subscriber Identity Module (USIM) of the terminal device if the USIM supports storage of entitlement management parameters; or storing said first NAS security context and said first PLMN identifier in a non-volatile storage medium of said terminal device if the USIM does not support storage of enrollment management parameters. The method according to claim 1 or 2, comprising:

4. The method of claim 1 , further comprising setting the first NAS security context to valid.

5. The step of storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, comprising: storing a first NAS security file and the first PLMN identifier in the storage medium of the terminal device if the storage medium of the terminal device does not store a NAS security context with the first PLMN established by the terminal device; or if the storage medium of the terminal device already stores the first PLMN identifier and a NAS security context with the first PLMN established by the terminal device, replacing the stored NAS security context with the first NAS security context.

5. The method according to claim 1 , further comprising:

6. The step of storing, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, comprising: if the storage medium of the terminal device does not store a NAS security context corresponding to the first access network, storing the first NAS security context and the first PLMN identifier in the storage medium of the terminal device; or if the storage medium of the terminal device already stores a NAS security context corresponding to the first access network, replacing the stored NAS security context corresponding to the first access network with the first NAS security context and storing the first PLMN identifier.

5. The method according to claim 1 , further comprising:

7. Prior to the step of storing in a storage medium of the terminal device a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device, the method further comprises: Deregistering from the first PLMN via all access networks The method of any one of claims 1 to 6, comprising:

8. The method further comprises: storing first time information, where the first time information is a time when the terminal device last used the first NAS security context, a time when the terminal device deregisters from the first PLMN, a time when the terminal device stores the first NAS security context, or a validity period of the first NAS security context. The method of any one of claims 1 to 7, comprising:

9. The method further comprises: determining, based on the first time information, that the first NAS security context is invalid; and deleting the first NAS security context stored in the storage medium of the terminal device or setting the first NAS security context to invalid The method of claim 8 comprising:

10. The method further comprises: deleting the first PLMN identifier from the storage medium of the terminal device or setting the first PLMN identifier to invalid The method of claim 9 comprising:

11. The method further comprises: storing an identifier of said first access network in said storage medium of said terminal device; The method of any one of claims 1 to 10, comprising:

12. Before the terminal device deregisters from the first PLMN via the first access network, the method further comprises: receiving a first Globally Unique Temporary Identifier (GUTI) (first GUTI) assigned by the first PLMN, where the first GUTI is used to identify the terminal device, and the first GUTI includes the first PLMN identifier; and If the storage medium of the terminal device already stores a second GUTI, deleting the second GUTI and storing the first GUTI, or replacing the second GUTI with the first GUTI; or storing the first GUTI in the storage medium of the terminal device if the storage medium does not store the second GUTI; Equipped with The second GUTI is transmitted to the terminal device before the first PLMN assigns the first GUTI, and the second GUTI includes the first PLMN identifier.

12. The method according to any one of claims 1 to 11.

13. After the step of transmitting a first registration request message to a first public land mobile network (PLMN) (first PLMN), the method further comprises: receiving, from the first PLMN, a second PLMN identifier of a second PLMN equivalent to the first PLMN; and storing said second PLMN identifier in said storage medium of said terminal device. The method of any one of claims 1 to 12, comprising:

14. After the terminal device deregisters from the first PLMN via the first access network, the method further comprises: obtaining a third GUTI assigned by the second PLMN based on the second PLMN identifier; including the third GUTI in a third registration request message; and sending the third registration request message to the first PLMN. The method of claim 13 comprising:

15. The method further comprises: registering with a third PLMN via the first access network; and deregistering from the third PLMN via the first access network, wherein when the terminal device deregisters from the third PLMN via the first access network, the terminal device further stores in the storage medium a second NAS security context with the third PLMN established by the terminal device, the second NAS security context corresponding to the first access network, and a third PLMN identifier of the third PLMN.

15. The method of claim 1 , comprising:

16. A method for processing a non-access stratum context applied to a terminal device or a chip in the terminal device, comprising: obtaining, from a storage medium of the terminal device, a first NAS security context with a first public land mobile network (PLMN) (first PLMN) established by the terminal device based on a first PLMN identifier of the first PLMN, before transmitting a registration request message to the first PLMN via a first access network; protecting the registration request message by using the first NAS security context; and sending the registration request message, the registration request message being protected by using the first NAS security context, to the first PLMN via the first access network; A method for providing the above.

17. The step of obtaining, from a storage medium of the terminal device based on a first PLMN identifier, a first NAS security context with the first PLMN established by the terminal device, comprising: retrieving the first NAS security context from a Universal Subscriber Identity Module (USIM) of the terminal device based on the first PLMN identifier, if the USIM supports storage of subscription management parameters; or if the USIM does not support storage of entitlement management parameters, retrieving the first NAS security context from a non-volatile storage medium of the terminal device based on the identifier of the first PLMN.

17. The method of claim 16, comprising:

18. The step of obtaining, from a storage medium of the terminal device based on a first PLMN identifier of the first PLMN, a first NAS security context established by the terminal device with the first PLMN, comprising: obtaining, based on the first PLMN identifier and an identifier of the first access network, from the storage medium of the terminal device, the first NAS security context corresponding to the first access network, the first NAS security context being established with the first PLMN by the terminal device.

18. The method of claim 16 or 17.

19. Before transmitting the registration request message to the first PLMN, the method further comprises: obtaining, from the storage medium of the terminal device, a second PLMN identifier of a second PLMN equivalent to the first PLMN; obtaining a second Globally Unique Temporary Identifier (GUTI) assigned by the second PLMN based on the second PLMN identifier from the storage medium of the terminal device; and including the second GUTI in the registration request message.

20. The method of claim 16 comprising:

20. Before transmitting the registration request message to the first PLMN, the method further comprises: obtaining a first GUTI assigned by the first PLMN based on the first PLMN identifier from the storage medium of the terminal device; and including the first GUTI in the registration request message.

19. The method of any one of claims 16 to 18, comprising:

21. Prior to obtaining the first NAS security context, the method further comprises: registering with a third PLMN via the first access network; and deregistering from the third PLMN via the first access network, wherein when the terminal device deregisters from the third PLMN via the first access network, the terminal device stores in the storage medium a second NAS security context with the third PLMN established by the terminal device, the second NAS security context corresponding to the first access network, and a third PLMN identifier of the third PLMN.

21. The method of any one of claims 16 to 20, comprising:

22. An apparatus, the apparatus being a terminal device or a chip in the terminal device, a transmitting module configured to transmit a first registration request message to a first public land mobile network (PLMN) (first PLMN); a receiving module configured to receive a registration accept message from the first PLMN; and a processing module configured to store, in a storage medium of the terminal device, a first PLMN identifier of the first PLMN and a first NAS security context with the first PLMN established by the terminal device when the terminal device deregisters from the first PLMN via a first access network. An apparatus comprising:

23. The processing module further comprises: Before the sending module sends a second registration request message to the first PLMN, determining the first NAS security context with the first PLMN to be established by the terminal device based on the first PLMN identifier; and Protecting the second registration request message by using the first NAS security context. and The transmission module further comprises: configured to send the second registration request message, the second registration request message being protected by using the first NAS security context, to the first PLMN via the first access network.

23. The apparatus of claim 22.

24. The processing module includes: storing the first NAS security context and the first PLMN identifier on a Universal Subscriber Identity Module (USIM) of the terminal device if the USIM supports storage of entitlement management parameters; or If the USIM does not support storage of enrollment management parameters, storing the first NAS security context and the first PLMN identifier in a non-volatile storage medium of the terminal device.

24. Apparatus according to claim 22 or 23, configured so as to

25. 25. The apparatus of claim 22, wherein the processing module is further configured to set the first NAS security context to valid.

26. The processing module includes: if the storage medium of the terminal device does not store a NAS security context with the first PLMN established by the terminal device, storing a first NAS security file and the first PLMN identifier in the storage medium of the terminal device; or If the storage medium of the terminal device already stores the first PLMN identifier and the NAS security context with the first PLMN established by the terminal device, replacing the stored NAS security context with the first NAS security context.

26. Apparatus according to any one of claims 22 to 25, configured so as to

27. The processing module includes: if the storage medium of the terminal device does not store a NAS security context corresponding to the first access network, storing the first NAS security context and the first PLMN identifier in the storage medium of the terminal device; or If the storage medium of the terminal device already stores a NAS security context corresponding to the first access network, replace the stored NAS security context corresponding to the first access network with the first NAS security context and store the first PLMN identifier.

27. Apparatus according to any one of claims 22 to 26, configured so as to

28. The processing module further comprises: Deregistering from the first PLMN via all access networks 28. Apparatus according to any one of claims 22 to 27, configured so as to

29. The processing module further comprises: and storing first time information, where the first time information is a time when the terminal device last used the first NAS security context, a time when the terminal device deregisters from the first PLMN, a time when the terminal device stores the first NAS security context, or a validity period of the first NAS security context.

29. Apparatus according to any one of claims 22 to 28.

30. The processing module further comprises: Determine that the first NAS security context is invalid based on the first time information, and delete the first NAS security context stored in the storage medium of the terminal device, or set the first NAS security context to invalid.

30. The apparatus of claim 29 configured to:

31. The processing module further comprises: Deleting the first PLMN identifier from the storage medium of the terminal device or setting the first PLMN identifier to invalid.

31. The apparatus of claim 30 configured to:

32. The processing module further comprises: storing an identifier of the first access network in the storage medium of the terminal device; 32. Apparatus according to any one of claims 22 to 31, configured to:

33. The receiving module further comprises: configured to receive a first Globally Unique Temporary Identifier (GUTI) (first GUTI) assigned by the first PLMN, where the first GUTI is used to identify the terminal device, and the first GUTI includes the first PLMN identifier; and The processing module further comprises: If the storage medium of the terminal device already stores a second GUTI, delete the second GUTI and store the first GUTI, or replace the second GUTI with the first GUTI; or If the storage medium of the terminal device does not store the second GUTI, the storage medium stores the first GUTI. It is configured as follows: The second GUTI is transmitted to the terminal device before the first PLMN assigns the first GUTI, and the second GUTI includes the first PLMN identifier.

33. Apparatus according to any one of claims 22 to 32.

34. The receiving module further comprises: configured to receive, from the first PLMN, a second PLMN identifier of a second PLMN equivalent to the first PLMN; and the processing module is further configured to store the second PLMN identifier in the storage medium of the terminal device.

34. Apparatus according to any one of claims 22 to 33.

35. The processing module further comprises: Obtaining a third GUTI assigned by the second PLMN based on the second PLMN identifier; and The third GUTI is included in the third registration request message. and the sending module is further configured to send the third registration request message to the first PLMN.

35. The apparatus of claim 34.

36. 36. The apparatus of claim 22, wherein the processing module is further configured to register with a third PLMN via the first access network and deregister from the third PLMN via the first access network, and when the terminal device deregisters from the third PLMN via the first access network, the processing module further stores in the storage medium a second NAS security context with the third PLMN established by the terminal device, the second NAS security context corresponding to the first access network, and a third PLMN identifier of the third PLMN.

37. An apparatus, the apparatus being a terminal device or a chip in the terminal device, a processing module configured to obtain, from a storage medium of the terminal device based on a first PLMN identifier of a first PLMN, a first NAS security context with the first PLMN established by the terminal device before the terminal device transmits a registration request message to the first PLMN via a first access network; and to protect the registration request message by using the first NAS security context; and a transmitting module configured to transmit the registration request message, the registration request message being protected by using the first NAS security context, to the first PLMN via the first access network; An apparatus comprising:

38. The processing module includes: Retrieving the first NAS security context from a Universal Subscriber Identity Module (USIM) of the terminal device based on the first PLMN identifier, if the USIM supports storage of subscription management parameters; or If the USIM does not support storage of entitlement management parameters, then reading the first NAS security context from a non-volatile storage medium of the terminal device based on the identifier of the first PLMN.

38. The apparatus of claim 37 configured to:

39. The processing module includes: Retrieving, from the storage medium of the terminal device, the first NAS security context corresponding to the first access network, the first NAS security context with the first PLMN established by the terminal device, based on the first PLMN identifier and an identifier of the first access network.

39. Apparatus according to claim 37 or 38, configured so as to

40. The processing module includes: obtaining, from the storage medium of the terminal device, a second PLMN identifier of a second PLMN equivalent to the first PLMN; Obtaining a second Globally Unique Temporary Identifier (GUTI) assigned by the second PLMN based on the second PLMN identifier from the storage medium of the terminal device; and The second GUTI is included in the registration request message.

38. The apparatus of claim 37 configured to:

41. The processing module further comprises: Obtaining a first GUTI assigned by the first PLMN based on the first PLMN identifier from the storage medium of the terminal device; and The first GUTI is included in the registration request message.

40. Apparatus according to any one of claims 37 to 39, configured so as to

42. 42. The apparatus of claim 37, wherein before obtaining the first NAS security context, the processing module is configured to register with a third PLMN via the first access network and deregister from the third PLMN via the first access network, and when the terminal device deregisters from the third PLMN via the first access network, the processing module stores in the storage medium a second NAS security context with the third PLMN established by the terminal device, the second NAS security context corresponding to the first access network, and a third PLMN identifier of the third PLMN.

43. A program for causing an electronic device to carry out the method according to any one of claims 1 to 21.

44. A chip comprising a processor, the chip being enabled to perform the method of any one of claims 1 to 21 when computer instructions stored in a memory are executed on the processor.

Images