Method and apparatus for acquiring security context, and communication system

Abstract

To provide a method and apparatus for acquiring security context using mobility management function (AMF), and a communication system.SOLUTION: In a method, after user equipment (UE) is handed over from 4G communications system to 5G communications system, an AMF 1 which provides an access and mobility management service for the UE in the 5G system acquires a security context of the UE from an AMF 2 in the 5G communication system. The UE transmits a first registration request message to the AMF 1. The first registration request message holds a second registration request message. The AMF 1 transmits the second registration request message to the AMF 2. The second registration request message uses a native security context between the UE and the AMF 2 for integrity protection. After successfully validating the integrity of the second registration request message, the AMF 2 returns the security context of the UE to the AMF 1.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to the field of communications, and more particularly to a method for obtaining security context and The present invention relates to an apparatus, a communication system, and a method for implementing the present invention. [Background technology]

[0002] In the 5th generation (5G) communication scenario, the mobility of user equipment increases the number of The network device that provides the service to the user device changes. In this scenario, user equipment will transition from the 4th generation (4G) communication system to the 5G communication system. In this handover scenario, the 4G access network From devices to 5G access network devices, and then from 4G core network devices The user equipment is handed over from the 5G core network device to the 5G core network device. Handover between devices is performed by the controller that provides mobility management services for user equipment. In other words, the mobility of the 4G communication system is a A mobility management entity (MME) to a mobility management entity (MME) of a 5G communication system Handover to the access and mobility management function (AMF) include. Summary of the Invention [Means for solving the problem]

[0003] Existing scenarios in which user equipment is handed over from a 4G communication system to a 5G communication system In addition to the AMF selected by the MME (first AMF), the 5G communication system also selects the AMF from the user equipment. In this case, the first AMF also includes an AMF that stores the security context of the first AMF. How does the first AMF obtain the security context of the user equipment from the second AMF? These are urgent issues that need to be resolved.

[0004] The present application provides a security context acquisition method and apparatus, and a communication system. The second registration request message sent by the first AMF to the second AMF includes the user Integrity protection is based on the native security context between the device and the second AMF. Therefore, the second AMF does not use the native security context between the user equipment and the second AMF. The second AMF can verify the integrity of the second registration request message based on the text, and the second AMF can If this validation is successful, the first AMF can successfully obtain the security context of the user equipment from the second AMF.

[0005] According to a first aspect, a method for obtaining a security context is provided. The method includes: The access and mobility management function AMF receives the first registration request message sent by the user equipment. receiving a registration request message, the first registration request message being a second registration request message; The second registration request message uses the first security context. Integrity protection is performed, and the first security context is between the user equipment and the second AMF. The first AMF is a native security context, and the second AMF is a Access and mobility management for user equipment after handover of user equipment to a new system The first AMF performs a second registration to the second AMF, the second AMF providing a security management service. The second AMF sends a registration request message to the second AMF. The second AMF verifies the integrity of the second registration request message. If the second AMF successfully verifies the integrity of the second registration request message, the first AMF The security context of the user equipment is transmitted to the

[0006] According to the security context acquisition method provided in this embodiment of the present application, 4G communication When the user equipment is handed over from the LTE system to the 5G communication system, Before, the security context of the user equipment is stored by the user equipment and the second AMF. After the user equipment is handed over from the 4G communication system to the 5G communication system, the first A The MF provides access and mobility management services for user equipment. The first AMF is , it is necessary to obtain the security context of the user equipment from the second AMF. Specifically, After receiving the handover command, the user equipment A fourth registration request message is sent based on the security context between the device and the second AMF. a second registration request message, and add the message to a first registration request message and send the first registration request message to the first AMF In this way, the first AMF can forward the second registration request message to the second AMF. The second AMF can send the second registration request message to the second AMF, and the second AMF can verify the integrity of the second registration request message. After successfully verifying the integrity of the registration request message, the first AMF sends the security information of the user equipment to the first AMF. This allows the first AMF to return a security context of the user equipment from the second AMF. This can increase the likelihood of successfully obtaining a security context.

[0007] Regarding the first aspect, in some implementations of the first aspect, a security control of a user equipment The context is the first security context, or The second security context is derived based on the

[0008] According to the security context acquisition method provided in this embodiment of the present application, a user The security context of the equipment is the native security context between the user equipment and the second AMF. Alternatively, the second AMF may perform key derivation to generate a new key. If so, the security context of the user equipment is the first security context. The second security context may be generated by key derivation based on

[0009] Regarding the first aspect, in some implementations of the first aspect, the first AMF may transmit a second AMF to the second AMF. The step of sending a registration request message includes the first AMF sending a user equipment context to the second AMF. sending a user equipment context transfer service invocation request, The service invocation request carries a second registration request message.

[0010] According to the security context acquisition method provided in this embodiment of the present application, the first A The second registration request message sent by the MF to the second AMF is received by the first AMF from the second AMF. It may be included in the user equipment context transfer service invocation request sent to F.

[0011] Regarding the first aspect, in some implementations of the first aspect, the second AMF transmits a user AMF to the first AMF. The step of transmitting the security context of the device includes a step of transmitting a first response from the second AMF to the first AMF. a step of transmitting a response message, the first response message being a security response of the user equipment; and maintaining a security context.

[0012] According to the security context acquisition method provided in this embodiment of the present application, the first A When returning the security context of the user equipment to the MF, the second AMF A first response message carrying the security context can be sent to the first AMF.

[0013] Regarding the first aspect, in some implementations of the first aspect, the method further comprises: The first AMF receives a message indicating that the integrity verification of the registration request message of If the first AMF continues to use the mapped security context, or The method further includes initiating an initial authentication with the user device.

[0014] According to the security context acquisition method provided in this embodiment of the present application, the first A When the MF fails to obtain a security context of the user equipment from the second AMF, The mapped security context generated through negotiation with the user device The first AMF can continue to be used or a security context between the first AMF and the user equipment can be created. To achieve this, an initial authentication can be initiated for the user equipment.

[0015] Regarding the first aspect, in some implementations of the first aspect, a mapped security context The message defines the security context between the mobility management entity (MME) and the user equipment. The MME is a network element in a 4G communication system.

[0016] In the security context acquisition method provided in this embodiment of the present application, The end security context is the security context between the user equipment and the MME. A security control generated separately by the user equipment and the first AMF by derivation based on the It is text.

[0017] Regarding the first aspect, in some implementations of the first aspect, the second AMF may receive a second registration request message. The step of verifying the integrity of the message is performed by the second AMF verifying the integrity of the message between the second AMF and the user equipment. and verifying the integrity of the second registration request message based on the active security context. The method includes the step of:

[0018] According to a second aspect, a method for obtaining a security context is provided. The method includes: The access and mobility management function AMF receives the second registration request message sent by the first AMF. receiving a second registration request message, the second registration request message including a first security code; The first security context is the user machine context. The native security context between the first AMF and the second AMF. for the user equipment after the user equipment is handed over from the system to the 5G communication system The second AM is an AMF that provides access and mobility management services. F verifies the integrity of the second registration request message. The second AMF verifies the integrity of the second registration request message. If the integrity of the message is successfully verified, the first AMF is informed of the security context of the user equipment. Send a message.

[0019] According to the security context acquisition method provided in this embodiment of the present application, 4G communication When the user equipment is handed over from the LTE system to the 5G communication system, Before, the security context of the user equipment is stored by the user equipment and the second AMF. After the user equipment is handed over from the 4G communication system to the 5G communication system, the first A The MF provides access and mobility management services for user equipment. The first AMF is , it is necessary to obtain the security context of the user equipment from the second AMF. Specifically, After receiving the handover command, the user equipment A fourth registration request message is sent based on the security context between the device and the second AMF. The second registration request message can then be generated. The UE adds the second registration request message to the first registration request message sent to the first AMF. In this way, the first AMF can forward the second registration request message to the second AMF; The second AMF can verify the integrity of the second registration request message. After successfully verifying the integrity of the request message, the first AMF sends the security control This is because the first AMF receives the security context of the user equipment from the second AMF. This can increase the chances of successfully retrieving the text.

[0020] Regarding the second aspect, in some implementations of the second aspect, The context is the first security context, or The second security context is generated by key derivation based on

[0021] According to the security context acquisition method provided in this embodiment of the present application, a user The security context of the equipment is the native security context between the user equipment and the second AMF. Alternatively, the second AMF may perform key derivation to generate a new key. If so, the security context of the user equipment is the first security context. The second security context may be generated by key derivation based on

[0022] Regarding the second aspect, in some implementations of the second aspect, the second AMF is The step of receiving the second registration request message sent by the second AMF is receiving a user equipment context transfer service invocation request transmitted via the Thus, the user equipment context transfer service invocation request sends a second registration request message. The method includes the steps of:

[0023] According to the security context acquisition method provided in this embodiment of the present application, the first A The second registration request message sent by the MF to the second AMF is received by the first AMF from the second AMF. It may be included in the user equipment context transfer service invocation request sent to F.

[0024] Regarding the second aspect, in some implementations of the second aspect, the second AMF transmits a user request to the first AMF. The step of transmitting the security context of the device includes a step of transmitting a first response from the second AMF to the first AMF. a step of transmitting a response message, the first response message being a security response of the user equipment; and maintaining a security context.

[0025] According to the security context acquisition method provided in this embodiment of the present application, the first A When returning the security context of the user equipment to the MF, the second AMF A first response message carrying the security context can be sent to the first AMF.

[0026] Regarding the second aspect, in some implementations of the second aspect, the second AMF may receive a second registration request message. The step of verifying the integrity of the message may be performed by the second AMF in the first security context. and verifying the integrity of the second registration request message based on the second registration request message.

[0027] According to a third aspect, a method for obtaining a security context is provided. determining a second registration request message by the user device; and performing integrity protection on the second registration request message, the second registration request message being provided with the first security information. The first security context is the user context. Native security control between the user device and the second access and mobility management function (AMF) The user equipment includes a first access and mobility management system. a first registration request message to the AMF, the first registration request message being a second registration request message; The first AMF holds a request message for transferring user equipment from the 4G communication system to the 5G communication system. Providing access and mobility management services for user equipment after it has been handed over This is AMF.

[0028] According to the security context acquisition method provided in this embodiment of the present application, 4G communication When the user equipment is handed over from the LTE system to the 5G communication system, Before, the security context of the user equipment is stored by the user equipment and the second AMF. After the user equipment is handed over from the 4G communication system to the 5G communication system, The first AMF provides access and mobility management services for user equipment. The MF needs to obtain the security context of the user equipment from the second AMF. In general, after receiving the handover command, the user equipment will read the natively stored A fourth registration request message is sent based on a security context between the user equipment and the second AMF. The second registration request message can then be generated. The UE may include a second registration request message in the first registration request message sent to the first AMF. In this way, the first AMF can forward the second registration request message to the second AMF. The second AMF can then verify the integrity of the second registration request message. After successfully verifying the integrity of the registration request message, the first AMF sends the security information of the user equipment to the first AMF. This allows the first AMF to return the security context of the user equipment from the second AMF. This can increase the chances of successfully obtaining a security context.

[0029] Regarding the third aspect, in some implementations of the third aspect, the method includes: If a Non-Access Stratum Security Mode Command NAS SMC message is received Then, verifying the integrity of the NAS SMC, and if the verification is successful, providing inaccessibility to the first AMF. and sending a process layer security mode complete message.

[0030] According to the security context acquisition method provided in this embodiment of the present application, a user The device receives the NAS SMC message sent by the first AMF and transmits the NAS SMC message If the verification is successful, a non-access layer security mode completion message is sent to the first AMF. Send.

[0031] According to a fourth aspect, a method for obtaining a security context is provided. The method includes: The access and mobility management function AMF receives the first registration request message sent by the user equipment. receiving a registration request message, the first registration request message being a second registration request message; The second registration request message uses the first security context. Integrity protection is performed, and the first security context is between the user equipment and the second AMF. The first AMF is a native security context, and the second AMF is a Access and mobility management for user equipment after handover of user equipment to a new system The first AMF performs a second registration to the second AMF, the second AMF providing a security management service. The second AMF successfully verifies the completeness of the second Registration Request message. If verified, the first AMF shall verify the security context of the user equipment sent by the second AMF. Receive a text.

[0032] According to the security context acquisition method provided in this embodiment of the present application, 4G communication When the user equipment is handed over from the LTE system to the 5G communication system, Before, the security context of the user equipment is stored by the user equipment and the second AMF. After the user equipment is handed over from the 4G communication system to the 5G communication system, the first A The MF provides access and mobility management services for user equipment. The first AMF is , it is necessary to obtain the security context of the user equipment from the second AMF. Specifically, After receiving the handover command, the user equipment A fourth registration request message is sent based on the security context between the device and the second AMF. The second registration request message can then be generated. The UE adds the second registration request message to the first registration request message sent to the first AMF. In this way, the first AMF can forward the second registration request message to the second AMF; The second AMF can verify the integrity of the second registration request message. After successfully verifying the integrity of the request message, the first AMF sends the security control This allows the first AMF to receive the security information of the user equipment from the second AMF. This can increase the chances of successfully obtaining a t-context.

[0033] Regarding the fourth aspect, in some implementations of the fourth aspect, The context is the first security context, or The second security context is generated by key derivation based on

[0034] According to the security context acquisition method provided in this embodiment of the present application, a user The security context of the equipment is the native security context between the user equipment and the second AMF. Alternatively, the second AMF may perform key derivation to generate a new key. If so, the security context of the user equipment is the first security context. The second security context may be generated by key derivation based on

[0035] Regarding the fourth aspect, in some implementations of the fourth aspect, the first AMF transmits a second AMF The step of sending a registration request message includes the first AMF sending a user equipment context to the second AMF. sending a user equipment context transfer service invocation request, The service invocation request carries a second registration request message.

[0036] According to the security context acquisition method provided in this embodiment of the present application, the first A The second registration request message sent by the MF to the second AMF is received by the first AMF from the second AMF. It may be included in the user equipment context transfer service invocation request sent to F.

[0037] Regarding the fourth aspect, in some implementations of the fourth aspect, the first AMF is The step of receiving the security context of the user equipment to be transmitted includes: receiving a first response message sent by the second AMF, The message maintains a security context of the user equipment.

[0038] According to the security context acquisition method provided in this embodiment of the present application, the first A When returning the security context of the user equipment to the MF, the second AMF A first response message carrying the security context can be sent to the first AMF.

[0039] Regarding the fourth aspect, in some implementations of the fourth aspect, the method further comprises: If the first AMF receives a message indicating that the integrity verification of the registration request message failed, In this case, the first AMF continues to use the mapped security context or The method further includes initiating an initial authentication with the device.

[0040] According to the security context acquisition method provided in this embodiment of the present application, the first A When the MF fails to obtain a security context of the user equipment from the second AMF, The mapped security context generated through negotiation with the user device The first AMF can continue to be used or a security context between the first AMF and the user equipment can be created. To achieve this, an initial authentication can be initiated for the user equipment.

[0041] Regarding the fourth aspect, in some implementations of the fourth aspect, a mapped security context The message defines the security context between the mobility management entity (MME) and the user equipment. The MME is a network element in a 4G communication system.

[0042] In the security context acquisition method provided in this embodiment of the present application, The end security context is the security context between the user equipment and the MME. A security control generated separately by the user equipment and the first AMF by derivation based on the It is text.

[0043] According to a fifth aspect, a method for obtaining a security context is provided. The method includes: The access and mobility management function AMF provides a user equipment context transfer service to a second AMF. sending a user equipment context transfer service call request, The request is used to obtain the security context of the user equipment. The device context transfer service invocation request carries indication information, and the indication information is The first AMF is used to indicate that the 4G communication system has been verified to be a 5G communication system. Access and mobility management for user equipment after handover of user equipment to a new system The first AMF is an AMF that provides a security management service. receiving a second response message transmitted, the second response message being a security Holds the tee context.

[0044] According to the security context acquisition method provided in this embodiment of the present application, the first A The user equipment context transfer service invocation request sent by the MF to the second AMF comprises: It holds the indication information that the UE has been verified. This is because the second AMF fails to verify the UE. To avoid a situation where the UE security context is not sent to the first AMF, the first AMF Increasing the likelihood of successfully obtaining a security context for a user equipment from a second AMF It is possible.

[0045] Regarding the fifth aspect, in some implementations of the fifth aspect, the instruction information may include: The indication information is used to indicate that the registration request message has been authenticated. The registration request message, including the ACK message, may be used to indicate that the integrity of the is received from the user equipment by the first AMF.

[0046] According to the security context acquisition method provided in this embodiment of the present application, the first A The indication information sent by the MF to the second AMF, indicating that the UE has been verified, is Inform the second AMF that the integrity of the registration request message sent by the This may be used by the first AMF to indicate that the UE is verified. Providing flexible and customizable solutions.

[0047] Regarding the fifth aspect, in some implementations of the fifth aspect, the first AMF transmits a user request to the second AMF. Before sending the device context transfer service invocation request, the method and successfully verifying integrity protection of the registration request message, and / or a registration request message received by the first AMF from the user equipment. The sage will be able to detect the user equipment after the user equipment is handed over from a 4G communication system to a 5G communication system. The first AMF determines that the registration request message is sent by the user device. include.

[0048] According to the security context acquisition method provided in this embodiment of the present application, the first A The MF shall, based on the results indicating that the registration request message was successfully validated, and / or Or, the received registration request message indicates that the user equipment is transitioning from a 4G communication system to a 5G communication system. The registration request message is sent by the user equipment after it has been handed over to the Based on this, a user equipment context transfer service invocation request is sent to the second AMF. It is determined that the information may be trusted.

[0049] Regarding the fifth aspect, in some implementations of the fifth aspect, a user equipment context transfer The service invocation request carries the identity of the user equipment.

[0050] According to the security context acquisition method provided in this embodiment of the present application, the first A The second AMF knows that the MF needs to obtain the security context of the user equipment. To enable this, the first AMF may include a user entity in the context transfer service invocation request. Add the vessel ID.

[0051] Regarding the fifth aspect, in some implementations of the fifth aspect, a user equipment context transfer The service invocation request is sent using the user equipment's uplink non-access stratum count (UL NAS COUNT Hold.

[0052] According to the security context acquisition method provided in this embodiment of the present application, the second A To enable the MF to know the UL NAS COUNT, the first AMF provides a context transfer service The UL NAS COUNT can be added to the call request.

[0053] Regarding the fifth aspect, in some implementations of the fifth aspect, a user equipment context transfer The service invocation request carrying a UL NAS COUNT indicates that the UE context transfer service The service call request includes carrying a plaintext registration request message, The line text registration request message contains the UL NAS COUNT, and the registration request message is The first AMF is received from the second AMF.

[0054] According to the security context acquisition method provided in this embodiment of the present application, a user The fact that the device context transfer service invocation request carries the UL NAS COUNT indicates that the user equipment The plain text registration request message is stored in the device context transfer service invocation request. The plain text registration request message may be implemented by This provides a flexible and optional solution for the first AMF to transmit the UL NAS COUNT to the second AMF. Provides solutions.

[0055] According to a sixth aspect, a method for obtaining a security context is provided. The method includes: The access and mobility management function AMF receives the user equipment content sent by the first AMF. receiving a text transfer service invocation request, the text transfer service invocation request being received from a user device context; The forwarding service invocation request is used to obtain the security context of the user equipment. The user equipment context transfer service invocation request carries the indication information, and the indication information The information is used to indicate that the user equipment is verified, and the first AMF is 5G communication system to a 5G communication system. The second AMF is an AMF providing access and mobility management services. Send a second response message to the first AMF, the second response message including a security setting for the user equipment. Holds the tee context.

[0056] According to the security context acquisition method provided in this embodiment of the present application, the first A User equipment context transfer service sent by MF and received by second AMF The call request carries an indication that the UE has been verified. The second AMF does not need to verify the UE. This is because the second AMF fails to verify the UE and does not To avoid a situation where the UE security context is not sent to the MF, and the first AMF receives a request from the second AMF. It is possible to increase the likelihood of successfully obtaining a security context for a user equipment. .

[0057] Regarding the sixth aspect, in some implementations of the sixth aspect, the instruction information may include: The indication information is used to indicate that the registration request message has been authenticated. The registration request message, including the ACK message, may be used to indicate that the integrity of the is received from the user equipment by the first AMF.

[0058] According to the security context acquisition method provided in this embodiment of the present application, the first A An indication sent by the MF and received by the second AMF indicating that the UE has been verified. The information indicates that the integrity of the registration request message sent by the UE has been successfully verified. It may be used by the first AMF to inform the second AMF that the UE has been verified. This provides a flexible and arbitrary solution for demonstrating that

[0059] Regarding the sixth aspect, in some implementations of the sixth aspect, a user equipment context transfer The service invocation request carries the identity of the user equipment.

[0060] According to the security context acquisition method provided in this embodiment of the present application, the second A The MF performs the first transfer based on the ID of the user equipment included in the context transfer service invocation request. One AMF may determine that it is necessary to obtain the security context of the user equipment.

[0061] Regarding the sixth aspect, in some implementations of the sixth aspect, a user equipment context transfer The service invocation request is sent using the user equipment's uplink non-access stratum count (UL NAS COUNT Hold.

[0062] According to the security context acquisition method provided in this embodiment of the present application, the second A The MF determines the UL NAS count based on the UL NAS COUNT included in the context transfer service invocation request. You can find out the COUNT.

[0063] Regarding the sixth aspect, in some implementations of the sixth aspect, a user equipment context transfer The service invocation request carrying a UL NAS COUNT indicates that the UE context transfer service The service call request includes carrying a plaintext registration request message, The line text registration request message contains the UL NAS COUNT, and the registration request message is The first AMF is received from the second AMF.

[0064] According to the security context acquisition method provided in this embodiment of the present application, a user The fact that the device context transfer service invocation request carries the UL NAS COUNT indicates that the user equipment The plain text registration request message is stored in the device context transfer service invocation request. The plain text registration request message may be implemented by This provides a flexible and optional solution for the first AMF to transmit the UL NAS COUNT to the second AMF. Provides solutions.

[0065] Regarding the sixth aspect, in some implementations of the sixth aspect, the method further comprises: The method further includes the step of performing key derivation based on the OUNT.

[0066] According to the security context acquisition method provided in this embodiment of the present application, the second A The MF can perform key derivation based on the received UL NAS COUNT.

[0067] According to a seventh aspect, there is provided a communication system. The communication system comprises a communication device according to the first aspect, or Operations performed by the first AMF and the second AMF in any one of the possible implementations of the first aspect Specifically, the communication device includes a first AMF and a second AMF, which may be configured to execute the The steps according to any one of the first aspect or possible implementations of the first aspect, or corresponding components (means) configured to perform a function, The components may be the first AMF and the second AMF of the first embodiment, or The first AMF and the second AMF may be chips or functional modules in the first AMF and the second AMF. or functionality may be software, hardware, or hardware and software. It may be implemented in combination.

[0068] According to an eighth aspect, a security context acquisition device is provided. The device comprises: any one of the aspects, the fourth aspect, a possible implementation of the fifth aspect, or a possible implementation of the fourth aspect The first AMF may be configured to perform the operations performed by the first AMF. The security context acquisition device may be implemented in any one of the following ways: or performing the steps or functions recited in any one of the possible implementations of the fourth aspect. and corresponding components (means) configured to: It may be the first AMF of the fourth and fifth aspects, or within the first AMF of the fourth and fifth aspects The steps or functions may be software, Implemented in hardware or a combination of hardware and software good.

[0069] According to a ninth aspect, a security context acquisition device is provided. The device includes a second any one of the aspects, the sixth aspect, a possible implementation of the second aspect, or a possible implementation of the sixth aspect In particular, the security device may be configured to perform the operations performed by the second AMF. The security context acquisition device may include the second aspect, the sixth aspect, a possible implementation of the second aspect, or or performing the steps or functions as recited in any one of the possible implementations of the sixth aspect. and corresponding components (means) configured to: It may be the second AMF of the second and sixth aspects, or within the second AMF of the second and sixth aspects The steps or functions may be software, Implemented in hardware or a combination of hardware and software good.

[0070] According to a tenth aspect, there is provided a security context acquisition device. The user equipment may be configured to perform the operations performed by the user equipment in the following manner: The security context acquisition device may further comprise the steps of: Each component may include a corresponding component (means) configured to perform a function. The component may be a user equipment of the third aspect, or a team in the user equipment of the third aspect. A step or function may be a software, hardware, or functional module. may be implemented by hardware, or a combination of hardware and software. stomach.

[0071] According to an eleventh aspect, a communication device including a processor, a transceiver, and a memory is provided. The memory is configured to store a computer program. The server is a security context acquisition device of any possible implementation of the first to fifth aspects. The processor is configured to perform the transmitting and receiving steps in the method. 6. A security context acquisition device method according to any one of the possible implementations of the present invention. To be able to do this, a computer program must be called from memory and The computer is configured to execute a computer program.

[0072] Optionally, there is one or more processors and one or more memories.

[0073] Optionally, the memory may be integral to the processor, or the memory and the processor may be may be located separately.

[0074] Optionally, the transceiver includes a transmitter and a receiver. include.

[0075] According to a twelfth aspect, there is provided a system. The system comprises the eighth and ninth aspects. The security context acquisition device includes a security context acquisition device provided by

[0076] According to a thirteenth aspect, there is provided a computer program product. The RAM product contains computer programs (sometimes called code or instructions). When the computer program is executed, the computer performs a method according to any one of the first to sixth aspects. It becomes possible to implement possible methods of implementation.

[0077] According to a fourteenth aspect, a computer readable medium is provided. Storing computer programs (sometimes called code or instructions). When the data program is executed on a computer, the computer performs the first to sixth aspects of the present invention. Any possible implementation method may be implemented.

[0078] According to a fifteenth aspect, there is provided a chip system including a memory and a processor. The memory is configured to store a computer program. configured to call a computer program and execute the computer program Thus, the communication device to which the chip system is attached can be any one of the first to sixth aspects. Implement any of the possible implementation methods. [Brief description of the drawings]

[0079] [Figure 1] 1 is a network architecture applicable to an embodiment of the present application; [Diagram 2] 1 is a schematic flow chart of a handover between communication systems. [Diagram 3] FIG. 2 is a schematic diagram of a security context acquisition method according to an embodiment of the present application; [Figure 4] FIG. 2 is a schematic diagram of another security context acquisition method according to an embodiment of the present application; [Diagram 5] 1 is a schematic diagram of a security context acquisition device 50 according to an embodiment of the present application. [Figure 6] 1 is a schematic diagram of a user device 60 according to an embodiment of the present application. [Figure 7] 7 is a schematic diagram of a security context acquisition device 70 according to an embodiment of the present application. [Figure 8] FIG. 2 is a schematic configuration diagram of a first AMF 80 according to an embodiment of the present application. [Figure 9] 1 is a schematic diagram of a security context acquisition device 90 according to an embodiment of the present application. [Figure 10] FIG. 2 is a schematic configuration diagram of a second AMF 100 according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0080] The technical solutions of the present application are described below with reference to the accompanying drawings.

[0081] The technical solution of the embodiment of the present application is the Global System for Mobile Global System for Mobile Communications (GSM), code Code division multiple access (CDMA) system, wideband code division multiple Wideband code division multiple access (WCDMA) systems, general purpose General packet radio service (GPRS) system, long-term Long Term Evolution (LTE) system, LTE frequency division duplex LTE time division duplex (TDD) system, LTE time division duplex (TDD) system Universal Mobile Telecommunications System (UMTS) Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability worldwide interoperability for microwave access ess, WiMAX) communication systems, future 5th generation (5G) systems, or The present invention can be applied to various communication systems such as new radio (NR) systems.

[0082] FIG. 1 is a network architecture applicable to an embodiment of the present application. As discussed above, the components of the network architecture are described separately below.

[0083] 1. User equipment (UE) 110 may be a variety of handheld or vehicle-mounted devices. , wearable device, and computing device having wireless communication capability, or wireless modem other processing devices connected to the These may include a mobile station (MS), a terminal, a soft client, etc. User device 110 may be a water meter, an electric meter, or a sensor.

[0084] 2. (radio access network, (R)AN) element 120 provides network access for authorized user equipment within a specific area. The system is configured to provide different quality transmission traffic based on the user equipment level, service requirements, etc. You can use the channel.

[0085] The (R)AN element is responsible for managing radio resources and providing communications between user equipment and the core network. to transmit control signals and user equipment data, and to provide access services for user equipment. (R)AN elements can also be understood as base stations in traditional networks. It can be done.

[0086] 3. The user plane network element 130 routes and forwards packets , as well as quality of service (QoS) processing of user plane data, etc. Used for.

[0087] In a 5G communication system, the user plane network element performs user plane functions ( The network element may be a user plane function (UPF). In this system, the user plane network element continues to be the UPF network element. or may have another name, which is not a limitation of this application. stomach.

[0088] 4. The data network element 140 provides a network for data transmission. It is configured as follows.

[0089] In a 5G communication system, the data network element is a data network. In future communication systems, the data network element may be a The element may still be a DN element or may have a different name. This is not a limitation of this application.

[0090] 5. The access and mobility management network element 150 is mainly responsible for mobility management. The access and mobility management network is configured to perform operations such as management and access control. The network element 150 may provide functionality such as mobility management functionality other than session management. The mobility management entity (MME) functions as a lawful interception and access authorization / authorization The authentication may be configured to enforce

[0091] In 5G communication systems, access and mobility management network elements are access and mobility management function (AMF) In future communication systems, the access and mobility management devices will continue to It may be AMF or may have another name, which is not a limitation of this application. I can't.

[0092] 6. Session Management The network element 160 mainly manages sessions and Assign and manage Internet Protocol (IP) addresses for devices The User Plane Function interface and the Policy Control and Charging Function interface are Select an endpoint that can manage the interface and notify the downlink data. The device is configured to perform the following operations.

[0093] In a 5G communication system, the session management network element performs the session management function ( The network element may be a session management function (SMF). In a communication system, the session management network element continues to be the SMF network element. It may be an element of the invention or may have another name. This is not a limitation of this application. Not determined.

[0094] 7. The policy control network element 170 provides a unified policy for network behavior. It guides the security mechanism and the control plane function network element (AMF or SMF network) network elements) to provide policy rule information. It is composed of.

[0095] In 4G communication systems, the policy control network element is responsible for policy and Policy and charging rules function (PCRF) network element In the 5G communication system, the policy control network element may Policy control function (PCF) network element In future communication systems, policy control network elements may be used. may still be a PCF network element or may have a different name. This is not a limitation of the present application.

[0096] 8. The authentication server 180 authenticates the service and provides keys to perform two-way authentication of user equipment. and is configured to support a unified authentication mechanism.

[0097] In the 5G communication system, the authentication server has the authentication server function. In future communication systems, the authentication server may be an authentication server (AUSF) network element. A functional network element may still be an AUSF network element. or another name, as this application is not limited to.

[0098] 9. The data management network element 190 processes the identity of the user equipment and accesses The RADIUS server is configured to perform authentication, registration, and mobility management.

[0099] In the 5G communication system, the data management network elements will be managed by unified data management (UDM). In a 4G communication system, the network element may be a UDM (Universal Data Management) network element. The data management network element is the home subscriber server. rver, HSS) network elements. In future communication systems, Data management may continue to be a UDM network element or may have a different name. This is not a limitation of this application.

[0100] 10. The application network element 1100 is affected by the application. Routes data to and from network exposure functions and accesses network elements to access the network, interact with the policy mechanism to enforce policy control, and so on. It is composed of.

[0101] In a 5G communication system, the application network element is an application function. It may also be an application function (AF) network element. In this system, the application network element continues to be the AF network element. It may be a component of a system or may have another name, but this is not a limitation of this application. I can't.

[0102] 11. Network storage network elements are responsible for managing all the network The network function services are configured to maintain real-time information of the network function services.

[0103] In 5G communication systems, network storage network elements are the Network Repository Function (NRF) A network element In future communication systems, network storage network elements will It may continue to be an NRF network element or may have a different name. This is not a limitation of this application.

[0104] The network elements and functions mentioned above are network elements in hardware devices. A component, software function that runs on dedicated hardware, or platform A virtual function that is instantiated on a virtual machine (e.g., a cloud platform). For ease of explanation, the following will be described in terms of access and mobility. The data management device is an AMF and the data management network element is a UDM network element. the session management network element is an SMF network element and the user plane network element is a UPF network element. The present application is illustrated by examples.

[0105] For ease of explanation, in the embodiments of the present application, the device is an AMF entity or a UDM entity. The session establishment method will be described using an example in which the device is an AMF entity. For implementation methods that are chips in the UDM entity, A specific explanation of how to establish a session where the entity is an AMF entity or a UDM entity. Please refer to the explanation below. Details will not be repeated.

[0106] In the network architecture shown in Figure 1, the user equipment is connected to the N1 interface. The (R)AN is connected to the AMF through the N2 interface, and the (R)AN is connected to the AMF through the N3 interface. The (R)AN is connected to the UPF through the N3 interface. The UPF is connected to the UPF through the N9 interface. The SMF is interconnected to the DN through the N4 interface, and the UPF is interconnected to the DN through the N6 interface. The AMF controls the UPF through the N11 interface. The AMF is connected to the SMF through the N11 interface. AMF transmits subscriptions to user equipment from the UDM unit through the N8 interface. The SMF receives user device application data from the UDM unit through the N10 interface. Get subscription data for the device.

[0107] The above-described network architecture applied to the embodiments of the present application is merely an example. It is understood that the network architecture applicable to the embodiments of the present application is not limited to this. Please understand that the network architecture that can perform the functions of the network elements described above is Any of the above techniques is applicable to the embodiments of the present application.

[0108] For example, in some network architectures, AMF, SMF network elements ment, PCF network element, BSF network element, and UDM network element Network function network elements and entities such as network elements Both are called network functions (NFs) or network elements. Or in some other network architecture, AMF, SMF network network element, PCF network element, BSF network element, and UDM network element. A set of network elements, such as a control plane These are sometimes called service-function network elements.

[0109] The user equipment in the embodiment of the present application may be an access terminal, a subscriber unit, a Subscriber station, mobile station, mobile console, relay station tion, remote station, remote terminal, mobile device, user terminal erminal, terminal equipment, terminal, wireless communication device, It may be a user agent, a user device, etc. The user device may alternatively be a mobile phone machine, cordless telephone, session initiation protocol (SIP ) telephones, wireless local loop (WLL) stations, personal personal digital assistant (PDA), handheld device with wireless communication function Handheld devices, computing devices, other processing devices connected to wireless modems, vehicle-mounted devices , wearable devices, user equipment in future 5G networks, or future evolution User equipment in a public land mobile network (PLMN) etc. This is not limited to the embodiment of the present application.

[0110] The network device in the embodiment of the present application has a wireless transceiver function and The device may be any device configured to communicate with a user device. evolved Node B (eNB), radio network controller ntroller, RNC), Node B (Node B, NB), base station controller er, BSC), base transceiver station (BTS), home home base station (for example, home evolved NodeB, or home Node B, HNB), baseBand unit (BBU), wireless fidelity y, WIFI) system access point (AP), wireless relay node , wireless backhaul node, transmission point (TP), transmission and This includes, but is not limited to, transmission and reception points (TRPs). Alternatively, the device may be connected to a gNB or a transmission port of a 5G system, such as an NR system. The antenna may be a TRP or TP, and one antenna of the antenna panel of the base station of the 5G system. Even if it is a group of antenna panels or antenna panels (including multiple antenna panels) Often, a baseband unit (BBU) constituting a gNB or a transmission point, or It may be a network node such as a distributed unit (DU).

[0111] In some deployments, the gNB may include a centralized unit (CU) and a DU. The gNB may further include an active antenna unit (AAU). The CU performs some functions of the gNB, and the DU performs some functions of the gNB. For example, the CU is a non-remote It is responsible for real-time protocol and service processing and radio resource control. RRC layer and packet data convergence protocol The DU performs the functions of the physical layer protocol and real-time support. It is responsible for processing the radio link control (RLC) layer, medium access It performs media access control (MAC) layer and physical (PHY) layer functions. The AAU handles some of the physical layer processing functions, radio frequency processing, and active antennas. The RRC layer information is ultimately converted to PHY layer information or is converted from PHY layer information. Therefore, in this architecture, RRC layer signaling Higher layer signaling such as packet forwarding is also considered to be sent by the DU or by the DU and AAU. The network device can be considered to be a CU node, a DU node, It can be understood that the device may include any one or more of the AAU nodes. The CU is a network device in the radio access network (RAN). It may be a network device in the core network (CN). This is not a limitation of the present application.

[0112] In an embodiment of the present application, the user equipment or network device is a hardware a hardware layer, an operating system layer that runs on the hardware layer, and an operating The hardware layer includes a central processing unit (CPU) and an application layer that runs on top of the system layer. central processing unit (CPU), memory management unit (MMU) ), and hardware such as memory (also called main memory). The operating system performs service processing by using a process. The operating system may be any one or more of the following computer operating systems: Linux operating system, Unix operating system, Android Operating system, iOS operating system, or windows operating system The application layer may be a browser, an address book, a word processor, software, and applications such as instant communication software In addition, specific examples of entities performing the methods provided in the embodiments of the present application are also included. The structure includes a program for recording the code of the method provided in the embodiment of the present application. As long as communication can be performed according to the method provided in the embodiment of the present application, the implementation of the present application For example, the entity performing the method provided in the embodiment of the present application may be The entity may be a user equipment or a network device, or Even if it is a function module that can call and execute a program on a network device, good.

[0113] Additionally, aspects or features of the present application may be implemented using standard programming and / or engineering techniques. The present application may be implemented as a method, apparatus, or article of manufacture that uses the arranging techniques. The term "article of manufacture" as used herein means any computer-readable component, carrier, or This includes computer programs accessible from any computer or media. The computer-readable medium may be a magnetic storage component (e.g., a hard disk, a floppy disk, (registered trademark) disk, or magnetic tape), optical disk (e.g., compact disk compact disc (CD) or digital versatile disc (DV D)), smart cards, and flash memory components (e.g. erasable programmable erasable programmable read-only memory (EPROM) , card, stick, or key drive). In addition, the various storage media described herein may be configured to store information. It may refer to one or more devices and / or other machine-readable media. The term "medium" includes wireless channels and any other media that may be used to store, carry, or transmit instructions and / or data. and / or various other media capable of holding the stomach.

[0114] The embodiments of the present application mainly concern that the network architecture shown in FIG. The mobility management entity MME in the case of the network architecture shown in Figure 1 Access and mobility when the network architecture in use is 5G network The present application relates to a first AMF and a second AMF. Specifically, the first AMF in this application provides core network services for UEs. A process in which user equipment is handed over from a 4G communication system to a 5G communication system in order to is the AMF selected from the 5G communication system for the UE by the MME of the 4G communication system. The second AMF of the present application is a method for handing over a user equipment from a 4G communication system to a 5G communication system. In the process of this, the UE security context is stored in the 5G communication system other than the first AMF. This is AMF.

[0115] In this application, the terms "first" and "second" are used for distinction only and are not intended to limit the scope of the present application. It should be understood that the above should not be construed as a limitation on the first AMF and the second AMF. is merely used to distinguish between different AMFs.

[0116] To facilitate understanding of the security context acquisition method provided in the embodiments of the present application. Therefore, referring to FIG. 2, the following description will be directed to a case where a user equipment is handed over from a 4G communication system to a 5G communication system. The handover process between communication systems is briefly explained below. 1 is a schematic flowchart showing a UE, an MME, a first AMF, and a second AMF. Includes AMF.

[0117] A handover between communication systems includes the following steps.

[0118] S210: The MME sends a forward relocation request message to the first AMF. Send.

[0119] Specifically, the MME of the 4G communication system is responsible for the transfer of user equipment from the 4G communication system to the 5G communication system. The UE knows that it will be handed over to the next system and provides access and mobility management services for the UE. In order to continue to provide the above, it is necessary to select a first AMF for the UE from the 5G communication system. When the UE accesses the 4G communication system, the UE and the MME share the same key K ASME The UE receives the 4G communication system. When the MME is handed over to the 5G communication system, the MME selects the first AMF and ASME And next In other words, the forward retry is performed by sending a next hop parameter (NH) to the first AMF. The placement request message is K ASME and NH.

[0120] In this embodiment of the present application, the method in which the MME learns of the handover between systems is not limited. For details, see the Handover from 4G to 5G Communication Systems in Existing Protocols. For example, the base station of a 4G communication system performs handover to the MME. As a result, the MME can transmit a server request to the UE from the 4G communication system to the 5G communication system. The user knows that a handover of the device is necessary.

[0121] In addition, the method in which the MME selects the first AMF is not limited in this embodiment of the present application. For details, please refer to the specifications of existing protocols. For example, the MME The MME stores at least one AMF configured by the 4G communication system to the 5G communication system. When it knows that it is necessary to hand over the user equipment to the system, it receives a notification from at least one AMF. Select the first AMF.

[0122] S220: The first AMF determines a mapped security context.

[0123] Specifically, the first AMF is ASME or NH Derives a mapped security context based on parameters such as the map The mapped security context is included in the UE's mapped context. The mapped context is negotiated between the UE and the MME in the 4G communication system. Based on the context generated by the first AMF, the UE's security information is derived separately by the first AMF and the UE. It should be understood that the security context is the UE security context. For information on how to derive the security context, see the specifications of existing protocols. The mapped security context is According to the security context between the MME and the user equipment, the first AMF and the UE In addition, in this application, the UE and the MME in the 4G communication system are The context to be used includes the security context between the UE and the MME. Similarly, in this application, the UE may be referred to as the 4G context of the UE. Before being handed over to the 5G communication system from the UE, the security information of the UE stored in the UE and the second AMF is The context is a context negotiated between the UE and the second AMF in a 5G communication system. , which includes the security context between the UE and the second AMF, and for distinction, It is also sometimes called the text.

[0124] For ease of explanation, the following describes the security context between the MME and the user equipment. The security context obtained by the first AMF and the UE separately by derivation based on the The security context between the second AMF and the UE is called the mapped security context. The text is called its native security context.

[0125] The present embodiment of the present application mainly relates to transmitting the security context of the UE to the first AMF by the second AMF. It should be further understood that the present invention relates to a security context of a UE. is part of the UE context and may be transferred with the UE context. For ease of explanation, in this embodiment of the present application, the UE is connected to the first AMF by the second AMF. Transmitting the security context of the UE is equivalent to transmitting the UE's context. This may be described as transmitting the security context of the UE. It is only used for ease of explanation and does not limit the protection scope of the embodiments of this application. It's not something like that.

[0126] The first AMF receives the K ASME and parameters such as NH The first AMF derives the mapped security context of the UE based on K ASME Based on NH, the key K AMF1 This includes deriving

[0127] For example, the first AMF is K ASME After receiving and NH, we use a predefined derivation formula to derive the key K AMF1 of It can be calculated. The formula is, K AMF1 = HMAC-SHA-256(Key,FC||P0||L0), where FC = 0x76, P0 = NH value, L0 = length of NH value (i.e. 0x00 0x20) ,KEY=K ASME The first AMF is the key K AMF1 and the security algorithm agreed with the UE Based on the algorithm, the integrity protection key K NASint1 and confidentiality protection key K NASenc1 Calculate K AMF1 , K NA Sint1 , and K NASenc1 is included in the security context of the UE. AMF1 , K NASint1 , and K. NASenc1 is K ASME Based on and NH, K ASME and NH are the security between the UE and the MME. Therefore, K AMF1 , K NASint1 , and K NASenc1 UE This is called the mapped security context.

[0128] S230: The first AMF sends a forward relocation response message to the MME Send.

[0129] Specifically, the first AMF determines the mapped security context and then sends it to the MME. Send a forward relocation response message. The forward relocation response message is sent when the UE is ready for a 4G communication system. When the UE is handed over from the UE to the 5G communication system, the first AMF is 2.1 The AMF may be used to provide access and mobility management services for This is used to inform the MME of the

[0130] S240: The MME sends a handover command message to the UE.

[0131] After receiving a forward reallocation response message sent by the first AMF, the MME , know that the first AMF can provide access and mobility management services for the UE; In this case, the MME sends a handover command message to the UE, so that the UE knows that the UE is in 4G mode. Learn that handover is possible from your communications system to a 5G communications system.

[0132] S250: The UE determines a mapped security context.

[0133] After receiving the handover command message, the UE uses the predetermined derivation formula to The key K stored in ASME Based on and NH, the key K AMF1 Calculate the specific derivation process For more information, please refer to S220 above, and we will not repeat the details here.

[0134] After S250, the UE and the first AMF have the same key K AMF1 Then, the key K AMF1 to derive another key. may be used for

[0135] For example, the UE and the first AMF have the same key K AMF1 Next, we obtain K AMF1 and between the UE and the first AMF. The non-access stratum (NAS) integrity protection algorithm and Based on the confidentiality protection algorithm, the UE and the first AMF may send a NAS message (e.g., registration The integrity protection key K used to protect the request message NASint1 and confidentiality protection key K NAS enc1 Specifically, K NASint1 and K. NASenc1 is calculated as follows:

[0136] K NASint1 = HMAC-SHA-256(KEY,S), where S=FC||P01||L01||P11||L1 1, FC=0x69, P01=algorithm type distinguisher sher, and L01 = length of algorithm type discriminator inguisher (i.e. 0x00 0x01), and P11 = algorithm identity. Yes, L11 = length of algorithm identity (i.e. 0x00 0x01 ), and KEY=K AMF1 It is.

[0137] K NASenc1 = HMAC-SHA-256(KEY,S), where S=FC||P0||L0||P1||L1. YES, FC=0x69, P0=algorithm type discriminator, L0=algorithm type P1 = algorithm ID, L1 = algorithm ID length (i.e. 0x00 0x01) and KEY=K AMF1 It is.

[0138] K NASint1 The algorithm type discriminator and algorithm ID for computing K NASenc1 of It is different from the one used for calculation.

[0139] After the handover is completed, the UE starts mobility registration, i.e., executes S260. The UE sends a registration request message to the first AMF, and the UE The generated K AMF1 The mapped security context generated by derivation based on The registration request message is secured using a , including encryption and / or integrity protection.

[0140] A message sent by the UE to a core network device in the access network It should be understood that the functions of the access device may be transferred by the device. Not limited to this embodiment, the access network device is between the UE and the first AMF For the sake of brevity, in this application, the message can be transferred between the UE and the first AMF. The UE sends a registration request message to the first AMF, and the MME forwards the message to the UE. The registration request message sent by the UE is described as A globally unique temporary user device ID in the The GUTI further includes a registration request message to the first AMF. Used by access network devices to make forwarding decisions Because the GUTI is contained in a mapped context, the GUTI is called a mapped GUTI. There is.

[0141] Optionally, when the UE sends a registration request message to the first AMF, the UE may receive a registration request message from another AM. F (second AMF) and the UE security context between the user equipment and the 5G global 5th generation globally unique temporary user equipment id Therefore, the UE adds the 5G-GUTI to the registration request message. do.

[0142] The present embodiment of the present application mainly relates to a first AMF transmitting a security context of a UE from a second AMF. It should be understood that the purpose of this document is to describe the process of successfully obtaining the In this application, the following cases are mainly considered: The UE sends a registration request message to the first AMF. When the UE receives the second AMF message, the UE receives the second AMF message. and 5G-GUTI.

[0143] The reason why the UE security context and 5G-GUTI are stored by the UE and the second AMF is It is further understood that the present invention is not limited to this embodiment and may be stipulated in existing protocols. For example, before a UE is handed over from a 4G communication system to a 5G communication system, The UE is handed over from the 5G network communication system to the 4G communication system; or A UE that supports dual connectivity can access a 5G communication system through a non-3GPP connection. and at the same time accessing the 4G communication system through a 3GPP connection. In this manner, the UE in connected mode is handed over from the 4G communication system to the 5G communication system.

[0144] If a security context of the UE between the second AMF and the UE exists on the second AMF, Understand that the first AMF needs to obtain the security context of the UE from the second AMF Specifically, the first AMF obtains the security context of the UE from the second AMF. The decision to use the 5G-GUTI is based on the 5G-GUTI included in the registration request message received from the UE. 5G-GUTI is configured by the second AMF for the UE and uses the The mapped security context may be used between the UE and the MME of the 4G communication system. The security context of the UE is determined by mapping between the The security context of the UE exists in the 5G communication system as specified in the In this case, the mapped security is determined by the negotiation between the first AMF and the UE. The security context of the UE is used in preference to the security context of the Then, the procedure shown in FIG. 2 is as follows: the first AMF calls the user equipment context transfer service. The method further includes a step S270 of initiating a request to transfer the UE context (Namf_Communication_UEContextTransfer).

[0145] Specifically, the first AMF receives a registration request message sent by the UE, and sends a registration request Based on the 5G-GUTI included in the message, the user equipment context transfer is performed for the second AMF. Initiate a user equipment context transfer service invocation request. holds the registration request message.

[0146] The registration request message is based on the mapped security context between the UE and the first AMF. The second AMF is secured based on the result of verifying the registration request message. It can be understood that the first AMF determines whether to return the security context of the UE to the first AMF. That is, S290 is executed. The second AMF verifies the registration request message.

[0147] In one possible implementation, the second AMF fails to validate the registration request message. In this case, The second AMF does not return the security context of the UE to the first AMF. As a result, the first AMF The first AMF fails to obtain the security context of the UE from the second AMF. The security context cannot be used preferentially. This is not compliant with the protocol. stomach.

[0148] In another possible implementation, the second AMF successfully verifies the integrity of the registration request message. In this case, the second AMF returns the security context of the UE to the first AMF, and the second AMF Optionally, execute S291 to send the security context of the UE to the first AMF. The second AMF sending the security context of the UE to the first AMF indicates that the second AMF has The UE context may be described as transmitting the UE context to the first AMF. The security context of the UE is determined through negotiation between the UE and the AMF in the second step. The UE's security context is AMF2 and non-access layer count s stratum count, NAS COUNT, etc.

[0149] Optionally, the second AMF may perform a local AMF transfer before transferring the security context of the UE. According to the rule policy, key K AMF2 The second AMF may perform key derivation on K AMF2 Key guidance for If derivation is performed, the second AMF uses the key K obtained after derivation. AMF2’ And the second AMF is K AMF2 For The first AMF transmits, to the first AMF, a derivation indication information used to indicate that key derivation has been performed using the derivation indication information.

[0150] In one possible implementation, the key derivation in this application may be horizontal key derivation.

[0151] For example, K AMF2 Perform horizontal key derivation for K AMF2’ The method for generating . K AMF2’ =HMAC-SHA-256(Key,S); FC=0x72; P0=0x01; L0=length of P0(ie 0x00 0x01); P1=uplink NAS COUNT; L1=length of P1(ie 0x00 0x04); KEY=K AMF2 ; S=FC||P0||L0||P1||L1

[0152] In another possible implementation, the key derivation in this application is performed between various network elements. For example, the first AMF and the second AMF may be a default key derivation scheme. However, the UE security control sent by the second AMF to the first AMF shall be agreed upon. If the context text includes derivation indication information, the first AMF derives the security context of the received UE. The key in the text is obtained by performing key derivation using a default key derivation method by the second AMF. It can be determined that this is the case.

[0153] Similarly, the first AMF also derives the key K after receiving the derivation indication information. AMF2 Perform key derivation for The key is K AMF2’ Instructs the UE to obtain a key and allows the UE and network side to agree on a key. The UE transmits derivation instruction information to the UE to obtain the key K AMF2 Receive a key identifier indicating Therefore, K AMF Instead of key K AMF2 It is understood that it is possible to determine whether key derivation is performed for The key identifier is not improved in this application. Therefore, the key identifier is not described in detail here. do not.

[0154] If the second AMF fails to verify the UE, the first AMF will transfer the security context of the UE from the second AMF. The inability to obtain a 5G data record means that the user equipment is handed over from the 4G communication system shown in Figure 2 to the 5G communication system. The handover process can be known by obtaining the security context of the UE. To avoid compromising, the embodiment of the present application implements a security context acquisition method as When the first AMF obtains the security context of the UE from the second AMF, the first AMF The security context holds an indication that the UE has been successfully verified. According to the indication information, the second AMF does not need to verify the UE, but can verify the security of the UE. This returns the UE security context as is. This can avoid the possibility of

[0155] In this application, verifying the UE means verifying the integrity of the registration request message sent by the UE. For example, to decrypt the registration request message and / or to verify the registration request. This should be understood to mean verifying the integrity of the message. The assumption that the integrity of the message is successfully verified is based on the fact that the registration request message is successfully decrypted. Therefore, in this embodiment of the present application, the UE is successfully verified. , this is described as the integrity of the registration request message being successfully verified.

[0156] Referring to FIG. 3, the following describes the security context acquisition provided in one embodiment of the present application. FIG. 3 illustrates a method for acquiring security context according to an embodiment of the present application. 1 is a schematic diagram of a method for obtaining a UE, an MME, a first AMF, and a second AMF.

[0157] The security context acquisition method includes the following steps.

[0158] S310: The first AMF sends a second request message to the second AMF.

[0159] The second request message is to request to obtain a security context of the UE. The second request message carries the indication information, which is used to indicate that the UE has verified It is used to indicate that

[0160] Optionally, the indication may be referred to as a reason value.

[0161] Specifically, the first AMF determines that the UE is verified mainly based on the received UE The first AMF determines whether the registration request message received satisfies a predefined condition. Before sending the second request message to the second AMF, the method steps shown in FIG. 3 are performed from S311 to S3 It should be understood that this further includes 16.

[0162] S311: The MME sends a forward relocation request message to the first AMF. This step is shown in FIG. This is similar to S210 and will not be described in detail again here.

[0163] S312: The first AMF determines the mapped security context. This step is shown in FIG. , and the details will not be described again here.

[0164] S313: The first AMF sends a forward relocation response message to the MME. This step is shown in FIG. This is similar to S230 and will not be described in detail again here.

[0165] S314: The MME sends a handover command message to the UE. This step corresponds to S2 in FIG. 40 and will not be described in detail again here.

[0166] S315: The UE determines the mapped security context. This step corresponds to S250 in FIG. and the details will not be described again here.

[0167] S316: The UE sends a registration request message to the first AMF. This step is the same as S260 in FIG. 2. and will not be described in detail again here.

[0168] In addition, the first AMF determines that the registration request message satisfies a predetermined condition, The first AMF successfully verifies the integrity protection of the registration request message; or The registration request message is sent when the UE is handed over from the 4G communication system to the 5G communication system. The first AMF subsequently determines that the registration request message is sent by the UE. For example, the first AMF may be configured to receive a registration request message from the MME before receiving the registration request message from the UE. Receive a forward relocation request message sent by the first AMF. Thus, the first AMF: The currently received Registration Request message corresponds to the Registration Request message received from the UE during the handover procedure. Therefore, it is possible to know that it is a request message.

[0169] Specifically, the first AMF successfully verifies the integrity protection of the registration request message: The first AMF may also be referred to as successfully verifying the UE. In other words, as shown in FIG. The method steps further include S317, in which the first AMF validates the UE.

[0170] In one possible implementation, the second request message is sent by the first AMF shown in FIG. User equipment context transfer service call request to be initiated (Namf_Communication_UEC The user equipment context transfer service is shown in FIG. Unlike the request for sending, the user equipment context transfer service in this embodiment of the present application The call request includes the newly added information element (IE), i.e. Includes instruction information.

[0171] In another possible implementation, the second request message is sent by the first AMF to the second AMF. Another possible second method is sent and used to obtain the security context of the UE. This is a request message.

[0172] It should be understood that the specific format of the second request message is not limited in this application. The indication information may be added to existing signaling between the first AMF and the second AMF, or This may be added to newly added signaling between one AMF and a second AMF.

[0173] In another possible implementation, in this embodiment of the present application, the first AMF transmits a user request to the second AMF. Sending indication information to the second AMF before sending a device context transfer service invocation request In other words, the first AMF needs to send the second request message A possible implementation is shown in Figure 3. is not shown.

[0174] Please note that this application is not limited to the manner in which the indication information specifically indicates that the UE has been verified. It should be further understood that in one possible implementation, the indication information may be the 5G-GUTI of the UE. In this case, the 5G-GUTI may be used to identify the UE and indicate that the UE is verified. In this implementation, new indication functions are added to the existing IE, and 5G-GUTI has new functions. The second AMF may be notified of the instruction in a prescribed manner. The information may be at least one newly added bit, the value of which is determined by the UE. It is set to 1 to indicate that it has been verified. The above possible implementation is an illustrative example. It is merely intended to be illustrative and not to limit the scope of protection of the present application.

[0175] In one possible implementation, the indication information explicitly indicates that the UE has been verified, or In another possible implementation, the indication information implicitly indicates that the UE has been verified. For example, the indication information may indicate that the completeness of the registration request message received by the first AMF from the UE is Indicates successful validation.

[0176] In addition, when the first AMF needs to obtain the security context of the UE, the second AMF To be able to make the determination, the second request message must additionally carry the identity of the UE. .

[0177] In one possible implementation, the UE ID may be the aforementioned 5G-GUTI.

[0178] In another possible implementation, the identity of the UE is a subscriber permanent identity. dentity, SUPI).

[0179] After the first AMF receives the 5G-GUTI of the UE from the UE, the first AMF transmits the security control of the UE from the second AMF. When it is determined that a text needs to be acquired, the UE's 5G-GUTI, the UE's SUPI, or the UE's 5G- It is understood that one may choose to continue to include both the G-GUTI and the SUPI in the second request message. I want to.

[0180] Optionally, the second AMF may be configured to update the uplink non-access stratum count (uplink non-access stratum count) of the UE. In order to obtain the UL stratum count, UL NAS COUNT, one possible implementation is The second request message holds the plaintext registration request message, and this plaintext The text registration request message includes a UL NAS COUNT, or in one possible implementation, a second The request message includes a UL NAS COUNT.

[0181] In addition, after the second AMF receives the second request message sent by the first AMF, Then, based on the indication information, the second AMF knows that the UE has been verified. In this case, the second AMF detects the UE. The second AMF determines that the UE does not need to be authenticated, i.e., that the UE does not need to be verified. do.

[0182] S330: The second AMF sends a second response message to the first AMF.

[0183] The second response message maintains the security context of the UE.

[0184] In this embodiment of the present application, the second AMF does not need to verify the UE. After receiving the second request message sent by the second AMF, the first AMF requests the security of the UE. This is because the second AMF fails to validate the UE and the first AMF returns the UE context. To avoid a situation where the MF fails to obtain the security context of the UE.

[0185] Optionally, the second request message contains the plaintext registration request message. If the second request message carries a UL NAS COUNT, or if the second request message carries a UL NAS COUNT, the second AMF For example, a plaintext registration request message is not secure. Since the registration request message is not protected, the second AMF uses the plain text registration request message. UL NAS COUNT is generated from the plaintext registration request message without the need to validate the can be obtained directly.

[0186] Furthermore, the second AMF may determine whether the first AMF in the security context of the UE is a UL NAS COUNT. In this case, the key returned by the second AMF to the first AMF is The key in the security context of the UE to be used is derived by performing key derivation on the first key. This is the second key obtained by

[0187] Specifically, in the security context of the UE sent by the second AMF to the first AMF If the key is a second key, the second AMF shall further verify that the second key is a key obtained by key derivation. In order to indicate this, it is necessary to send key derivation instruction information to the first AMF.

[0188] The procedure after the first AMF obtains the security context of the UE is as follows: In the existing procedure for handing over a UE to a 5G communication system, the first AMF checks the security context of the UE. Please understand that the procedure is similar to that after obtaining the text. For details, see the existing procedure. Please refer to the instructions below, and we will not go into the details again here.

[0189] In the security context acquisition method shown in FIG. 3, a first AMF acquires a second AMF. A second request message sent to F carries indication information, and the indication information indicates that the UE has been verified. Therefore, the second AMF is used to indicate that the UE detects The second AMF can determine that the UE is authenticated and does not need to be verified. After receiving the second request message, the first AMF updates the security context of the UE. This is because the second AMF fails to verify the UE, and the first AMF does not verify the UE security. The present application provides a second AMF to verify the UE. A method for obtaining a security context is also provided. However, this method is This can increase the likelihood that the first AMF will successfully verify the UE, thereby allowing the first AMF to This increases the likelihood of successfully obtaining the security context of the user equipment from the AMF.

[0190] The method for obtaining the security context will be described in detail below with reference to FIG. 4. 2 is a schematic diagram of another security context acquisition method according to an embodiment of the present application. The schematic diagram includes a UE, an MME, a first AMF, and a second AMF.

[0191] The security context acquisition method includes the following steps.

[0192] S410: The UE determines a first registration request message.

[0193] The first registration request message holds the second registration request message. The message is integrity protected using the first security context. The security context is the native security context between the UE and the second AMF. It is text.

[0194] Specifically, the UE determines the first registration request message mainly based on the second registration request message. The second registration request message is to determine whether the UE should use native security. After integrity protection is performed on the fourth registration request message using the The fourth registration request message contains the GUTI and the key identifier (ngKSI) information. The UE-context UL NAS COUNT between the UE and the second AMF. For simplicity, this GUTI is sometimes called the native GUTI, and the key identifier is the native Sometimes called a key identifier.

[0195] Optionally, there may be several cases for the fourth registration request message:

[0196] Case 1: The fourth registration request message includes the native GUTI, the native key identifier, and the UL NAS COUNCIL. In case 1, the fourth registration request message is generated by the UE based on The fourth message may be called the fourth message or may have another possible name. The name of the message is not limited in this embodiment of the present application.

[0197] A fourth registration request generated by the UE based on the UE context between the UE and the second AMF It should be understood that the request message may alternatively be in another format. In addition to the active GUTI, Native Key Identifier, and UL NAS COUNT, The fourth registration request message further includes another information element (IE).

[0198] In case 1, the UE sends a fourth registration request message based on the first security context. The integrity protection of the message is performed by the UE based on the first security context. and performing integrity protection for the fourth registration request message and generating a first MAC for the fourth registration request message. Therefore, the first registration request message contains the second registration request message. The first registration request message includes a first MAC and a fourth registration request message. It can also be understood as.

[0199] In addition, in case 1, the UE determines the first registration request message by performing the following steps: include.

[0200] Step 1: The UE formulates a fourth registration request message.

[0201] Step 2: The UE sends a fourth registration request message based on a security context between the UE and the second AMF. The message is integrity protected and a first MAC is generated.

[0202] Step 3: The UE establishes a third registration based on the mapped security context between the UE and the first AMF. The fifth M provides integrity protection to the registration request message (RR1) and the second registration request message (RR2). The third registration request message is generated by the UE in method step S260 shown in FIG. Specifically, the third registration request message is sent to the first AMF. The message includes the GUTI and key identifier information in the mapped context between the UE and the first AMF. For ease of distinction, this GUTI is sometimes called a mapped GUTI, and the key identifier is Sometimes called a mapped key identifier.

[0203] In this case, the first registration request message is sent to the fourth registration request message (RR4) and the third registration request message (RR5). The message includes a registration request message (RR3), a fifth MAC (MAC5), and a first MAC (MAC1). RR4 will be integrity protected using the native security context. MAC5 is the MAC value obtained by using the mapped security context. RR1 and RR2 are obtained by applying integrity protection to the MAC value (or MAC5 is a MAC value obtained by applying integrity protection to the MAC value). RR3, RR4, and MAC1 are integrity protected using the shared security context. The first registration request message uses the native security Integrity protection is performed sequentially based on the context and the mapped security context. It can also be understood that this is a message.

[0204] Case 2: The fourth registration request message is for the UE to register the third This is the registration request message obtained after performing integrity protection on the registration request message. .

[0205] In case 2, the UE sends a fourth registration request message based on the first security context. The integrity protection of the message is performed by the UE based on the first security context. and performing integrity protection for the fourth registration request message and generating a first MAC for the fourth registration request message. Therefore, the first registration request message contains the second registration request message. The first registration request message includes a first MAC and a fourth registration request message. It can also be understood as.

[0206] In addition, in case 2, the UE determines the first registration request message by performing the following steps: include.

[0207] Step 1: The UE establishes a third registration based on the mapped security context between the UE and the first AMF. The registration request message is integrity protected and a third MAC is generated.

[0208] Step 2: The UE performs step 100 based on the native security context between the UE and the second AMF. A third registration request with integrity protection based on the mapped security context in step 1. The message is integrity protected and a first MAC is generated.

[0209] In this case, the first registration request message is sent to the third registration request message (RR3) and the third MA. C(MAC3) and the first MAC (MAC1). MAC3 is a mapped security context MAC1 is the MAC value obtained by performing integrity protection on RR3 using Integrity protection for RR3 and MAC3 using the native security context The first registration request message is a MAC value obtained by Integrity protection is sequentially performed based on the text and the native security context It can also be understood to be a message.

[0210] Case 3: The fourth registration request message is the third registration request message. The message is a registration request message sent by the UE to the first AMF in the method step S260 shown in FIG. It's sage.

[0211] In case 3, the UE sends a fourth registration request message based on the first security context. The integrity protection of the message is performed by the UE based on the first security context. and performing integrity protection for the fourth registration request message and generating a first MAC for the fourth registration request message. Therefore, the first registration request message contains the second registration request message. The first registration request message includes a first MAC and a fourth registration request message. It can also be understood as.

[0212] In addition, in case 3, the UE determines the first registration request message by performing the following steps: include.

[0213] Step 1: The UE establishes a third AMF based on a native security context between the UE and the second AMF. The registration request message is integrity protected and a first MAC is generated.

[0214] Step 2: The UE performs a step based on the mapped security context between the UE and the first AMF. A third registration request with integrity protection based on the native security context at 1. The message is integrity protected and a fourth MAC is generated.

[0215] In this case, the first registration request message is a third registration request message (RR3) and the first MA C(MAC1) and a fourth MAC (MAC4). MAC1 is the native security context. MAC4 is the MAC value obtained by integrity protecting RR3 using Provide integrity protection for RR3 and MAC1 using a mapped security context The first registration request message is a MAC value obtained by Integrity protection is performed sequentially based on the context text and the mapped security context. It can also be understood to be a message.

[0216] In case 1, the first AMF is included in the first registration request message sent by the UE. Native security context based on both the protected GUITI and the native GUTI to the second AMF, the second registration request message being integrity protected using Please understand that you can decide.

[0217] The above cases 1 to 3 are possible cases of the second registration request message and the case where the UE It is further noted that this is merely an example to illustrate how to determine the registration request message. It should be understood that other undescribed possible forms of the second registration request are also within the scope of protection of this application. For example, the fourth registration request message is sent by the UE based on the native context. Here is another possible message that can be constructed using

[0218] S420: The UE sends a first registration request message to the first AMF.

[0219] Specifically, the UE sends the first registration request message determined in S410 to the first AMF. .

[0220] A first registration request message sent by the UE to the first AMF is It should be understood that the access network device may forward the request to the access network. The function is not limited in this application. Therefore, the first registration request sent by the UE to the first AMF The request message may be forwarded by the access network device when the UE is connected to the first access network. This is directly described as sending a first registration request message to the MF.

[0221] Before the UE sends a first registration request message to the first AMF, the UE It should be further understood that the context needs to be determined. Therefore, when the UE receives the first A Before sending the first registration request message to the MF, the method steps shown in FIG. 4 include steps S411 to Further includes S414.

[0222] S411: The MME sends a forward relocation request message to the first AMF. This step is shown in FIG. This is similar to S210 and will not be described in detail again here.

[0223] S412: The first AMF determines the mapped security context. This step is shown in FIG. , and the details will not be described again here.

[0224] S413: The first AMF sends a forward relocation response message to the MME. This step is shown in FIG. This is similar to S230 and will not be described in detail again here.

[0225] S414: The MME sends a handover command message to the UE. This step corresponds to S2 in FIG. 40 and will not be described in detail again here.

[0226] Specifically, after receiving the handover command message, the UE In addition, the UE derives the native security context. By using the mapped security context, the first registration request message Provide security protection against.

[0227] S430: The first AMF verifies the UE.

[0228] Specifically, the first AMF determines that the UE is verified mainly based on the received UE The first step is to determine whether the first registration request message received satisfies a predetermined condition. The first AMF determines that the registration request message satisfies a predetermined condition, The first AMF sends the first registration request message based on the mapped security context. Successfully verify the integrity protection of the message; or The first registration request message is sent when the UE is handed over from the 4G communication system to the 5G communication system. The first AMF determines that the registration request message is sent by the UE after the For example, the first AMF receives a first registration request message sent by the UE. Before receiving the forward relocation request message sent by the MME, The AMF determines whether the currently received first registration request message is the same as the first registration request message received from the UE in the handover procedure. It can be seen that the message being sent is a registration request message.

[0229] After the first AMF verifies that the UE is verified, the first AMF sends a second registration request message to the second AMF. The second AMF sends a registration request message to the UE, and the second registration request message is used by the second AMF to verify the UE. In other words, the method steps shown in FIG. 4 are used in which a first AMF sends a second request to a second AMF. The method further includes S440 for sending the message.

[0230] Optionally, the second registration request message is included in the first request message, and the first AMF to the second AMF.

[0231] In one possible implementation, the first request message is sent by the first AMF shown in FIG. User equipment context transfer service call request to be initiated (Namf_Communication_UEC The user equipment context transfer service is shown in FIG. Unlike the request for sending, the user equipment context transfer service in this embodiment of the present application The call request includes the newly added information element, namely the first MAC.

[0232] In another possible implementation, the first request message is sent by the first AMF to the second AMF. Another possible first one is sent and used to obtain the security context of the UE. This is a request message.

[0233] It should be understood that the specific format of the first request message is not limited in this application. The MAC may be added to the existing signaling between the first AMF and the second AMF, or This may be added to newly added signaling between the first AMF and the second AMF.

[0234] In addition, when the first AMF needs to obtain the security context of the UE, the second AMF In order to be able to determine, the first request message further carries the ID of the UE. In this case, the UE ID is included in a second registration request message sent by the first AMF to the second AMF. can be.

[0235] In one possible implementation, the UE's ID may be a mapped GUTI.

[0236] In one possible implementation, the UE's ID may be the native GUTI.

[0237] In another possible implementation, the UE's ID may be the SUPI.

[0238] After the first AMF receives the UE's mapped GUTI from the UE, the first AMF transmits the UE's security information from the second AMF. When determining that a context needs to be obtained, the first AMF obtains a mapped GUTI of the UE; Continue adding the UE's SUPI, or both the UE's mapped GUTI and SUPI, to the first request message. It should be understood that you can choose between

[0239] The first registration request message received by the first AMF is shown in case 1 of S410 If the first registration request message is a first registration request message, the first registration request message is a second registration request message. and further understanding that the second registration request message includes a native GUTI. In this case, the first AMF may add the native GUTI of the UE to the first request message. You can choose between:

[0240] In addition, the second registration request message further includes a UL NAS COUNT of the UE, so that the second The AMF can obtain the UL NAS COUNT of the UE.

[0241] In addition, after the second AMF receives the first request message sent by the first AMF, Then, determine whether the UE is verified based on the integrity verification result of the second registration request message. Specifically, the second AMF executes S450, that is, determines whether the second registration request message is Verify the integrity of the message.

[0242] The second AMF performs a first AMF authentication based on a security context between the second AMF and the user equipment. The second AMF is stored natively and the second AMF is stored in the Generate a second MAC based on the received security context and compare the first MAC with the second MAC. If the first MAC is equal to the second MAC, the second AMF successfully verifies the UE and declares that the UE is verified. In this case, the second AMF transmits the security context of the UE to the first AMF. Send.

[0243] The first MAC is based on a security context of the UE negotiated between the UE and the second AMF. a MAC generated by the UE based on the second AMF, and a second MAC is negotiated between the UE and the second AMF. The MAC is generated by the second AMF based on the security context of the UE to be It should be understood that, therefore, it is highly likely that the first MAC is equal to the second MAC. In this case, The second AMF can successfully verify the UE and the second AMF may fail due to a low probability event such as a transmission error. As long as the UE verification does not fail, the UE security context is returned to the first AMF. Compared with the method steps shown in Figure 4, the security context acquisition method The method is for the first AMF to successfully obtain a security context of the user equipment from the second AMF. Increase the likelihood of success.

[0244] The second AMF executes S460 after successfully verifying the integrity of the second registration request message. That is, send the security context of the user UE to the first AMF.

[0245] Optionally, the security context of the UE is included in the first response message.

[0246] Furthermore, if the security context of the UE is included in the UE context, the second A The MF can send the UE's context to the first AMF.

[0247] Optionally, the second AMF may determine the security context of the UE based on the UL NAS COUNT. In this case, the second AMF can derive the key for the first key in the The key in the security context of the UE returned to F is derived from the first key. In this embodiment of the present application, the second key generated by key derivation is The security context of the UE including the second key to be used is called the second security context. In other words, the security information of the UE sent by the second AMF to the first AMF is The authentication context may not undergo key derivation and is stored natively in the second AMF. The security context of the UE between the second AMF and the UE, or the second AMF The MF performs a security check between the UE and the second AMF stored natively according to the local policy. When performing key derivation on a key in a security context to generate a derived key, It may be a second security context.

[0248] Specifically, in the security context of the UE sent by the second AMF to the first AMF If the key is a second key, the second AMF shall further verify that the second key is a key obtained by key derivation. In order to indicate this, it is necessary to send key derivation instruction information to the first AMF.

[0249] The procedure after the first AMF obtains the security context of the UE is as follows: In the existing procedure for handing over a UE to a 5G communication system, the first AMF checks the security context of the UE. Please understand that the procedure is similar to that after obtaining the text. For details, see the existing procedure. Please refer to the instructions below, and we will not go into the details again here.

[0250] For example, the UE and the first AMF may then use the native security context. Specifically, the first AMF sends a non-access stratum security mode command ( The UE sends a non-access stratum secure mode command (NAS SMC) message. After successfully verifying the NAS SMC message, the UE will Non-access layer security mode complete for AMF te) Send a message.

[0251] In one possible implementation, the second AMF fails to verify the integrity of the second registration request message. Then, the first AMF notifies the second AMF that the second AMF failed to verify the integrity of the second registration request message. To inform the first AMF, a failure indication information is sent to the first AMF.

[0252] Additionally, a failure indicating that the second AMF failed to verify the integrity of the second registration request message. After the first AMF receives the indication information, the first AMF determines whether the first AMF is determines that the mapped security context can continue to be used, or the first AMF , according to a local policy, decide to start an initial authentication for the UE, and A new security context is generated between the UEs.

[0253] The sequence numbers of the processes described above do not imply an execution order in the embodiments of the method described above. It should be understood that the order of execution of processes is based on the functionality and internal logic of the processes. The present invention should be determined by the applicant and should not be construed as a limitation on the practice of the embodiments of the present application. It shouldn't be.

[0254] As described above, the security context acquisition method according to the embodiment of the present application has been described with reference to FIG. The following describes the security of the embodiment of the present application with reference to Figs. 5 to 10. The context acquisition device will now be described in detail.

[0255] FIG. 5 is a schematic diagram of a security context acquisition device 50 according to the present application. As shown, the device 50 includes a transmitting unit 510, a processing unit 520, and a receiving unit 530. Includes.

[0256] The sending unit 510 is configured to send a first registration request message to the first AMF. .

[0257] The processing unit 520 is configured to determine a first registration request message.

[0258] The receiving unit 530 receives a handover command message sent by the MME. It is configured to:

[0259] The device 50 corresponds exactly to the user equipment in the embodiment of the method. The device may be a user equipment in the embodiment, or a chip in the user equipment in the embodiment of the method. The corresponding units of the device 50 are shown in Figs. 4. Perform the corresponding steps performed by the user equipment in the embodiment of the method shown in The device is configured to:

[0260] The transmitting unit 510 of the device 50 is a transmission sequence performed by the user equipment in the embodiment of the method. For example, the sending unit 510 sends a registration request message to the first AMF in FIG. 4. The step S316 of sending a first registration request message to the first AMF in FIG. Execute S420.

[0261] The processing unit 520 is a processor for implementing or processing in a user equipment in an embodiment of the method. For example, the processing unit 520 performs the steps of 4, step S315 of determining the first registration request message, and step S410 of determining the first registration request message. Execute.

[0262] The receiving unit 530 performs the receiving steps performed by the user equipment in the embodiment of the method. For example, the receiving unit 530 receives the handover command sent by the MME in FIG. 4. Step 314 of receiving the handover command message sent by the MME in FIG. and receiving a command message in step 414.

[0263] The transmitting unit 510 and receiving unit 530 shown in the device 50 perform both receiving and transmitting functions. The processing unit 520 may be a processor. The sending unit 510 may be a transmitter, and the receiving unit 530 may be a receiver. The receiver and transmitter may be integrated to form a transceiver.

[0264] FIG. 6 is a schematic diagram of a user device 60 applicable to an embodiment of the present application. The device 60 may be applied to the system shown in FIG. 1. For ease of explanation, FIG. Only the main components of the user device are shown. The device 60 includes a processor (corresponding to the processing unit 520 in FIG. 5), a memory, a control circuit, and an antenna. 5. The processor includes a processor and an input / output device (corresponding to the transmitting unit 510 and the receiving unit 530 in FIG. 5). The processor is configured to control the antenna and the input / output device to transmit and receive signals. The memory is configured to store a computer program. The security context acquisition method provided in the application is The computer program may then be read from the memory to execute the corresponding steps and / or operations. It is configured to call and execute computer programs. will not be explained again.

[0265] Those skilled in the art will appreciate that for ease of explanation, FIG. 6 is an illustration of a single memory and a single processor. It can be seen that the actual user equipment has multiple processors and multiple The memory may be referred to as a storage medium or a storage device. This is not limited to this embodiment of the present application.

[0266] FIG. 7 is a schematic diagram of a security context acquisition device 70 according to the present application. As shown, the device 70 includes a receiving unit 710, a processing unit 720, and a transmitting unit 730. Includes.

[0267] The receiving unit 710 receives a first registration request message sent by a user equipment. The first registration request message carries a second registration request message, and the second registration request message The message is integrity protected using the first security context and the first security context is The security context is a native security context between the user equipment and the second AMF. The first AMF is a UE handover signal for a 4G communication system to a 5G communication system. The AMF provides access and mobility management services for user equipment after it is It is configured so that

[0268] The processing unit 720 is configured to determine a mapped security context. .

[0269] The sending unit 730 is configured to send a second registration request message to the second AMF. .

[0270] The device 70 corresponds exactly to the first AMF in the method embodiment. or a chip or chips in the first AMF in the method embodiment. The corresponding units of the device 70 are shown in Figs. The method according to the present invention is adapted to perform the corresponding steps performed by the first AMF in the embodiment of the method according to the present invention. It is composed of.

[0271] The receiving unit 710 of the device 70 performs a receiving step performed by the first AMF in the method embodiment. For example, the receiving unit 710 performs a forward redistribution request sent by the MME in FIG. Step S311 of receiving a relocation request message and forward relocation sent by the MME in FIG. Step S411 of receiving a request message and the registration request message sent by the UE in FIG. Step S316 of receiving the first registration request message sent by the UE in FIG. Step S420 of receiving a second response message sent by the second AMF in FIG. Step S330 of transmitting the security context of the UE by the second AMF in FIG. and a step S460 of receiving the signal.

[0272] The processing unit 720 processes steps performed or processed in the first AMF in the method embodiment. For example, the processing unit 720 performs the mapping of the mapped security context in FIG. 4. Step S312 for determining the mapped security context and step S313 for determining the mapped security context in FIG. 3, and step S430 of verifying the UE in FIG. 4. do.

[0273] The sending unit 730 performs the sending step performed by the first AMF in the method embodiment. For example, the sending unit 730 sends a forward relocation response message to the MME in FIG. Step S313 of sending a forward relocation response message to the MME in FIG. 4; and step S413 of sending a forward relocation response message to the MME in FIG. In FIG. 3, a step S310 of sending a second request message to the second AMF and in FIG. 4, a step S310 of sending a second request message to the second AMF and a step S440 of transmitting a registration request message.

[0274] The receiving unit 710 and the transmitting unit 730 are transceivers having both receiving and transmitting functions. The processing unit 720 may be a processor. The receiving unit 30 may be a transmitter. The receiving unit 710 may be a receiver. They may be integrated to form a transceiver.

[0275] As shown in FIG. 8, an embodiment of the present application further provides a first AMF 80. The AMF 80 includes a processor 810, a memory 820, and a transceiver 830. The memory 820 stores The processor 830 executes the instructions or programs stored in the memory 820. The instructions or programs stored in the memory 820 are executed. When executed, the transceiver 830 communicates with the receiving unit 710 and It is configured to perform the operations performed by the sending unit 730.

[0276] FIG. 9 is a schematic diagram of a security context acquisition device 90 according to the present application. As shown, the device 90 includes a receiving unit 910, a processing unit 920, and a transmitting unit 930. It is equipped with.

[0277] The receiving unit 910 receives a second registration request message sent by the first AMF; The second registration request message is integrity protected using the first security context. The first security context is a native security context between the user equipment and the second AMF. The security context is configured to be

[0278] The processing unit 920 is configured to verify the integrity of the second registration request message.

[0279] The sending unit 930 detects that the processing unit 920 has successfully verified the integrity of the second registration request message. and if verified, transmitting a security context of the user equipment to the first AMF. It is done.

[0280] The device 90 corresponds exactly to the second AMF in the method embodiment. or a chip or chips in the second AMF in the method embodiment. The corresponding units of the device 90 are shown in Figs. The method according to the present invention is adapted to perform the corresponding steps performed by the second AMF in the embodiment of the method according to the present invention. It is composed of.

[0281] The receiving unit 910 of the device 90 performs a receiving step performed by the second AMF in the embodiment of the method. For example, the receiving unit 910 receives the second AMF transmitted by the first AMF in FIG. Step S310 of receiving a request message and a second registration sent by the first AMF in FIG. and a step S440 of receiving the request message.

[0282] The processing unit 920 may be configured to process steps performed or processed within the second AMF in the method embodiment. For example, the processing unit 920 determines that the UE does not need to be verified in FIG. 4. Perform step S320 and step S450 of verifying the integrity of the second registration request message in FIG. To carry out.

[0283] The sending unit 930 performs the sending step performed by the second AMF in the method embodiment. For example, the sending unit 930 sends a second response message to the first AMF in FIG. Step S330 and step S46 of sending the security context of the UE to the first AMF in FIG. Execute 0 and.

[0284] The transmitting unit 930 and the receiving unit 910 are transceivers having both receiving and transmitting functions. The processing unit 920 may be a processor. The receiver and the transmitter are the same as those in the embodiment. They may be integrated to form a transceiver.

[0285] As shown in FIG. 10, an embodiment of the present application further provides a second AMF 100. The AMF 100 of the second embodiment includes a processor 1010, a memory 1020, and a transceiver 1030. The memory 1020 stores instructions or programs, and the processor 1030 executes the instructions or programs stored in the memory 1020. The instructions or programs stored in the memory 1020 are configured to execute the When the program is executed, the transceiver 1030 functions as a receiver unit 90 in the device 90 shown in FIG. 10 and the transmitting unit 930.

[0286] An embodiment of the present application further provides a computer-readable storage medium. The readable storage medium stores instructions that, when executed by a computer, cause the computer to 3 and 4 to carry out the steps performed by the first AMF. become.

[0287] An embodiment of the present application further provides a computer-readable storage medium. The readable storage medium stores instructions that, when executed by a computer, cause the computer to 3 and 4 in order to carry out the steps performed by the second AMF. become.

[0288] An embodiment of the present application further provides a computer program product including instructions. When the computer program product is executed on a computer, the computer executes the program shown in FIG. and the steps performed by the first AMF in the manner shown in FIG. do.

[0289] An embodiment of the present application further provides a computer program product including instructions. When the computer program product is executed on a computer, the computer executes the program shown in FIG. and the steps performed by the second AMF in the manner shown in Figure 4. do.

[0290] An embodiment of the present application further provides a chip including a processor. The processor includes: , the security context acquisition method provided in this application is performed by the second AMF A computer program stored in memory for performing corresponding operations and / or procedures. The computer program is configured to read the program and execute the program. Optionally, the chip further includes a memory. The memory is connected to the processor through a circuit or cable. The processor reads the computer program from the memory and and configured to execute a computer program. The processor further includes a communication interface. The communication interface receives data and / or information that needs to be processed. The processor is configured to receive data and / or information from the communication interface. The communication interface is an input / output interface. It may be a face.

[0291] The present application further provides a chip including a processor, the processor comprising: Corresponding operations performed by the first AMF in the provided security context acquisition method and / or calling a computer program stored in memory to perform the steps. Optionally, the device is configured to call the The chip further includes a memory, which is connected to the processor through a circuit or cable. The processor reads the computer program from the memory and executes the Optionally, the chip is configured to communicate with a communications interface. The processor is connected to the communication interface. The interface is configured to receive data and / or information that needs to be processed. The processor receives data and / or information from the communication interface and The communication interface is an input / output interface. That's fine.

[0292] Those skilled in the art will appreciate that by combining the examples described in the embodiments disclosed herein, Thus, the units and steps of an algorithm may be implemented using electronic hardware or a computer. Please note that this may be implemented using a combination of software and electronic hardware. Whether a function is implemented by hardware or software is a matter of technical considerations. The specific solution depends on the specific application and design constraints. Although the described functionality may be implemented in a variety of ways for different applications, such implementations are within the spirit and scope of the present application. should not be considered as going beyond its scope.

[0293] For ease of explanation, detailed operation processes of the aforementioned systems, devices and units are not provided. For the process, please refer to the corresponding process in the above method embodiment. This can be clearly understood by those skilled in the art, and the details will not be described again here.

[0294] In some embodiments provided in the present application, the disclosed systems, devices, and It should be understood that the methods and techniques may be implemented in other manners. The embodiment of the device is merely an example. For example, the division into units may be a logical division of functions. However, the actual implementation may be divided differently. For example, the actual implementation may be divided into multiple units or components. Components may be combined or integrated into other systems. Alternatively, some functions may be ignored or not performed. The shown or discussed mutual couplings or direct couplings or communication connections may represent some Indirect coupling or communication between devices or units may be implemented using a The connection may be implemented in an electrical, mechanical or other form.

[0295] Units described as separate parts may or may not be physically separate. The parts shown as units may or may not be physical units. may be located in one location or distributed over several network units. In order to achieve the objectives of the solution of the embodiment, some or all of the units may be actually The selection may be based on the requirements.

[0296] In addition, the functional units of the embodiments of the present application may be integrated into one processing unit; Each unit may exist physically alone, or two or more units may exist together. will be integrated into the unit.

[0297] The functions are implemented in the form of software functional units and sold or used as independent products. In this case, the functions may be stored in a computer-readable storage medium. The technical solution of the present application is essentially or in part contributed to the prior art, Part of the technical solution may be implemented in the form of a software product. The software product is stored in a storage medium and includes all of the steps of the method described in the embodiments of the present application. A computer device (personal computer, server, etc.) that executes part or a part of the , or network device, etc. The storage media mentioned above may be USB flash drives, removable hard disks, read-only Memory (Read-Only Memory, ROM), Random Access Memory ((R)ANdom Access Memory Any medium capable of storing program code, such as a RAM, magnetic disk, or optical disk. Includes media.

[0298] Additionally, in this application, the term "and / or" is used exclusively to describe the associated subject matter. This describes the association relationship between A and B, and indicates that three relationships can exist. For example, A and B / or B can be used to distinguish between the following three cases: when only A exists, when both A and B exist, In addition, the present invention can represent the case where only B is present, and the case where only B is present. The character " / " typically indicates an "or" relationship between related objects. The term "one" can mean "one" and "two or more." For example, A, B, and At least one of A and B and C is such that only A exists, only B exists, only C exists, and both A and B exist. A and C exist, A and C exist, C and B exist, and A, B, and C exist. This can be done.

[0299] The above description is only a specific implementation of the present application, and is not intended to limit the protection scope of the present application. There are no variations that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application. Any modifications or substitutions shall fall within the scope of protection of this application. The scope is subject to the scope of protection of the claims. [Explanation of symbols]

[0300] 50 Security context acquisition device 60 User Equipment 70 Security context acquisition device 80 First AMF 90 Security context acquisition device 100 Second AMF 110 User Equipment 120 elements 130 User Plane Network Elements 140 Data Network Elements 150 Mobility Management Network Elements 160 Session Management Network Element 170 Policy Control Network Elements 180 Authentication Server 190 Data Management Network Elements 510 Transmitter Unit 520 Processing Unit 530 Receiver Unit 710 Receiver Unit 720 Processing Unit 730 Sending Unit 810 Processor 820 Memory 830 Transceiver 910 Receiver Unit 920 Processing Unit 930 Sending Unit 1010 Processor 1020 Memory 1030 Transceiver 1100 Application Network Elements

Claims

1. A method for obtaining a security context, comprising: A step of receiving a first registration request message from a user equipment (UE) by a first access and mobility management function (AMF) and receiving a second request message from the first AMF by a second AMF after the first AMF successfully verifies the integrity of the first registration request message, wherein after the UE is handed over from a 4G communication system to a 5G communication system, the first AMF receives the first registration request message from the UE; If the second request message carries indication information, and the indication information is used to indicate that the UE has been verified, skipping verification of the UE by the second AMF, and sending, by the second AMF, a native security context of the UE to the first AMF based on the second request message; The method includes:

2. The method of claim 1, wherein the step of skipping verification of the UE further comprises: skipping verifying the integrity of the second request message.

2. The method of claim 1, comprising:

3. The method according to claim 1 or 2, wherein after the first AMF receives the first registration request message and before the second AMF receives the second request message, the second AMF has not verified the UE.

4. 4. The method of claim 1, wherein handing over the UE from a 4G communications system to a 5G communications system comprises handing over the UE from a 4G communications system to a 5G communications system when the UE is in a connected mode.

5. The method according to any one of claims 1 to 4, wherein in response to receiving the first registration request message, the first AMF verifies the integrity of the first registration request message.

6. The second request message includes a 5G globally unique temporary user equipment identity (GUTI) of the UE; Prior to the step of transmitting a native security context of the UE by the second AMF to the first AMF, the method further comprises: determining, by the second AMF, the native security context of the UE based on the 5G GUTI of the second request message; 6. The method of claim 1, further comprising:

7. The indication information is used to indicate that the user equipment (UE) has been verified. The indication information is used to indicate that the integrity of a first registration request message from the UE has been successfully verified.

7. The method of claim 1 , comprising:

8. The first AMF is an AMF selected from the 5G communication system by a mobility management entity (MME) of the 4G communication system for the UE to provide a core network service to the UE during a process in which the UE is handed over from a 4G communication system to a 5G communication system; 8. The method of claim 1, wherein the second AMF is an AMF of the 5G communication system other than the first AMF of the 5G communication system, and the second AMF stores a native 5G security context of the UE.

9. The reason why the native security context is stored by the second AMF is that Because the UE is handed over from the 5G communication system to the 4G communication system before the UE is handed over from the 4G communication system to the 5G communication system; or 9. The method according to claim 1, wherein the UE supporting dual connectivity accesses the 5G communication system via a non-3GPP connection and simultaneously accesses the 4G communication system via a 3GPP connection, and the UE in a connected mode is handed over from the 4G communication system to the 5G communication system.

10. A communication device, comprising: A processor and a memory, The memory stores instructions, and when the instructions stored in the memory are executed by the processor, the communications device performs the method of any one of claims 1 to 9.

11. A communication system comprising: a first Access and Mobility Management Function (AMF) and a second AMF; The first AMF is receiving a first registration request message from a user equipment (UE) after the UE completes a handover procedure; Verifying the integrity of the first registration request message; When the first AMF successfully verifies the integrity of the registration request message, the second AMF is configured to send a second request message, the second request message carrying indication information used to indicate that the UE has been verified; 10. A communication system, wherein the second AMF is configured to execute a method according to any one of claims 1 to 9.

12. The method further comprises a mobility management entity (MME), Before receiving the first registration request message sent by the UE, the first AMF: receiving a first forward relocation request from the MME, the first forward relocation request including a 4G security context between the UE and the MME; determining a mapped security context based on the 4G security context; and further configured to send a forward relocation response message to the MME; Verifying the integrity of the first registration request message includes: verifying integrity of the first registration request message by using the mapped security context; Before the first AMF receives the first registration request message from the UE, Sending the first forward relocation request to the first AMF; receiving a forward relocation response message from the first AMF; The communication system of claim 11 , configured to send a handover command to the UE.

13. The 4G security context includes a key K ASME and a next hop parameter NH, and the mapped security context includes a key K AMF1 , The communication system of claim 12 , wherein determining the mapped security context based on the 4G security context comprises deriving the key K AMF1 based on the key K ASME and the NH.

14. The key K AMF1 is derived based on a predefined derivation formula; 14. The communication system of claim 13, wherein the predetermined derivation formula is K AMF1 =HMAC-SHA-256(Key, FC||P0||L0), FC=0x76, P0=NH value, L0=length of NH value, and KEY=K ASME .

15. The communication system described in claim 14, wherein the first AMF is further configured to calculate an integrity protection key K NASint1 and a confidentiality protection key K NASenc1 based on the key K AMF1 and a security algorithm agreed with the UE.

16. A formula for generating the integrity protection key K NASint1 is K NASint1 =HMAC-SHA-256(KEY,S), where S = FC||P0 1 ||L0 1 ||P11||L1 1 , FC = 0x69, P0 1 is the algorithm type discriminator, L0 1 is the length of the algorithm type discriminator, P1 1 is the algorithm identifier, and L1 1 is the length of the algorithm identifier, KEY = K AMF1 , The formula for generating the confidentiality protection key K NASenc1 is 16. The communication system of claim 15, wherein K NASenc1 = HMAC-SHA-256(KEY, S), where S = FC||P0||L0||P1||L1, FC = 0x69, P0 is an algorithm type discriminator, L0 is the length of the algorithm type discriminator, P1 is an algorithm identifier, L1 is the length of the algorithm identifier, and KEY = K AMF1 .

17. A communication system as described in any one of claims 11 to 16, wherein the first registration request message includes a 5G-GUTI of the UE.

Images