Non-access stratum message processing method and apparatus

Abstract

The present application provides a non-access stratum (NAS) message processing method and apparatus. The method comprises: a terminal device generating a plurality of NAS keys, wherein at least two of the plurality of NAS keys are respectively associated with different NFs, and the plurality of NAS keys comprise a first NAS key for a first NF; the first NF generating a first NAS key, wherein the first NF is a non-anchor point function; the terminal device processing an NAS message between the terminal device and the first NF on the basis of the first NAS key generated by the terminal device; and the first NF processing an NAS message between the first NF and the terminal device on the basis of the first NAS key generated by the first NF. According to the embodiments of the present application, after an access network device is directly connected to a plurality of CN NFs, a terminal device can generate an NAS key associated with each of the plurality of CN NFs, and accordingly, each of the plurality of CN NFs can also generate an NAS key, such that an NAS message is processed.

Description

A non-access layer message processing method and device Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a method and apparatus for processing non-access layer messages. Background Art

[0002] In the fifth generation (5G) communication system, the base station has a direct connection with the access and mobility management function (AMF) (referred to as "direct connection"), but no direct connection with the core network network function (CNNF) of other control planes. Therefore, messages between other control plane CNNFs and the base station need to be transmitted through the AMF. In other words, the AMF acts as a proxy between the base station and other control plane CNNFs. However, this architecture increases transmission latency and is therefore not friendly to latency-sensitive services (such as ultra-reliable low-latency communications (URLLC) services).

[0003] To reduce transmission latency, future communication systems will likely include multiple NFs directly connected to base stations. Therefore, how to update the non-access stratum (NAS) security mechanism to adapt to future communication systems is a pressing issue.

[0004] Summary of the Invention

[0005] The present application provides a NAS message processing method and apparatus for updating the NAS security mechanism so that it can be applicable to future communication systems.

[0006] In a first aspect, a NAS message processing method is provided, including:

[0007] The terminal device generates multiple non-access layer NAS keys, at least two of the multiple NAS keys are respectively associated with different NFs in multiple network functions NF; the terminal device processes NAS messages communicated with the multiple NFs based on the multiple NAS keys.

[0008] According to an embodiment of the present application, after the wireless access network device is directly connected to multiple CN NFs, the terminal device can generate a NAS key associated with each CN NF in the multiple CN NFs, so as to process the received NAS message (for example, encrypt and decrypt and / or complete the security).

[0009] In conjunction with the first aspect, in certain implementations of the first aspect, the terminal device generates multiple NAS keys, including:

[0010] The terminal device generates a first NAS key based on one or more of a type parameter of a first NF, an identifier of the first NF, an identifier of a security algorithm selected by the first NF, a NAS count value (count) of the first NF, and a PDU session identifier, wherein the first NF is one of the multiple NFs and the first NAS key is one of the multiple NAS keys.

[0011] In conjunction with the first aspect, in certain implementations of the first aspect, the terminal device generates multiple NAS keys, including:

[0012] The terminal device generates a first NAS key based on the type parameter of the first NF and / or the identifier of the first NF, the identifier of the security algorithm selected by the first NF, and the NAS count value (count) of the first NF, wherein the first NF is one of the multiple NFs and the first NAS key is one of the multiple NAS keys.

[0013] In conjunction with the first aspect, in certain implementations of the first aspect, the terminal device generates multiple NAS keys, including:

[0014] The terminal device generates a first NAS key based on the type parameter of the first NF and / or the identifier of the first NF, the identifier of the security algorithm selected by the first NF, the NAS count value of the first NF, and the PDU session identifier, where the first NF is one of the multiple NFs and the first NAS key is one of the multiple NAS keys.

[0015] In conjunction with the first aspect, in certain implementations of the first aspect, the terminal device generates multiple NAS keys, including:

[0016] The terminal device generates a first NAS key according to the identifier of the security algorithm selected by the first NF, the NAS count value of the first NF, and the PDU session identifier, where the first NF is one of the multiple NFs and the first NAS key is one of the multiple NAS keys.

[0017] In combination with the first aspect, in some implementations of the first aspect, the NAS count value of the first NF starts counting from 0; or, the NAS count value of the first NF starts counting from an initial NAS count value of the anchor function.

[0018] Exemplarily, the anchor function may be AMF.

[0019] In conjunction with the first aspect, in certain implementations of the first aspect, the terminal device generates multiple NAS keys, including:

[0020] The terminal device generates the multiple NAS keys based on the NAS root key.

[0021] For example, the NAS root key may be K SEAF , or K AMF , or by K SEAF Derived key (not K AMF ), or by K AMF Derived key.

[0022] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0023] The terminal device creates a NAS entity corresponding to a first NF, where the first NF is one of the multiple NFs.

[0024] In conjunction with the first aspect, in some implementations of the first aspect, the terminal device creates a NAS entity corresponding to the first NF, including:

[0025] After the terminal device accesses the core network for the first time and is successfully authenticated, the terminal device creates a NAS entity corresponding to the first NF; or, the terminal device receives a message and creates a NAS entity corresponding to the first NF based on the message.

[0026] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0027] The terminal device suspends the NAS entity corresponding to the first NF and saves the security context of the first NF; wherein the security context includes the type of the first NF and / or the identifier of the first NF, the NAS count value of the first NF, and the identifier of the security algorithm selected by the first NF, and the first NF is one of the multiple NFs.

[0028] In combination with the first aspect, in some implementations of the first aspect, the security context also includes a PDU session identifier.

[0029] In combination with the first aspect, in certain implementations of the first aspect, the terminal device suspending the NAS entity corresponding to the first NF includes:

[0030] When the terminal device enters an idle state or an inactive state, the terminal device suspends the NAS entity corresponding to the first NF; or, the terminal device receives a message and suspends the NAS entity corresponding to the first NF according to the message.

[0031] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0032] The terminal device deletes a NAS entity corresponding to a first NF and deletes a security context of the first NF, where the first NF is one of the multiple NFs.

[0033] In combination with the first aspect, in some implementations of the first aspect, the terminal device deleting the NAS entity corresponding to the first NF includes:

[0034] When the terminal device enters an idle state or an inactive state, the terminal device deletes the NAS entity corresponding to the first NF; or, the terminal device receives a message and deletes the NAS entity corresponding to the first NF according to the message.

[0035] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0036] When creating a NAS entity corresponding to a first NF, the terminal device activates a first NAS key; or, the terminal device receives a first message and activates the first NAS key according to the first message; wherein the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

[0037] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0038] When the NAS entity corresponding to the first NF is suspended or deleted, the terminal device deactivates the first NAS key; or, the terminal device receives a second message and deactivates the first NAS key according to the second message; wherein the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

[0039] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0040] When transitioning from a connected state to an idle state or an inactive state, the terminal device saves a security context of a first NF, where the security context of the first NF includes an identifier of a security algorithm selected by the first NF and a NAS count value of the first NF; when transitioning from the idle state or the inactive state to the connected state, the terminal device generates the first NAS key based on the security context of the first NF; wherein the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

[0041] In combination with the first aspect, in some implementations of the first aspect, the security context of the first NF also includes one or more of the type of the first NF, the identifier of the first NF, the PDU session identifier, and the identifier of the terminal device.

[0042] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0043] When the terminal device transitions from a connected state to an idle state or an inactive state, the terminal device does not save the security context of the first NF; when the terminal device transitions from the idle state or the inactive state to the connected state, the terminal device receives the security context of the first NF from a second NF and generates the first NAS key based on the security context of the first NF, wherein the second NF is used to save the security context of the first NF, wherein the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

[0044] Exemplarily, the second NF may be the first NF, i.e., the first NF stores the security context. Alternatively, the second NF may be different from the first NF, i.e., the second NF stores the security context instead of the first NF. For example, if the first NF is an SMF and the second NF is an AMF, the SMF may send the security context to the AMF, and the AMF stores the security context instead of the SMF.

[0045] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0046] When the terminal device transitions from a connected state to an idle state or an inactive state, the terminal device does not save the NAS count value of the first NF; when the terminal device transitions from the idle state or the inactive state to the connected state, the terminal device generates the first NAS key; wherein the NAS count value corresponding to the first NF starts counting from 0; or, the NAS count value corresponding to the first NF starts counting from an initial NAS count value of an anchor function; the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

[0047] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes:

[0048] The terminal device receives a third message from a first NF and updates a first NAS key according to the third message, where the first NF is one of the multiple NFs and the first NAS key is one of the multiple NAS keys; or the terminal device receives a fourth message from an anchor function and updates the multiple NAS keys according to the fourth message.

[0049] Exemplarily, the first NF may be any one of AMF, SMF, PCF, and LMF.

[0050] In combination with the first aspect, in certain implementations of the first aspect, when the terminal device switches from the first NF to the first target NF, the method further includes:

[0051] The terminal device receives a security algorithm identifier from a first target NF, where the first NF is one of the multiple NFs and is a non-anchor function.

[0052] In a second aspect, a NAS message processing method is provided, including:

[0053] The first network function NF generates a first non-access layer NAS key; the first NF processes the NAS message between the terminal device based on the first NAS key, and the first NF is a non-anchor function.

[0054] According to an embodiment of the present application, after the wireless access network device is directly connected to multiple CN NFs, the first NF (non-anchor function) among the multiple CN NFs can also generate a NAS key to process the received NAS message (for example, encrypt and decrypt and / or complete the security).

[0055] In conjunction with the second aspect, in certain implementations of the second aspect, the first NF generates a first NAS key, including:

[0056] The first NF generates the first NAS key according to one or more of a type parameter of the first NF, an identifier of the first NF, an identifier of a security algorithm selected by the first NF, a NAS count value (count) maintained by the first NF, and a PDU session identifier.

[0057] In conjunction with the second aspect, in certain implementations of the second aspect, the first NF generates a first NAS key, including:

[0058] The first NF generates the first NAS key according to a type parameter of the first NF and / or an identifier of the first NF, an identifier of a security algorithm selected by the first NF, and a NAS count value (count) maintained by the first NF.

[0059] In conjunction with the second aspect, in certain implementations of the second aspect, the first NF generates a first NAS key, including:

[0060] The first NF generates the first NAS key according to the type parameter of the first NF and / or the identifier of the first NF, the identifier of the security algorithm selected by the first NF, the NAS count value maintained by the first NF, and the PDU session identifier.

[0061] In conjunction with the second aspect, in certain implementations of the second aspect, the first NF generates a first NAS key, including:

[0062] The first NF generates the first NAS key according to the identifier of the security algorithm selected by the first NF, the NAS count value maintained by the first NF, and the PDU session identifier.

[0063] In combination with the second aspect, in some implementations of the second aspect, the NAS count value maintained by the first NF starts counting from 0; or, the NAS count value maintained by the first NF starts counting from an initial NAS count value of the anchor function.

[0064] In conjunction with the second aspect, in certain implementations of the second aspect, the first NF generates a first NAS key, including:

[0065] The first NF obtains a NAS root key from an anchor function; and the first NF generates the first NAS key based on the NAS root key.

[0066] For example, the NAS root key may be K SEAF , or K AMF , or by K SEAF Derived key (not K AMF ), or by K AMF Derived key.

[0067] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0068] The first NF creates a NAS entity corresponding to the first NF.

[0069] In conjunction with the second aspect, in certain implementations of the second aspect, the first NF creating a NAS entity corresponding to the first NF includes:

[0070] After successfully performing access authentication on the terminal device, the first NF creates a NAS entity corresponding to the first NF; or, the first NF receives a message and creates a NAS entity corresponding to the first NF according to the message.

[0071] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0072] The first NF suspends a NAS entity corresponding to the first NF and saves a security context of the first NF, where the security context includes the first NAS count value, an identifier of a security algorithm selected by the first NF, and an identifier of the terminal device.

[0073] In combination with the second aspect, in some implementations of the second aspect, the security context also includes one or more of the type of the first NF, the identifier of the first NF, and the PDU session identifier.

[0074] With reference to the second aspect, in certain implementations of the second aspect, the first NF suspending a NAS entity corresponding to the first NF includes:

[0075] The first NF receives the message and suspends the NAS entity corresponding to the first NF according to the message.

[0076] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0077] The first NF deletes a NAS entity corresponding to the first NF and deletes a security context of the first NF.

[0078] With reference to the second aspect, in certain implementations of the second aspect, the first NF deleting the NAS entity corresponding to the first NF includes:

[0079] The first NF receives the message and deletes the NAS entity corresponding to the first NF according to the message.

[0080] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0081] When creating a NAS entity corresponding to the first NF, the first NF activates the first NAS key; or, the first NF receives the fifth message and activates the first NAS key according to the fifth message.

[0082] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0083] The first NF receives activation success information, where the activation success information is used to indicate that the terminal device has successfully activated the first NAS key; and the first NF transmits a NAS message with the terminal device based on the activation success information.

[0084] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0085] When the NAS entity corresponding to the first NF is suspended or deleted, the first NF deactivates the first NAS key; or, the first NF receives a sixth message and deactivates the first NAS key according to the sixth message.

[0086] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0087] The first NF receives deactivation success information, where the deactivation success information is used to indicate that the terminal device successfully deactivated the first NAS key.

[0088] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0089] When the terminal device transitions from a connected state to an idle state or an inactive state, the first NF saves a security context of the terminal device, where the security context of the terminal device includes an identifier of a security algorithm selected by the first NF, a NAS count value of the first NF, and an identifier of the terminal device; when the terminal device transitions from the idle state or the inactive state to the connected state, the first NF generates the first NAS key according to the security context of the terminal device.

[0090] In combination with the second aspect, in certain implementations of the second aspect, the security context of the terminal device also includes one or more of the type of the first NF, the identifier of the first NF, and the PDU session identifier.

[0091] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0092] When the terminal device changes from a connected state to an idle state or an inactive state, the first NF does not save the security context of the terminal device; when the terminal device changes from the idle state or the inactive state to the connected state, the first NF obtains the security context of the terminal device from the second NF and generates the first NAS key according to the security context of the terminal device.

[0093] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0094] When the terminal device changes from a connected state to an idle state or an inactive state, the second NF saves a security context, where the security context includes an identifier of the terminal device, a type of the first NF and / or an identifier of the first NF, an identifier of a security algorithm selected by the first NF, and a NAS count value of the first NF; when the terminal device changes from an idle state or an inactive state to a connected state, the second NF sends the security context to the first NF and the terminal device.

[0095] It can be understood that, at this time, the second NF is different from the first NF, for example, the first NF is SMF, LMF or PCF, and the second NF is AMF.

[0096] In combination with the second aspect, in some implementations of the second aspect, the security context also includes a PDU session identifier.

[0097] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0098] When the terminal device transitions from a connected state to an idle state or an inactive state, the first NF does not save the NAS count value of the first NF; when the terminal device transitions from the idle state or the inactive state to a connected state, the first NF generates the first NAS key; wherein the NAS count value corresponding to the first NF starts counting from 0; or, the NAS count value corresponding to the first NF starts counting from an initial NAS count value of the anchor function.

[0099] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0100] When a preset condition is met, the first NF updates the first NAS key; the first NF sends a third message, where the third message is used to instruct the terminal device to update the first NAS key; or, the first NF notifies the anchor function that the first NF successfully updates the first NAS key.

[0101] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0102] The anchor function receives a NAS key update request message from a first NF, where the multiple NFs directly connected to the wireless access network device include the first NF; the anchor function sends a NAS key update request message to the other NFs in the multiple NFs directly connected to the wireless access network device except the first NF and the anchor function; the anchor function determines that each of the multiple NFs directly connected to the wireless access network device successfully updates the corresponding NAS key; the anchor function sends a fourth message to the terminal device, where the fourth message is used to instruct the terminal device to update the NAS keys of the multiple NFs directly connected to the wireless access network device.

[0103] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0104] The first NF receives a message from the anchor function and, according to the message, suspends NAS message transmission with the terminal device during the first NAS key update period.

[0105] In conjunction with the second aspect, in some implementations of the second aspect, the method further includes:

[0106] The first NF receives the message from the anchor function and, based on the message, resumes NAS message transmission with the terminal device.

[0107] In conjunction with the second aspect, in certain implementations of the second aspect, when the terminal device switches from the first NF to the first target NF, the method further includes:

[0108] The first NF sends the security context of the terminal device to the first target NF, where the security context of the terminal device includes the NAS count value of the first NF.

[0109] In conjunction with the second aspect, in some implementations of the second aspect, the security context of the terminal device further includes one or more of the following:

[0110] PDU session identifier and security capability information of the terminal device.

[0111] In conjunction with the second aspect, in certain implementations of the second aspect, the first NF sending the security context of the terminal device to the first target NF includes:

[0112] The first NF directly sends the security context of the terminal device to the first target NF; or, the first NF sends the security context of the terminal device to the first target NF through a source anchor function; or, the first NF sends the security context of the terminal device to the first target NF through a source anchor function and a target anchor function.

[0113] In conjunction with the second aspect, in certain implementations of the second aspect, when the terminal device switches from the first NF to the first target NF, the method further includes:

[0114] The source anchor function sends the security capability information of the terminal device to the first target NF.

[0115] In conjunction with the second aspect, in certain implementations of the second aspect, the source anchor function sending the security capability information of the terminal device to the first target NF includes:

[0116] The source anchor function directly sends the security capability information of the terminal device to the first target NF; or, the source anchor function sends the security capability information of the terminal device to the first target NF through a target anchor function.

[0117] In conjunction with the second aspect, in certain implementations of the second aspect, when the terminal device switches from the first NF to the first target NF, the method further includes:

[0118] The source anchor function receives the security algorithm identifier selected by the first target NF; and the source anchor function sends the security algorithm identifier selected by the first target NF to the terminal device.

[0119] In conjunction with the second aspect, in certain implementations of the second aspect, the source anchor function receives the security algorithm identifier selected by the first target NF, including:

[0120] The source anchor function receives the security algorithm identifier selected by the first target NF from the first target NF; or the source anchor function receives the security algorithm identifier selected by the first target NF from the target anchor function

[0121] In a third aspect, a NAS message processing method is provided, including:

[0122] A terminal device generates multiple non-access layer NAS keys, at least two of the multiple NAS keys are respectively associated with different NFs in multiple network functions NFs, the multiple NAS keys include a first NAS key for a first NF, and the first NF is one of the multiple NFs; the first NF generates a first NAS key, and the first NF is a non-anchor function; the terminal device processes a NAS message with the first NF based on the first NAS key generated by the terminal device; the first NF processes a NAS message with the terminal device based on the first NAS key generated by the first NF.

[0123] In the embodiment of the present application, the first NAS key generated by the first NF and the first NAS key generated by the terminal device for the first NF may be the same as or different from each other.

[0124] In combination with the third aspect, in certain implementations of the third aspect, the terminal device and the first NF generate a first NAS key based on one or more of the type parameter of the first NF, the identifier of the first NF, the identifier of the security algorithm selected by the first NF, the NAS count value (count) of the first NF, and the PDU session identifier, wherein the multiple NAS keys include the first NAS key.

[0125] In combination with the third aspect, in certain implementations of the third aspect, the terminal device and the first NF generate a first NAS key based on the type parameter of the first NF and / or the identifier of the first NF, the identifier of the security algorithm selected by the first NF, and the NAS count value of the first NF.

[0126] In combination with the third aspect, in certain implementations of the third aspect, the terminal device and the first NF generate a first NAS key based on the type parameter of the first NF and / or the identifier of the first NF, the identifier of the security algorithm selected by the first NF, the NAS count value of the first NF, and the PDU session identifier.

[0127] In combination with the third aspect, in certain implementations of the third aspect, the terminal device and the first NF generate a first NAS key based on the identifier of the security algorithm selected by the first NF, the NAS count value of the first NF, and the PDU session identifier.

[0128] In combination with the third aspect, in certain implementations of the third aspect, the NAS count value of the first NF starts counting from 0; or, the NAS count value of the first NF starts counting from an initial NAS count value of the anchor function.

[0129] In combination with the third aspect, in certain implementations of the third aspect, the terminal device and the first NF generate a first NAS key based on a NAS root key.

[0130] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0131] The terminal device creates a NAS entity corresponding to the first NF; the first NF creates a NAS entity corresponding to the first NF.

[0132] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0133] The terminal device suspends the NAS entity corresponding to the first NF; the first NF suspends the NAS entity corresponding to the first NF.

[0134] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0135] The terminal device deletes the NAS entity corresponding to the first NF; the first NF deletes the NAS entity corresponding to the first NF.

[0136] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0137] The terminal device activates the first NAS key generated by the terminal device; and the first NF activates the first NAS key generated by the first NF.

[0138] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0139] The terminal device sends an activation success message, where the activation success message is used to indicate that the terminal device has successfully activated the first NAS key generated by the terminal device; the first NF receives the activation success message; and the first NF transmits a NAS message with the terminal device based on the activation success message.

[0140] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0141] The terminal device deactivates the first NAS key generated by the terminal device; and the first NF deactivates the first NAS key generated by the first NF.

[0142] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0143] The terminal device sends a deactivation success message, where the deactivation success message is used to indicate that the terminal device successfully deactivated the first NAS key generated by the terminal device; the first NF receives the deactivation success message.

[0144] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0145] When the terminal device changes from a connected state to an idle state or an inactive state, the first NF and the terminal device both save a security context; when the terminal device changes from the idle state or the inactive state to the connected state, the first NF and the terminal device respectively generate a first NAS key based on the saved security context.

[0146] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0147] When the terminal device changes from a connected state to an idle state or an inactive state, neither the first NF nor the terminal device saves the security context; when the terminal device changes from the idle state or the inactive state to the connected state, the first NF and the terminal device respectively obtain a security context from a second NF, and respectively generate a first NAS key based on the obtained security context.

[0148] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0149] When the terminal device transitions from a connected state to an idle state or an inactive state, neither the first NF nor the terminal device saves the NAS count value of the first NF; when the terminal device transitions from the idle state or the inactive state to the connected state, the first NF and the terminal device respectively generate a first NAS key; wherein the NAS count value corresponding to the first NF starts counting from 0; or, the NAS count value corresponding to the first NF starts counting from an initial NAS count value of an anchor function.

[0150] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0151] When a preset condition is met, the first NF updates the first NAS key generated by the first NF; the first NF sends a third message; the terminal device receives the third message and updates the first NAS key generated by the terminal device according to the third message.

[0152] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0153] When the preset conditions are met, multiple NFs directly connected to the wireless access network device update the corresponding multiple NAS keys; when the multiple NFs all successfully update the corresponding multiple NAS keys, the anchor function sends a fourth message; the terminal device receives the fourth message and updates the multiple NAS keys according to the fourth message.

[0154] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0155] The terminal device and the first NF receive a message from the anchor function, and according to the received message, suspend NAS message transmission between the first NF and the terminal device during a first NAS key update period.

[0156] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes:

[0157] The terminal device and the first NF receive the message from the anchor function, and resume NAS message transmission between the first NF and the terminal device according to the received message.

[0158] In combination with the third aspect, in certain implementations of the third aspect, when the terminal device switches from the first NF to the first target NF, the method further includes:

[0159] The first NF sends the security context of the terminal device; and the first target NF receives the security context of the terminal device.

[0160] In conjunction with the third aspect, in certain implementations of the third aspect, the security context of the terminal device includes security capability information of the terminal device, and the method further includes:

[0161] The first target NF selects a security algorithm according to the security capability information of the terminal device; the first target NF sends an identifier of the security algorithm selected by the first target NF; and the terminal device receives the identifier of the security algorithm selected by the first target NF.

[0162] In a fourth aspect, a communication device is provided, which may be a terminal device, or a device in the terminal device (for example, a chip, or a chip system, or a circuit), or a device that can be used in conjunction with the terminal device.

[0163] In one possible implementation, the communication device may include a module or unit corresponding to the method / operation / step / action described in the first aspect. The module or unit may be a hardware circuit, software, or a combination of hardware circuit and software.

[0164] In a fifth aspect, a communication device is provided. The communication device may be a first NF, or a device in the first NF (for example, a chip, or a chip system, or a circuit), or a device that can be used in conjunction with the first NF.

[0165] In one possible implementation, the communication device may include a module or unit that executes the method / operation / step / action related to the first NF in the second aspect. The module or unit may be a hardware circuit, software, or a combination of hardware circuit and software.

[0166] In a sixth aspect, a communication device is provided, comprising a communication interface and a processor, wherein the communication interface is used to output and / or input signals, and the processor is used to execute a computer program or instruction stored in a memory, so that the communication device executes the method in the first aspect or the second aspect.

[0167] Optionally, the memory may be included in the communication device. As one approach, the memory may be provided separately from the processor; as another approach, the memory may be located in the processor and integrated with the processor.

[0168] Optionally, the memory may also be outside the communication device and coupled to the processor.

[0169] In a seventh aspect, a computer-readable storage medium is provided, comprising a computer program, which, when executed on a computer, enables the computer to execute the method in any possible implementation of the first aspect or the second aspect.

[0170] In an eighth aspect, a chip or a chip system is provided, the chip or chip system including a processing circuit and an input / output interface, the processing circuit being used to execute the method in any possible implementation of the first aspect or the second aspect.

[0171] In the ninth aspect, a computer program product is provided, which includes: a computer program (also referred to as code, or instructions), which, when executed, enables a computer to execute a method in any possible implementation of the first aspect or the second aspect.

[0172] In a tenth aspect, a communication system is provided, comprising multiple NFs directly connected to a base station and a terminal device. The terminal device is configured to execute the method of any possible implementation of the first aspect; the multiple NFs directly connected to the base station include a first NF, which is configured to execute the method of any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0173] FIG1 shows a communication system.

[0174] FIG2 shows another communication system.

[0175] FIG3 is a flowchart diagram 1 of the NAS message processing method proposed in this application.

[0176] FIG4 is a second flow chart of the NAS message processing method proposed in this application.

[0177] FIG5 is a flow chart of a method for suspending a NAS entity.

[0178] FIG6 is a flowchart of a method for deleting a NAS entity.

[0179] FIG7 is a flow chart of a method for deactivating a NAS key.

[0180] FIG8 is a flow chart of a NAS key generation method when a terminal device switches to a connected state.

[0181] FIG9 is a flow chart showing a method for independently updating a NAS key by a terminal device and a first NF.

[0182] FIG10 is a flow chart showing a method for uniformly updating NAS keys between a terminal device and multiple NFs.

[0183] FIG11 is a flow chart showing a method for generating a NAS key by a first target NF in a handover scenario.

[0184] FIG12 is a schematic block diagram of a communication device provided in this application.

[0185] FIG13 is another schematic block diagram of the communication device provided in this application. DETAILED DESCRIPTION

[0186] To make the objectives, technical solutions, and advantages of this application more clear, the present application will be further described in detail below with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to the device embodiments or system embodiments. In the description of this application, unless otherwise specified, the meaning of "multiple" is two or more.

[0187] In the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0188] It is understood that the various numbers used in this application are for ease of description and are not intended to limit the scope of this application. The order of execution of the above-mentioned processes does not necessarily imply a specific order of execution. The order of execution of each process should be determined by its function and inherent logic.

[0189] The terms "first," "second," "third," "fourth," and various other terminology designations, if any, in the specification and claims of this application and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or apparatus.

[0190] It can be understood that, in this application, “used to indicate” can include both direct indication and indirect indication.

[0191] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field will know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0192] The technical solutions provided in this application can be applied to various communication systems, such as 5G or new radio (NR) systems, long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, etc. The technical solutions provided in this application can also be applied to future communication systems, such as the sixth generation (6G) th The technical solution provided in this application can also be applied to device-to-device (D2D) communication, vehicle-to-everything (V2X) communication, machine-to-machine (M2M) communication, machine-type communication (MTC), and Internet of Things (IoT) communication systems or other communication systems.

[0193] For easier understanding, some technical terms are explained below.

[0194] 1. Terminal equipment

[0195] The terminal device in the embodiments of the present application can be: user equipment (UE), mobile station (MS), mobile terminal (MT), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent or user device, etc.

[0196] The terminal device may be a device that provides voice / data connectivity to users, such as a handheld device or vehicle-mounted device with wireless connection function. Examples of terminal devices include: mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving or autopilot, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in future 5G networks or future evolved public land mobile communication networks (PLMNs). The terminal equipment in the network (PLMN), etc., is not limited to this in the embodiments of the present application.

[0197] As an example and not a limitation, in the embodiment of the present application, the terminal device may also be a wearable device. Wearable devices may also be called wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include devices that are fully functional, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as devices that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various types of smart bracelets and smart jewelry for vital sign monitoring. In addition, in the embodiment of the present application, the terminal device may also be a terminal device in an Internet of Things (IoT) system.

[0198] 2. Network Function (NF)

[0199] In the embodiments of the present application, NFs may include radio access network (RAN) network functions and core network (CN) network functions. Furthermore, NFs may be physical network entities or logical functions, without limitation. Network functions may also be referred to as network elements.

[0200] Among them, the RAN in the embodiment of the present application can refer to the access network or the access network equipment, and no distinction is made here. The access network equipment is a device that provides wireless communication functions for terminal devices, and can also be called access equipment, network equipment or wireless access network equipment. The access network equipment includes but is not limited to: the next generation node basestation (gNB) in the 5G system, the evolved node B (eNB) in the LTE system, the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home evolved node B (HNB), the base band unit (BBU), the transmission and receiving point (TRP), the transmitting point (TP), the small base station equipment (pico), the mobile switching center, or the network equipment in the future network. It is understandable that the present application does not limit the specific type of access network equipment. In systems using different wireless access technologies, the names of devices with access network equipment functions may be different.

[0201] Optionally, in some deployments of access devices, the access device may include a centralized unit (CU) and a distributed unit (DU). In other deployments of access devices, the CU may be further divided into a CU-control plane (CP) and a CU-user plane (UP). In still other deployments of access devices, the access device may also be an open radio access network (ORAN) architecture. This application does not limit the specific deployment method of the access device.

[0202] The following describes the control plane CN NF using the 5G system as an example. In 5G, the control plane CN NF includes AMF, session management function (SMF), policy control function (PCF), location management function (LMF), etc. It is understandable that the 5G system also includes other types of NFs, which will not be described here.

[0203] (1)AMF

[0204] The AMF can be used for mobility management and access management, and can be used to implement other functions of the mobility management entity (MME) in addition to session management, such as legal detection or access authorization. In addition, it is also used to transmit user policies between terminal devices and PCF.

[0205] In addition, this application does not limit the name of AMF in future communication systems.

[0206] (2)SMF

[0207] SMF can be used for session management, allocation and management of Internet Protocol (IP) addresses for terminal devices, selection and management of user plane function (UPF) network elements, termination points of policy control and charging function interfaces, and downlink data notification.

[0208] In addition, this application does not limit the name of SMF in future communication systems.

[0209] (3)PCF

[0210] PCF can provide policy rule information and other information for control plane functional network elements (such as access and mobility management function network element, session management function network element, etc.). PCF is mainly responsible for policy control of session and service flow level billing, QoS bandwidth guarantee and mobility management, terminal device policy decision, etc. PCF can have the capabilities of both access and mobility management policy control network element (AM PCF) and session management policy control network element (SM PCF). Logically, AM PCF and SM PCF can be understood as different network functions with different capabilities. In actual deployment scenarios, AM PCF and SM PCF can be the same policy control network element entity or two different policy control network element entities.

[0211] For example, the AM PCF is directly connected to the AMF and provides the AMF with mobility and terminal device access selection policies. Mobility policies include, for example, service area restriction management and radio access technology frequency selection priority (RFSP) index management.

[0212] In addition, this application does not limit the name of PCF in future communication systems.

[0213] (4)LMF

[0214] LMF can be used to interact with the 5G core network to complete the terminal's positioning function. In addition, this application does not limit the name of LMF in future communication systems.

[0215] (5) Anchor function

[0216] In the embodiment of the present application, the anchor function can be understood as a network function for generating a NAS root key.

[0217] In the 5G system, the anchor function can be AMF. This application does not limit the NF that can serve as the anchor function in the future communication system. For example, in the future communication system, the anchor function can still be AMF, of course, it can also be other NFs without limitation.

[0218] The technical problems addressed by this application are described below.

[0219] As shown in Figure 1, in the 5G system, the radio access network device has a direct connection with the AMF (abbreviated as "direct connection"), but no direct connection with other control plane CN NFs (e.g., SMF, PCF, LMF). Therefore, messages between other CN NFs (NFs not directly connected to the radio access network device) and the radio access network device (e.g., Ng messages and NAS messages) need to be transmitted through the AMF, or in other words, the AMF acts as a proxy between the radio access network device and other CN NFs. This architecture will introduce transmission delays and is therefore not friendly to delay-sensitive services (e.g., ultra-reliable low-latency communications (URLLC) services).

[0220] As shown in Figure 2, as an implementation method, in future communication systems, radio access network devices can directly connect to multiple types of control plane CN NFs. That is, radio access network devices can directly communicate with multiple types of control plane CN NFs. For example, in addition to being directly connected to the AMF, radio access network devices can also directly connect to one or more of the SMF, PCF, and LMF. Based on the communication architecture shown in Figure 2, transmission latency can be reduced. Taking SMF as an example, in the architecture of Figure 1, communication between the terminal device and the SMF passes through the radio access network device and the AMF; in the architecture of Figure 2, communication between the terminal device and the SMF can bypass the AMF, thereby reducing transmission latency.

[0221] Optionally, as another way, in future communication systems, although the radio access network equipment is directly connected to various types of control plane CN NFs, the radio access network equipment can also communicate with the CN NF through the anchor function.

[0222] In other words, future communication systems may include both anchor functions and non-anchor functions. For example, the anchor function is the AMF, and the non-anchor functions include the SMF, LMF, and PCF. Radio access network devices may communicate with the SMF, LMF, or PCF via the AMF.

[0223] Of course, future communication systems may not include the anchor point function, and this application does not limit this.

[0224] It is understandable that with the development of technology, the existing NAS security mechanism is not suitable for future communication systems in which wireless access network equipment is directly connected to various types of control plane CN NFs.

[0225] Based on the above problems, the present application proposes a method 300. It is understood that the method 300 is applicable to future communication systems (eg, the communication system shown in FIG2 ). Specifically, as shown in FIG3 , the method 300 includes the following steps.

[0226] S301: A terminal device generates multiple NAS keys, where at least two of the multiple NAS keys are associated with different NFs in the multiple NFs.

[0227] Regarding the mechanism of generating multiple NAS keys by the terminal device, please refer to method 400, which will not be explained in detail here.

[0228] For example, the terminal device can generate a key associated with the SMF, denoted as K SMF Furthermore, the terminal device can be based on K SMF Generate the NAS key for encrypting and decrypting NAS messages (i.e., NAS messages between terminal devices and SMF), denoted as K NASsmf-enc , and the NAS key used for NAS message integrity protection (abbreviated as "integrity protection"), denoted as K NASsmf-int Among them, K NASsmf-enc and K NASsmf-int Also the key associated with the SMF.

[0229] It is understandable that the terminal device can generate K SMF , K NASsmf-enc , K NASsmf-int For example, when the encryption and decryption function of the NAS message between the terminal device and the SMF is not needed, the terminal device may not generate K NASsmf-enc For example, when the integrity protection function of the NAS message between the terminal device and the SMF is not required, the terminal device may not generate K NASsmf-int For example, when the encryption and decryption functions of NAS messages between the terminal device and SMF and the security function are not needed, the terminal device can generate K SMF , does not generate K NASsmf-enc and K NASsmf-int .

[0230] In addition, optionally, for the same terminal device, different PDU sessions may correspond to different SMF entities. Therefore, the terminal device may generate K SMF , K NASsmf-enc and K NASsmf-int These keys can be generated at the PDU session level. For example, for PDU session #1, the terminal device can generate K SMF #1, K NASsmf-enc #1 and K NASsmf-int One or more of #1; Optionally, if there are other PDU sessions, such as PDU session #2, the terminal device can generate K SMF #2, K NASsmf-enc #2 and K NASsmf-int One or more of #2.

[0231] It is understandable that the PDU session is associated with the SMF entity, and the SMF entity associated with the PDU session will change as the terminal device performs the switching process. For example, before the switch, PDU session #1 is associated with SMF #1, and PDU session #2 is associated with SMF #2. After the switch, PDU session #1 and PDU session #2 are both associated with SMF #3. If the NAS key is generated at the SMF granularity, then after the switch, the NAS keys of PDU session #1 and PDU session #2 may be the same, causing a conflict. Therefore, the terminal device generates NAS keys at the PDU session granularity, which is more flexible in the switching scenario, thereby reducing the probability of conflict.

[0232] The terminal device can also generate a key associated with LMF, denoted as K LMF Furthermore, the terminal device can be based on K LMF Generate the key for NAS message encryption and decryption (i.e., NAS message between terminal device and LMF), denoted as K NASlmf-enc , and the key used for NAS message protection, denoted as K NASlmf-int Among them, K NASlmf-enc and K NASlmf-int Also the key associated with LMF.

[0233] It is understandable that the terminal device can generate K LMF , K NASlmf-enc , K NASlmf-int For example, when the encryption and decryption function of the NAS message between the terminal device and the LMF is not needed, the terminal device may not generate K NASlmf-enc For example, when the integrity protection function of the NAS message between the terminal device and the LMF is not required, the terminal device may not generate K NASlmf-int For example, when the encryption and decryption functions of NAS messages between the terminal device and LMF and the security function are not needed, the terminal device can generate K LMF , does not generate K NASlmf-enc and K NASlmf-int .

[0234] The terminal device can also generate a key associated with the PCF, denoted as K PCF Furthermore, the terminal device can be based on K PCF Generate the key for NAS message encryption and decryption (i.e., NAS message between terminal device and PCF), denoted as K NASpcf-enc , and the key used for NAS message protection, denoted as K NASpcf-int Among them, K NASpcf-enc and K NASpcf-int Also the key associated with PCF.

[0235] It is understandable that the terminal device can generate K PCF , K NASpcf-enc , K NASpcf-int For example, when the encryption and decryption function of the NAS message between the terminal device and the PCF is not needed, the terminal device may not generate K NASpcf-enc For example, when the integrity protection function of the NAS message between the terminal device and the PCF is not required, the terminal device may not generate K NASpcf-int For example, when the encryption and decryption functions of NAS messages between the terminal device and PCF and the security function do not need to be enabled, the terminal device can generate K PCF , does not generate K NASpcf-enc and K NASpcf-int .

[0236] The terminal device can also generate a key associated with the AMF, denoted as K AMF Furthermore, the terminal device can be based on K AMF Generate the key for NAS message encryption and decryption (i.e., NAS message between terminal device and AMF), denoted as K NASamf-enc , and the key used for NAS message protection, denoted as K NASamf-int Among them, K NASamf-enc and K NASamf-int It is also the key associated with AMF.

[0237] It is understandable that the terminal device can generate K AMF , K NASamf-enc , K NASamf-int For example, when the encryption and decryption function of the NAS message between the terminal device and the AMF is not required, the terminal device may not generate K NASamf-enc For example, when the integrity protection function of NAS messages between the terminal device and AMF is not required, the terminal device may not generate K NASamf-int For example, when the encryption and decryption functions of NAS messages between the terminal device and AMF and the security function are not needed, the terminal device can generate K AMF , does not generate K NASamf-enc and K NASamf-int .

[0238] The following describes “at least two keys among the multiple keys are associated with different network functions” through several examples.

[0239] Example 1:

[0240] The multiple keys generated by the terminal device include K AMF and K PCF , where K AMFAssociated with AMF, K PCF Associated with PCF. That is, K AMF and K PCF They are associated with different NFs respectively.

[0241] Example 2:

[0242] The multiple keys generated by the terminal device include K AMF , K for PDU Session #1 SMF #1 and K for PDU session #2 SMF #2, where K AMF Associated with AMF, K SMF #1 and K SMF #2 is associated with the same SMF. That is, K AMF and K SMF #1 is associated with different NFs, K AMF and K SMF #2 are associated with different NFs respectively.

[0243] Example 3:

[0244] The multiple keys generated by the terminal device include K AMF , K PCF and K LMF , where K AMF Associated with AMF, K PCF Associated with PCF, K LMF is associated with LMF. That is, K AMF , K PCF and K LMF They are associated with different NFs respectively.

[0245] Example 4:

[0246] The multiple keys generated by the terminal device include K AMF , K PCF , K LMF and K SMF , where K AMF Associated with AMF, K PCF Associated with PCF, K LMF Associated with LMF, K SMF Associated with SMF. That is, K AMF , K PCF , K LMF and K SMF They are associated with different NFs respectively.

[0247] In this embodiment of the present application, from the network side, multiple NFs directly connected to the wireless access network device each generate a corresponding NAS key. For example, the multiple NFs directly connected to the wireless access network device include NF#1, NF#2, and NF#3. NF#1 generates NAS key #1, NF#2 generates NAS key #2, and NF#3 generates NAS key #3. The following example uses the generation of a first NAS key by a first NF, one of the multiple NFs.

[0248] S302: The first NF generates a first NAS key.

[0249] The first NF is any one of the multiple NFs corresponding to the multiple NAS keys generated by the terminal device.

[0250] It is understandable that the multiple NFs are NFs directly connected to the radio access network device. The first NF may have an anchor function (ie, the first NF is an anchor function) or may not have an anchor function (ie, the first NF is a non-anchor function).

[0251] Regarding the mechanism by which the first NF generates the first NAS key, reference may be made to method 400, which will not be described in detail here.

[0252] For example, if the first NF is SMF, SMF can generate K SMF . Optionally, SMF can be based on K SMF Generate the key for NAS message encryption and decryption (i.e., NAS message between terminal device and SMF), denoted as K NASsmf-enc , and / or, based on K SMF Generate the key for NAS message security, denoted as K NASsmf-int .

[0253] It is understood that the first NF determines whether to generate NAS keys related to encryption and decryption based on whether to enable NAS message encryption and decryption. Similarly, the first NF determines whether to generate NAS keys related to security based on whether to enable NAS message security.

[0254] Similar to the terminal device, SMF can optionally generate K based on the granularity of PDU session. SMF , K NASsmf-enc and K NASsmf-int According to the embodiment of the present application, the SMF generates NAS keys based on the PDU session granularity, which can avoid the situation where different SMFs generate the same NAS keys for the same terminal device, thereby reducing the probability of conflict.

[0255] For another example, the first NF is LMF, LMF can generate K LMF . Optionally, LMF can be based on K LMFGenerate the key for NAS message encryption and decryption (i.e., NAS message between terminal device and LMF), denoted as K NASlmf-enc , and / or, based on K LMF Generate the key for NAS message security, denoted as K NASlmf-int .

[0256] For another example, the first NF is PCF, PCF can generate K PCF . Optionally, PCF can be based on K PCF Generate the key for NAS message encryption and decryption (i.e., NAS message between terminal device and PCF), denoted as K NASpcf-enc , and / or, based on K PCF Generate the key for NAS message security, denoted as K NASpcf-int .

[0257] For another example, if the first NF is AMF, AMF can generate K AMF Alternatively, the first NF can be based on K AMF Generate K NASamf-enc , and / or, K NASamf-int .

[0258] S303: The first NF processes a NAS message with the terminal device based on the first NAS key generated in S302. Accordingly, the terminal device processes a NAS message with the first NF based on the first NAS key generated for the first NF in S301.

[0259] Take the following line transmission as an example:

[0260] The first NF may encrypt the NAS message based on the first NAS key generated in S302 and send the NAS message. Accordingly, the terminal device may receive the NAS message and decrypt the NAS message based on the first NAS key generated in S301.

[0261] For example, SMF can be based on K NASsmf-enc The NAS message communicated with a terminal device is encrypted and NAS message #1 is sent to the terminal device. Accordingly, the terminal device can receive NAS message #1 and NASsmf-enc Decrypt NAS message #1.

[0262] For example, LMF can be based on K NASlmf-enc The NAS message communicated with a terminal device is encrypted and a NAS message #2 is sent to the terminal device. Accordingly, the terminal device can receive the NAS message #2 and NASlmf-enc Decrypt NAS message #2.

[0263] For example, PCF can be based on K NASpcf-enc The NAS message communicated with a terminal device is encrypted and a NAS message #3 is sent to the terminal device. Accordingly, the terminal device can receive the NAS message #3 and NASpcf-enc Decrypt NAS message #3.

[0264] Take uplink transmission as an example:

[0265] The terminal device may encrypt the NAS message based on the first NAS key generated in S301 and send the NAS message. Correspondingly, the first NF may receive the NAS message and decrypt the NAS message based on the first NAS key generated in S302.

[0266] For example, the terminal device can be based on K NASsmf-enc The NAS message communicated with an SMF is encrypted and the NAS message #a is sent to the SMF. Accordingly, the SMF can receive the NAS message #a and NASsmf-enc Decrypt NAS message #a.

[0267] For example, the terminal device can be based on K NASlmf-enc The NAS message communicated with a LMF is encrypted and NAS message #b is sent to the LMF. Accordingly, the LMF can receive NAS message #b and NASlmf-enc Decrypt NAS message #b.

[0268] For example, the terminal device can be based on K NASpcf-enc The NAS message communicated with a PCF is encrypted and the NAS message #c is sent to the PCF. Accordingly, the PCF can receive the NAS message #c and NASpcf-enc Decrypt NAS message #c.

[0269] In addition, as a case, the first NAS key generated by the first NF in S302 and the first NAS key generated by the terminal device for the first NF in S301 may be the same.

[0270] For example, in a symmetric encryption scenario, SMF can be based on K NASsmf-enc Encrypt the NAS message and send it. After receiving the NAS message, the terminal device can use the same NAS key K NASsmf-enc Decrypt the NAS message.

[0271] As another case, the first NAS key generated by the first NF in S302 and the first NAS key generated by the terminal device for the first NF in S301 may be different.

[0272] For example, in an asymmetric encryption scenario, there are two keys, private key and public key. SMF can be based on the public key K NASsmf-enc Encrypt the NAS message and send it. After receiving the NAS message, the terminal device can use the private key K NASsmf-enc Decrypt the NAS message.

[0273] According to an embodiment of the present application, after the wireless access network device is directly connected to multiple control plane CN NFs, the terminal device can generate one or more NAS keys associated with each of the multiple CN NFs, and accordingly, each of the multiple CN NFs can also generate a NAS key to process the NAS message (for example, encryption and decryption and / or security).

[0274] To better understand the method 300 proposed in this application, the following detailed description of the method 300 is provided in conjunction with the method 400, taking the first NF as an example. It is understood that the first NF is any one of multiple NFs directly connected to the radio access network device. Specifically, the method 400 includes the following steps.

[0275] S401: A terminal device sends security capability information of the terminal device to a first NF. Correspondingly, the first NF receives the security capability information from the terminal device.

[0276] For example, the first NF may have an anchor function (i.e., the first NF is an anchor function) or may not have an anchor function (i.e., the first NF is a non-anchor function). For example, the first NF may be any one of AMF, SMF, LMF, and PCF.

[0277] The following describes several ways in which the first NF obtains the security capability information of the terminal device.

[0278] Method 1:

[0279] The terminal device directly sends the security capability information of the terminal device to the first NF.

[0280] Exemplarily, the terminal device may directly send a NAS message to the first NF, where the NAS message includes security capability information of the terminal device.

[0281] Method 2:

[0282] The terminal device sends security capability information to the wireless access network device. Further, the wireless access network device sends the security capability information of the terminal device to the first NF.

[0283] For example, the first NF is SMF, and the terminal device can send the security capability information of the terminal device to the wireless access network device. Further, the wireless access network device sends the security capability information of the terminal device to the SMF.

[0284] In another scenario, the terminal device can send a NAS message to the radio access network device. The NAS message includes the terminal device's security capability information. The radio access network device does not parse the NAS message. Furthermore, the radio access network device sends the NAS message to the first NF. In other words, the NAS message is transparently transmitted at the radio access network device.

[0285] Method 3:

[0286] The terminal device sends security capability information to the anchor function (e.g., AMF). Further, the anchor function sends the security capability information of the terminal device to the first NF. In this mode 3, the first NF is not an anchor function, or in other words, the first NF is a non-anchor function.

[0287] For example, the first NF is LMF, and the terminal device can send the security capability information of the terminal device to AMF. Further, AMF sends the security capability information of the terminal device to LMF.

[0288] In one case, the terminal device may send a NAS message to the anchor function, the NAS message including the security capability information of the terminal device, and the anchor function may further send the NAS message to the first NF. That is, the NAS message is transparently transmitted at the anchor function.

[0289] Method 4:

[0290] The terminal device may send the security capability information of the terminal device to the wireless access network device. Further, the wireless access network device sends the security capability information of the terminal device to the anchor function (e.g., AMF). Further, the anchor function sends the security capability information of the terminal device to the first NF.

[0291] It can be understood that, in the fourth approach, the first NF is not an anchor function.

[0292] For example, the first NF is SMF, and the terminal device can send the security capability information of the terminal device to SMF through the wireless access network device and AMF.

[0293] In one scenario, the terminal device may send a NAS message to the radio access network device, where the NAS message includes the terminal device's security capability information. Furthermore, the radio access network device sends the NAS message to the anchor function. Furthermore, the anchor function may send the NAS message to the first NF. In other words, the NAS message is transparently transmitted between the anchor function and the radio access network device.

[0294] S402: The first NF selects a security algorithm based on the security capability information of the terminal device and the security capability information of the first NF.

[0295] S403: The first NF sends information about the security algorithm. Correspondingly, the terminal device receives the information about the security algorithm.

[0296] The information of the security algorithm is used to indicate the security algorithm selected by the first NF in S402. For example, the information of the security algorithm is an identifier of the security algorithm.

[0297] The following describes several ways for terminal devices to obtain information about the security algorithm.

[0298] Method 1:

[0299] The first NF sends the security algorithm information to the anchor function (e.g., AMF). Further, the anchor function sends the security algorithm information to the terminal device.

[0300] It can be understood that, in this mode 1, the first NF is not an anchor function, or in other words, the first NF is a non-anchor function.

[0301] For example, the first NF is SMF. After selecting a security algorithm, SMF can send the identifier of the selected security algorithm to the terminal device through AMF.

[0302] In one case, the first NF may send a NAS message to the anchor function, the NAS message including information about the security algorithm, and the anchor function further sends the NAS message to the terminal device. That is, the NAS message is transparently transmitted at the anchor function.

[0303] Method 2:

[0304] The first NF directly sends the security algorithm information to the terminal device.

[0305] As a case, the first NF may send a NAS message to the terminal device, where the NAS message includes information about the security algorithm.

[0306] Method 3:

[0307] The first NF sends the information of the security algorithm to the wireless access network device. Further, the wireless access network device sends the information of the security algorithm to the terminal device.

[0308] For example, the first NF is a PCF. After selecting a security algorithm, the PCF may send an identifier of the selected security algorithm to the terminal device through a wireless access network device.

[0309] In one scenario, the first NF can send a NAS message to the radio access network device, where the NAS message includes information about the security algorithm. Furthermore, the radio access network device can send the NAS message to the terminal device. That is, the NAS message is transparently transmitted at the radio access network device.

[0310] Method 4:

[0311] The first NF may send information about the security algorithm to an anchor function (e.g., AMF). Further, the anchor function sends information about the security algorithm to a radio access network device. Further, the radio access network device sends information about the security algorithm to a terminal device.

[0312] It can be understood that, in this mode 4, the first NF is not an anchor function.

[0313] For example, the first NF is SMF, and SMF can send the identifier of the security algorithm it selects to the terminal device through AMF and the wireless access network device.

[0314] In one scenario, the first NF can send a NAS message to the anchor function, including information about the security algorithm. Furthermore, the anchor function can send the NAS message to the radio access network device. Furthermore, the radio access network device can send the NAS message to the terminal device. In other words, the NAS message is transparently transmitted between the anchor function and the radio access network device.

[0315] S404: The first NF creates (or establishes) a NAS entity.

[0316] It is understandable that the NAS entity can be used to generate NAS messages, encrypt NAS messages, decrypt NAS messages, perform integrity protection on NAS messages, and maintain NAS security context.

[0317] The following describes the triggering conditions for the first NF to create a NAS entity in different situations.

[0318] Case 1:

[0319] After successfully authenticating the terminal device, the first NF creates a NAS entity corresponding to the first NF.

[0320] For example, the first NF is a PCF. When the PCF successfully performs access authentication on the terminal device, the PCF creates a NAS entity corresponding to the PCF, which is recorded as a NASpcf entity.

[0321] Case 2:

[0322] The first NF receives message #A and creates a NAS entity corresponding to the first NF according to message #A. It is understandable that the message #A may come from any one of the terminal device, the radio access network device, the AMF (in this case, the first NF is not the AMF), the enhanced serving mobile location center (E-SMLC), and the secure user plane location (SUPL) location platform (SLP).

[0323] For example, the first NF is an SMF. Exemplarily, the message #A may explicitly instruct the SMF to create a NAS entity corresponding to the SMF, which is recorded as a NASsmf entity. For example, the message #A may include one bit. When the value of the bit is "1", the message #A instructs the SMF to create a NASsmf entity.

[0324] Alternatively, the message #A may implicitly instruct the SMF to create a NASsmf entity (for example, the message #A is a PDU session creation message (PDU session create message)). That is, the PDU session creation message may be reused to implicitly instruct the SMF to create a NASsmf entity.

[0325] For example, the first NF is an LMF. Exemplarily, the message #A may explicitly instruct the LMF to create a NAS entity corresponding to the LMF, denoted as a NASlmf entity. For example, the message #A may include one bit. When the value of the bit is "1," the message #A instructs the LMF to create a NASlmf entity.

[0326] Alternatively, the message #A may implicitly instruct the LMF to create a NASlmf entity (for example, the message #A is a positioning service start message). That is, the positioning service start message may be reused to implicitly instruct the LMF to create a NASlmf entity.

[0327] For example, the first NF is a PCF. Exemplarily, the message #A may explicitly instruct the PCF to create a NASpcf entity. For example, the message #A may include one bit, and when the value of the bit is "1", the message #A instructs the PCF to create a NASpcf entity.

[0328] Alternatively, the message #A may implicitly instruct the PCF to create a NASpcf entity. For example, the message #A may be an AM policy association establishment message, an AM policy association modification message, or a UE policy association establishment message sent by the AMF to the PCF. That is, an existing message may be reused to implicitly instruct the PCF to create a NASpcf entity.

[0329] S405: The first NF generates a first NAS key.

[0330] It is understandable that the present application does not limit the execution order of S404 and S405. For example, S404 can be executed before S405 or after S405.

[0331] Specifically, the first NF may obtain the NAS root key and generate the first NAS key based on the NAS root key. It is understood that if the first NF is an anchor function, the first NF may generate the NAS root key. If the first NF is not an anchor function, the first NF may obtain the NAS root key from an anchor function (e.g., AMF). For example, a NF such as SMF, PCF, or LMF may obtain the NAS root key from the AMF.

[0332] For example, the NAS root key is the key corresponding to the security anchor function, denoted as K SEAF , or the NAS root key is the key corresponding to the access and mobility management function, recorded as K AMF , or, the NAS root key is based on K SEAF The derived key (but not K AMF , or with K AMF different), or, the NAS root key is based on K AMF Derived key.

[0333] The following uses the NAS root key as K SEAF or K AMF Taking NAS as an example, the process of generating the first NAS key by the first NF is described.

[0334] (1)NAS root key is K SEAF .

[0335] The first NF is SMF, which is based on K SEAF Generate K SMF , optionally, SMF can be based on K SMF Generate K NASsmf-enc , and / or, K NASsmf-int .

[0336] Alternatively, the first NF is LMF, which is based on K SEAF Generate K LMF , optionally, LMF can be based on K LMF Generate K NASlmf-enc , and / or, K NASlmf-int .

[0337] Alternatively, the first NF is PCF, which is based on K SEAF Generate K PCF , optionally, PCF can be based on K PCF Generate K NASpcf-enc , and / or, K NASpcf-int .

[0338] Alternatively, the first NF is AMF, which is based on K SEAF Generate K AMF , optionally, AMF can be based on K AMF Generate the key for NAS message encryption and decryption (i.e., NAS message between terminal device and AMF), denoted as K NASamf-enc , and / or, the key used for NAS message security, denoted as K NASamf-int .

[0339] (2)NAS root key is K AMF .

[0340] The first NF is SMF, which is based on K AMF Generate K SMF , optionally, SMF can be based on K SMF Generate K NASsmf-enc , and / or, K NASsmf-int .

[0341] Alternatively, the first NF is LMF, which is based on K AMF Generate K LMF , optionally, LMF can be based on K LMF Generate K NASlmf-enc , and / or, K NASlmf-int .

[0342] Alternatively, the first NF is PCF, which is based on K AMF Generate K PCF , optionally, PCF can be based on K PCF Generate K NASpcf-enc , and / or, K NASpcf-int .

[0343] Alternatively, the first NF is AMF. Optionally, AMF can be based on K AMF Generate K NASamf-enc , and / or, KNASamf-int .

[0344] Next, the input parameters for generating the first NAS key are described.

[0345] In an embodiment of the present application, a first NF may use one or more of the following as input parameters: a first NF type parameter, a first NF identifier, a first NF NAS count, a security algorithm identifier, or a PDU session identifier. The first NF NAS count may be maintained by the first NF. This application does not limit the combination of input parameters. Several possible input parameter scenarios are described below. It should be understood that the following scenarios are merely illustrative.

[0346] Case 1:

[0347] The first NF may take the type parameter of the first NF and / or the identifier of the first NF, the NAS count maintained by the first NF, and the security algorithm identifier (ie, the identifier of the security algorithm selected in S402) as input parameters, and input the input parameters into the corresponding algorithm.

[0348] In the embodiments of the present application, "the type parameter of the first NF and / or the identifier of the first NF" may include three optional cases, namely, "the type parameter of the first NF," "the identifier of the first NF," and "the type parameter of the first NF and the identifier of the first NF." This will not be further described below.

[0349] For example, the first NF may input the input parameters into a next generation encryption algorithm (NEA), such as 128-NEA1, 128-NEA2, or 128-NEA3, which will not be described in detail below.

[0350] For example, the first NF is PCF, PCF generates K PCF When the PCF type parameter and / or the PCF identifier, the NAS count maintained by the PCF, and the security algorithm identifier selected by the PCF in S402 can be used as input parameters.

[0351] For example, the first NF is LMF, LMF generates K LMF When performing the operation, the type parameter of the LMF and / or the identifier of the LMF, the NAS count maintained by the LMF, and the security algorithm identifier selected by the LMF in S402 may be used as input parameters.

[0352] Case 2:

[0353] The first NF may take the type parameter of the first NF and / or the identifier of the first NF, the NAS count maintained by the first NF, the security algorithm identifier (ie, the identifier of the security algorithm selected in S402), and the PDU session identifier (PDUsession id) as input parameters.

[0354] For example, the first NF is SMF, SMF generates K SMF When performing the SMF operation, the type parameter of the SMF, the NAS count maintained by the SMF, the security algorithm identifier selected by the SMF in S402, and the PDU session identifier can be used as input parameters.

[0355] Case 3:

[0356] The first NF may take the NAS count maintained by the first NF, the security algorithm identifier (ie, the identifier of the security algorithm selected in S402), and the PDU session identifier as input parameters.

[0357] For example, the first NF is SMF, SMF generates K SMF When performing the above operations, the NAS count maintained by the SMF, the security algorithm identifier selected by the SMF in S402, and the PDU session identifier can be used as input parameters.

[0358] From the above cases 1 to 3, it can be seen that in the embodiment of the present application, each NF of the multiple NFs directly connected to the wireless access network device can maintain a NAS count separately.

[0359] As a way, the NAS count maintained by multiple NFs directly connected to the wireless access network device can start from 0.

[0360] Alternatively, the NAS counts maintained by multiple NFs directly connected to the radio access network device can be counted starting from the initial NAS count of the anchor function (e.g., AMF). Taking the first NF among the multiple NFs as an example, it is understood that if the first NF is not the anchor function, the first NF (e.g., SMF, PCF, or LMF) can obtain the initial NAS count of the anchor function from the anchor function.

[0361] It can be understood that in the above cases 1 to 3, by using multiple parameters as input parameters, the probability of conflict in the generated NAS keys is low.

[0362] Case 4:

[0363] The first NF may only take one of the type parameter of the first NF, the identifier of the first NF, the NAS count maintained by the first NF, the security algorithm identifier, and the PDU session identifier as an input parameter.

[0364] For example, the first NF may only take the type parameter of the first NF as an input parameter to generate a NAS key.

[0365] It can be understood that by using one parameter as an input parameter, the NAS key generation mechanism can be simplified and the complexity of the NAS key generation algorithm can be reduced.

[0366] S406: The first NF activates the first NAS key.

[0367] This step S406 is optional. It is understood that if the first NAS key is activated, the first NF can encrypt and decrypt and / or perform integrity protection on the NAS message. If the first NAS key is not activated, the first NF can also transmit NAS messages to the terminal device.

[0368] The triggering conditions for the first NF to activate the first NAS key are described below.

[0369] Case 1:

[0370] When creating a NAS entity corresponding to the first NF, the first NF activates the first NAS key.

[0371] For example, PCF can activate K when creating a NASpcf entity. PCF , LMF can activate K when creating NASlmf entities LMF , SMF can activate K when creating NASsmf entity SMF .

[0372] Case 2:

[0373] The first NF receives message #B (ie, the fifth message) and activates the first NAS key according to message #B.

[0374] Exemplarily, the message #B may come from any one of the terminal device, wireless access network device, AMF (in this case, the first NF is not AMF), E-SMLC, and SLP.

[0375] For example, the first NF is SMF, and SMF receives a PDU session creation message (an example of message #B). The PDU session creation message can implicitly instruct SMF to create a NAS entity and generate and activate a NAS key.

[0376] S407, the terminal device creates a NAS entity.

[0377] The following describes the triggering conditions for the terminal device to create a NAS entity in different situations.

[0378] Case 1:

[0379] When the terminal device accesses the core network for the first time and is successfully authenticated, the terminal device creates a NAS entity corresponding to the first NF.

[0380] For example, when a terminal device accesses the core network for the first time and authentication is successful, the terminal device creates one or more of the following entities: NASamf entity, NASpcf entity, NASsmf entity, and NASlmf entity.

[0381] Case 2:

[0382] The terminal device receives message #C and creates a NAS entity corresponding to the first NF according to message #C. Optionally, message #C is used to indicate the NAS entity identifier to be created.

[0383] As an implementation, message #C may explicitly instruct the terminal device to create a NAS entity. For example, message #C is a NAS security mode command (SMC) message. The NAS SMC message includes one or more bits that may be used to instruct the terminal device to create one or more of a NASamf entity, a NASpcf entity, a NASsmf entity, and a NASlmf entity.

[0384] For example, the AMF may send a NAS SMC message to the terminal device. Alternatively, the SMF, PCF, and LMF may also send a NAS SMC message to the terminal device.

[0385] As another implementation method, the message #C may implicitly instruct the terminal device to create a NAS entity.

[0386] For example, the terminal device can send a PDU session creation request message (PDU session create request message) to the network side, and the terminal device can receive a PDU session creation acceptance message (PDU session create accept message) from the network side. After receiving the PDU session creation acceptance message, the terminal device can establish a NASsmf entity for each PDU session.

[0387] For another example, the AMF may send a positioning service activation message to the terminal device, and the terminal device may create a NASlmf entity after receiving the positioning service activation message.

[0388] For another example, the LMF may send an LTE positioning protocol (LPP) request location information message to the UE, and the terminal device may create a NASlmf entity based on the message.

[0389] S408: The terminal device generates multiple NAS keys, wherein at least two NAS keys among the multiple NAS keys are respectively associated with different NFs among the multiple NFs.

[0390] It is understood that the present application does not limit the execution order of S407 and S408. For example, S407 can be executed before S408 or after S408.

[0391] Specifically, the terminal device can generate a NAS key based on the NAS root key. Unlike the network side, the terminal device can generate a NAS root key. For example, the terminal device can generate K AMF or K SEAF For more information about the NAS root key, please refer to the above.

[0392] The following uses the NAS root key as K SEAF or K AMF As an example, this section describes the process of generating multiple NAS keys on a terminal device.

[0393] (1)NAS root key is K SEAF .

[0394] Terminal equipment can be based on K SEAF Generate K SMF Optionally, the terminal device can be based on K SMF Generate K NASsmf-enc , and / or, K NASsmf-int .

[0395] Terminal equipment can be based on K SEAF Generate K LMF Optionally, the terminal device can be based on K LMF Generate K NASlmf-enc , and / or, K NASlmf-int .

[0396] Terminal equipment can be based on K SEAF Generate K PCF Optionally, the terminal device can be based on K PCF Generate K NASpcf-enc , and / or, K NASpcf-int .

[0397] Terminal equipment can be based on K SEAF Generate K AMF Optionally, the terminal device can be based on K AMF Generate K NASamf-enc , and / or, K NASamf-int .

[0398] (2)NAS root key is K AMF .

[0399] Terminal equipment can be based on K AMF Generate K SMF Optionally, the terminal device can be based on K SMF Generate K NASsmf-enc , and / or, K NASsmf-int .

[0400] Terminal equipment can be based on K AMF Generate K LMF Optionally, the terminal device can be based on K LMF Generate K NASlmf-enc , and / or, K NASlmf-int .

[0401] Terminal equipment can be based on K AMF Generate K PCF Optionally, the terminal device can be based on K PCF Generate K NASpcf-enc , and / or, K NASpcf-int .

[0402] Optionally, the terminal device can be based on K AMF Generate K NASamf-enc , and / or, K NASamf-int .

[0403] The multiple NAS keys generated by the terminal device include a first key generated by the terminal device for the first NF. Next, taking the first NF as an example, input parameters when the terminal device generates the first NAS key for the first NF are described.

[0404] Exemplarily, the terminal device may input the input parameters into an NEA, for example, 128-NEA1, or 128-NEA2, or 128-NEA3.

[0405] In an embodiment of the present application, a terminal device may use one or more of the following as input parameters: the type parameter of the first NF, the identifier of the first NF, the NAS count of the first NF, the security algorithm identifier, and the PDU session identifier. The NAS count of the first NF may be maintained by the terminal device or obtained from another NF. This application does not limit the combination of input parameters. Several possible input parameter scenarios are described below. It should be understood that the following scenarios are merely exemplary.

[0406] Scenario A:

[0407] The terminal device may take the type parameter of the first NF and / or the identifier of the first NF, the NAS count of the first NF, and the security algorithm identifier (ie, the identifier of the security algorithm received from the first NF in S403) as input parameters.

[0408] For example, if the first NF is PCF, the terminal device generates K PCF When the terminal device receives the security algorithm from the PCF in step S403, the type parameter of the PCF, the NAS count of the PCF maintained by the terminal device, and the security algorithm identifier from the PCF received in step S403 may be used as input parameters.

[0409] For example, the first NF is LMF, and the terminal device generates K LMF When the LMF type parameter, the NAS count of the LMF maintained by the terminal device, and the security algorithm identifier received from the LMF in S403 can be used as input parameters.

[0410] Case B:

[0411] The terminal device may take the type parameter of the first NF and / or the identifier of the first NF, the NAS count of the first NF, the security algorithm identifier (i.e., the identifier of the security algorithm received from the first NF in S403), and the PDU session identifier as input parameters.

[0412] For example, if the first NF is SMF, the terminal device generates K SMF When the SMF type parameter, the NAS count of the SMF maintained by the terminal device, the security algorithm identifier from the SMF received in S403, and the PDU session identifier can be used as input parameters.

[0413] Case C:

[0414] The terminal device may use the NAS count of the first NF, the security algorithm identifier (ie, the identifier of the security algorithm received in S403), and the PDU session identifier (PDUsession id) as input parameters.

[0415] For example, if the first NF is SMF, the terminal device generates K SMF When performing the authentication, the NAS count, security algorithm identifier and PDU session identifier of the SMF maintained by the terminal device can be used as input parameters.

[0416] From Case A to Case C, it can be seen that when multiple NFs are directly connected to the wireless access network equipment respectively, the terminal device can maintain the NAS count of the multiple NFs.

[0417] As a method, the NAS count of each NF in the plurality of NFs may start from 0.

[0418] As another approach, the NAS count of each NF among the multiple NFs may start from the initial NAS count of the anchor function (e.g., AMF). At this time, the terminal device may obtain the initial NAS count of the anchor function from the anchor function.

[0419] S409: The terminal device activates the multiple NAS keys generated in S408.

[0420] The following uses the first NF as an example to describe the triggering condition for the terminal device to activate the first NAS key, wherein the first NAS key is a NAS key generated by the terminal device for the first NF.

[0421] This step S409 is optional. It is understood that if the first NAS key is activated, the terminal device can encrypt and decrypt and / or perform integrity protection on the NAS message. If the first NAS key is not activated, the NAS message can also be transmitted between the first NF and the terminal device.

[0422] Case 1:

[0423] When creating the NAS entity corresponding to the first NF, the terminal device activates the first NAS key.

[0424] For example, if the first NF is SMF, when the terminal device creates the NAS entity corresponding to the SMF, the terminal device activates K SMF , K NASsmf-enc and K NASsmf-int .

[0425] Case 2:

[0426] The terminal device receives message #D (ie, the first message) and activates the first NAS key according to message #D.

[0427] For example, the AMF may send a message #D to the terminal device (exemplarily, the message #D may be encrypted), and the terminal device may activate the AMF-related NAS key based on the message #D.

[0428] For another example, the SMF may send a message #D to the terminal device (exemplarily, the message #D may not be encrypted), and the terminal device may activate the NAS key associated with the SMF based on the message #D.

[0429] For another example, the PCF may send a message #D to the terminal device (illustratively, the message #D may not be encrypted), and the terminal device may activate the NAS key associated with the PCF based on the message #D.

[0430] For another example, LMF may send a message #D to the terminal device (exemplarily, the message #D may not be encrypted), and the terminal device may activate the NAS key associated with the LMF based on the message #D.

[0431] Optionally, after the terminal device successfully activates the first NAS key, the terminal device may send an activation success message. Accordingly, the first NF receives the activation success message. The activation success message indicates that the terminal device successfully activates the first NAS key.

[0432] Exemplarily, the terminal device may directly send activation success information to the first NF.

[0433] Alternatively, the terminal device may send activation success information to the first NF through the wireless access network device.

[0434] Alternatively, the terminal device may send activation success information to the first NF through the wireless access network device and the anchor function (eg, AMF). It is understandable that the first NF is not an anchor function at this time.

[0435] It should be understood that, based on the activation success information, the first NF can learn that the terminal device has successfully activated the first NAS key. After this, the first NF sends a NAS message to the terminal device. Based on this, it is possible to avoid the situation where the first NF sends a NAS message, but the terminal device is unable to process the NAS message (for example, the terminal device cannot decrypt the NAS message) because the first NAS key has not been activated.

[0436] Optionally, the first NF may default that the terminal device has successfully activated the first NAS key. In this case, the terminal device does not need to send the activation success information to the first NF.

[0437] S410: The first NF processes a NAS message with the terminal device based on the first NAS key generated in S405. Accordingly, the terminal device processes a NAS message with the first NF based on the first NAS key for the first NF generated in S408.

[0438] In addition, as one case, the first NAS key generated by the first NF in S405 and the first NAS key generated by the terminal device for the first NF in S408 can be the same. As another case, the first NAS key generated by the first NF in S405 and the first NAS key generated by the terminal device for the first NF in S408 can be different. For this, please refer to the above and will not be repeated here.

[0439] For details about this process, please refer to the description in S303.

[0440] Optionally, in the above method 400, S401 to S403, S404 to S406, and S407 to S409 may be independent of each other. In other words, S404 to S406 may not depend on the execution of S401 to S403 (or, may not be executed based on S401 to S403), S407 to S409 may not depend on the execution of S401 to S403, and S407 to S409 may not depend on the execution of S404 to S406.

[0441] Optionally, each item in S404 to S409 may be independent of each other, that is, each item in S404 to S409 may be executed independently without dependency between each other.

[0442] According to an embodiment of the present application, after a wireless access network device is directly connected to multiple CN NFs, the terminal device can generate a NAS key associated with each of the multiple CN NFs, and accordingly, each of the multiple CN NFs can also generate a NAS key, so that the terminal device and the multiple CN NFs can process the NAS message (for example, perform encryption and decryption and / or complete security).

[0443] This application also proposes a suspend mechanism for NAS entities within the NAS security mechanism. Figure 5 shows a method 500 proposed in this application. It is understood that, as an implementation, method 500 can be performed based on method 400. Specifically, method 500 includes the following steps.

[0444] S501: The first NF suspends the NAS entity and saves the security context of the first NF.

[0445] The security context of the first NF includes one or more of the NAS count of the first NF, the security algorithm identifier selected by the first NF, the identifier of the terminal device, the type of the first NF, the identifier of the first NF, and the PDU session identifier.

[0446] For example, the security context of the first NF includes the NAS count of the first NF, the security algorithm identifier selected by the first NF, and the identifier of the terminal device. Optionally, the security context of the first NF also includes one or more of the type of the first NF, the identifier of the first NF, and the PDU session identifier.

[0447] That is, in this embodiment of the present application, each NF directly connected to the radio access network device maintains a NAS count. For example, the SMF can maintain a NAS count based on the PDU session granularity. The AMF can maintain the AMF's NAS count. The LMF can maintain the LMF's NAS count. The PCF can maintain the PCF's NAS count.

[0448] As an implementation, the first NF receives message #E and suspends the NAS entity corresponding to the first NF according to message #E. For example, the message #E may be sent by a terminal device, a radio access network device, or another CN NF.

[0449] Example 1:

[0450] The first NF is the PCF. The AMF may send a message #E1 to the PCF, where the message #E1 is used to instruct the PCF to suspend the NASpcf entity.

[0451] Exemplarily, the message #E1 may explicitly instruct the PCF to suspend the NASpcf entity. For example, the message #E1 may include one bit, and when the value of the bit is "1", the message #E1 instructs the PCF to suspend the NASpcf entity.

[0452] Alternatively, the message #E1 may implicitly instruct the PCF to suspend the NASpcf entity. For example, a certain message may be multiplexed to implicitly instruct the PCF to suspend the NASpcf entity through the message type of the message.

[0453] Example 2:

[0454] The first NF is SMF. AMF can send message #E2 to SMF, which is used to instruct SMF to suspend the NASsmf entity.

[0455] Exemplarily, the message #E2 may explicitly instruct the SMF to suspend the NASsmf entity. For example, the message #E2 may include 1 bit, and when the value of the bit is "1", the message #E2 instructs the SMF to suspend the NASsmf entity.

[0456] Alternatively, the message #E2 may implicitly instruct the SMF to suspend the NASsmf entity (for example, the message #E2 is a PDU session delete message). That is, the PDU session delete message may be reused to implicitly instruct the SMF to suspend the NASsmf entity.

[0457] Example 3:

[0458] The first NF is LMF. The AMF may send message #E3 to the LMF and suspend the NASlmf entity according to the message #E3.

[0459] Exemplarily, the message #E3 may explicitly instruct the LMF to suspend the NASlmf entity. For example, the message #E3 may include one bit, and when the value of the bit is "1", the message #E3 instructs the LMF to suspend the NASlmf entity.

[0460] Alternatively, the message #E3 may implicitly instruct the LMF to suspend the NASlmf entity (for example, the message #E3 is a positioning service deletion message). That is, the positioning service deletion message may be reused to implicitly instruct the LMF to suspend the NASlmf entity.

[0461] S502: The terminal device suspends the NAS entity corresponding to the first NF and saves the security context of the first NF.

[0462] The security context of the first NF includes one or more of the type of the first NF, the identifier of the first NF, the NAS count of the first NF, the security algorithm identifier selected by the first NF, the PDU session identifier, and the identifier of the terminal device.

[0463] For example, the security context of the first NF includes the type of the first NF and / or the identifier of the first NF, the NAS count of the first NF, and the identifier of the security algorithm selected by the first NF. Optionally, the security context of the first NF may also include one or more of a PDU session identifier and an identifier of a terminal device.

[0464] In an embodiment of the present application, a terminal device can maintain multiple NAS counts. For example, the terminal device can maintain the NAS count of the SMF at the granularity of the PDU session. The terminal device can maintain the NAS count of the AMF. The terminal device can maintain the NAS count of the LMF. The terminal device can maintain the NAS count of the PCF.

[0465] The triggering condition of S502 is described below.

[0466] Case 1:

[0467] When the terminal device enters an idle state or an inactive state, the terminal device suspends the NAS entity corresponding to the first NF and saves the security context of the first NF.

[0468] For example, when the terminal device enters an idle state or an inactive state, the terminal device suspends the NASamf entity and / or the NASpcf entity.

[0469] Case 2:

[0470] The terminal device receives message #F and suspends the NAS entity corresponding to the first NF according to message #F.

[0471] For example, the message #F may be an RRC release message or a NAS de-registration message. After receiving the message #F, the terminal device suspends the NASamf entity and / or NASpcf entity.

[0472] For example, the message #F may be a PDU session release message (PDU sessionrelease message). After receiving the message #F, the terminal device suspends the NASsmf entity.

[0473] For example, the message #F may be a positioning service release message. After receiving the message #F, the terminal device suspends the NASlmf entity.

[0474] It is understandable that if the first NF and the terminal device save the security context when suspending the NAS entity, the first NF and the terminal device do not need to obtain the security context from other network elements when subsequently restoring the NAS entity, thereby reducing signaling interaction and improving the efficiency of restoring the NAS entity.

[0475] This application also proposes a NAS entity deletion mechanism within the NAS security mechanism. Figure 6 illustrates method 600 proposed in this application. It is understood that, as an implementation, method 600 can be performed based on method 400, or both method 400 and method 500. Specifically, method 600 includes the following steps.

[0476] S601: The first NF deletes the NAS entity and deletes the security context of the first NF.

[0477] As an implementation manner, the first NF may receive message #G, and delete the NAS entity corresponding to the first NF according to message #G, and delete the security context of the first NF.

[0478] Example 1:

[0479] The first NF is PCF. The AMF may send a message #G1 to the PCF, where the message #G1 is used to instruct the PCF to delete the NASpcf entity.

[0480] Exemplarily, the message #G1 may explicitly instruct the PCF to delete the NASpcf entity. For example, the message #G1 may include one bit, and when the value of the bit is "1", the message #G1 instructs the PCF to delete the NASpcf entity.

[0481] Alternatively, the message #G1 may implicitly instruct the PCF to delete the NASpcf entity. For example, a certain message may be reused to implicitly instruct the PCF to delete the NASpcf entity through the message type of the message.

[0482] Example 2:

[0483] The first NF is SMF. AMF can send message #G2 to SMF, which is used to instruct SMF to delete the NASsmf entity.

[0484] Exemplarily, the message #G2 may explicitly instruct the SMF to delete the NASsmf entity. For example, the message #G2 may include one bit, and when the value of the bit is "1", the message #G2 instructs the SMF to delete the NASsmf entity.

[0485] Alternatively, the message #G2 may implicitly instruct the SMF to delete the NASsmf entity (for example, the message #G2 is a PDU session delete message). That is, the PDU session delete message may be reused to implicitly instruct the SMF to delete the NASsmf entity.

[0486] Example 3:

[0487] The first NF is LMF. LMF may receive message #G3 and delete the NASlmf entity according to message #G3.

[0488] Exemplarily, the message #G3 may explicitly instruct the LMF to delete the NASlmf entity. For example, the message #G3 may include one bit, and when the value of the bit is "1", the message #G3 instructs the LMF to delete the NASlmf entity.

[0489] Alternatively, the message #G3 may implicitly instruct the LMF to delete the NASlmf entity (for example, the message #G3 is a positioning service deletion message). That is, the positioning service deletion message may be reused to implicitly instruct the LMF to delete the NASlmf entity.

[0490] S602: The terminal device deletes the NAS entity corresponding to the first NF and deletes the security context of the first NF.

[0491] The triggering condition of S602 is described below.

[0492] Case 1:

[0493] When the terminal device enters an idle state or an inactive state, the terminal device deletes the NAS entity corresponding to the first NF and deletes the security context of the first NF.

[0494] For example, when the terminal device enters an idle state or an inactive state, the terminal device deletes the NASamf entity and / or the NASpcf entity.

[0495] Case 2:

[0496] The terminal device receives message #H and deletes the NAS entity corresponding to the first NF according to message #H.

[0497] Similarly, the message #H may explicitly or implicitly instruct the terminal device to delete the NAS entity corresponding to the first NF.

[0498] For example, the message #H may be an RRC release message or a NAS de-registration message. After receiving the message #H, the terminal device deletes the NASAmf entity and / or the NASpcf entity.

[0499] For example, the message #H may be a PDU session release message (PDU sessionrelease message). After receiving the message #H, the terminal device deletes the NASsmf entity.

[0500] For example, the message #H may be a positioning service release message. After receiving the message #H, the terminal device deletes the NASlmf entity.

[0501] It can be understood that deleting the security context while deleting the NAS entity can save storage space of the terminal device and the first NF.

[0502] This application also proposes a NAS key deactivation mechanism within the NAS security mechanism. Specifically, Figure 7 illustrates a method 700 proposed in this application. It is understood that, as an implementation, method 700 can be performed based on method 400. Specifically, method 700 includes the following steps.

[0503] S701: The first NF deactivates the first NAS key.

[0504] The triggering conditions of S701 are described below.

[0505] Case 1:

[0506] When the NAS entity corresponding to the first NF is suspended or deleted, the first NF deactivates the first NAS key.

[0507] Case 2:

[0508] The first NF receives message #I (ie, the sixth message) and deactivates the first NAS key according to message #I.

[0509] Similarly, the message #1 may explicitly or implicitly instruct the first NF to deactivate the first NAS key.

[0510] For example, if the first NF is AMF, the radio access network device may send a UE context release request message (an example of message #1) to the AMF, and the AMF may deactivate the AMF-related NAS key according to the message. Alternatively, the AMF may deactivate the AMF-related NAS key after sending a UE context release command (UE context release command) to the radio access network device.

[0511] For another example, if the first NF is an SMF, the radio access network device may send a UE context release request message to the SMF, and the SMF may deactivate the SMF-related NAS key based on the message. Alternatively, the SMF may deactivate the SMF-related NAS key after sending a UE context release command to the radio access network device.

[0512] S702: The terminal device deactivates the first NAS key generated for the first NF.

[0513] The triggering conditions of S702 are described below.

[0514] Case 1:

[0515] When the NAS entity corresponding to the first NF is suspended or deleted, the terminal device deactivates the first NAS key.

[0516] Case 2:

[0517] The terminal device receives message #J (ie, the second message) and deactivates the first NAS key according to message #J.

[0518] Similarly, the message #J may explicitly or implicitly instruct the terminal device to deactivate the first NAS key.

[0519] For example, the terminal device may deactivate the first NAS key after receiving an access network connection release (AN connection release) message (an example of message #J) sent by the wireless access network device.

[0520] For another example, the terminal device may deactivate the first NAS key after sending an AN connection release message to the radio access network device.

[0521] Optionally, after the terminal device successfully deactivates the first NAS key, the terminal device may send a deactivation success message. Accordingly, the first NF receives the deactivation success message from the terminal device. The deactivation success message is used to indicate that the terminal device successfully deactivated the first NAS key.

[0522] Specifically, the terminal device can send deactivation success information to the first NF through the wireless access network device.

[0523] Alternatively, the terminal device may send a deactivation success message to the first NF via a wireless access network device or an anchor function (eg, AMF). It is understandable that the first NF is not an anchor function at this time.

[0524] Optionally, the present application also proposes a NAS security mechanism when a terminal device changes from an idle state or an inactive state to a connected state.

[0525] 8 shows a method 800 proposed in this application. It is understood that, as an implementation, the method 800 can be performed based on the method 400. Specifically, the method 800 includes four parallel situations, namely S801, S802, S803 and S804.

[0526] S801: When a terminal device changes from a connected state to an idle state or an inactive state, a first NF and the terminal device both save a security context. When the terminal device changes from the idle state or the inactive state to a connected state again, the first NF and the terminal device each generate a first NAS key based on the saved security context.

[0527] As described above, it is understandable that the first NAS key generated by the first NF and the first NAS key generated by the terminal device for the first NF may be the same as or different from each other.

[0528] The security context includes one or more of the type of the first NF, the identifier of the first NF, the identifier of the terminal device, the identifier of the security algorithm selected by the first NF, the NAS count of the first NF, and the PDU session identifier.

[0529] For example, the security context stored by the terminal device includes the type of the first NF and / or the identifier of the first NF, the identifier of the security algorithm selected by the first NF, and the NAS count of the first NF. Optionally, the security context also includes one or more of the PDU session identifier and the identifier of the terminal device.

[0530] For another example, the security context saved by the first NF includes the identifier of the terminal device, the identifier of the security algorithm selected by the first NF, and the NAS count of the first NF. Optionally, the security context also includes one or more of the PDU session identifier, the type of the first NF, and the identifier of the first NF.

[0531] It can be understood that when the terminal device changes from a connected state to an idle state or an inactive state, the first NF and the terminal device both save the security context. When the terminal device subsequently changes from an idle state or an inactive state to a connected state again, the first NF and the terminal device no longer need to obtain the security context from other network elements, thereby reducing signaling interaction.

[0532] In addition, when the terminal device changes from the connected state to the idle state or the inactive state, the first NF can suspend the NAS entity, and the terminal device also suspends the NAS entity. When the terminal device changes from the idle state or the inactive state to the connected state, the first NF reactivates (or resumes) the NAS entity, and the terminal device also reactivates the NAS entity.

[0533] S802: When the terminal device transitions from a connected state to an idle state or an inactive state, neither the first NF nor the terminal device saves the security context. When the terminal device transitions from the idle state or the inactive state to a connected state again, the first NF and the terminal device each receive the security context from the second NF and generate a first NAS key based on the received security context.

[0534] As described above, it is understandable that the first NAS key generated by the first NF and the first NAS key generated by the terminal device for the first NF may be the same as or different from each other.

[0535] The second NF is used to store the security context. For example, the second NF may be an AMF, or other NFs. The security context includes one or more of the following: a terminal device identifier, a first NF type, a first NF identifier, a security algorithm identifier selected by the first NF, a NAS count value of the first NF, and a PDU session identifier.

[0536] For example, the security context includes the terminal device identifier, the type of the first NF and / or the identifier of the first NF, the security algorithm identifier selected by the first NF, and the NAS count value of the first NF. Optionally, the security context also includes a PDU session identifier.

[0537] That is, as an implementation, when a terminal device transitions from a connected state to an idle or inactive state, the second NF can store the security context on behalf of the first NF and the terminal device, thereby saving storage space for the first NF and the terminal device. For example, the first NF can send the security context to the second NF, and / or the terminal device can send the security context to the second NF.

[0538] Furthermore, in S802 above, the terminal device and the first NF do not store the security context. When the terminal device transitions from a connected state to an idle or inactive state, the first NF may delete the NAS entity, and the terminal device may also delete the NAS entity. When the terminal device transitions from an idle or inactive state to a connected state, the first NF may recreate the NAS entity, and the terminal device may also recreate the NAS entity.

[0539] Optionally, as a case, if the terminal device or the first NF initiates the deregistration process of the terminal device, the terminal device and the first NF may both delete the corresponding NAS entity.

[0540] S803: When the terminal device transitions from the connected state to the idle state or the inactive state, neither the first NF nor the terminal device saves the NAS count of the first NF. When the terminal device transitions from the idle state or the inactive state to the connected state, the first NF and the terminal device each generate a first NAS key, and the NAS count corresponding to the first NF starts counting from the NAS count of the anchor function (e.g., AMF).

[0541] As described above, it is understandable that the first NAS key generated by the first NF and the first NAS key generated by the terminal device for the first NF may be the same as or different from each other.

[0542] It can be understood that, in S803, the first NF is not an anchor function, or in other words, the first NF is a non-anchor function.

[0543] In S803, although the first NF and the terminal device do not save the NAS count of the first NF, they can save other information in the security context, for example, one or more of the type of the first NF, the identifier of the first NF, the identifier of the security algorithm selected by the first NF, the PDU session identifier, and the identifier of the terminal device.

[0544] That is to say, in S803, when the terminal device changes from the connected state to the idle state or the inactive state, the terminal device and the first NF do not save the NAS count of the first NF. When the terminal device changes from the idle state or the inactive state to the connected state, the first NF and the terminal device respectively obtain the NAS count of the anchor function from the anchor function. Since the NAS count of the AMF is random, the security level of the subsequent generation of the first NAS key can be improved.

[0545] S804: When the terminal device transitions from the connected state to the idle state or the inactive state, neither the first NF nor the terminal device saves the NAS count of the first NF. When the terminal device transitions from the idle state or the inactive state to the connected state, the first NF and the terminal device each generate a first NAS key, and the NAS count corresponding to the first NF starts from 0.

[0546] As described above, it is understandable that the first NAS key generated by the first NF and the first NAS key generated by the terminal device for the first NF may be the same as or different from each other.

[0547] It can be understood that, similar to S803, in S804, although the first NF and the terminal device do not save the NAS count of the first NF, they can save other information in the security context, for example, one or more of the type of the first NF, the identifier of the first NF, the identifier of the security algorithm selected by the first NF, the PDU session identifier, and the identifier of the terminal device.

[0548] That is, in S804, when the terminal device changes from the connected state to the idle state or the inactive state, the terminal device and the first NF do not save the NAS count of the first NF, nor do they maintain the NAS count of the anchor function (e.g., AMF), thereby simplifying the NAS security mechanism of the terminal device and the first NF.

[0549] As can be seen from the above, in future communication systems, each of the multiple NFs directly connected to the radio access network device will have a corresponding NAS key. In some cases, the NAS keys of the terminal device and the NF need to be synchronously updated (rekeying). Therefore, this application also optionally proposes a NAS key update mechanism within the NAS security mechanism. The following describes the NAS key update mechanism in two cases.

[0550] Case 1:

[0551] When generating NAS keys, K SEAF The root key is a key that is used to store and retrieve the NAS key of a first NF among multiple NFs directly connected to a wireless access network device. When the NAS key of the first NF is updated, the first NF can perform an independent NAS key update process on the terminal device. Figure 9 illustrates method 900 proposed in this application. It is understood that, as an implementation, method 900 can be performed based on method 400. Method 900 includes the following steps.

[0552] S901: When a preset condition is met, the first NF updates the first NAS key.

[0553] For example, the preset condition may be that the value of the NAS count corresponding to the first NF reaches a maximum value.

[0554] S902: The first NF sends a message #K (ie, a third message). Correspondingly, the terminal device receives the message #K from the first NF.

[0555] The message #K is used to instruct the terminal device to update the first NAS key. Exemplarily, the message #K may be a NAS message.

[0556] Alternatively, as a method, the first NF may send a NAS message to the radio access network device, the NAS message including information instructing the terminal device to update the first NAS key, and the radio access network device then sends the NAS message to the terminal device. That is, the NAS message is transparently transmitted at the radio access network device.

[0557] S903: The terminal device updates the first NAS key generated for the first NF according to the message #K.

[0558] For example, if the first NF is SMF, the terminal device can update K according to the message #K SMF , K NASsmf-enc and K NASsmf-int .

[0559] Of course, the first NF can also be PCF, LMF, AMF, etc.

[0560] It is understood that while steps S901 to S903 described above are triggered by the first NF, the NAS key synchronization update can alternatively be triggered by the terminal device. For example, if a preset condition is met, the terminal device can update the first NAS key, and the terminal device can send an instruction to the first NF, instructing the first NF to update the NAS key. The first NF can then update the NAS key based on the instruction from the terminal device.

[0561] For example, the terminal device may directly send indication information to the first NF.

[0562] Alternatively, the terminal device may send an instruction message to an anchor function (e.g., AMF), and the anchor function may further instruct the first NF to update the NAS key. In this case, the first NF is not an anchor function, or in other words, the first NF is a non-anchor function.

[0563] It is understandable that when the NAS count value reaches the maximum value, the first NF and the terminal device synchronously update the NAS key, which can avoid third-party attack replay and thus improve security.

[0564] Optionally, if the first NF is not an anchor function, or in other words, the first NF is a non-anchor function, the method 900 further includes S904 to S907.

[0565] S904: The anchor function sends a message #L to the first NF and the terminal device. Correspondingly, the first NF and the terminal device receive the message #L.

[0566] This message #L is used to indicate that NAS message transmission between the first NF and the terminal device is suspended during the first NAS key update period.

[0567] It is understandable that the present application does not limit the execution order of S904 and S901. As a case, S904 can also be executed before S901.

[0568] S905: The first NF and the terminal device suspend NAS message transmission during the first NAS key update period according to message #L.

[0569] It is understandable that during the NAS key update, the old NAS key may become invalid, but the new NAS key has not yet been successfully enabled. Therefore, during the NAS key update, the first NF and the terminal device can suspend NAS message transmission to reduce the probability of NAS message parsing errors.

[0570] S906: The anchor function sends a message #M to the first NF and the terminal device. Correspondingly, the first NF and the terminal device receive the message #M.

[0571] This message #M is used to instruct the first NF to resume NAS message transmission with the terminal device.

[0572] As an implementation method, after the anchor function sends the message #L, the anchor function can start a timer. For example, the preset duration of the timer is greater than or equal to the duration required for the NAS key update. After the timer times out, the anchor function sends the message #M.

[0573] As another implementation, after successfully updating the first NAS key, the first NF may notify the anchor function of the successful update of the first NAS key. Similarly, after successfully updating the first NAS key, the terminal device may notify the anchor function of the successful update of the first NAS key. Based on this, the anchor function may send message #M.

[0574] S907: The first NF and the terminal device restart NAS message transmission according to message #M.

[0575] Similar to S904 to S907, if the first NF is an anchor function, the first NF may optionally send a message #L to the terminal device, instructing the terminal device to suspend NAS message transmission with the first NF during the first NAS key update period. The first NF may also suspend NAS message transmission with the terminal device during the first NAS key update period. Subsequently, the first NF may send a message #M to the terminal device, instructing the terminal device to resume NAS message transmission with the first NF. Accordingly, the first NF may also resume NAS message transmission with the terminal device.

[0576] Case 2:

[0577] When generating a NAS key, K AMFis the root key. If K AMF If the NAS key of each of the multiple NFs directly connected to the wireless access network device is updated, the NAS key of each NF must be updated. Accordingly, the terminal device must also update the NAS key corresponding to each of the multiple NFs. Figure 10 illustrates method 1000 proposed in this application. It is understood that, as an implementation, method 1000 can be performed based on method 400. Method 1000 includes the following steps.

[0578] S1001: When a preset condition is met, each NF among a plurality of NFs directly connected to a wireless access network device updates a NAS key.

[0579] Exemplarily, the NAS count of a certain NF (e.g., a first NF) among multiple NFs directly connected to a wireless access network device reaches a maximum value. If the first NF is not an anchor function, the first NF may send a NAS key update request message to the anchor function. Further, the anchor function may send a NAS key update request message to all other NFs among the multiple NFs except the first NF and the anchor function, thereby updating the NAS key of each of the multiple NFs directly connected to the wireless access network device. If the first NF is an anchor function, the first NF may send a NAS key update request message to all other NFs among the multiple NFs except the first NF, thereby updating the NAS key of each of the multiple NFs directly connected to the wireless access network device.

[0580] S1002: Multiple NFs directly connected to the wireless access network device send NAS key update success indication information to the anchor function. Correspondingly, the anchor function receives the NAS key update success indication information from the multiple NFs.

[0581] It is understandable that step S1002 is an optional step. As another approach, the anchor function may assume that all of the multiple NFs directly connected to the wireless access network device have successfully updated their corresponding NAS keys.

[0582] S1003: The anchor function determines that each of the multiple NFs directly connected to the wireless access network device has successfully updated the NAS key.

[0583] For example, multiple NFs directly connected to a wireless access network device include AMF, SMF, PCF, and LMF, and the anchor function is AMF. The AMF can determine that the AMF, SMF, PCF, and LMF have all successfully updated their corresponding NAS keys.

[0584] S1004: The anchor function sends message #N (ie, the fourth message) to the terminal device. Correspondingly, the terminal device receives message #N from the anchor function.

[0585] The message #N is used to instruct the terminal device to update the NAS key corresponding to each NF in multiple NFs directly connected to the wireless access network device. Exemplarily, the message #N can be a NAS message.

[0586] Alternatively, as a method, the anchor function may send a NAS message to the radio access network device. The NAS message includes information instructing the terminal device to update the NAS key corresponding to each of the multiple NFs. The radio access network device then sends the NAS message to the terminal device. That is, the NAS message is transparently transmitted at the radio access network device.

[0587] S1005: The terminal device updates the NAS key corresponding to each NF in multiple NFs directly connected to the wireless access network device according to message #N.

[0588] For example, multiple NFs directly connected to the wireless access network device include AMF, SMF, PCF, and LMF. The terminal device can update the NAS key corresponding to AMF, the NAS key corresponding to SMF, the NAS key corresponding to PCF, and the NAS key corresponding to LMF according to the message #N.

[0589] It is understood that while steps S1001 to S1005 described above are network-initiated unified NAS key updates, in another scenario, unified NAS key updates can also be initiated by a terminal device. For example, if the NAS count of a particular NF among multiple NFs directly connected to a wireless access network device reaches a maximum value, the terminal device updates the NAS key corresponding to each of the multiple NFs. Furthermore, the terminal device sends instruction information to the multiple NFs, causing each of the multiple NFs to update its corresponding NAS key. For example, the terminal device can directly send an instruction message to the multiple NFs. Alternatively, the terminal device can send an instruction message to an anchor function, and the anchor function can further instruct other CN NFs among the multiple NFs, excluding the anchor function, to update their NAS keys.

[0590] It is understandable that when the NAS count value reaches the maximum value, multiple NFs and terminal devices directly connected to the wireless access network device synchronously update the NAS key, which can avoid third-party attack replay and thus improve security.

[0591] Optionally, the method 1000 further includes S1006 to S1009.

[0592] S1006: The anchor function sends a message #P to multiple NFs and terminal devices directly connected to the wireless access network device. Correspondingly, the first NF and the terminal device receive the message #P.

[0593] The message #P is used to indicate that NAS message transmission is suspended during the NAS key update period.

[0594] S1007, multiple NFs and terminal devices directly connected to the wireless access network device suspend NAS message transmission during the NAS key update period according to message #P.

[0595] It is understandable that during the NAS key update, the old NAS key may become invalid, but the new NAS key has not yet been successfully activated. Therefore, during the NAS key update, multiple NFs and terminal devices directly connected to the wireless access network device can suspend NAS message transmission to reduce the probability of NAS message parsing errors.

[0596] S1008: The anchor function sends a message #Q to multiple NFs and terminal devices directly connected to the wireless access network device. Correspondingly, the first NF and the terminal device receive the message #Q.

[0597] This message #Q is used to indicate the resumption of NAS message transmission.

[0598] Regarding the triggering mechanism of the message #Q, please refer to S906.

[0599] S1009: Multiple NFs and terminal devices directly connected to the wireless access network device restart NAS message transmission according to message #Q.

[0600] Optionally, in some cases, the NF providing services to a terminal device may change, i.e., from a source NF to a target NF. Therefore, this application also proposes a NAS security mechanism for when a terminal device undergoes a handover. Figure 11 illustrates method 1100 proposed in this application. It is understood that, as an implementation, method 1100 can be performed based on method 400. Method 1100 includes the following steps.

[0601] S1101: A first NF sends a security context of a terminal device. Correspondingly, a first target NF receives the security context of the terminal device.

[0602] The security context includes the NAS count maintained by the first NF. Optionally, the security context also includes one or more of the PDU session identifier and the terminal device security capability information.

[0603] The following describes how the first target NF receives the security context.

[0604] Method 1:

[0605] The first NF sends the security context to the anchor function. Further, the anchor function sends the security context to the first target NF.

[0606] It can be understood that, in this mode 1, the first NF is not an anchor function, or in other words, the first NF is a non-anchor function.

[0607] For example, the first NF is the source SMF, the anchor function is the AMF, the first target NF is the target SMF, and the source SMF can send the security context to the target SMF through the AMF.

[0608] For another example, the first NF is the source PCF, the anchor function is the AMF, and the first target NF is the target PCF. The source PCF can send the security context to the target PCF through the AMF.

[0609] For another example, the first NF is the source LMF, the anchor function is the AMF, the first target NF is the target LMF, and the source LMF can send the security context to the target LMF through the AMF.

[0610] It can be understood that if the anchor function is also switched, that is, from the source anchor function to the target anchor function, the first NF can send the security context to the first target NF through the source anchor function (e.g., source AMF) and the target anchor function (e.g., target AMF).

[0611] Method 2:

[0612] The first NF sends the security context directly to the first target NF.

[0613] For example, the first NF is the source SMF, the first target NF is the target SMF, and the source SMF can directly send the security context to the target SMF.

[0614] For another example, the first NF is the source PCF, the first target NF is the target PCF, and the source PCF can directly send the security context to the target PCF.

[0615] For another example, the first NF is the source LMF, the first target NF is the target LMF, and the source LMF can directly send the security context to the target LMF.

[0616] For another example, the first NF is the source AMF, the first target NF is the target AMF, and the source AMF can send the security context directly to the target AMF.

[0617] Method 3:

[0618] Taking the anchor function as AMF as an example, AMF can also send the terminal device security capability information maintained by AMF to the first target NF.

[0619] For example, if the first target NF is the target SMF, the AMF may send the terminal device security capability information to the target SMF. For another example, if the first target NF is the target PCF, the AMF may send the terminal device security capability information to the target PCF. For another example, if the first target NF is the target LMF, the AMF may send the terminal device security capability information to the target LMF.

[0620] It can be understood that if the anchor point function is also switched, that is, from the source anchor point function to the target anchor point function, the source anchor point function (e.g., source AMF) can send the terminal device security capability information to the first target NF through the target anchor point function (e.g., target AMF).

[0621] S1102: The first target NF generates a NAS key according to the security context of the terminal device.

[0622] It is understandable that the first target NF may select a security algorithm according to the security capability information of the terminal device and generate a NAS key.

[0623] In addition, the first target NF may send information about the security algorithm selected by the first target NF to the terminal device. Exemplarily, the first target NF may send information about the security algorithm to the terminal device in the following ways.

[0624] Method 1:

[0625] The first target NF directly sends the security algorithm information to the terminal device.

[0626] Exemplarily, the first target NF sends a NAS message to the terminal device, where the NAS message includes information about the security algorithm.

[0627] Method 2:

[0628] The first target NF may send information about the security algorithm to the terminal device through an anchor function (e.g., AMF).

[0629] It can be understood that, in this mode 2, the first target NF is not an anchor function, or in other words, the first target NF is a non-anchor function.

[0630] For example, the first target NF is the target SMF, and the target SMF can send the identifier of the security algorithm selected by the target SMF to the terminal device through the AMF.

[0631] For example, the first target NF is the target LMF, and the target LMF can send the identifier of the security algorithm selected by the target LMF to the terminal device through the AMF.

[0632] For example, the first target NF is the target PCF, and the target PCF can send the identifier of the security algorithm selected by the target PCF to the terminal device through the AMF.

[0633] It can be understood that if the anchor point function is also switched, that is, from the source anchor point function to the target anchor point function, the first target NF can send security algorithm information to the terminal device through the target anchor point function (e.g., target AMF) and the source anchor point function (e.g., source AMF).

[0634] Method 3:

[0635] The first target NF may send information about the security algorithm to the terminal device through the first NF.

[0636] For example, the first target SMF may send information about the security algorithm to the terminal device through the first SMF.

[0637] Method 4:

[0638] The first target NF may send information about the security algorithm to the terminal device through the anchor function and the first NF.

[0639] It can be understood that, in this mode 4, the first target NF and the first NF are not anchor functions, or in other words, the first target NF and the first NF are non-anchor functions.

[0640] For example, the first target SMF can send security algorithm information to the terminal device through AMF and the first SMF.

[0641] According to an embodiment of the present application, a terminal device can switch from a source SMF to a target SMF, from a source LMF to a target LMF, from a source AMF to a target AMF, and from a source PCF to a target PCF. The source NF can send the security context of the terminal device to the target NF, thereby saving signaling overhead (for example, the terminal device no longer needs to send its own security capability information to the target NF), so that the target NF can generate a NAS key based on the security context of the terminal device and process NAS messages with the terminal device.

[0642] The above describes the method proposed in this application. FIG12 shows a communication device provided in an embodiment of this application, which includes a transceiver unit and a processing unit.

[0643] The transceiver unit can be used to implement corresponding information transmission and reception functions. The transceiver unit can also be called a communication interface or a communication unit. The processing unit can be used to perform processing operations.

[0644] Exemplarily, the device further includes a storage unit, which can be used to store instructions and / or data, and the processing unit can read the instructions and / or data in the storage unit so that the device implements the actions of the device in the aforementioned various method embodiments.

[0645] As an implementation method, the device can be the terminal device in the aforementioned embodiment, or a component (such as a chip) of the terminal device. Among them, the transceiver unit and the processing unit can be used to implement relevant operations of the terminal device.

[0646] For example, the transceiver unit may be configured to execute S401 , and the processing unit may be configured to execute S407 , S408 , S409 , and S410 .

[0647] For another example, the processing unit may be configured to execute S502 .

[0648] For another example, the processing unit may be configured to execute S602 .

[0649] For another example, the processing unit may be configured to execute S702 .

[0650] For another example, the processing unit may be configured to execute any one of S801 to S804.

[0651] For another example, the processing unit may be configured to execute S903 , S905 , and S907 .

[0652] For another example, the processing unit may be configured to execute S1005 , S1007 , and S1009 .

[0653] As another implementation, the device may be the first NF in the aforementioned embodiment, or a component (such as a chip) of the first NF. The transceiver unit and the processing unit may be used to implement related operations of the first NF.

[0654] For example, the transceiver unit may be configured to execute S403 , and the processing unit may be configured to execute S402 , S404 , S405 , and S406 .

[0655] For another example, the processing unit may be configured to execute S501.

[0656] For another example, the processing unit may be configured to execute S601.

[0657] For another example, the processing unit may be configured to execute S701.

[0658] For another example, the processing unit may be configured to execute any one of S801 to S804.

[0659] For another example, the processing unit may be configured to execute S901 , S905 , and S907 .

[0660] For another example, the processing unit may be configured to execute S1001 , S1007 , and S1009 .

[0661] It can be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0662] The transceiver unit can be replaced by a transceiver (for example, the sending unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as the processing unit, can be replaced by a processor to respectively perform the transceiver operations and related processing operations in each method embodiment.

[0663] In addition, the above-mentioned transceiver unit may also be a transceiver circuit (for example, may include a receiving circuit and a sending circuit), and the processing unit may be a processing circuit.

[0664] Figure 13 illustrates another communication device provided in an embodiment of the present application. The communication device includes a processor and a communication interface. The processor is configured to execute programs or instructions stored in a memory, or read data stored in a memory, to perform the relevant actions in the above method embodiments. For example, there may be one or more processors. The communication interface is configured to receive and / or transmit signals.

[0665] Exemplarily, the communication device may further include a memory for storing computer programs or instructions and / or data. The memory may be integrated with the processor or may be separately provided. Of course, the communication device may also not include the memory, and the memory may be provided externally to the communication device. Exemplarily, there may be one or more memories.

[0666] For example, the processor, communication interface, and memory are interconnected via a bus; the bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. These buses can be categorized as address buses, data buses, and control buses. For ease of illustration, FIG13 shows only one thick line, but this does not imply that there is only one bus or only one type of bus.

[0667] It is understood that the processor mentioned in the embodiments of the present application can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor can further include a hardware chip. The above-mentioned hardware chip can be an application specific integrated circuit (ASIC), a programmable logic device (PLD). The above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0668] It is also understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache.

[0669] It is understood that if the embodiments of the present application are implemented in the form of software and sold or used as an independent product, the corresponding program (also referred to as code or instructions) can be stored in a readable storage medium. Therefore, the present application also provides a readable storage medium including a program that, when executed on a device or computer, causes the device or computer to perform any possible implementation of the above-mentioned solution.

[0670] The readable storage media include: U disk, mobile hard disk, ROM, RAM, disk or CD and other media that can store program code.

[0671] The technical solution of the present application can be embodied in the form of a software product. Therefore, the present application also provides a program product, which includes: a program, which, when executed, enables a device or computer to execute any possible implementation of the above solution.

[0672] In addition, an embodiment of the present application further provides a chip system (or chip). The chip system includes a processor and an interface circuit, wherein the interface circuit is used to provide the processor with data, instructions, or information transmission and / or reception, and the processor is used to execute any possible implementation of the above solution.

[0673] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for processing a non-access layer NAS message, characterized in that: include: The terminal device generates multiple NAS keys, and at least two NAS keys of the multiple NAS keys are respectively associated with different NFs of the multiple network functions NFs; The terminal device processes NAS messages for communicating with the multiple NFs based on the multiple NAS keys.

2. The method according to claim 1, characterized in that The terminal device generates multiple NAS keys, including: The terminal device generates a first NAS key according to a type parameter of a first NF and / or an identifier of the first NF, an identifier of a security algorithm selected by the first NF, and a NAS count value of the first NF, wherein the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

3. The method according to claim 1, characterized in that The terminal device generates multiple NAS keys, including: The terminal device generates a first NAS key according to the type parameter of the first NF and / or the identifier of the first NF, the identifier of the security algorithm selected by the first NF, the NAS count value of the first NF, and the PDU session identifier, wherein the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

4. The method according to claim 1, characterized in that The terminal device generates multiple NAS keys, including: The terminal device generates a first NAS key according to the identifier of the security algorithm selected by the first NF, the NAS count value of the first NF, and the PDU session identifier, wherein the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

5. The method according to any one of claims 2 to 4, characterized in that: The NAS count value of the first NF starts counting from 0; or, The NAS count value of the first NF starts counting from the initial NAS count value of the anchor function.

6. The method according to any one of claims 1 to 5, characterized in that The terminal device generates multiple NAS keys, including: The terminal device generates the multiple NAS keys based on the NAS root key.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: When creating a NAS entity corresponding to the first NF, the terminal device activates the first NAS key; Alternatively, the terminal device receives the first message, and activates the first NAS key according to the first message; The first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: When suspending or deleting the NAS entity corresponding to the first NF, the terminal device deactivates the first NAS key; Alternatively, the terminal device receives the second message, and deactivates the first NAS key according to the second message; The first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: When the terminal device changes from the connected state to the idle state or the inactive state, the terminal device saves the security context of the first NF, where the security context of the first NF includes an identifier of the security algorithm selected by the first NF and a NAS count value of the first NF; When transitioning from the idle state or the inactive state to the connected state, the terminal device generates a first NAS key according to the security context of the first NF; The first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

10. The method according to any one of claims 1 to 8, characterized in that The method further comprises: When the terminal device changes from the connected state to the idle state or the inactive state, the terminal device does not save the security context of the first NF; When the terminal device enters the connected state from the idle state or the inactive state, the terminal device obtains the security context of the first NF from the second NF, and generates a first NAS key according to the security context of the first NF; The first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

11. The method according to any one of claims 1 to 8, characterized in that The method further comprises: When the terminal device changes from the connected state to the idle state or the inactive state, the terminal device does not save the NAS count value of the first NF; When transitioning from the idle state or the inactive state to the connected state, the terminal device generates a first NAS key; The NAS count value corresponding to the first NF starts counting from 0; or, the NAS count value corresponding to the first NF starts counting from the initial NAS count value of the anchor function; The first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys.

12. The method according to any one of claims 1 to 11, characterized in that The method further comprises: The terminal device receives a third message from a first NF, and updates a first NAS key according to the third message, where the first NF is one of the multiple NFs, and the first NAS key is one of the multiple NAS keys; or, The terminal device receives a fourth message from the anchor function, and updates the multiple NAS keys according to the fourth message.

13. A method for processing non-access layer NAS messages, characterized in that: include: The first network function NF generates a first NAS key; The first NF processes the NAS message between the terminal device based on the first NAS key, and the first NF is a non-anchor function.

14. The method according to claim 13, characterized in that The first NF generates a first NAS key, including: The first NF generates the first NAS key according to a type parameter of the first NF and / or an identifier of the first NF, an identifier of a security algorithm selected by the first NF, and a NAS count value maintained by the first NF.

15. The method according to claim 13, characterized in that The first NF generates a first NAS key, including: The first NF determines the type parameter of the first NF and / or the identifier of the first NF, the first NF The first NAS key is generated based on the identifier of the selected security algorithm, the NAS count value maintained by the first NF, and the PDU session identifier.

16. The method according to claim 13, characterized in that The first NF generates a first NAS key, including: The first NF generates the first NAS key according to the identifier of the security algorithm selected by the first NF, the NAS count value maintained by the first NF, and the PDU session identifier.

17. The method according to any one of claims 14 to 16, characterized in that: The NAS count value maintained by the first NF starts counting from 0; or, The NAS count value maintained by the first NF starts counting from the initial NAS count value of the anchor function.

18. The method according to any one of claims 13 to 17, characterized in that: The first NF generates a first NAS key, including: The first NF obtains the NAS root key from the anchor function; The first NF generates the first NAS key based on the NAS root key.

19. The method according to any one of claims 13 to 18, characterized in that: The method further comprises: When creating a NAS entity corresponding to the first NF, the first NF activates the first NAS key; Alternatively, the first NF receives the fifth message and activates the first NAS key according to the fifth message.

20. The method according to any one of claims 13 to 19, characterized in that The method further comprises: When suspending or deleting the NAS entity corresponding to the first NF, the first NF deactivates the first NAS key; Alternatively, the first NF receives the sixth message and deactivates the first NAS key according to the sixth message.

21. The method according to any one of claims 13 to 20, characterized in that The method further comprises: When the terminal device changes from a connected state to an idle state or an inactive state, the first NF saves a security context of the terminal device, where the security context of the terminal device includes an identifier of a security algorithm selected by the first NF, a NAS count value of the first NF, and an identifier of the terminal device; When the terminal device changes from the idle state or the inactive state to the connected state, the first NF generates the first NAS key according to the security context of the terminal device.

22. The method according to any one of claims 13 to 20, characterized in that The method further comprises: When the terminal device changes from a connected state to an idle state or an inactive state, the first NF does not save the security context of the terminal device; When the terminal device changes from the idle state or the inactive state to the connected state, the first NF obtains the security context of the terminal device from the second NF and generates the first NAS key according to the security context of the terminal device.

23. The method according to any one of claims 13 to 20, characterized in that The method further comprises: When the terminal device changes from a connected state to an idle state or an inactive state, the first NF does not save the NAS count value of the first NF; When the terminal device changes from the idle state or the inactive state to the connected state, the first NF generates the first NAS key; The NAS count value corresponding to the first NF starts from 0; or, The NAS count value corresponding to the first NF starts counting from the initial NAS count value of the anchor function.

24. The method according to any one of claims 13 to 23, characterized in that The method further comprises: When a preset condition is met, the first NF updates the first NAS key; The first NF sends a third message, where the third message is used to instruct the terminal device to update the first NAS key.

25. A method for processing non-access layer NAS messages, characterized in that: include: The terminal device generates a plurality of NAS keys, at least two of the plurality of NAS keys are respectively associated with different NFs in a plurality of network functions NFs, and the plurality of NAS keys include a first NAS key for a first NF, where the first NF is one of the plurality of NFs; A first NF generates a first NAS key, wherein the first NF is a non-anchor function; The terminal device processes a NAS message with the first NF based on the first NAS key generated by the terminal device; The first NF processes a NAS message between the first NF and the terminal device based on a first NAS key generated by the first NF.

26. A communication device, characterized in that: The method comprises a unit for executing any one of the methods of claims 1 to 12, or comprises a unit for executing any one of the methods of claims 13 to 24.

27. A communication device, characterized in that: include: A communication interface and a processor, wherein the processor is used to execute a computer program or instruction so that the communication device executes the method according to any one of claims 1 to 12, or the communication device executes the method according to any one of claims 13 to 24.

28. A communication system, characterized in that: The communication system includes a terminal device and a first NF; The terminal device is used to execute the method as described in any one of claims 1-12, and the first NF is used to execute the method as described in any one of claims 13-24.

29. A computer-readable storage medium, characterized in that: The method comprises a computer program or an instruction, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 12, or enables the computer to execute the method according to any one of claims 13 to 24.

30. A computer program product, characterized in that The method comprises instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 12, or cause the computer to execute the method according to any one of claims 13 to 24.

Images