Communication method, communication apparatus, medium, and program product

Abstract

Provided in the present disclosure are a communication method, a communication apparatus, a computer-readable storage medium, and a computer program product. The communication method comprises: a communication security apparatus obtaining a trusted service request for a terminal; the communication security apparatus determining a security algorithm for the trusted service request on the basis of a trusted policy; the communication security apparatus executing the security algorithm to obtain a trusted service execution result; and the communication security apparatus sending a trusted service response comprising the trusted service execution result. In this way, a security function can be effectively decoupled from a communication function, facilitating the independent evolution and flexible deployment of a security capability.

Description

Communication method, communication device, medium and program product Technical Field

[0001] Embodiments of the present disclosure relate to the field of communications, and more particularly, to a communication method, a communication device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Mobile communication networks typically consist of three components: the core network (CN), the radio access network (RAN), and user equipment (UE). User equipment belongs to and is directly controlled by the user, while the access network and core network belong to and are directly controlled by the operator. Before a user can access operator services and network resources, a negotiation between the user and the operator, known as authentication, is required to confirm the true identities of both parties.

[0003] Conventionally, authentication on the user device side is jointly implemented by the universal subscriber identity module (USIM) of the terminal device and the mobile equipment (ME). ME is mainly responsible for the communication module, and also supports the derivation and storage of some keys and the generation of authentication parameters. When the UE accesses the network, the derivation and storage of keys, and the generation of authentication parameters are jointly performed by the USIM and ME. It can be seen that security is set as a function of the UE and is tightly coupled with the communication function. Updating and upgrading the security function requires modifying the configuration of the USIM and ME, which is labor-intensive and complex to operate. At the same time, existing communication standards pay little attention to security, and only have encryption, integrity protection, authentication and authorization. If new security capabilities are needed, they rely on the voluntary design of operators and equipment manufacturers. The security protection level of some environments in the user device is weak, which makes the authentication process have a certain degree of risk.

[0004] Summary of the Invention

[0005] In view of this, embodiments of the present disclosure provide a communication method, a communication device, a computer-readable storage medium, and a computer program product for providing a trusted service.

[0006] In a first aspect, a communication method is provided. The method includes: a communication security device obtaining a trusted service request for a terminal; the communication security device determining a security algorithm for the trusted service request based on a trusted policy; the communication security device executing the security algorithm to obtain a trusted service execution result; and the communication security device transmitting a trusted service response including the trusted service execution result. In this manner, by providing a dedicated communication security device with a high security level to perform functions related to trusted services, the overall security level can be improved.

[0007] In some implementations of the first aspect, the trusted service request is received from a communication device of the terminal, and the trusted service response is sent to the communication device. In this way, when a communication security device independent of the communication device is provided, the communication device transceiver function can be used to communicate with other network nodes.

[0008] In some implementations of the first aspect, the trusted service request is obtained from a network device, and the terminal's communication device and communication security device are integrated. In this implementation, the communication security device operates at a different layer from the communication device, for example. In this manner, the communication device cannot parse or extract information sent to or from the communication security device, making it less likely that information will be leaked through the communication device.

[0009] In some implementations of the first aspect, obtaining and sending trusted service requests are performed in a trusted protocol layer. In this way, by setting up a dedicated trusted protocol layer, messages about trusted services can be prevented from being obtained by other components, thereby improving security.

[0010] In some implementations of the first aspect, executing a security algorithm includes: in response to determining that a trusted service request includes a set of authentication request parameters, the communication security device verifies at least one security parameter in the set of authentication parameters; and in response to successful verification, the trusted service execution result includes a first authentication response parameter, the first authentication response parameter is obtained by executing a first security algorithm in the security algorithm based on the set of authentication request parameters, or in response to failed verification, the trusted service execution result includes a verification failure indication.

[0011] In some implementations of the first aspect, executing the security algorithm includes: in response to determining that the trusted service request includes a set of authentication request parameters, the communication security device verifies at least one security parameter in the set of authentication parameters; in response to successful verification, the trusted service execution result includes a second authentication response parameter, the second authentication response parameter is obtained by executing a second security algorithm in the security algorithm based on the first authentication response parameter, and the first authentication response parameter is obtained by executing a first security algorithm in the security algorithm based on a set of authentication request parameters, or in response to verification failure, the trusted service execution result includes a verification failure indication.

[0012] In these implementations, the communication security device is independent of the communication device and replaces the identity recognition device to perform the verification of security parameters and the calculation of response parameters. In this way, by integrating the authentication service, the interaction of authentication information is reduced, thereby improving security.

[0013] In some implementations of the first aspect, the at least one security parameter includes at least one of the following: an authentication code or a serial number. In this way, the validity of the authentication parameter can be determined by verifying the authentication code and the serial number, further improving security.

[0014] In some implementations of the first aspect, executing the first security algorithm further includes: the communications security device obtaining a set of key parameters; and the communications security device executing the first security algorithm based on the set of key parameters and a set of authentication request parameters to obtain first authentication response parameters. In some alternative implementations, obtaining the set of key parameters includes: the communications security device sending a request for the set of key parameters to an identity recognition device; and the communications security device receiving the set of key parameters from the identity recognition device. In this way, obtaining the key enables generation of response parameters associated with the user equipment, facilitating subsequent authentication by other network nodes.

[0015] In some implementations of the first aspect, executing the security algorithm includes: in response to determining that the trusted service request includes a set of authentication request parameters, the communication security device sends the set of authentication request parameters to the identity recognition device; the communication security device receives a first authentication response parameter from the identity recognition device, the first authentication response parameter being determined by the identity recognition device based on the set of authentication request parameters; and the communication security device executes a second security algorithm in the security algorithm based on the first authentication response parameter to obtain a second authentication response parameter, wherein the trusted service execution result includes the second authentication response parameter. In this implementation, the authentication function of the identity recognition device remains unchanged. In this way, there is no need to change the settings of the traditional identity recognition device, thereby improving the applicability of the method.

[0016] In some implementations of the first aspect, the method further includes: in response to determining that the terminal includes multiple identity recognition devices, the communications security device selecting a target identity recognition device from the multiple identity recognition devices based on a predetermined configuration. In this implementation, the terminal may include different identity recognition devices from two different vendors. Through this selection, the authentication service can be completed using the appropriate identity recognition device.

[0017] In some implementations of the first aspect, selecting a target identity device includes: in response to determining that multiple identity devices are assigned corresponding priorities, the communication security device selecting the identity device with the highest priority among the multiple identity devices as the target identity device; in response to determining that multiple identity devices are not assigned priorities, the communication security device selecting the currently activated identity device as the target identity device, the activated identity device being currently providing a communication service; in response to determining that none of the multiple identity devices are providing a communication service, the communication security device presenting options for the multiple identity devices to a user; and in response to receiving a user selection, the communication security device selecting the identity device selected by the user as the target identity device. In this way, it is possible to identify a suitable identity device using different rules.

[0018] In some implementations of the first aspect, the trusted policy is negotiated between the communication security device and the network equipment. In this way, security can be further improved by negotiating with the communication security device instead of a communication device with a lower security level or other components of the terminal.

[0019] In some implementations of the first aspect, executing the security algorithm includes: in response to determining that the trusted service request includes challenge information for the trusted metric, the communications security device executing a third security algorithm in the security algorithm based on the challenge information to obtain evidence, and the trusted service execution result includes the evidence. In this manner, utilizing a dedicated communications security device to determine the security algorithm for the trusted metric can improve security associated with the trusted metric service.

[0020] In some implementations of the first aspect, executing the security algorithm includes: in response to determining that the trusted service request includes challenge information for a trusted metric, the communication security device sending the challenge information to a trusted device of the terminal; and the communication security device receiving evidence from the trusted device, the evidence generated by the trusted device based on the challenge information, the trusted service execution result including the evidence. In this manner, utilizing a dedicated communication security device to exchange information with the trusted device can improve security associated with the trusted metric service.

[0021] In some implementations of the first aspect, the trusted device is integrated into the communication security device. In some alternative implementations, the trusted device is integrated into the communication device or the identification device. In this way, by integrating devices that perform different trusted services, it is beneficial to protect security parameters from being leaked.

[0022] In some implementations of the first aspect, the method further includes: the communication security device signing the evidence, and the trusted service result includes the signature on the evidence. In this way, the security of the evidence is further improved through the secondary signature.

[0023] In a second aspect, a communication security device is provided. The communication security device includes: a transceiver module configured to obtain a trusted service request for a terminal; a processing module configured to determine a security algorithm for the trusted service request based on a trusted policy; the processing module further configured to execute the security algorithm to obtain a trusted service execution result; and the transceiver module further configured to send a trusted service response including the trusted service execution result.

[0024] In some implementations of the second aspect, the trusted service request is received from a communication device of the terminal, and the trusted service response is sent to the communication device.

[0025] In some implementations of the second aspect, the trusted service request is obtained from a network device, and the communication device and the communication security device of the terminal are integrated together.

[0026] In some implementations of the second aspect, obtaining and sending the trusted service request are performed at a trusted protocol layer.

[0027] In some implementations of the second aspect,

[0028] The processing module is specifically configured to: in response to determining that the trusted service request includes a set of authentication request parameters, verify at least one security parameter in a set of authentication parameters, and in response to successful verification, the trusted service execution result includes a first authentication response parameter, the first authentication response parameter is obtained by executing a first security algorithm in the security algorithm based on the set of authentication request parameters, or in response to failed verification, the trusted service execution result includes a verification failure indication.

[0029] In some implementations of the second aspect, the execution module includes: the processing module is specifically configured to: in response to determining that the trusted service request includes a set of authentication request parameters, verify at least one security parameter in a set of authentication parameters; in response to successful verification, the trusted service execution result includes a second authentication response parameter, the second authentication response parameter is obtained by executing a second security algorithm in the security algorithm based on the first authentication response parameter, and the first authentication response parameter is obtained by executing a first security algorithm in the security algorithm based on a set of authentication request parameters, or in response to verification failure, the trusted service execution result includes a verification failure indication.

[0030] In some implementations of the second aspect, the at least one security parameter includes at least one of the following: an authentication code or a serial number.

[0031] In some implementations of the second aspect, the transceiver module is specifically configured to obtain a set of key parameters; and the processing module is specifically configured to execute a first security algorithm based on a set of key parameters and a set of authentication request parameters to obtain a first authentication response parameter.

[0032] In some implementations of the second aspect, the transceiver module is specifically configured to: send a request for a set of key parameters to the identity recognition device; and receive a set of key parameters from the identity recognition device.

[0033] In some implementations of the second aspect, the transceiver module is specifically configured to: in response to determining that the trusted service request includes a set of authentication request parameters, send a set of authentication request parameters to the identity identification device; receive a first authentication response parameter from the identity identification device, the first authentication response parameter being determined by the identity identification device based on the set of authentication request parameters, and the processing module is specifically configured to execute a second security algorithm in the security algorithm based on the first authentication response parameter to obtain a second authentication response parameter, and the trusted service execution result includes the second authentication response parameter.

[0034] In some implementations of the second aspect, the trust policy is negotiated between the communication security device and the network device.

[0035] In some implementations of the second aspect, the processing module is further configured to: in response to determining that the terminal includes multiple identity recognition devices, select a target identity recognition device from the multiple identity recognition devices based on a predetermined configuration.

[0036] In some implementations of the second aspect, the processing module is specifically configured to: in response to determining that multiple identity identification devices are set with corresponding priorities, select the identity identification device with the highest priority among the multiple identity identification devices as the target identity identification device; in response to determining that multiple identity identification devices are not set with priorities, select the currently activated identity identification device as the target identity identification device, and the activated identity identification device is providing communication services; or in response to determining that none of the multiple identity identification devices provide communication services, present options for multiple identity identification devices to the user; and in response to receiving the user's selection, select the identity identification device selected by the user as the target identity identification device.

[0037] In some implementations of the second aspect, the processing module is further configured to: in response to determining that the trusted service request includes challenge information for the trust metric, execute a third security algorithm in the security algorithm based on the challenge information to obtain evidence, and the trusted service execution result includes the evidence.

[0038] In some implementations of the second aspect, the transceiver module is specifically configured to: in response to determining that the trusted service request includes challenge information for the trusted measurement, send challenge information to the trusted device of the user equipment; and receive evidence from the trusted device, the evidence being generated by the trusted device based on the challenge information, and the trusted service execution result including the evidence.

[0039] In some implementations of the second aspect, the trusted device is integrated into the communication security device.

[0040] In some implementations of the second aspect, the trusted device is integrated into a communication device or an identity recognition device.

[0041] In some implementations of the second aspect, the processing module is further configured to: sign the evidence, and the trusted service result includes the signature for the evidence.

[0042] In a third aspect, a communication device is provided, comprising a processor coupled to a memory, wherein the memory stores instructions that, when executed by the processor, cause a first communication device to perform any of the methods of the first aspect and its implementations.

[0043] In a fourth aspect, a computer-readable storage medium is provided, which stores instructions, which, when run, enable the method according to the first aspect or any implementation thereof to be executed.

[0044] In a fifth aspect, a computer program product is provided, wherein the computer program product includes instructions, which, when executed, enable the method according to the first aspect or any implementation thereof to be executed.

[0045] In a sixth aspect, a communication system is provided, which includes the communication device according to the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0047] FIG1A illustrates an example communication architecture scenario in which embodiments of the present disclosure may be implemented.

[0048] 1B to 1H illustrate simplified block diagrams of example terminal devices according to embodiments of the present disclosure.

[0049] FIG2 illustrates a signaling process for executing a trusted service according to an embodiment of the present disclosure.

[0050] FIG3 illustrates a signaling process for terminal authentication according to some embodiments of the present disclosure.

[0051] 4A and 4B illustrate a signaling process for terminal authentication according to other embodiments of the present disclosure.

[0052] 5A and 5B illustrate a signaling process for terminal authentication according to further embodiments of the present disclosure.

[0053] 6A and 6B illustrate a signaling process of a trust metric according to some embodiments of the present disclosure.

[0054] 7A and 7B illustrate a signaling process of a trust metric according to other embodiments of the present disclosure.

[0055] FIG8 shows a flowchart of a method according to an embodiment of the present disclosure.

[0056] FIG9 shows a simplified block diagram of an example device for one possible implementation of an embodiment of the present disclosure.

[0057] FIG10 shows a simplified block diagram of an example device for one possible implementation of an embodiment of the present disclosure.

[0058] Throughout the drawings, the same or similar reference numerals are used to designate the same or similar components. DETAILED DESCRIPTION

[0059] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain application embodiments are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0060] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to." The term "based on" should be understood as "based at least in part on." The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment." The terms "first," "second," etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0061] The embodiments of the present disclosure may be implemented according to any appropriate communication protocol, including but not limited to cellular communication protocols such as the fourth generation (4G), fifth generation (5G), and communication protocols evolved after 5G (e.g., the sixth generation (6G)), and / or any other protocol currently known or developed in the future.

[0062] The technical solutions of the embodiments of the present disclosure are applied to communication systems that follow any appropriate communication protocols, such as: Long Term Evolution (LTE) systems, Frequency Division Duplex (FDD) systems, Time Division Duplex (TDD) systems, 5G systems (e.g., New Radio (NR)) and communication systems evolved after 5G (e.g., 6G systems), etc.

[0063] For illustrative purposes, the following description of the embodiments of the present disclosure is based on the context of a cellular communication system in the 3rd Generation Partnership Project (3GPP). However, it should be understood that the embodiments of the present disclosure are not limited to this communication system, but can be applied to any communication system with similar problems, such as a wireless local area network (WLAN), a wired communication system, or other communication systems developed in the future.

[0064] The term "terminal device" as used in this disclosure refers to any device that can perform wired or wireless communication with network devices or with each other. A terminal or terminal device may sometimes be referred to as User Equipment (UE). A terminal device may be any type of mobile terminal, fixed terminal or portable terminal. A terminal device may be a variety of wireless communication devices with wireless communication capabilities. With the rise of Internet of Things (IoT) technology, more and more devices that did not previously have communication capabilities, such as but not limited to household appliances, vehicles, tools and equipment, service equipment and service facilities, have begun to obtain wireless communication capabilities by configuring wireless communication units, so that they can access wireless communication networks and accept remote control. Such devices have wireless communication capabilities because they are configured with wireless communication units, and therefore also fall into the category of wireless communication devices.As an example, the terminal device may include a mobile cellular phone, a cordless phone, a mobile terminal (MT), a mobile station, a mobile device, a wireless terminal, a handheld device, a client, a subscription station, a portable subscription station, an Internet node, a communicator, a desktop computer, a laptop computer, a notebook computer, a tablet computer, a personal communication system device, a personal navigation device, a personal digital assistant (PDA), a customer-premises equipment (CPE), a smart point of sale (POS) machine, a wireless data card, a wireless modem (Modulator demodulator, Modem), a positioning device, a radio broadcast receiver, an e-book device, a gaming device, an IoT device, an in-vehicle device, an aircraft, a virtual reality (VR) device, an augmented reality (AR) device, a wearable device (e.g., a smart watch, etc.), a terminal in device-to-device communication (D2D), a terminal in vehicle to everything (V2X), a wireless terminal in industrial control, a self-driving car, etc. The present invention also includes wireless terminals in the following aspects: wireless terminals in smart driving, wireless terminals in remote medical, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, terminal devices in 5G networks, any terminal devices in evolved public land mobile networks (PLMNs), other devices that can be used for communication, or any combination thereof. The embodiments of the present disclosure are not limited to this.

[0065] The term "network device" used in this disclosure is an entity or node that can be used to communicate with a terminal device, for example, an access network device. An access network device can be a device deployed in a wireless access network to provide wireless communication functions for a mobile terminal, for example, a node in a radio access network (RAN), which can also be called an access network device, or a RAN node (or device). The network device is used to help the terminal achieve wireless access. In one possible scenario, the network device can be a base station, an evolved NodeB (eNodeB), a transmitting and receiving point (TRP), a transmitting point (TP), a next generation NodeB (gNB), a next generation base station in a sixth generation (6G) mobile communication system, a base station in a future mobile communication system, a satellite, an integrated access and backhaul (IAB) node, a network device in a mobile switching center non-terrestrial network (NTN) communication system, that is, it can be deployed on a high-altitude platform or a satellite, etc. Depending on the size of the service coverage area provided, the access network equipment may include a macro base station providing a macro cell, a micro base station for providing a micro cell (Pico cell), a micro base station for providing a micro cell, and a femto base station for providing a femto cell. In some possible scenarios, the network equipment may also be a device that acts as a base station in device-to-device (D2D) communication, vehicle-to-vehicle communication, drone communication, and machine communication. Optionally, the network equipment may also be a server, a wearable device, a vehicle or an on-board device, etc. For example, the access network equipment in the vehicle to everything (V2X) technology may be a road side unit (RSU).

[0066] In another possible scenario, multiple network devices collaborate to assist the terminal in achieving wireless access, and different network devices respectively implement part of the functions of the base station. For example, the network device can be a centralized unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU can be set separately, or can also be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH). It can be understood that the network device can be a CU node, a DU node, or a device including a CU node and a DU node. In addition, the CU can be divided into a network device in the access network RAN, or the CU can be divided into a network device in the core network CN, which is not limited here.

[0067] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (Open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, this application uses CU, CU-CP, CU-UP, DU and RU as examples for description. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0068] For ease of description, in the subsequent embodiments of the present disclosure, the aforementioned devices providing wireless communication functions for mobile terminals are collectively referred to as network devices. The embodiments of the present disclosure do not limit the form of network devices. The device used to implement the functions of the network device can be a network device; it can also be a device that supports the network device in implementing the functions, such as a chip system. The device can be installed in the network device or used in conjunction with the network device.

[0069] As mentioned above, the USIM is a card with a higher security level than the mobile device. It stores the Subscription Permanent Identifier (SUBSCRIPT PMI) and the user's root key (K). Furthermore, the USIM supports the derivation of encryption and security keys from the root key, the generation of authentication parameters, and network authentication. The ME is primarily responsible for the communication module and also supports the derivation and storage of some keys and the generation of authentication parameters. When the UE accesses the network, the derivation and storage of keys and the generation of authentication parameters are jointly performed by the USIM and ME.

[0070] In the current setup, security services are configured as UE functions and are tightly coupled with communication functions. In this case, updating or upgrading security functions requires extensive and complex configuration changes to the USIM and ME. Furthermore, traditional communication standards have limited security features, covering only encryption, integrity protection, authentication, and authorization. If new security capabilities are needed, they rely solely on the independent design of operators or equipment manufacturers, resulting in a lack of a unified standard process for adding or deleting security features. Furthermore, security functions in the authentication process are dispersed between the ME and the USIM, requiring both to complete the authentication process. While the USIM provides a highly secure environment, the ME's security protection level is weaker, posing a significant security risk. The security and communication modules are coupled, lacking independent processing mechanisms.

[0071] In view of this, the embodiments disclosed in the present disclosure provide a mechanism for providing services associated with a variety of trusted security services using an independently set security module. In this mechanism, a dedicated security function module is deployed on the UE side to take over the security functions executed on the ME, which can effectively achieve the decoupling of security and communication, and is conducive to the independent evolution and flexible deployment of security capabilities. In addition, the dedicated security module can provide a variety of security algorithms such as encryption and authentication. As a result, users can select and configure them on demand, so that the dedicated security module helps to realize the service-oriented security function, and transforms the traditional process of the terminal calling the security function into the terminal requesting the security service from the security module, and the security module provides the security service, thereby realizing the standardization of the request and response process of the security service.

[0072] FIG1A illustrates an example communication architecture scenario 100 in which embodiments of the present disclosure may be implemented. In architecture scenario 100, there is a terminal device (UE) 110, a first network device 120, and a second network device 130. For example, the first network device 120 may be an access network device, and the second network device 130 may be a core network device. The terminal device 110 connects to the second network device 130 via the base station 120 and utilizes network services provided by the second network device 130. The terminal device 110 includes two identity recognition modules 111-1 and 111-2 (collectively referred to as identity recognition modules 111) for storing security authentication parameters. In one possible implementation, the identity module 111 may be a USIM, or any type of mobile phone card, such as a Subscriber Identity Module (SIM), an electronic SIM (eSIM), a virtual SIM (vSIM), a Universal Integrated Circuit Card (UICC), an eletronic UICC (eUICC), a soft SIM, etc. The terminal device 110 further includes a communication device 113 for communication functions, which may be, for example, an ME. The terminal device 110 also includes a dedicated security module for performing security functions, including a communication security device 112-1 deployed on the communication device 113, a communication security device 112-3 integrated on the identity recognition module 111-1, a communication security device 112-2 integrated on the identity recognition module 111-2, and a communication security device 112-4 independent of the terminal device 110 (collectively referred to as the communication security device 112-1, the communication security device 112-2, and the communication security device 112-3). In one possible implementation, the communication security device 112 can provide security functions of traditional 5G networks, such as security policy negotiation, authentication, encryption, and key management, as well as security functions that may be applied in future 6G. All security functions are provided to the identity recognition module 111 and the communication device 113 in the form of services. In one possible implementation, the communication security device 112 supports hot plugging and can be updated on demand, so that it can be easily updated and upgraded at any time thereafter.

[0073] In addition, terminal device 110 may also include a security module for executing trusted services, including a trusted device 114 deployed on communication device 113, a trusted device 114-3 integrated on identity recognition module 111-1, and a trusted device 114-2 integrated on identity recognition module 111-2 (collectively referred to as trusted device 114 together with trusted device 114-1 and trusted device 114-3). Trusted device 114 may, for example, provide a trusted measurement service.

[0074] By adding a communication security device 112 to the terminal device 110, an independent, flexible and scalable trusted functional service can be provided. Here, there are two ways to implement the communication security device 112: one is to appear as a logically independent node in physical or virtual form; the other is to appear as a logical function and be part of the UE. The communication security device 112 has a unified external interface (even as a logical function, it has a standardized interface for communication nodes), forming the basis for multi-party negotiation and trusted communication. Specifically, as shown in Figure 1A, the deployment of the communication security device 112 includes three possible solutions, namely, the communication security device 112-1 is combined with the communication device 113, the communication security device 112-2 is combined with the identity recognition module 111-2 or the communication security device 112-3 is combined with the identity recognition module 111-1, and the communication security device 112-4 is independent of the identity recognition module 111 and the communication device 113. The different architectures of the terminal device will be described in detail below in conjunction with Figures 1B to 1H.

[0075] Figure 1B illustrates the architecture of terminal device 110 corresponding to communication security device 112-2 or 112-3. As shown in Figure 1B, communication security device 112 is combined with an identity recognition device, thereby expanding the functionality of an identity recognition device, such as a mobile phone card, to support communication security device 112, thereby creating a new card type with more comprehensive functions and enhanced capabilities. The combination of communication security device 112 and identity recognition device may also involve virtualizing communication security device 112 into an application of an identity recognition device, such as a smart card, where the identity recognition device includes communication security device 112. Alternatively, the capabilities of the identity recognition device and stored information such as keys and user identities may be included in communication security device 112, where communication security device 112 includes the identity recognition device.

[0076] Figure 1C shows the architecture of the terminal device corresponding to the communication security device 112-1. As shown in Figure 1C, the communication security device 112 can be encapsulated within the communication device 113 and virtualized as a functional module within the communication device 113. Other components 115 in the communication device 113 (such as communication-related functions) can call the communication security device 112 and reuse the interface of the communication device 113 to communicate with the identity recognition module 111 and other nodes in the network. Here, the communication security device 112 can communicate with the corresponding security devices at other nodes through a dedicated trusted service layer.

[0077] Figure 1D shows the architecture of the terminal device corresponding to the communication security device 112-4. As shown in Figure 1D, the communication security device 112 is externally connected to the terminal in the form of an independent hardware card, such as connected to the terminal device 110 via a USB interface.

[0078] In addition, the trusted device 114 in the terminal device 110 can be arranged in a variety of ways. Figures 1E and 1F show the architecture of the terminal device 110 corresponding to the trusted device 114-1. As shown in Figure 1E, the trusted device 114 is deployed on the communication device 113. The trusted device 114 can be encapsulated within the communication device 113 and interact with other components 115 in the communication device 113 (such as communication-related functions). Figure 1F also shows the communication security device 112 deployed in the communication device 113.

[0079] Figures 1G and 1H illustrate the architecture of the terminal device 110 corresponding to trusted devices 114-2 and 114-3. As shown in Figure 1G, the trusted device 114 is combined with the identity recognition device 111. Both the trusted device 114 and the identity recognition device 111 are security-related dedicated hardware modules with high compatibility. By deploying the trusted device 114 on the identity recognition device 111, it is easier to isolate security functions from other communication functions, and the internal structure and interface of the terminal device 110 are simplified. Here, the communication security device 112 can be deployed on the communication device 113, or it can be independent of the communication device 113 and the identity recognition device 111. In addition, the communication security device 112 can also be integrated with the trusted device 114 and the identity recognition device 111, as shown in Figure 1H.

[0080] After the terminal device 110 is newly equipped with a communication security device 112, the trusted service process on the terminal side requires three entities to complete: the communication security device 112, the communication device 113, and the identity recognition device 111. In one possible implementation, the communication device 113 can receive a trusted service request from other nodes outside the terminal device 110 (such as an authentication request from the core network to the terminal device), or the communication device 113 can itself generate a trusted service request (such as a UE initiating a security policy negotiation process with the core network). Afterwards, the communication device 113 sends the trusted service request to the communication security device 112. In one possible implementation, the trusted service request can be sent in the form of a standardized message. In an alternative embodiment, if the communication security device 112 is deployed in the communication device 113, the communication security device 112 can also be called in the form of a command. There are two solutions for the identity recognition device 111. In one possible implementation, the identity recognition device 111 continues to provide the original security functions without modification. In this case, the communication security device 112 only takes over the functions of the communication device 113. In an alternative embodiment, identity recognition device 111 serves only as a storage for security parameters such as keys and user identity information and no longer supports security algorithms. In this case, communication security device 112 takes over the security functions of both communication device 113 and identity recognition device 111. In one possible implementation, communication security device 112 can perform security functions including those originally provided by communication device 113 and identity recognition device 111, as well as additional security functions such as trusted proof and blockchain. The following generally describes the process of executing trusted service functions with reference to Figure 2.

[0081] FIG2 illustrates a signaling process 200 for executing a trusted service according to some embodiments of the present disclosure. For clarity and without limitation, the signaling process 200 will be described in conjunction with FIG1A. The signaling process 200 may be executed, for example, by the identity recognition devices 111-1 and 111-2, the communication security device 112, the communication device 113, and the second network device 130 in FIG1A. In the embodiment shown in FIG2,

[0082] When the operator wants to authenticate the terminal device 110, the second network device 130 sends (202) a trusted service request 205 to the terminal. The trusted service request 205 is received by the communication device 113 of the terminal device 110. In a possible implementation, the trusted service request may also be generated by the communication device 113.

[0083] In one possible implementation, the message of the trusted service request 205 includes one or more of the following: a core network identity, a requested trusted service name, and possible authentication parameters. For example, in the authentication process of the Authentication and Key Agreement (AKA), the authentication parameter may be an authentication vector (AV), and the AV may include a random number (RAND) and an authentication token (AUTN). Exemplarily, the authentication parameter also includes a first security parameter for verification before performing the calculation. Exemplarily, in the authentication process of AKA, the first security parameter may be a message authentication code (MAC) and a sequence number (SQN) in AUTN.

[0084] After receiving the trusted service request 205, the communication device 113 does not process the trusted service request 205, but forwards (204) the trusted service request to the communication security device 112. In one possible implementation, the transmission of the trusted service request can be performed at a trusted protocol layer and can only be parsed by the communication security device 112. Here, the trusted protocol layer is, for example, above the packet data convergence protocol layer.

[0085] After receiving the trusted service request 205, the communication security device 112 determines (208) the security algorithm to be used based on the trusted service request and the trusted policy. In one possible implementation, the trusted policy can be determined by negotiation between the communication security device 112 and the second network device 130 before the trusted service process. The specific security algorithm used by the trusted service is determined by the trusted policy obtained through the trusted negotiation. For example, the trusted policy specifies the specific security algorithm to be called and the security parameters as input to the security algorithm. The security algorithm may include one or more of the following: an authentication algorithm, an encryption algorithm, and an integrity protection algorithm. For example, the authentication algorithm may include: Authentication and Key Agreement Protocol AKA, or Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA), etc.; the encryption algorithm or integrity protection algorithm may include the SNOW algorithm, the ZUC algorithm, etc.

[0086] Here, compared to the related art where the communication device negotiates with the core network, the communication security device 112 replaces the terminal device to negotiate the trusted policy, thereby improving security. In one possible implementation, the trusted policy can also specify traditional 5G security algorithms such as authentication algorithms and encryption algorithms, as well as trusted proofs such as trusted metrics for Trusted Platform Modules (TPMs), Software Guard Extensions (SGX) algorithms, and new encryption algorithms, such as post-quantum cryptography (PQC) and homomorphic encryption, which are new 6G security algorithms.

[0087] In one possible implementation, if the security parameters for the security algorithm determined by the communication security device 112 include second security parameters stored in the identification device 111, then the communication security device 112 sends (210) a request 215 for the second security parameters to the identification device 111. Exemplarily, the second security parameters may be key parameters stored in the identification device 111. Here, the key parameters may be, for example, an operator-specific root key or generated based on the root key. In one possible implementation, during the AKA authentication process, the second security parameters may be an integrity key (IK) and a cipher key (CK). After the identification device 111 receives (212) the request 215 for the second security parameters from the communication security device 112, the identification device 111 sends (214) the second security parameters 225 to the communication security device 112 in response. After obtaining the first security parameters and possibly the second security parameters, the communication security device 112 executes (218) the corresponding security algorithm to obtain a corresponding trusted service execution result. After completing the security algorithm, the communication security device 112 generates a trusted service response including the trusted service execution result. The trusted service execution result may include, for example, a success indication, a failure indication, or a response parameter. Exemplarily, the response parameter is, for example, a first authentication response parameter. The first authentication response parameter (response, RES) is generated on the identity authentication device side of the terminal according to a predetermined algorithm based on the input security parameters, and is used to compare with the expected authentication parameter (expected response, XRES) generated on the network device side, and XRES is generated with the same input parameters and the same algorithm. In one possible implementation, the response parameter may also be a second authentication response parameter RES* generated on the communication device side of the terminal based on the first authentication response parameter RES, which is used to authenticate with different network elements on the network device side.

[0088] The communication security device 112 sends (220) a trusted service response message to the communication device 113, and accordingly, the communication device 113 receives and forwards (222) the trusted service response message to the requesting node (eg, the second network device 130).

[0089] To more clearly describe the embodiments of the present disclosure, the embodiments of the present disclosure are described below with reference to Figures 3 to 7B. Figures 3 to 5B respectively illustrate the authentication process for a terminal according to different embodiments of the present disclosure. Figures 6A to 7B respectively illustrate the interaction process for trust measurement according to different embodiments of the present disclosure.

[0090] Figure 3 illustrates a signaling process 300 for terminal authentication according to some embodiments of the present disclosure. For clarity and without limitation, signaling process 300 will be described in conjunction with Figure 1A. Signaling process 300 can, for example, be performed by the identity recognition device 111-1, identity recognition device 111-2, communications security device 112, communications device 113, and second network device 130 in Figure 1A. In this embodiment, communications security device 112 is integrated into identity recognition device 111-1 to form an identity recognition device with dedicated security functions, such as a USIM with dedicated security functions. Here, communications security device 112 represents the device formed by the combination of communications security device 112 and identity recognition device 111-1. In this embodiment, communications security device 112 retains existing security functions, such as verifying the AUTN, derivation of keys, and generation of response parameters during the authentication process. Communications security device 112 performs the existing security functions of communications device 113 as well as newly added security functions, such as generation of authentication response parameters and addition of trusted proofs by communications device 113 during the authentication process.

[0091] As shown in Figure 3, when the second network device 130 needs to authenticate the terminal device 110, the second network device 130 sends (302) an authentication service request 305 to the terminal device 110. After receiving the authentication service request 305, the communication device 113 forwards the authentication service request 305 message for the terminal to the communication security device 112. The message carries authentication parameters. For example, in the AKA authentication process, the authentication parameters can be RAND and AUTN.

[0092] In one possible implementation, the terminal may include multiple identity recognition devices, for example, the terminal in the embodiment of Figure 1A includes two identity recognition devices 111-1 and 111-2. In such an implementation, after the communication security device 112 receives (306) the authentication service request 305, the communication security device 112 selects the identity recognition device 111-1 or the identity recognition device 111-2 to perform the authentication service, for example, through pre-configured rules. In one possible implementation, each identity recognition device is equipped with a corresponding communication security device, so that the corresponding identity recognition device will be selected after the communication security device receives the authentication service request. In some other embodiments, multiple identity recognition devices share one communication security device. The communication security device can store multiple profiles and provide different security functions based on the profiles.

[0093] In one possible implementation, if the communications security device 112 determines that multiple identity recognition devices are assigned corresponding priorities, the communications security device may select the identity recognition device with the highest priority among the multiple identity recognition devices as the target identity recognition device based on preset priority rules. If the communications security device 112 determines that multiple identity recognition devices are not assigned corresponding priorities, in one possible implementation, the communications security device 112 may select the currently active identity recognition device as the target identity recognition device based on preset service rules. Here, an active identity recognition device is one that is currently providing communication services. Communication services may include data services and voice services. If the communications security device 112 determines that none of the multiple identity recognition devices are providing communication services, the communications security device presents options for the user to select from the multiple identity recognition devices and, upon receiving the user's selection, selects the selected identity recognition device as the target identity recognition device. It should be understood that the above steps are merely exemplary, and while the execution of the various rules is related, they may also be independent.

[0094] For example, in an example where a terminal device includes two identity recognition devices implemented as USIM cards, the communication security device can perform the function of selecting an identity recognition device such as a USIM card based on the following configuration rules: (1) If the terminal device is set with a main card and a secondary card, the communication security device will interact with the main card first; (2) If the terminal does not have a main card, the communication security device will select the currently activated card to provide it with trusted services. The active card refers to the card currently in use, such as a card that is in a call or using data services; (3) If the terminal has no main card and no active card, the communication security device will select the default card to provide it with trusted services. The default card is the default card set by the user; (4) If none of the above conditions are met, the user is prompted to manually select a card through the human-computer interaction interface.

[0095] In the embodiment shown in FIG3 , communication security device 112 is integrated with identification device 111-1 and is considered to be associated. Therefore, communication security device 112 selects identification device 111-1 to perform authentication functions. Communication security device 112 parses the trusted service request and determines (308) the authentication algorithm to use based on the trusted policy. After determining the authentication algorithm, communication security device 112 verifies (310) at least one first security parameter among the authentication parameters, such as the MAC and SQN in the AKA authentication process.

[0096] The communications security device verifying the authentication parameters may include: the communications security device 112 comparing the received MAC with a pre-stored MAC. If the two are identical, the MAC verification is determined to be successful. After the MAC verification is successful, the communications security device 112 also verifies the SQN. The communications security device 112 compares the received SQN with a preset SQN range to verify the freshness of the AUTN. If the communications security device 112 determines that the SQN is within the preset range, the SQN authentication is determined to be successful. After the SQN verification is successful, the communications security device 112 determines that the AUTN verification is successful. If either the MAC or the SQN fails to verify during the verification process, the communications security device 112 determines that the AUTN verification has failed and generates a failure indication.

[0097] After the first security parameter is verified, the communication security device 112 calls the authentication algorithm, calculates (312) and generates an authentication response parameter. In one possible implementation, the input of the authentication algorithm is, for example, the received authentication parameter and the possible second security parameter stored in the self-identification device 111. Exemplarily, the input can be AUTN and RAND in the AKA authentication process and K, IK, CK from the identification device 111. At the same time, the response parameter can be, for example, the first response parameter RES. The communication security device 112 generates an authentication service response 335 carrying the authentication response parameter and sends (314) the authentication service response 335 to the communication device 113. After receiving the authentication service response 335, the communication device 113 forwards (316) the authentication service response 335 to the second network device 130. The second network device 130 receives (318) the authentication service response 335 to confirm the authentication result.

[0098] In this embodiment, by providing a dedicated communication security module, security functions are made independent, enhancing the importance of security within the communication network and facilitating the service-oriented nature of security functions, which is conducive to the upgrade and evolution of security functions. Specifically, this embodiment separates the security functions of communication device 113 from those of communication device 113, eliminating the need to process security parameters or execute security algorithms. In traditional communication networks, identity recognition device 111 possesses a higher security level, while communication device 113 primarily handles communication functions, has a lower security level, and is vulnerable to attacks. Therefore, while identity recognition device 111 can perform security functions without issue, communication device 113 performs security functions without risk. In the solution presented in this embodiment, security parameters are processed exclusively by communication security device 112. As a security module, communication security device 112 possesses a higher security level than communication device 113 (the security module's own protection measures enable physical security isolation), thus protecting security parameters from leakage.

[0099] Furthermore, as a security module, communication security device 112 shares similar functionality with identity recognition device 111. The integration of communication security device 112 and identity recognition device 111 expands the functionality of identity recognition device 111, enabling it to support not only existing authentication capabilities but also trusted policy negotiation and potentially new security features such as trusted metrics, making it a more powerful and comprehensive security hardware module, such as a secure smart card.

[0100] Figure 4A illustrates a signaling process 400A for terminal authentication according to yet other embodiments of the present disclosure. For clarity and without limitation, signaling process 400 will be described in conjunction with Figure 1A. Signaling process 400A can, for example, be performed by the identity recognition devices 111-1 and 111-2, the communication security device 112, the communication device 113, and the second network device 130 in Figure 1A. In this embodiment, the communication security device 112 is combined with the communication device 113. In this case, the communication device 113 is responsible for receiving and sending messages; the communication security device 112, as an internal function of the communication device 113, accepts calls from the communication device 113 and is responsible for performing security functions; the identity recognition device 111 may retain its original security functions (for example, verifying AUTN and generating RES during the AKA authentication process), or it may simply serve as a module that provides the keys required for authentication (for example, K, IK, CK during the AKA authentication process), while the communication security device 112 performs the security functions.

[0101] As shown in FIG4A , the second network device 130 sends ( 402 ) an authentication service request 405 carrying authentication parameters to the communication device 113. After the communication device 113 receives ( 404 ) the authentication service request 405 , the communication device 113 uses the authentication service request 405 as an input parameter and calls the communication security device 112. The communication security device 112 parses the trusted service request and determines ( 406 ) the authentication algorithm to be used based on the trusted policy.

[0102] In one possible implementation, the messages communicated between second network device 130 and communications security device 112 may be encrypted. The transmission of the feasible service request is performed, for example, at a trusted service layer. In such an embodiment, communications device 113 cannot recognize the content of the authentication service request message and, therefore, cannot extract the authentication parameters carried in the message. Therefore, the authentication parameters can only be recognized and extracted by communications security device 112.

[0103] The communication security device 112 selects the identification device 111-1 to perform the authentication function based on, for example, the preset rules described above. Thereafter, the communication security device 112 sends (408) authentication parameters 415 to the identification device 111-1 via the communication device 113 at the trusted service layer. After the identification device 111-1 receives the security parameters 415, the identification device 111-1 verifies (412) at least one first security parameter in the authentication parameters 415 (e.g., MAC and SQN in the AKA authentication process), and if the first security parameter verification is successful, invokes the authentication algorithm and calculates (414) a first response parameter (e.g., RES in the AKAK authentication process).

[0104] The identification device 111 sends (416) a response message 425 to the communication device 113. In one possible implementation, the identification device 111 may also generate a second security parameter. In this case, the response message 425 carries the response parameter and the second security parameter. For example, the second security parameter may be the key parameter IK, CK in the AKA authentication process. After the communication device 113 receives (418) the response message 425, the response parameter and the possible second security parameter in the response message 425 are input to the communication security device 112. Finally, the communication security device 112 generates a second response parameter (e.g., RES* in the AKAK authentication process) based on the response parameter and the possible second security parameter. The communication device 113 packages the authentication service response 435 into an authentication service message and sends (422) the authentication service response 435 to the second network device 130. The second network device 130 receives (424) the authentication service response 435 to confirm the authentication result.

[0105] Figure 4B shows a signaling process 400B for terminal authentication according to some other embodiments of the present disclosure. For the sake of clarity and without any limitation, the signaling process 400B will be described in conjunction with Figure 1A. The signaling process 400B can, for example, be performed by the identity recognition devices 111-1 and 111-2, the communication security device 112, the communication device 113, and the second network device 130 in Figure 1A. In this embodiment, the communication security device 112 is combined with the communication device 113. At this time, the communication device 113 is responsible for receiving / sending messages; the communication security device 112, as an internal function of the communication device 113, accepts the call of the communication device 113 and is responsible for performing security functions; the identity recognition device 111 only serves as a module that provides the key required for authentication, and the communication security device 112 performs the security function.

[0106] As shown in Figure 4B, the second network device 130 sends (432) an authentication service request 445 carrying input authentication parameters to the communication device 113. After the communication device 113 receives (434) the authentication service request 445 from the second network device 130, the communication device 113 uses the authentication service request 405 as an input parameter and calls the communication security device 112. The communication security device 112 parses the trusted service request and determines (436) the security algorithm to be used based on the trusted policy. Similarly, the message communicated between the second network device 130 and the communication security device 112 can be encrypted and transmitted in the trusted service layer. The communication device 113 cannot recognize the content in the authentication service request message, and therefore cannot extract the authentication parameters carried in the message, so that the authentication parameters can only be recognized and extracted by the communication security device 112.

[0107] Afterwards, the communication security device 112 verifies (438) at least one first security parameter in the authentication parameters, and if the first security parameter verification is successful, sends (440) a request 455 for a second security parameter to the identity recognition device 111-1. Here, the communication security device 112 selects the identity recognition device 111-1 to perform the authentication function, for example, based on the above-mentioned rules. After the identity recognition device 111-1 receives (442) the request 455 for the second security parameter from the communication security device 112, the identity recognition device 111-1 sends (444) a second security parameter 465 to the communication device 113. For example, the second security parameter 465 may include K, IK, and CK in the AKA authentication process. After the communication device 113 receives (446) the second security parameter 465, the communication device 113 inputs the second security parameter 465 as a parameter to the communication security device 112. The communication security device 112 calls the authentication algorithm, calculates (448) a response parameter (e.g., the first response parameter RES in the AKA authentication process) based on the obtained second security parameter and the received authentication parameter, and returns it to the communication device 113. The communication device 113 packages the authentication service response 475 into an authentication service message and sends (450) the authentication service response 475 to the second network device 130. The second network device 130 receives (452) the authentication service response 435 from the communication device 113 to confirm the authentication result.

[0108] In such an embodiment, although the communication security device 112 is combined with the communication device 113 as a logical functional module, the communication between the communication security device 112 and the second network device is performed at the trusted service layer, and the security messages and parameters are still unknown to the communication device 113. In this way, the separation of the security function of the communication device 113 is achieved, which is conducive to protecting the security parameters from being leaked. In addition, the embodiment in which the function of the identity recognition device 111 remains unchanged is suitable for the evolution stage from 5G to 6G. In contrast, in the solution of reducing the security function of the identity recognition device 111, the identity recognition device 111 only stores the key and identity information, and the communication security device 112 performs all security functions, realizing the separation of security execution and secure storage, which is conducive to the independent evolution of security functions.

[0109] Figure 5A shows a signaling process 500A for terminal authentication according to some other embodiments of the present disclosure. For the sake of clarity and without any limitation, the signaling process 500A will be described in conjunction with Figure 1A. The signaling process 500A can, for example, be performed by the identity recognition devices 111-1 and 111-2, the communication security device 112, the communication device 113, and the second network device 130 in Figure 1A. Here, the communication security device 112 is independent of the communication device 113 and the identity recognition device 111. At this time, the communication device 113 is responsible for receiving / sending messages; the communication security device 112 is responsible for performing security functions; and the identity recognition device 111 retains the original security functions (for example, verifying AUTN and generating RES during the AKA authentication process).

[0110] As shown in Figure 5A, the second network device 130 sends (504) an authentication service request 505 to the communication device 113. At this time, the authentication service request 505 includes authentication parameters. After receiving the authentication service request 505, the communication device 113 forwards (504) the authentication service request 505 to the communication security device 112. After receiving (506) the authentication service request 505, the communication security device 112 parses the trusted service request and determines (508) the authentication algorithm to be used based on the trusted policy. In this embodiment, the communication security device 112 selects the identity recognition device 111-1 to perform the authentication function according to the above rules. The communication security device 112 sends (510) a message including authentication parameters 515 (such as AUTN and RAND in the AKA authentication process) to the identity recognition device 111-1. The identity recognition device 111-1 verifies (514) at least one first security parameter in the authentication parameters and calculates (516) a first response parameter (such as RES in the AKA authentication process) after the first security parameter verification is successful. Subsequently, the identity recognition device 111-1 sends (518) a response message 525 to the communication security device 112. For example, the response message 525 may include a second security parameter and a first response parameter. After receiving (520) the response message 525, the communication security device 112 generates (522) a second response parameter. For example, the communication security device 112 generates the second response parameter based on the second security parameter and the first response parameter according to the determined security algorithm. The communication security device 112 sends (524) an authentication service response 535 carrying the second response parameter to the communication device 113. Thereafter, the communication device 113 forwards (526) the authentication service response 535 to the second network device 130. The second network device 130 receives (528) the authentication service response 535 from the communication device 113 to confirm the authentication result.

[0111] Figure 5B shows a signaling process 500B for terminal authentication according to some other embodiments of the present disclosure. For the sake of clarity and without any limitation, the signaling process 500B will be described in conjunction with Figure 1A. The signaling process 500B can, for example, be performed by the identity recognition devices 111-1 and 111-2, the communication security device 112, the communication device 113, and the second network device 130 in Figure 1A. Here, the communication security device 112 is independent of the communication device 113 and the identity recognition device 111. At this time, the communication device 113 is responsible for receiving / sending messages; the communication security device 112 is responsible for performing security functions; the identity recognition device 111 merely serves as a module for providing the key required for authentication, and the communication security device 112 performs the security function.

[0112] As shown in FIG5B , the second network device 130 sends (534) an authentication service request 545 to the communication device 113. At this time, the authentication service request 545 includes authentication parameters (e.g., AUTN and RAND in the AKA authentication process). After receiving the authentication service request 545, the communication device 113 forwards (534) the authentication service request 545 to the communication security device 112. After receiving (536) the authentication service request 545, the communication security device 112 parses the trusted service request and determines (538) the authentication algorithm to be used based on the trusted policy. The communication security device 112 verifies (540) at least one first security parameter in the authentication parameters and, after the first security parameter is verified, sends a request 555 for a second security parameter to the identity recognition device 111-1. After receiving (544) the request 555 for the second security parameter, the identity recognition device 111-1 sends (546) the second security parameter 565 to the communication security device 112. After receiving (548) the second security parameter 565, the communication security device 112 calculates (550) the response parameter. Subsequently, the communication security device 112 generates (552) an authentication service response 575 based on the response parameter and sends (554) the authentication service response 575 to the communication device 113. The communication device 113 then forwards (556) the authentication service response 575 to the second network device 130. The second network device 130 receives (558) the authentication service response 575 from the communication device 113 to confirm the authentication result.

[0113] In addition to authentication services, trusted services also involve trusted measurement technology. In trusted measurement technology, the entities involved in trusted measurement are divided into attesters and verifiers. When the verifier needs to obtain the trusted status of the attester, the verifier sends a challenge value to the attester. The attester generates trusted measurement evidence based on the challenge value and returns it. The verifier verifies the trusted measurement evidence and determines whether the attester is trustworthy based on the verification result. Conventional trusted measurement technologies can be divided into TPM (Trusted Platform Module), SGX, etc. TPM is a dedicated hardware module responsible for executing the trusted measurement process. Specifically, the attester's TPM is responsible for generating evidence and signing it, and the verifier's TPM verifies the signature and verifies the evidence. The following will take TPM technology as an example to describe the trusted measurement service in detail with reference to Figures 6A to 7B.

[0114] Figure 6A shows a signaling process 600A for performing trust measurement according to some embodiments of the present disclosure. For the sake of clarity and without any limitation, the signaling process 600A will be described in conjunction with Figure 1A. The signaling process 600A can be performed, for example, by the trusted device 114, the communication security device 112, the communication device 113 and the second network device 130 in Figure 1A. Here, the trusted device 114 is deployed on the communication device 113. The function of the trusted device 114 is to perform trust measurement on the terminal device 110 and generate evidence. Therefore, being deployed on the communication device 113 can more efficiently and conveniently realize data interaction between the trusted device 114 and the terminal device, reducing data transmission overhead. The communication security device 112 may be combined with the identity recognition device 111, or it may be independent of the communication device 113 and the identity recognition device 111.

[0115] As shown in Figure 6A, the second network device 130, as a verifier, sends (602) a trusted measurement service request 605 including challenge information to the terminal device 110. Here, the challenge information can be a challenge request, and the challenge request can include a random number and a platform configuration register (PCR) index. After receiving the trusted measurement service request 605, the communication device 113 forwards (604) the trusted measurement service request 605 to the communication security device 112. After receiving (606) the trusted measurement service request 605, the communication security device 112 parses the trusted service request and determines (608) that the device to perform the trusted measurement service is the trusted device 114 based on the trusted policy. Afterwards, the communication security device 112 sends (610) challenge information 615 to the communication device 113. After receiving (612) the challenge information 615, the communication device 113 inputs the challenge information 615 to the trusted device 114. The trusted device 114 generates (614) evidence based on the challenge information and signs it. Here, the evidence is, for example, an integrity indicator for the corresponding platform configuration register generated based on a random number in the challenge information. The trusted device 114 sends (616) the generated evidence and the trusted device signature 625 to the communication security device 112 via the communication device 113. In one possible implementation, after receiving (618) the evidence and the trusted device signature 625, the communication security device 112 may sign (620) the evidence. Thereafter, the communication security device 112 generates a trusted measurement service response 635 and sends it (622) to the communication device 113. Here, the trusted measurement service response 635 includes the evidence, the trusted device signature, and optionally may also include the communication security device signature. After receiving the trusted measurement service response 635, the communication device 113 forwards (624) it to the verifier second network device 130. The second network device 130 receives (626) the trusted measurement service response 635 from the communication device 113 to determine the trusted measurement service result.

[0116] Figure 6B illustrates a signaling process 600B for performing trust metrics according to some embodiments of the present disclosure. For clarity and without limitation, signaling process 600B will be described in conjunction with Figure 1A. Signaling process 600B may, for example, be performed by trusted device 114, communications security device 112, communications device 113, and second network device 130 in Figure 1A. Here, trusted device 114 and communications security device 112 are deployed together on communications device 113.

[0117] As shown in Figure 6B, the second network device 130, as a verifier, sends (632) a trusted metric service request 645 including challenge information to the terminal device 110. After receiving (634) the trusted metric service request 645, the communication device 113 forwards the trusted metric service request 645 to the communication security device 112. After receiving the trusted metric service request 645, the communication security device 112 parses the trusted metric service request and determines (636) that the device to perform the trusted metric service is the trusted device 114 based on the trusted policy. Thereafter, the trusted device 114 generates (638) evidence based on the challenge information and signs it. In one possible implementation, the communication security device 112 can sign (640) the evidence. Thereafter, the communication security device 112 generates a trusted metric service response 655 and sends (642) the evidence to the verifier second network device 130 through the communication device 113. Here, the trusted metric service response 655 includes evidence, a trusted device signature, and optionally may also include a communication security device signature. Second network device 130 receives ( 644 ) a trust metric service response 655 from communication apparatus 113 to determine a trust metric service result.

[0118] In such an embodiment, communication device 113 cannot directly call the trust metric module. Instead, communication security device 112 is responsible for determining the trust metric algorithm to use and then calling trusted device 114, providing secure and reliable input and output guarantees for trusted device 114. During the execution of the trust metric service, the challenge information is invisible to communication device 113, thereby preventing parameter leakage.

[0119] Figure 7A illustrates a signaling process 700A for executing a trust measurement according to some embodiments of the present disclosure. For clarity and without limitation, the signaling process 700A will be described in conjunction with Figure 1A. The signaling process 700A can, for example, be executed by the trusted device 114, the communication security device 112, the communication device 113, and the second network device 130 in Figure 1A. Here, the trusted device 114 is combined with the identity recognition device 111, for example, to form a smart card having both a trust measurement function and an identity recognition device function. In this embodiment, the trusted device 114 represents the device after the trusted device 114 and the identity recognition device 111 are combined.

[0120] As shown in Figure 7A, the second network device 130, as a verifier, sends (702) a trusted measurement service request 705 including challenge information to the terminal device 110. After receiving the trusted measurement service request 705, the communication device 113 forwards (704) the trusted measurement service request 705 to the communication security device 112. After receiving (706) the trusted measurement service request 705, the communication security device 112 parses the trusted measurement service request 705 and determines (708) that the device to perform the trusted measurement service is the trusted device 114 based on the trusted policy. Afterwards, the communication security device 112 sends (710) a challenge message 715 to the trusted device 114. After receiving (712) the challenge message 715, the trusted device 114 generates (714) evidence based on the challenge information and signs it. The trusted device 114 sends (716) the generated evidence and the trusted device signature 725 to the communication security device 112. In one possible implementation, after receiving (718) the evidence and the trusted device signature 625, the communication security device 112 may sign (720) the evidence. Thereafter, the communication security device 112 generates a trusted metric service response 735 and sends (722) the trusted metric service response 735 to the communication device 113. Here, the trusted metric service response 735 includes the evidence, the trusted device signature, and optionally the communication security device signature. After receiving the trusted metric service response 735, the communication device 113 forwards (724) the trusted metric service response 735 to the verifier second network device 130. The second network device 130 receives (726) the trusted metric service response 735 from the communication device 113 to determine the trusted metric service result.

[0121] In this embodiment, both the trusted device 114 and the identification device 111 are dedicated security-related hardware modules, which are highly feasible to combine. Combining the trusted device 114 with the identification device 111 can more easily isolate security functions from other communication functions and simplify the internal structure and interface of the terminal device.

[0122] Figure 7B shows a signaling process 700B for executing a trust measurement according to some embodiments of the present disclosure. For clarity of description without any limitation, the signaling process 700B will be described in conjunction with Figure 1A. The signaling process 700B can, for example, be executed by the trusted device 114, the communication security device 112, the communication device 113, and the second network device 130 in Figure 1A. Here, the trusted device 114, the communication security device 112, and the identity recognition device 111 are combined to form, for example, a smart card having a trust measurement function, a security function, and an identity recognition device function. In this embodiment, the communication security device 112 is used to represent the device after the trusted device 114, the communication security device 112, and the identity recognition device 111 are combined.

[0123] As shown in FIG7B , the second network device 130, as a verifier, sends (732) a trusted metric service request 745 including challenge information to the terminal device 110. After receiving the trusted metric service request 745, the communication device 113 forwards (734) the trusted metric service request 745 to the communication security device 112. After receiving (736) the trusted metric service request 745, the communication security device 112 parses the trusted service request and determines (738) the algorithm to execute the trusted metric service based on the trusted policy. Thereafter, the communication security device 112 generates (740) evidence based on the challenge information and signs it to obtain a trusted device signature. In one possible implementation, the communication security device 112 may also sign (742) the evidence twice to obtain a communication security device signature. Thereafter, the communication security device 112 generates a trusted metric service response 755 and sends (744) the trusted metric service response 755 to the communication device 113. Here, the trusted metric service response 755 includes evidence, a trusted device signature, and may also include a communication security device signature. After receiving the trust metric service response 755, the communication apparatus 113 forwards 746 the trust metric service response 755 to the verifier second network device 130. The second network device 130 receives 748 the trust metric service response 755 from the communication apparatus 113 to determine the trust metric service result.

[0124] In such an embodiment, devices with related installation functions are highly integrated, which simplifies the interaction process and further avoids information leakage.

[0125] Figure 8 shows a flowchart of a method 800 implemented at a terminal device according to an embodiment of the present disclosure. In one possible implementation, method 800 can be implemented by the communication security device 112 in the example communication architecture scenario 100. In other possible implementations, method 800 can also be implemented by other electronic devices independent of the example communication architecture scenario 100. As an example, the following description of method 800 will be based on the example of implementation by the communication security device 112 in the example communication architecture scenario 100.

[0126] As shown in Figure 8, at 810, the communication security device 112 obtains a trusted service request for the terminal 110; at 820, the communication security device 112 determines a security algorithm for the trusted service request based on the trusted policy; at 830, the communication security device 112 executes the security algorithm to obtain a trusted service execution result; and at 840, the communication security device 112 sends a trusted service response including the trusted service execution result.

[0127] Figures 9 and 10 are schematic diagrams of possible communication devices provided by embodiments of the present disclosure. These communication devices can implement the functions of the terminal device or network device in the above-mentioned method embodiments, and thus can also achieve the beneficial effects of the above-mentioned method embodiments. In the embodiments of the present disclosure, the communication device can be the terminal device 110 shown in Figure 1A, or a module (such as a chip) applied to these devices.

[0128] As shown in Figure 9, a communication device 900 includes a transceiver module 901 and a processing module 902. The communication device 900 can be used to implement the functions of a terminal device or network device in the method embodiment shown in Figure 8. It should be understood that the transceiver module 901 can be an interface for communicating with other devices in accordance with the corresponding protocol.

[0129] When the communication apparatus 900 is used to implement the functions of the terminal device 110 in the method embodiment described in FIG8 : the transceiver module 901 is used to obtain a trusted service request for the terminal, and to send a trusted service response including a trusted service execution result.

[0130] When the communication device 900 is used to implement the function of the second network device 120 in the method embodiment of Figure 2: the transceiver module 901 is used to determine the security algorithm for the trusted service request based on the trusted policy and to execute the security algorithm to obtain the trusted service execution result.

[0131] For a more detailed description of the above-mentioned transceiver module 901 and the processing module 902, please refer to the relevant description in the above-mentioned method embodiment, which will not be described again here.

[0132] As shown in Figure 10, communication device 1000 includes a processor 1010 and an interface circuit 1020. Processor 1010 and interface circuit 1020 are coupled to each other. It will be appreciated that interface circuit 1020 may be a transceiver or an input / output interface. Optionally, communication device 1000 may further include a memory 1030 for storing instructions executed by processor 1010, input data required by processor 1010 to execute instructions, or data generated by processor 1010 after executing instructions.

[0133] When the communication device 1000 is used to implement the method in the above method embodiment, the processor 1010 is used to execute the functions of the above processing module 902 , and the interface circuit 1020 is used to execute the functions of the above transceiver module 901 .

[0134] When the communication device is a chip used in a terminal device, the terminal device chip implements the functions of the terminal device in the above method embodiments. The terminal device chip receives information from other modules in the terminal device (such as a radio frequency module or antenna), and the information is sent by the network device to the terminal device; or the terminal device chip sends information to other modules in the terminal device (such as a radio frequency module or antenna), and the information is sent by the terminal device to the network device.

[0135] When the communication device is a chip used in a network device, the network device chip implements the network device functions of the above method embodiments. The network device chip receives information from other modules in the network device (such as a radio frequency module or antenna), and the information is sent by the terminal device to the network device; or the network device chip sends information to other modules in the network device (such as a radio frequency module or antenna), and the information is sent by the network device to the terminal device.

[0136] It is understood that the processor in the embodiments of the present disclosure may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0137] The embodiment of the present disclosure also provides a chip, which may include an input interface, an output interface, and a processing circuit. In the embodiment of the application, the input interface and the output interface may complete the interaction of signaling or data, and the processing circuit may complete the generation and processing of signaling or data information. Exemplarily, the chip of the communication security device 112 may obtain a trusted service request for a terminal. The chip of the communication security device 112 may determine a security algorithm for the trusted service request based on a trusted policy. The chip of the communication security device 112 may execute a security algorithm to obtain a trusted service execution result. The chip of the communication security device 112 may send a trusted service response including the trusted service execution result.

[0138] The present disclosure also provides a chip system, including a processor for supporting a computing device to implement the functions described in any of the above embodiments. In one possible design, the chip system may also include a memory for storing necessary program instructions and data. When the processor executes the program instructions, the device in which the chip system is installed implements the method described in any of the above embodiments. For example, the chip system may be composed of one or more chips, or may include chips and other discrete devices.

[0139] An embodiment of the present disclosure further provides a processor for coupling with a memory, wherein the memory stores instructions. When the processor runs the instructions, the processor executes the methods and functions involved in any of the above embodiments.

[0140] The embodiments of the present disclosure also provide a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the methods and functions involved in any of the above embodiments.

[0141] The embodiments of the present disclosure further provide a computer-readable storage medium having computer instructions stored thereon. When a processor executes the instructions, the processor executes the methods and functions involved in any of the above embodiments.

[0142] In general, the various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representation, it should be understood that the blocks, devices, systems, techniques, or methods described herein may be implemented as, by way of non-limiting example, hardware, software, firmware, dedicated circuits or logic, general-purpose hardware or a controller or other computing device, or some combination thereof.

[0143] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which are executed in a device on a real or virtual processor of a target to perform the process / method as described above with reference to the accompanying drawings. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or divided between program modules as needed. The machine-executable instructions for the program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0144] The computer program for realizing the method of the present disclosure can be written in one or more programming languages. These computer programs can be provided to the processor of general-purpose computer, special-purpose computer or other programmable data processing device, so that when the program code is executed by the computer or other programmable data processing device, the function / operation specified in the flow chart and / or block diagram is implemented. The program code can be executed completely on the computer, partially on the computer, as an independent software package, partially on the computer and partially on a remote computer or completely on a remote computer or server.

[0145] In the context of the present disclosure, a computer program or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like. Examples of signals may include electrical, optical, radio, acoustic, or other forms of propagated signals, such as carrier waves, infrared signals, and the like.

[0146] A computer-readable medium may be any tangible medium that contains or stores a program for or relating to an instruction execution system, apparatus, or device. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of computer-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random-access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0147] In addition, although the operations of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that these operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can change the order of execution. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps. It should also be noted that the features and functions of two or more devices according to the present disclosure can be embodied in one device. Conversely, the features and functions of a device described above can be further divided into being embodied by multiple devices.

[0148] While various implementations of the present disclosure have been described above, the above descriptions are exemplary, non-exhaustive, and not intended to limit the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described implementations. The terminology used herein is selected to provide a good explanation of the principles, practical applications, or improvements to existing technologies, or to enable other persons skilled in the art to understand the various implementations disclosed herein.

Claims

1. A communication method, comprising: The communication security device obtains a trusted service request for the terminal; The communication security device determines a security algorithm for the trusted service request based on a trusted policy; The communication security device executes the security algorithm to obtain a trusted service execution result; as well as The communication security device sends a trusted service response including the trusted service execution result.

2. The method according to claim 1, wherein The trusted service request is received from a communication device of the terminal, and the trusted service response is sent to the communication device. 3 . The method according to claim 1 , wherein the trusted service request is obtained from a network device, and the communication device of the terminal and the communication security device are integrated together. 4 . The method according to claim 1 , wherein obtaining and sending the trusted service request is performed at a trusted protocol layer.

5. The method according to any one of claims 1 to 4, wherein executing the security algorithm comprises: In response to determining that the trusted service request includes a set of authentication request parameters, the communications security device verifies at least one security parameter in the set of authentication parameters; as well as In response to the verification being successful, the trusted service execution result includes a first authentication response parameter, where the first authentication response parameter is obtained by executing a first security algorithm in the security algorithms based on the set of authentication request parameters, or In response to the verification failure, the trusted service execution result includes a verification failure indication.

6. The method of claim 3, wherein executing the security algorithm comprises: In response to determining that the trusted service request includes a set of authentication request parameters, the communications security device verifies at least one security parameter in the set of authentication parameters; In response to the verification being successful, the trusted service execution result includes a second authentication response parameter, where the second authentication response parameter is obtained by executing a second security algorithm in the security algorithm based on the first authentication response parameter, where the first authentication response parameter is obtained by executing a first security algorithm in the security algorithm based on the set of authentication request parameters, or In response to the verification failure, the trusted service execution result includes a verification failure indication.

7. The method according to claim 5 or 6, wherein the at least one security parameter comprises at least one of the following: an authentication code or a serial number.

8. The method of claim 5, wherein executing the first security algorithm further comprises: The communication security device obtains a set of key parameters; as well as The communication security device executes the first security algorithm based on the set of key parameters and the set of authentication request parameters to obtain the first authentication response parameter.

9. The method according to claim 8, wherein obtaining the set of key parameters comprises: The communication security device sends a request for the set of key parameters to the identity recognition device; as well as The communication security device receives the set of key parameters from the identification device.

10. The method according to any one of claims 1 to 9, wherein executing the security algorithm comprises: In response to determining that the trusted service request includes a set of authentication request parameters, the communication security device sends the set of authentication request parameters to the identity recognition device; The communication security device receives a first authentication response parameter from the identity recognition device, the first authentication response parameter being determined by the identity recognition device based on the set of authentication request parameters; as well as The communication security device executes a second security algorithm among the security algorithms based on the first authentication response parameter to obtain a second authentication response parameter, and the trusted service execution result includes the second authentication response parameter.

11. The method according to claim 9 or 10, further comprising: In response to determining that the terminal includes a plurality of identity recognition devices, the communication security device selects a target identity recognition device from the plurality of identity recognition devices based on a predetermined configuration.

12. The method of claim 11, wherein selecting the target identification device comprises: In response to determining that the plurality of identity recognition devices are set with corresponding priorities, the communication security device selects an identity recognition device having a highest priority among the plurality of identity recognition devices as the target identity recognition device; In response to determining that the plurality of identity recognition devices are not prioritized, the communication security device selects a currently activated identity recognition device as the target identity recognition device, the activated identity recognition device being providing a communication service; In response to determining that none of the plurality of identification devices provides the communication service, the communication security device presents options for the plurality of identification devices to a user; as well as In response to receiving the user's selection, the communication security device selects the identification device selected by the user as the target identification device.

13. The method according to any one of claims 1-12, wherein the trusted policy is negotiated between the communication security device and a network device.

14. The method according to any one of claims 1 to 13, wherein executing the security algorithm comprises: In response to determining that the trusted service request includes challenge information for a trust metric, the communication security device executes a third security algorithm among the security algorithms based on the challenge information to obtain a proof, and the trusted service execution result includes the proof.

15. The method according to any one of claims 1 to 13, wherein executing the security algorithm comprises: In response to determining that the trusted service request includes challenge information for a trusted metric, the communication security device sends the challenge information to a trusted device of the terminal; as well as The communication security device receives evidence from the trusted device, where the evidence is generated by the trusted device based on the challenge information, and the trusted service execution result includes the evidence. The method according to claim 14 , wherein the trusted device is integrated into the communication security device. The method according to claim 15 , wherein the trusted device is integrated into the communication device or the identification device.

18. The method according to claim 14 or 15, further comprising: The communication security device signs the evidence, and the trusted service result includes the signature for the evidence.

19. A communication security device, characterized in that: include: A transceiver module is configured to obtain a trusted service request for a terminal; A processing module, configured to determine a security algorithm for the trusted service request based on a trusted policy; The processing module is further configured to execute the security algorithm to obtain a trusted service execution result; as well as The transceiver module is further configured to send a trusted service response including the trusted service execution result.

20. The communication security device according to claim 19, wherein The trusted service request is received from a communication device of the terminal, and the trusted service response is sent to the communication device.

21. The communication security device according to claim 19, wherein the trusted service request is obtained from a network device, and the communication device and the communication security device of the terminal are integrated together.

22. The communication security device according to any one of claims 19 to 21, wherein obtaining and sending the trusted service request is performed in a trusted protocol layer.

23. The communication security device according to claim 20, wherein the processing module is specifically configured to: responsive to determining that the trusted service request includes a set of authentication request parameters, verifying at least one security parameter in the set of authentication parameters, and In response to the verification being successful, the trusted service execution result includes a first authentication response parameter, where the first authentication response parameter is obtained by executing a first security algorithm in the security algorithms based on the set of authentication request parameters, or In response to the verification failure, the trusted service execution result includes a verification failure indication.

24. The communication security device according to claim 21, wherein the processing module is specifically configured to: In response to determining that the trusted service request includes a set of authentication request parameters, verifying at least one security parameter in the set of authentication parameters; In response to the verification being successful, the trusted service execution result includes a second authentication response parameter, where the second authentication response parameter is obtained by executing a second security algorithm in the security algorithm based on the first authentication response parameter, where the first authentication response parameter is obtained by executing a first security algorithm in the security algorithm based on the set of authentication request parameters, or In response to the verification failure, the trusted service execution result includes a verification failure indication.

25. The communication security device according to claim 23 or 24, wherein the at least one security parameter comprises at least one of the following: an authentication code or a serial number.

26. The communication security device according to claim 23, wherein The transceiver module is specifically configured to obtain a set of key parameters; and The processing module is specifically configured to execute the first security algorithm based on the set of key parameters and the set of authentication request parameters to obtain the first authentication response parameter.

27. The communication security device according to claim 24, wherein the transceiver module is specifically configured as: sending a request for the set of key parameters to the identification device; and The set of key parameters is received from the identification device.

28. The communication security device according to any one of claims 19 to 27, wherein the transceiver module is specifically configured to: in response to determining that the trusted service request includes a set of authentication request parameters, send the set of authentication request parameters to the identity recognition device; receiving a first authentication response parameter from the identification device, the first authentication response parameter being determined by the identification device based on the set of authentication request parameters, and The processing module is specifically configured to execute a second security algorithm among the security algorithms based on the first authentication response parameter to obtain a second authentication response parameter, and the trusted service execution result includes the second authentication response parameter.

29. The communication security device according to any one of claims 17 to 28, wherein the trusted policy is negotiated between the communication security device and a network device.

30. The communication security device according to claim 28 or 29, wherein the processing module is further configured to: In response to determining that the terminal includes a plurality of identification devices, a target identification device is selected from the plurality of identification devices based on a predetermined configuration.

31. The communication security device according to claim 30, wherein the processing module is specifically configured to: In response to determining that the plurality of identity recognition devices are set with corresponding priorities, selecting an identity recognition device with a highest priority among the plurality of identity recognition devices as the target identity recognition device; In response to determining that the plurality of identity recognition devices are not prioritized, selecting a currently activated identity recognition device as the target identity recognition device, the activated identity recognition device being providing a communication service; or In response to determining that none of the plurality of identification devices provides the communication service, presenting options for the plurality of identification devices to a user; as well as In response to receiving the user's selection, the identity recognition device selected by the user is selected as the target identity recognition device.

32. The communication security device according to any one of claims 17 to 31, wherein the processing module is further configured to: In response to determining that the trusted service request includes challenge information for a trust metric, a third security algorithm among the security algorithms is executed based on the challenge information to obtain evidence, and the trusted service execution result includes the evidence.

33. The communication security device according to any one of claims 17 to 31, wherein the transceiver module is specifically configured as: In response to determining that the trusted service request includes challenge information for a trusted metric, sending the challenge information to a trusted device of the user equipment; and A proof is received from the trusted device, where the proof is generated by the trusted device based on the challenge information, and the trusted service execution result includes the proof.

34. The communication security device according to claim 33, wherein the trusted device is integrated in the communication security device.

35. The communication security device according to claim 34, wherein the trusted device is integrated into the communication device or the identity recognition device.

36. The communication security device according to claim 34 or 35, wherein the processing module is further configured to: The evidence is signed, and the trusted service result includes the signature for the evidence.

37. A communication security device, comprising a processor, wherein the processor is coupled to a memory, wherein the memory stores instructions, and when the instructions are executed by the processor, the communication security device executes the method according to any one of claims 1 to 18.

38. A computer-readable storage medium storing instructions, which, when executed, cause the method of any one of claims 1 to 18 to be executed.

39. A computer program product comprising instructions which, when executed, cause the method of any one of claims 1 to 18 to be performed.

40. A terminal device, characterized in that: Comprising a communication security device according to claim 37.

Images