Key updating method, communication apparatus, and storage medium

Abstract

Disclosed are a key updating method, a communication apparatus, and a storage medium. The key updating method comprises: receiving a key request message sent by an application function (AF) network element, the key request message being used for requesting an AKMA application key; in response to the key request message, triggering primary authentication of a terminal; when the primary authentication is successful, deriving the AKMA application key on the basis of a new AKMA key; and sending a first key response message to the AF network element, the first key response message comprising the AKMA application key.

Description

Key updating method, communication device, and storage medium

[0001] This disclosure claims priority to Chinese patent application No. 202310984666.4, filed on August 4, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present disclosure relates to the field of communication network technology, and in particular to a key updating method, a communication device, and a storage medium. Background Art

[0003] According to the 3rd Generation Partnership Project (3GPP) Technical Specification (TS) 33.535, during the authentication and key management for applications (AKMA) process, when the AKMA application key (K AF When the service life of the AF expires, the application function (AF) network element can deny the user equipment or terminal (UE) access to the AF or update the K AF If the AF network element decides to AF If the UE still accepts access to the AF after the expiration, the AF network element needs to request a new K by sending a key request message to the AKMA anchor function (AAnF) network element. AF The AAnF network element needs to request the unified data management function (UDM) network element to trigger the master authentication to obtain the AKMA key (K AKMA ), and according to K AKMA Derive new K AF .

[0004] Summary of the Invention

[0005] In one aspect, a key update method is provided, which is applied to AAnF. The key update method includes:

[0006] Receive a key request message sent by an application function AF network element, where the key request message is used to request an AKMA application key;

[0007] In response to the key request message, triggering primary authentication of the terminal;

[0008] If the primary authentication succeeds, the AKMA application key is derived based on the new AKMA key;

[0009] A first key response message is sent to the AF network element, where the first key response message includes the AKMA application key.

[0010] On the other hand, a key updating device is provided, which is applied to AAnF. The key updating device includes:

[0011] A communication module, configured to receive a key request message sent by an application function AF network element, wherein the key request message is used to request an AKMA application key;

[0012] an authentication module, configured to trigger a primary authentication of the terminal in response to the key request message;

[0013] A generation module, configured to derive an AKMA application key based on the new AKMA key if the primary authentication succeeds;

[0014] The communication module is further configured to send a first key response message to the AF network element, where the first key response message includes the AKMA application key.

[0015] On the other hand, a communication device is provided, comprising: a memory and a processor; the memory and the processor are coupled; the memory is used to store a computer program; and the processor implements the key update method described in the above aspects when executing the computer program.

[0016] In another aspect, a computer-readable storage medium is provided, wherein computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are executed by a processor, the key updating method described in the above aspect is implemented.

[0017] In yet another aspect, a computer program product is provided, including computer program instructions, which implement the key updating method described in the above aspect when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] To more clearly illustrate the technical solutions of the present disclosure, the following briefly introduces the drawings required for use in some embodiments of the present disclosure. Obviously, the drawings described below are only drawings of some embodiments of the present disclosure, and those skilled in the art can also derive other drawings based on these drawings.

[0019] FIG1 is a schematic diagram of an AKMA architecture according to some embodiments of the present disclosure.

[0020] FIG2 is a schematic diagram of a key derivation hierarchy according to some embodiments of the present disclosure.

[0021] FIG3 is a flowchart of a key updating method according to some embodiments of the present disclosure.

[0022] FIG4 is a flowchart of another key updating method according to some embodiments of the present disclosure.

[0023] FIG5 is a flowchart of another key updating method according to some embodiments of the present disclosure.

[0024] FIG6 is a flowchart of another key updating method according to some embodiments of the present disclosure.

[0025] FIG7 is a flowchart of another key updating method according to some embodiments of the present disclosure.

[0026] FIG8 is a schematic structural diagram of a key updating device according to some embodiments of the present disclosure.

[0027] FIG9 is a schematic structural diagram of a communication device according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0028] To help those skilled in the art better understand the technical solutions of the embodiments of the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the drawings in the present disclosure. Obviously, the embodiments described are only some of the embodiments of the present disclosure, not all of them. Based on the embodiments of the present disclosure, all other embodiments obtained by those of ordinary skill in the art without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0029] It should be noted that in this disclosure, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this disclosure as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0030] In the following, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the technical features being referred to. Therefore, a feature defined with the terms "first," "second," etc., may explicitly or implicitly include one or more of such features.

[0031] In the description of this disclosure, unless otherwise specified, " / " means "or." For example, A / B can mean A or B. "And / or" herein is merely a description of an association relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: only A, only B, and both A and B. Furthermore, "at least one" means one or more, and "a plurality" means two or more.

[0032] The technical solutions in the embodiments of the present disclosure will be described below with reference to the accompanying drawings in the embodiments of the present disclosure.

[0033] Refer to Figure 1, which is a network architecture diagram involved in the key update method provided in the embodiment of the present disclosure. As shown in Figure 1, the network architecture includes: terminal equipment, radio access network (RAN) or access network (AN) (hereinafter RAN and AN are collectively referred to as (R)AN) and core network. The core network includes multiple core network elements (or network function network elements), such as: access and mobility management function (AMF) network element, application layer function (AF) network element, authentication server function (AUSF) network element, unified data management (UDM) network element, network exposure function (NEF) network element and AAnF network element. In addition, the core network may also include some other network elements not shown, such as session management function (SMF) network element, policy control function (PCF) network element and user plane function (UPF) network element, etc., which are not described in detail in the embodiment of the present disclosure.

[0034] The terminal device communicates with the AMF network element through the next generation network (Next generation, N) 1 interface (referred to as N1), the RAN device communicates with the AMF network element through the N2 interface (referred to as N2), and the terminal device communicates with the AF network element through the reference point Ua*.

[0035] Control plane network elements such as AMF, UDM, AUSF, AAnF, NEF, and AF can also interact using service-based interfaces. For example, as shown in Figure 1, the service-based interface provided by the AMF network element can be Namf; the service-based interface provided by the UDM network element can be Nudm; the service-based interface provided by the AUSF network element can be Nausf; the service-based interface provided by the AAnF network element can be Naanf; the service-based interface provided by the NEF can be Nnef; and the service-based interface provided by the AF network element can be Naf. These will not be described one by one here.

[0036] It should be noted that the core network element may have other names, and the embodiments of the present disclosure are not limited thereto. For example, the AMF network element may also be referred to as AMF, the UPF network element may also be referred to as UPF, and so on.

[0037] The AMF network element is mainly responsible for mobility management processing, such as access control, mobility management, attachment and detachment functions.

[0038] The UDM network element is mainly used to manage user contract data and authentication data, as well as perform authentication credit processing, user identification processing, access authorization, registration / mobility management, subscription management and short message management.

[0039] The AUSF network element is used to provide authentication services for terminal devices for the AMF network element, and to provide security protection for data sent to terminal devices by some network elements (such as UDM).

[0040] The NEF network element is used to securely expose the services and capabilities provided by the 3GPP network to external networks.

[0041] The AF network element is used to provide services and routing information to other network elements in the network.

[0042] The AAnF network element is used to generate an AKMA application key (for example, the AKMA application key may be referred to as K) used between the UE and the AF. AF ).

[0043] The (R)AN can be composed of (R)AN devices. (R)AN devices can be various types of base stations, such as macro base stations, micro base stations (also known as "small cells"), and distributed unit-control units (DU-CUs). A DU-CU is a device deployed in a radio access network that can wirelessly communicate with terminal devices. Furthermore, the base stations can also be wireless controllers in cloud radio access network (CRAN) scenarios, relay stations, access points, vehicle-mounted devices, wearable devices, or network devices in future public land mobile networks (PLMNs). (R)AN devices can also be broadband network gateways (BNGs), aggregation switches, and non-3rd Generation Partnership Project (3GPP) access devices. (R)AN devices are primarily responsible for air interface radio resource management, uplink and downlink data classification, quality of service (QoS) management, data compression and encryption, signaling processing with control plane network elements, and data forwarding with user plane functional network elements. The embodiments of the present disclosure do not limit the form and structure of the (R)AN device.

[0044] A terminal device may be a device with wireless transceiver capabilities. The terminal device may have different names, such as UE, access terminal, terminal unit, terminal station, mobile station, mobile station, remote station, remote terminal, mobile device, wireless communication device, terminal agent, or terminal apparatus. For example, the terminal device may be a mobile phone, a tablet computer, or a computer with wireless transceiver capabilities. The terminal device may also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in smart grids, a wireless terminal in smart cities, or a wireless terminal in smart homes.

[0045] In some embodiments, the AUSF, AAnF and UE may belong to the same home public land mobile network (HPLMN).

[0046] In some embodiments, the network side and the UE side can perform key derivation according to the key hierarchy shown in FIG2. AUSF is used to generate the AUSF key (for example, the AUSF key is called K AUSF ) deduced K AKMA and the authority key identifier (A-KID); furthermore, AUSF can use K AKMA Sent to AAnF, which will then AKMA Derived K AF At the same time, the UE will also derive K by the same method before initiating an AKMA session with the AF network element. AKMA and A-KID.

[0047] For example, according to K AUSF Derived K AKMA The calculation method is: K AKMA =KDF(K AUSF , "AKMA", SUPI); where KDF is the abbreviation of key derivation function, and SUPI is the abbreviation of subscription permanent identifier.

[0048] It should be noted that the network architecture and application scenarios described in the embodiments of the present disclosure are intended to more clearly illustrate the technical solutions of the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0049] If the AF network element decides to AF If the UE is still allowed to access the AF network element after the expiration, the AF network element needs to request a new K by sending a key request message to the AAnF. AF For example, based on the AKMA architecture shown in FIG1 , as shown in FIG3 , AF requests K from AAnF. AF The process can be implemented as follows Sa1-Sa7.

[0050] Sa1. The UE sends an Application Session Establishment Request message to the AF network element. Correspondingly, the AF network element receives the Application Session Establishment Request message sent by the UE.

[0051] The above application session establishment request message is used to request to establish a session connection with the AF network element.

[0052] The above application session establishment request message includes A-KID. It should be noted that before the above Sa1, the UE needs to use the authentication server function (AUSF) key (K AUSF )Derived K AKMA and A-KID, and then, the UE can include A-KID in the application session establishment request message sent to the AF network element. The UE can derive K before or after sending the application session establishment request message. AF .

[0053] In some embodiments, before the above-mentioned Sa1, the above-mentioned method further includes: the UE may initiate a request message to the AF network element through the reference point Ua* (the request message may include or not include AKMA-related parameters), and the request message is used to request the AF network element to confirm whether to use AKMA. If the AF network element needs to use AKMA and the request message sent by the UE does not include AKMA-related parameters, the AF network element sends a response message to the UE through AKMA to instruct the UE to use AKMA.

[0054] Sa2. The AF network element sends a key request message (Naanf_AKMA_ApplicationKey_Get Request) to the AAnF network element. Correspondingly, the AAnF network element receives the key request message sent by the AF network element.

[0055] The key request message is used to request the K AF .

[0056] In some embodiments, the above-mentioned Sa2 can be implemented as follows: when the AF network element does not include context related to the A-KID, the AF network element sends a key request message to the AAnF network element having the A-KID. For example, when the AF network element is located in the operator network, the AF network element can directly send the key request message to the AAnF network element. When the AF network element is a third-party application and is located outside the operator network, the AF network element can send the key request message to the AAnF network element through the NEF.

[0057] The key request message includes the A-KID and the AF network element identifier (AF_ID). For example, the AF_ID consists of the fully qualified domain name (FQDN) of the AF network element and the Ua* security protocol identifier. The Ua* security protocol identifier is used to identify the security protocol that the AF will use with the UE.

[0058] In some embodiments, after receiving the key request message sent by the AF network element, the AAnF network element checks whether the AAnF network element can provide services to the AF network element based on the configured local policy or based on the authorization information available in the signaling (e.g., OAuth2.0 token). If yes, the following Sa3 will be executed; if not, the AAnF network element should reject the request of the AF network element.

[0059] In some embodiments, the AAnF network element determines the K of the UE based on the A-KID. AKMA Whether it exists (that is, the AAnF network element checks whether there is a valid AKMA context of the UE in the AAnF network element based on the A-KID). If it exists, the AAnF network element executes the following Sa3; if it does not exist, the AAnF network element executes the following Sa4 and gives an error response (that is, K AF Update failed response message).

[0060] Sa3. The AAnF network element determines the generic public subscription identifier (GPSI) required by the AF network element according to the local policy, and then the AAnF network element sends a Nudm_SDM_Get request message to the UDM network element. Correspondingly, the UDM network element receives the Nudm_SDM_Get request message sent by the AAnF network element.

[0061] The Nudm_SDM_Get request message is used to obtain the GPSI of the UE. The Nudm_SDM_Get request message includes the SUPI of the UE.

[0062] Sa4. The UDM network element sends a Nudm_SDM_Get response message to the AAnF network element. Correspondingly, the AAnF network element receives the Nudm_SDM_Get response message sent by the UDM network element.

[0063] The Nudm_SDM_Get response message includes the GPSI of the UE.

[0064] In some embodiments, the AAnF network element stores the received UE's GPSI as part of the UE's AKMA context.

[0065] Sa5, if there is no K in the AAnF network element AF , then AAnF network element according to K AKMA Derived K AF .

[0066] For example, the AAnF network element can derive K according to the following formula: AF : KAF=KDF(AF ID, K AKMA ), where KDF represents the key generation function.

[0067] Sa6. The AAnF network element sends a key response message to the AF network element. Correspondingly, the AF network element receives the key response message sent by the AAnF network element.

[0068] The key response message includes the UE's SUPI, K AF and K AF In some embodiments, the key response message may further include: the GPSI of the UE. In some embodiments, whether the key response message includes SUPI or GPSI may be determined based on the local policy of the AAnF network element. For example, if the AF network element is located in the operator network, the key response message includes SUPI or GPSI; if the AF network element is located outside the operator network, the AAnF network element may send a key response message to the AF network element through the NEF, and the key response message includes GPSI.

[0069] Sa7. The AF network element sends an application session establishment response message to the UE. Correspondingly, the UE receives the application session establishment response message sent by the AF network element.

[0070] The application session establishment response message includes the new K AF , and K AF The effective time.

[0071] In some embodiments, the UE's K does not exist in the AAnF network element. AKMA In the case (i.e., K AF If the update fails, the application session establishment response message includes the failure reason, and the AF network element rejects the application session establishment request initiated by the UE based on the failure reason. The UE can then regenerate the A-KID and send an application session establishment request message including the latest A-KID to the AF network element.

[0072] In the above-mentioned process of derivation of application keys, if the AAnF network element includes the valid AKMA context of the UE, the AAnF network element can determine K according to the valid AKMA context of the UE when receiving the key request message sent by the AF network element. AF However, if the UE's AKMA context is invalid or deleted in the AAnF network element, the AAnF network element cannot find the K according to the received key request message. AKMA or UE's SUPI, which will result in K AF Update failed.

[0073] In response to the above technical problems, the embodiments of the present disclosure provide a key update method, the idea of ​​which is that: when there is no valid AKMA context in the AAnF network element, the AAnF network element can trigger the main authentication of the terminal based on the received key request message, and then, if the main authentication is successful, derive the AKMA application key based on the new AKMA key, and feedback the AKMA application key to the AF network element, thereby increasing the probability of successful AKMA application key update.

[0074] The following is an introduction to the key update method provided by the embodiment of the present disclosure.

[0075] The key update method provided by the embodiment of the present disclosure is applied to the AAnF network element shown in Figure 1. For example, as shown in Figure 4, the key update method provided by the embodiment of the present disclosure may include the following S101-S104.

[0076] S101. An AAnF network element receives a key request message sent by an AF network element.

[0077] The key request message is used to request the AKMA application key (for example, K AKMA Exemplarily, the key request message may include: A-KID and AF_ID.

[0078] In some embodiments, the key request message includes the terminal's GPSI. The GPSI can be used by the AAnF network element to trigger primary authentication with the UDM network element, i.e., to execute the following S102. It is understood that the method provided in the embodiments of the present disclosure can include the terminal's GPSI in the key request message sent by the AF network element to the AAnF network element. In this way, even if there is no valid AKMA context for the UE in the AAnF network element, the AAnF network element can initiate primary authentication with the UDM network element based on the terminal's GPSI to update the AKMA application key.

[0079] In some embodiments, as shown in FIG5 , after S101 , the method further includes the following S200 - S201 .

[0080] S200. The AAnF network element sends a first request message to the AF network element.

[0081] The first request message is used to request the GPSI of the terminal.

[0082] In some embodiments, the above S200 may be implemented as follows: when the AKMA context of the terminal is invalid or deleted, the AAnF network element sends a first request message to the AF network element. For example, the AAnF network element may check the AKMA context of the terminal based on the A-KID to determine whether the AKMA context of the terminal is invalid or deleted.

[0083] S201. The AAnF network element receives a first response message sent by the AF network element.

[0084] The first response message includes the GPSI of the terminal.

[0085] It is understandable that, based on the method provided in the embodiment of the application, when the AKMA context of the terminal is invalid or deleted, the AAnF network element can proactively obtain the GPSI of the terminal from the AF network element (for example, sending a first request message to the terminal), and then initiate primary authentication to the UDM network element based on the GPSI of the terminal to update the K AF .

[0086] For example, as shown in Table 1, to implement the method provided in S200-S201 above, the embodiment of the present disclosure specifies the following network functions (NF) for the AF network element:

[0087] Table 1 NF services provided by AF

[0088] S102. The AAnF network element triggers primary authentication of the terminal in response to the key request message.

[0089] In some embodiments, the above S102 can be implemented as: sending an authentication request message to the UDM network element, the authentication request message including the terminal's GPSI. It is understandable that including the terminal's GPSI in the authentication request message is to enable the UDM network element to determine which terminal to trigger primary authentication with.

[0090] Accordingly, after receiving the authentication request message sent by the AAnF network element, the UDM network element can trigger the home network to trigger the primary authentication of the terminal based on the terminal's GPSI. For example, the UDM network element stores the correspondence between GPSI and SUPI, so the UDM network element can determine the terminal's SUPI based on the terminal's GPSI, and then initiate primary authentication for the terminal based on the terminal's SUPI.

[0091] For example, the authentication-related NF services provided by the UDM network element (for example, triggering the home network to trigger primary authentication) can be seen in the following Table 2:

[0092] Table 2 NF services of authentication triggers provided by UDM

[0093] Service Description: This service operation allows the NF to request the UDM network element to trigger the primary authentication.

[0094] Exemplarily, the parameter settings for triggering the primary authentication operation may include at least one of the following:

[0095] Required input: SUPI;

[0096] Optional input: None;

[0097] Required output: success / failure;

[0098] Optional output: None.

[0099] In some embodiments, the above method also includes: the AAnF network element receives an authentication confirmation message sent by the UDM network element, and the authentication confirmation message is used to indicate that the main authentication is being performed. It can be understood that after receiving the authentication request message sent by the AAnF network element, the UDM network element can first send an authentication confirmation message to the AAnF network element, and then trigger the main authentication. In this way, the UDM network element can quickly respond to the authentication request message sent by the AAnF network element without having to wait until the main authentication is completed before feeding back to the AAnF network element. In this case, if the main authentication is successful, the UDM network element or other network elements in the network (such as AUSF, etc.) can send a response message indicating the success of the main authentication and the result of the main authentication to the AAnF network element; if the main authentication fails, the UDM network element or other network elements in the network (such as AUSF, AMF, etc.) can send a response message indicating the failure of the main authentication to the AAnF network element.

[0100] S103. When the primary authentication succeeds, the AAnF network element derives the AKMA application key based on the new AKMA key.

[0101] In some embodiments, the above method also includes: receiving an authentication response message sent by the target network element, the authentication response message includes second indication information and a new AKMA key, the second indication information is used to indicate that the main authentication is successful, and the target network element includes any one of the following: AUSF network element, UDM network element.

[0102] In some embodiments, when the primary authentication is successful, AUSF can derive a new AKMA key based on the AUSF key generated during the primary authentication process; then, AUSF sends an authentication response message to the AAnF network element, and the authentication response message includes a second indication information and a new AKMA key.

[0103] In some embodiments, when the primary authentication is successful, AUSF can derive a new AKMA key based on the AUSF key generated during the primary authentication process; further, AUSF can send the new AKMA key to the UDM network element; accordingly, after receiving the new AKMA key, the UDM network element can send an authentication response message to the AAnF network element, and the authentication response message includes the second indication information and the new AKMA key.

[0104] In some embodiments, the above method also includes: the AAnF network element receives an authentication response message sent by the UDM network element, the authentication response message includes second indication information, and the second indication information is used to indicate that the main authentication is successful; and receives a new AKMA key sent by the AUSF.

[0105] It can be understood that when the primary authentication is successful, the UDM network element can feedback an authentication response message indicating the success of the primary authentication to the AAnF network element; since the new AKMA key is derived by AUSF based on the AUSF key generated during the primary authentication process, the new AKMA key can be sent directly by AUSF to the AAnF network element.

[0106] In some embodiments, the above method also includes: the AAnF network element receives an authentication response message sent by the target network element, the authentication response message includes third indication information, the third indication information is used to indicate that the main authentication failed or was not executed, and the target network element includes any one of the following: AMF network element, AUSF network element, UDM network element.

[0107] In some embodiments, the above method also includes: when the primary authentication fails or is not executed, the AAnF network element sends a second key response message to the AF network element, the second key response message includes first indication information, and the first indication information is used to indicate that the AKMA application key update failed.

[0108] S104. The AAnF network element sends a first key response message to the AF network element. The first key response message includes the AKMA application key.

[0109] In some embodiments, the first key response message may further include: the validity period of the AKMA application key.

[0110] In some embodiments, the first key response message may further include: SUPI or GPSI.

[0111] It is understandable that the embodiments of the present disclosure provide a method for updating the AKMA application key when there is no valid AKMA context for the UE in the AAnF network element. It can be seen that the AAnF network element in the embodiments of the present disclosure can receive the GPSI of the UE sent by the AF network element (for example, the AF network element proactively sends the GPSI of the UE to the AAnF network element; or the AAnF network element proactively requests the AF network element to obtain the GPSI of the UE), and then initiate primary authentication with the UDM network element based on the GPSI of the UE to achieve the update of the AKMA application key.

[0112] For ease of understanding, the key updating method provided by the embodiments of the present disclosure is described below using different scenarios as examples.

[0113] Scenario 1: The AF network element directly sends the GPSI to the AAnF network element.

[0114] For example, as shown in FIG6 , in scenario 1, the key update method provided by the embodiment of the present disclosure may be implemented as follows Sb1 - Sb11 .

[0115] Sb1. The UE sends an application session establishment request message to the AF network element. Correspondingly, the AF network element receives the application session establishment request sent by the UE.

[0116] The above application session establishment request message is used to request to establish a session connection with the AF network element.

[0117] The above application session establishment request message includes the A-KID.

[0118] Sb2. AF network element determines the UE's K AF The validity period has expired.

[0119] Understandably, in K AF If the AF network element still wants to accept the access of UE after the validity period has expired, it can request the AAnF network element to update K by performing the following operations: AF .

[0120] Sb3. The AF network element sends a key request message to the AAnF network element. Correspondingly, the AAnF network element receives the key request message sent by the AF network element.

[0121] The key request message is used to request the K AF .

[0122] The key request message includes: A-KID, AF_ID and UE's GPSI.

[0123] Sb4. The AAnF network element sends an authentication request message to the UDM network element. Correspondingly, the UDM network element receives the authentication request message sent by the AAnF network element.

[0124] The authentication request message includes the GPSI of the terminal.

[0125] Sb5. The UDM network element triggers the home network to trigger primary authentication based on the UE's GPSI.

[0126] Sb6. The UDM network element sends an authentication confirmation message to the AAnF network element. Correspondingly, the AAnF network element receives the authentication confirmation message sent by the UDM network element.

[0127] The authentication confirmation message is used to indicate that the primary authentication is being performed.

[0128] In some embodiments, if the primary authentication triggered by the home network succeeds, the following Sb8 is executed; if the primary authentication triggered by the home network fails or is not executed (including the case where it is not executed according to the policy of the UDM network element), the following Sb7 is continued to be executed.

[0129] Sb7. If the primary authentication triggered by the home network fails, the AAnF network element sends a second key response message (Naanf_AKMA_ApplicationKey_Get Response) to the AF network element. Correspondingly, the AF network element receives the second key response message sent by the AAnF network element.

[0130] The second key response message includes first indication information, where the first indication information is used to indicate that the AKMA application key update fails.

[0131] In some embodiments, if Sb7 is executed, Sb8, Sb9, and Sb10 are skipped.

[0132] Sb8. If the primary authentication triggered by the home network is successful, the UE and the AAnF network element derive a new K AKMA .

[0133] In some embodiments, the AUSF key K is generated during the master authentication process. AUSF ; Then AUSF network element according to K AUSF Derived to get the new K AKMA , and sent to UE and AAnF network element.

[0134] Sb9, AAnF network elements according to the new K AKMA Derived K AF .

[0135] Sb10. The AAnF network element sends a first key response message (Naanf_AKMA_ApplicationKey_Get) to the AF network element. Correspondingly, the AF network element receives the first key response message sent by the AAnF network element.

[0136] The first key response message includes K AF , K AF Validity time and SUPI or GPSI. Exemplarily, the AAnF network element may determine whether to include SUPI or GPSI in the first key response message based on a local policy.

[0137] Sb11. The AF network element sends an application session establishment response message to the UE. Correspondingly, the UE receives the application session establishment response message sent by the AF network element.

[0138] In some embodiments, when the AKMA application key update fails (ie, executing the above Sb7), the above application session establishment response message is used to indicate the rejection of application session establishment, and the application session establishment response message may include the failure reason.

[0139] It is understood that the embodiments of the present disclosure provide a method for updating the AKMA application key when there is no valid AKMA context for the UE in the AAnF network element. It can be seen that in the above scenario one, the AF network element can directly send the UE's GPSI to the AAnF network element, so that even if there is no valid AKMA context for the UE in the AAnF network element, the primary authentication can be initiated to the UDM network element based on the UE's GPSI to achieve the update of the AKMA application key.

[0140] Scenario 2: The AAnF network element requests the GPSI from the AF network element.

[0141] Exemplarily, as shown in FIG7 , in scenario 2, the key update method provided by the embodiment of the present disclosure may be implemented as follows Sc1-Sc14.

[0142] Sc1. The UE sends an application session establishment request message to the AF network element. Correspondingly, the AF network element receives the application session establishment request sent by the UE.

[0143] The above application session establishment request message is used to request to establish a session connection with the AF network element.

[0144] The above application session establishment request message includes the A-KID.

[0145] Sc2. AF network element determines UE's K AF The validity period has expired.

[0146] Understandably, in K AF If the AF network element still wants to accept the access of UE after the validity period has expired, the AF network element can request the AAnF network element to update K by executing the following steps: AF .

[0147] Sc3. The AF network element sends a key request message to the AAnF network element. Correspondingly, the AAnF network element receives the key request message sent by the AF network element.

[0148] The key request message is used to request the K AF .

[0149] The key request message includes: A-KID, AF_ID and UE's GPSI.

[0150] Sc4. The AAnF network element checks whether there is a valid AKMA context of the UE in the AAnF network element according to the A-KID.

[0151] In the case that there is a valid AKMA context of the UE in the AAnF network element, the following Sc7 is executed.

[0152] In the case that there is no valid AKMA context for the UE in the AAnF network element, the following Sc5 is executed.

[0153] Sc5. The AAnF network element sends a first request message to the AF network element. The first request message is used to request the GPSI of the terminal.

[0154] Sc6. The AAnF network element receives the first response message sent by the AF network element. Correspondingly, the AF network element receives the first response message sent by the AAnF network element.

[0155] The first response message includes the GPSI of the terminal.

[0156] Sc7. The AAnF network element sends an authentication request message to the UDM network element. Correspondingly, the UDM network element receives the authentication request message sent by the AAnF network element.

[0157] The authentication request message includes the GPSI of the terminal.

[0158] Sc8. The UDM network element triggers the home network to trigger primary authentication based on the UE's GPSI.

[0159] Sc9. The UDM network element sends an authentication confirmation message (Nudm_UECM_AuthTrigger Response) to the AAnF network element. Correspondingly, the AAnF network element receives the authentication confirmation message sent by the UDM network element.

[0160] The authentication confirmation message is used to indicate that the primary authentication is being performed.

[0161] In some embodiments, if the primary authentication triggered by the home network succeeds, the following Sc11 is executed; if the primary authentication triggered by the home network fails or is not executed (including the case where it is not executed according to the policy of the UDM network element), the following Sc10 is continued to be executed.

[0162] Sc10. If the primary authentication triggered by the home network fails, the AAnF network element sends a second key response message (Naanf_AKMA_ApplicationKey_Get Response) to the AF network element. Correspondingly, the AF network element receives the second key response message sent by the AAnF network element.

[0163] The second key response message includes first indication information, where the first indication information is used to indicate that the AKMA application key update fails.

[0164] In some embodiments, when Sc10 is performed, Sc11 , Sc12 , and Sc13 are skipped.

[0165] Sc11. If the primary authentication triggered by the home network is successful, the UE and the AAnF network element derive a new K AKMA .

[0166] In some embodiments, the AUSF key K is generated during the master authentication process. AUSF ; Then AUSF network element according to K AUSF Derived to get the new K AKMA , and sent to UE and AAnF network element.

[0167] Sc12, AAnF network elements according to the new K AKMA Derived K AF .

[0168] Sc13. The AAnF network element sends a first key response message (Naanf_AKMA_ApplicationKey_Get) to the AF network element. Correspondingly, the AF network element receives the first key response message sent by the AAnF network element.

[0169] The first key response message includes K AF , K AF Validity time and SUPI or GPSI. Exemplarily, the AAnF network element may determine whether to include SUPI or GPSI in the first key response message based on a local policy.

[0170] Sc14. The AF network element sends an application session establishment response message to the UE. Correspondingly, the UE receives the application session establishment response message sent by the AF network element.

[0171] In some embodiments, when the AKMA application key update fails (ie, executing the above Sc10), the above application session establishment response message is used to indicate the rejection of application session establishment, and the application session establishment response message may include the failure reason.

[0172] It can be understood that the embodiment of the present disclosure proposes a method for updating the AKMA application key when there is no valid AKMA context of the UE in the AAnF network element. It can be seen that in the above scenario 2, after receiving the key request message sent by the AF network element, the AAnF network element needs to determine whether there is a valid AKMA context of the UE in the AAnF network element, and then actively initiates a request to the AF network element to obtain the GPSI of the UE when there is no valid AKMA context of the UE in the AAnF network element; accordingly, after receiving the request from the AAnF network element, the AF network element sends the GPSI of the UE to the AAnF network element. In this way, the AAnF network element can initiate primary authentication to the UDM network element based on the GPSI of the UE to achieve the update of the AKMA application key.

[0173] The above mainly introduces the solution of the embodiment of the present disclosure from the perspective of method. It can be understood that in order to realize the above functions, the key update device includes at least one of the hardware structure and software modules corresponding to the execution of each function. It should be easy for those skilled in the art to realize that, in combination with the units and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiment of the present disclosure.

[0174] It is understandable that, in order to implement the above functions, the key update device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments of the present disclosure, the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software-driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present disclosure.

[0175] The disclosed embodiments can divide the key update device into functional modules based on the above-mentioned method embodiments. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one functional module. The above-mentioned integrated modules can be implemented in the form of hardware or software. It should be noted that the division of modules in the disclosed embodiments is schematic and is only a logical functional division. In actual implementation, other division methods can be used. The following example uses the division of each functional module according to each function as an example for explanation.

[0176] FIG8 is a schematic diagram of a key updating apparatus according to an embodiment of the present disclosure, which is used to execute the key updating method according to the above method embodiment. As shown in FIG8 , the key updating apparatus 300 includes: a communication module 301 , an authentication module 302 , and a generation module 303 .

[0177] The communication module 301 is configured to receive a key request message sent by an application function AF network element, where the key request message is used to request an AKMA application key.

[0178] The authentication module 302 is configured to trigger a primary authentication of the terminal in response to the key request message.

[0179] The generation module 303 is configured to derive an AKMA application key based on the new AKMA key when the primary authentication succeeds.

[0180] The communication module 301 is further configured to send a first key response message to the AF, where the first key response message includes the AKMA application key.

[0181] In some embodiments, the authentication module 302 is configured to send an authentication request message to the unified data management network element UDM, where the authentication request message includes the universal public user identity GPSI of the terminal.

[0182] In some embodiments, the key request message includes the GPSI of the terminal.

[0183] In some embodiments, the communication module 301 is further configured to send a first request message to the AF, where the first request message is used to request the GPSI of the terminal; and receive a first response message sent by the AF, where the first response message includes the GPSI of the terminal.

[0184] In some embodiments, the communication module 301 is configured to send a first request message to the AF when the AKMA context of the terminal is invalid or deleted.

[0185] In some embodiments, the communication module 301 is further configured to receive an authentication confirmation message sent by the UDM, where the authentication confirmation message is used to indicate that the primary authentication is being performed.

[0186] In some embodiments, the communication module 301 is also used to receive an authentication response message sent by the target network element, the authentication response message includes a second indication information and a new AKMA key, the second indication information is used to indicate that the main authentication is successful, and the target network element includes any one of the following: authentication server function network element AUSF, UDM.

[0187] In some embodiments, the communication module 301 is further used to receive an authentication response message sent by the UDM, where the authentication response message includes second indication information, and the second indication information is used to indicate that the primary authentication is successful; and receive a new AKMA key sent by the AUSF.

[0188] In some embodiments, the communication module 301 is further configured to send a second key response message to the AF when the primary authentication fails or is not performed, where the second key response message includes first indication information, and the first indication information is configured to indicate that the AKMA application key update has failed.

[0189] In some embodiments, the communication module 301 is also used to receive an authentication response message sent by a target network element, the authentication response message includes a third indication information, the third indication information is used to indicate that the main authentication failed or was not executed, and the target network element includes any one of the following: AMF network element, AUSF network element, UDM network element.

[0190] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present disclosure provides a structure of the communication device involved in the above-mentioned embodiment. As shown in Figure 9, the communication device 400 includes: a memory 401, a processor 402, a communication interface 403, and a bus 404.

[0191] The memory 401 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0192] Processor 402 may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present disclosure. Processor 402 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. Processor 402 may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present disclosure. Processor 402 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0193] The communication interface 403 is used to connect to other devices via a communication network, such as Ethernet, wireless access network, or wireless local area network (WLAN).

[0194] In some embodiments, memory 401 may exist independently of processor 402 and may be connected to processor 402 via bus 404 for storing instructions or program codes. When processor 402 calls and executes the instructions or program codes stored in memory 401, the key update method provided in the embodiments of the present disclosure can be implemented.

[0195] In some embodiments, the memory 401 may also be integrated with the processor 402 .

[0196] Bus 404 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 404 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG9 shows only one thick solid line, but this does not mean that there is only one bus or only one type of bus.

[0197] Some embodiments of the present disclosure provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes a key update method as described in any of the above embodiments.

[0198] For example, the computer-readable storage media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, or magnetic tapes), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., erasable programmable read-only memories (EPROMs), cards, sticks, or key drives). The various computer-readable storage media described in this disclosure may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or carrying instructions and / or data.

[0199] An embodiment of the present disclosure provides a computer program product comprising instructions. When the computer program product is run on a computer, the computer is enabled to execute the key updating method described in any one of the above embodiments.

[0200] The above is only a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or replacements within the technical scope disclosed in the present disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A key update method is applied to an authentication and key management AKMA anchor function AAnF network element at the application layer, wherein: The method comprises: Receiving a key request message sent by an application function AF network element, where the key request message is used to request an AKMA application key; In response to the key request message, triggering primary authentication of the terminal; In case the primary authentication is successful, deriving the AKMA application key based on the new AKMA key; Send a first key response message to the AF network element, where the first key response message includes the AKMA application key.

2. The method according to claim 1, wherein: Triggering the primary authentication of the terminal includes: An authentication request message is sent to a unified data management (UDM) network element, where the authentication request message includes a universal public user identity (GPSI) of the terminal.

3. The method according to claim 2, wherein: The key request message includes the GPSI of the terminal.

4. The method according to claim 2, further comprising: Sending a first request message to the AF network element, where the first request message is used to request the GPSI of the terminal; A first response message sent by the AF network element is received, where the first response message includes the GPSI of the terminal.

5. The method according to claim 4, wherein: The sending a first request message to the AF network element includes: When the AKMA context of the terminal is invalid or deleted, a first request message is sent to the AF network element.

6. The method according to claim 2, further comprising: An authentication confirmation message sent by the UDM network element is received, where the authentication confirmation message is used to indicate that the primary authentication is being performed.

7. The method according to claim 2, further comprising: Receive an authentication response message sent by a target network element, wherein the authentication response message includes second indication information and the new AKMA key, wherein the second indication information is used to indicate that the primary authentication is successful, and the target network element includes any one of the following: an authentication server function AUSF network element and a UDM network element.

8. The method according to claim 2, further comprising: receiving an authentication response message sent by the UDM network element, wherein the authentication response message includes second indication information, and the second indication information is used to indicate that the primary authentication is successful; Receive the new AKMA key sent by the AUSF network element.

9. The method according to claim 1, further comprising: In a case where the primary authentication fails or is not performed, a second key response message is sent to the AF network element, where the second key response message includes first indication information, where the first indication information is used to indicate that the AKMA application key update has failed.

10. The method according to claim 9, further comprising: Receive an authentication response message sent by a target network element, wherein the authentication response message includes third indication information, and the third indication information is used to indicate that the main authentication has failed or has not been executed. The target network element includes any one of the following: access and mobility management AMF network element, AUSF network element, and UDM network element.

11. A communication device, characterized in that: include: Memory and processor; Memory and processor coupling; The memory is used to store instructions executable by the processor; When the processor executes the instructions, the key updating method according to any one of claims 1 to 10 is performed.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on an electronic device, the electronic device executes the key updating method according to any one of claims 1 to 10.

Images