Communication method and communication apparatus

Abstract

A communication method and a communication apparatus. During a user equipment parameter update process, a data management network element can store in a UPU list a header of a UPU container as a data set of a new type or can additionally add a field in the UPU list for storing the header of the UPU container, and provide to an authentication network element the UPU list comprising the header of the UPU container, such that the authentication network element can obtain, on the basis of the UPU list comprising the header of the UPU container, a message authentication code used for performing integrity protection on the UPU list, and the message authentication code obtained thereby can also perform integrity protection on the header of the UPU container, thus helping to improve the security of information transmission, and performing integrity protection on a first header while minimizing message format modifications as much as possible.

Description

Communication method and communication device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 4, 2023, with application number 202310984243.2 and invention name “A Communication Method and Communication Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communications, and more particularly, to a communication method and a communication device. Background Art

[0003] The User Equipment Parameters Update (UPU) mechanism allows the data management element (DMNE) to update user equipment (UE) parameters through a control plane procedure. After a UE successfully registers with the network, the DMNE securely delivers updated parameters to the UE. Currently, in the UPU procedure, the DMNE can send messages to the UE through the control plane. However, there is a risk that the information sent by the DMNE to the UE may be tampered with during transmission.

[0004] Summary of the Invention

[0005] The present application provides a communication method and a communication device, which help to improve the security of information transmission in the UPU process.

[0006] In a first aspect, a communication method is provided. The method can be executed by a data management network element or a module or unit (such as a chip or circuit) in the data management network element, and this application does not limit this.

[0007] The method includes: when it is necessary to update the parameters of the terminal device, sending a first request message to the authentication network element, the first request message including the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message is used to request security protection of the first UPU list, the first UPU list includes a first data set and a second data set, the first data set includes a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set of the first header carrying a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, and the first length field is used to indicate The length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message includes a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code is used to perform integrity protection on the first UPU list; sending the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element.

[0008] In the above method, the data management network element can place the first header of the UPU container in the first UPU list and provide the first UPU list including the first header to the authentication network element, so that the authentication network element can obtain a message authentication code for integrity protection of the first UPU list based on the first UPU list. Because the first UPU list includes the first header, the obtained message authentication code can also perform integrity protection on the first header. Compared to the existing UPU process that only protects the integrity of the UPU list and count value, the above method can also perform integrity protection on the first header, making the information provided by the network to the terminal device less susceptible to tampering, which helps to improve the security of information transmission. In addition, the data management network element can store the first header of the UPU container in the first UPU list as a new type of data set. This allows the integrity of the first header to be protected while minimizing changes to the message format.

[0009] In combination with the first aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0010] Based on the above method, the integrity protection of the first header can be achieved, so that the terminal device can correctly perform subsequent operations according to the first header, such as whether to read the UPU list, whether to send confirmation information, and whether to re-register.

[0011] In combination with the first aspect or any implementation thereof, in some other implementations, the method further includes: receiving first information from the terminal device, the first information being used to indicate that the terminal device has failed to read the first header from the UPU container.

[0012] In the above method, if the terminal device fails to read the first header from the first UPU list, for example, the terminal device does not support the UPU list of this format, then the terminal device can send a first message to the data management network element, and the first information is used to indicate that the terminal device fails to read the first header from the UPU container, so that the data management network element knows that the terminal device does not support the UPU container of this format, and the data management network element may no longer send the UPU container of this format to the terminal device subsequently.

[0013] In combination with the first aspect or any implementation thereof, in some other implementations, the sending of the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element includes: sending a notification message to the mobile management network element, the notification message including the first UPU list, the first message authentication code and the count value, the notification message also including second information, the second information being used to determine the second header of the UPU container, the first UPU list, the first message authentication code, the count value and the second information being carried in the notification message as independent information elements, and the second header being used to carry the information given by the network to the terminal device.

[0014] In the above method, the data management network element may send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in a notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container based on the second information, thereby implementing the construction of the UPU container.

[0015] In combination with the first aspect or any implementation thereof, in some other implementations, the second information is the second header.

[0016] In combination with the first aspect or any implementation thereof, in some implementations, the notification message includes the UPU container, the UPU container includes the first UPU list, the first message authentication code, the count value and the second header of the UPU container, the second header is used to carry the information from the network to the terminal device, and the second header is outside the first UPU list.

[0017] In a second aspect, a communication method is provided, which can be executed by a terminal device or a module or unit (such as a chip or circuit) in the terminal device, and this application does not limit this.

[0018] The terms or features in the second aspect or its implementation that are the same as those in the first aspect or its implementation can refer to the first aspect or its implementation, and its technical effects can refer to the technical effects in the first aspect or its implementation.

[0019] The method includes: receiving a user equipment parameter update UPU container, the UPU container including a first UPU list, a first message authentication code and a count value corresponding to the first message authentication code, the first UPU list including a first data set and a second data set, the first data set including a first type field, a first length field and a first data field, the first type field being used to indicate that the type of the first data set is a data set carrying the first header of the UPU container, the first header being used to carry information from the network to the terminal device, the first length field being used to indicate the length of the first data set, the first data field being used to carry the first header, the second data set including a second type field, a second length field and a second data field, the second type field being used to indicate the type of the parameter to be updated of the terminal device, the second length field being used to indicate the length of the second data set, and the second data field being used to carry the parameter to be updated; determining a second message authentication code based on the first UPU list and the count value; obtaining the first header and the parameter to be updated when the first message authentication code and the second message authentication code match, and performing subsequent operations based on the first header.

[0020] In the above method, the first message authentication code is used to perform integrity protection on the first UPU list in the received UPU container. The first UPU list of the UPU container includes not only the parameters to be updated for the terminal device, but also the first header of the UPU container. Therefore, the first message authentication code can also perform integrity protection on the first header. When the first message authentication code and the second message authentication code match, i.e., when integrity authentication is passed, the terminal device can correctly perform subsequent operations, such as whether to send a confirmation message and whether to re-register, based on the integrity-authenticated first header. Furthermore, the data management network element can store the first header of the UPU container as a new type of data set in the first UPU list. This allows for integrity protection of the first header while minimizing changes to the message format.

[0021] In combination with the second aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0022] In combination with the second aspect or any implementation thereof, in some other implementations, the subsequent operations performed based on the first header include: when the second flag bit indicates a request for the terminal device to reply with confirmation information, determining the confirmation information based on the count value, the confirmation information including a third message authentication code, and the third message authentication code is used by the data management network element to verify whether the terminal device correctly receives the first UPU list; sending the confirmation information to the data management network element; and / or, when the third flag bit indicates a request for the terminal device to re-register, re-registering.

[0023] In combination with the second aspect or any implementation thereof, in some other implementations, the method further includes: when the first message authentication code and the second message authentication code do not match, discarding the UPU container.

[0024] In combination with the second aspect or any implementation thereof, in some other implementations, obtaining the first header includes: obtaining the first header in the first data field based on the first type field; obtaining the parameters to be updated includes: obtaining the parameters to be updated in the second data field based on the second type field.

[0025] In a third aspect, a communication method is provided, which can be executed by a mobility management network element or a module or unit (such as a chip or circuit) in the mobility management network element, and this application does not limit this.

[0026] The terms or features in the third aspect or its implementation that are the same as those in the first aspect or its implementation can refer to the first aspect or its implementation, and its technical effects can refer to the technical effects in the first aspect or its implementation.

[0027] The method includes: receiving a notification message from a data management network element, the notification message including a first UPU list, a first message authentication code, a count value corresponding to the first message authentication code, and second information, the first UPU list, the first message authentication code, the count value, and the second information being carried in the notification message in the form of independent cells, the first UPU list including a first data set and a second data set, the first data set including a first type field, a first length field, and a first data field, the first type field being used to indicate that the type of the first data set is a data set carrying the first header of a UPU container, the UPU container being used to carry the first UPU list, the first header being used to carry information from the network to the terminal device, the first length field being used to indicate the length of the first data set, the first data field Used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated of the terminal device, the second length field is used to indicate the length of the second data set, the second data field is used to carry the parameter to be updated, and the second information is used to determine the second header of the UPU container; according to the first UPU list, the first message authentication code, the count value and the second information, the UPU container is generated, the UPU container includes the second header, the first UPU list, the first message authentication code and the count value, the second header is outside the first UPU list, and the second header is used to carry the information from the network to the terminal device; the UPU container is sent to the terminal device.

[0028] In the above method, the data management network element may send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in a notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container based on the second information, thereby implementing the construction of the UPU container.

[0029] In combination with the third aspect, in some implementations, the second information is the second header.

[0030] In combination with the third aspect or any implementation thereof, in some other implementations, the first header and / or the second header respectively include at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0031] In a fourth aspect, a communication method is provided, which can be executed by a data management network element or a module or unit (such as a chip or circuit) in the data management network element, and this application does not limit this.

[0032] The method includes: when it is necessary to update the parameters of the terminal device, sending a first request message to the authentication network element, the first request message including the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message being used to request security protection of the first UPU list, the first UPU list including a data set and a first header of a UPU container, the UPU container being used to carry the first UPU list, the first header being used to carry information from the network to the terminal device, the data set including a type field, a length field and a data field, the type field being used to indicate the type of the parameter to be updated, the length field being used to indicate the length of the data set, and the data field being used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message including a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code being used to perform integrity protection on the first UPU list; and sending the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element.

[0033] In the above method, the data management network element can place the first header of the UPU container in the first UPU list and provide the first UPU list including the first header to the authentication network element, so that the authentication network element can obtain a message authentication code for integrity protection of the first UPU list based on the first UPU list. Because the first UPU list includes the first header, the obtained message authentication code can also perform integrity protection on the first header. Compared to the existing UPU process that only performs integrity protection on the UPU list and count value, the above method can also perform integrity protection on the first header, making the information provided by the network to the terminal device less susceptible to tampering, which helps to improve the security of information transmission. In addition, the data management network element can add an additional field to the first UPU list to store the first header of the UPU container. This allows the integrity of the first header to be protected while minimizing changes to the message format.

[0034] In combination with the fourth aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0035] Based on the above method, the integrity protection of the first header can be achieved, so that the terminal device can correctly perform subsequent operations according to the first header, such as whether to read the UPU list, whether to send confirmation information, and whether to re-register.

[0036] In combination with the fourth aspect or any implementation thereof, in some other implementations, the first header is located at a preset position in the first UPU list.

[0037] In the above method, the data management network element places the first header of the UPU container at a preset position. This eliminates the need for additional information between the data management network element and the terminal device to determine the position of the first header in the first UPU list. This solution is simple and easy to implement, and it protects the integrity of the first header while minimizing changes to the message format.

[0038] In combination with the fourth aspect or any implementation thereof, in some other implementations, the preset position is after the data set, and the data set is the last data set in the first UPU list.

[0039] In the above method, the data management network element places the first header of the UPU container after the last data set in the first UPU list, and can perform integrity protection on the first header while minimizing changes to the message format.

[0040] In combination with the fourth aspect or any implementation thereof, in some implementations, the preset position is before the data set, and the data set is the first data set in the first UPU list.

[0041] In the above method, the data management network element places the first header of the UPU container before the first data set of the first UPU list, so as to perform integrity protection on the first header while minimizing changes to the message format.

[0042] In combination with the fourth aspect or any implementation thereof, in some other implementations, the first header is after the data set, and the data set further includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is after the data set.

[0043] In the above method, the data management network element can place the first header of the UPU container after any data set in the first UPU list and identify the data set using a flag bit, so that the receiving end of the first UPU list (such as a UE) can locate the data set and obtain the first header after the data set. This solution is flexible and easy to implement, and can protect the integrity of the first header while minimizing changes to the message format.

[0044] In combination with the fourth aspect or any implementation thereof, in some other implementations, the type field and the fourth flag are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag occupies one bit of the 5th to 8th bits of the byte.

[0045] In combination with the fourth aspect or any implementation thereof, in some other implementations, the method further includes: receiving first information from the terminal device, the first information being used to indicate that the terminal device has failed to read the first header from the UPU container.

[0046] In the above method, if the terminal device fails to read the first header from the first UPU list, for example, the terminal device does not support the UPU list of this format, then the terminal device can send a first message to the data management network element, and the first information is used to indicate that the terminal device fails to read the first header from the UPU container, so that the data management network element knows that the terminal device does not support the UPU container of this format, and the data management network element may no longer send the UPU container of this format to the terminal device subsequently.

[0047] In combination with the fourth aspect or any implementation thereof, in some other implementations, sending the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element includes: sending a notification message to the mobile management network element, the notification message including the first UPU list, the first message authentication code and the count value.

[0048] In combination with the fourth aspect or any implementation thereof, in some other implementations, the notification message also includes second information, and the second information is used to determine the second header of the UPU container. The first UPU list, the first message authentication code, the count value and the second information are carried in the notification message as independent elements, and the second header includes the first flag bit, the second flag bit and the third flag bit.

[0049] In the above method, the data management network element may send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in a notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container based on the second information, thereby implementing the construction of the UPU container.

[0050] In combination with the fourth aspect or any implementation thereof, in some other implementations, the second information is the second header.

[0051] In combination with the fourth aspect or any implementation thereof, in some other implementations, the notification message includes the UPU container, the UPU container includes the first UPU list, the first message authentication code, the count value and the second header of the UPU container, the second header includes the first flag bit, the second flag bit and the third flag bit, and the second header is outside the first UPU list.

[0052] In a fifth aspect, a communication method is provided, which can be executed by a terminal device or a module or unit (such as a chip or circuit) in the terminal device, and this application does not limit this.

[0053] The terms or features in the fifth aspect or its implementation methods that are the same as those in the fourth aspect or its implementation methods can refer to the fourth aspect or its implementation methods, and its technical effects can refer to the technical effects in the fourth aspect or its implementation methods.

[0054] The method includes: receiving a user equipment parameter update UPU container, the UPU container including a first UPU list, a first message authentication code and a count value corresponding to the first message authentication code, the first UPU list including a data set and a first header of the UPU container, the first header being used to carry information from the network to the terminal device, the data set including a type field, a length field and a data field, the type field being used to indicate the type of the parameter to be updated of the terminal device, the length field being used to indicate the length of the data set, and the data field being used to carry the parameter to be updated; determining a second message authentication code based on the first UPU list and the count value; when the first message authentication code and the second message authentication code match, obtaining the first header and the parameter to be updated, and performing subsequent operations based on the first header.

[0055] In the above method, the first message authentication code is used to perform integrity protection on the first UPU list in the received UPU container. The first UPU list of the UPU container includes not only the parameters to be updated for the terminal device, but also the first header of the UPU container. Therefore, the first message authentication code can also perform integrity protection on the first header. When the first message authentication code and the second message authentication code match, i.e., when integrity authentication is passed, the terminal device can correctly perform subsequent operations, such as whether to send a confirmation message and whether to re-register, based on the integrity-authenticated first header. In addition, the data management network element can add an additional field to the first UPU list to store the first header of the UPU container. This allows for integrity protection of the first header while minimizing changes to the message format.

[0056] In combination with the fifth aspect, in some implementations, the first header includes at least one of a first flag bit, a second flag bit, and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0057] In combination with the fifth aspect or any implementation thereof, in some other implementations, the subsequent operations performed based on the first header include: when the second flag bit indicates a request for the terminal device to reply with confirmation information, determining the confirmation information based on the count value, the confirmation information including a third message authentication code, and the third message authentication code is used by the data management network element to verify whether the terminal device correctly receives the first UPU list; sending the confirmation information to the data management network element; and / or, when the third flag bit indicates a request for the terminal device to re-register, re-registering.

[0058] In combination with the fifth aspect or any implementation thereof, in some other implementations, the method further includes: when the first message authentication code and the second message authentication code do not match, discarding the UPU container.

[0059] In combination with the fifth aspect or any implementation thereof, in some other implementations, the first header is located at a preset position in the first UPU list.

[0060] In combination with the fifth aspect or any implementation thereof, in some other implementations, the preset position is after the data set, and the data set is the last data set in the first UPU list.

[0061] In combination with the fifth aspect or any implementation thereof, in some other implementations, the preset position is before the data set, and the data set is the first data set in the first UPU list.

[0062] In combination with the fifth aspect or any implementation thereof, in some other implementations, obtaining the first head includes: obtaining the first head according to the preset position.

[0063] In combination with the fifth aspect or any implementation thereof, in some other implementations, the first header is after the data set, and the data set further includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is after the data set.

[0064] In combination with the fifth aspect or any implementation thereof, in some other implementations, the type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit of the 5th to 8th bits of the byte.

[0065] In combination with the fifth aspect or any implementation thereof, in some other implementations, obtaining the first header includes: obtaining the first header after the data set according to the fourth flag.

[0066] In a sixth aspect, a communication method is provided, which can be executed by a mobile management network element or a module or unit (such as a chip or circuit) in the mobile management network element, and this application does not limit this.

[0067] The terms or features in the sixth aspect or its implementation methods that are the same as those in the first aspect or its implementation methods can refer to the fourth aspect or its implementation methods, and its technical effects can refer to the technical effects in the fourth aspect or its implementation methods.

[0068] The method includes: receiving a notification message from a data management network element, the notification message including a first UPU list, a first message authentication code, a count value corresponding to the first message authentication code, and second information, the first UPU list, the first message authentication code, the count value, and the second information are carried in the notification message in the form of independent cells, the first UPU list includes a data set and a first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the data set includes a type field, a length field, and a data field, the type field is used to indicate the type of the parameter to be updated of the terminal device, The length field is used to indicate the length of the data set, the data field is used to carry the parameters to be updated, the first message authentication code is used to perform integrity protection on the first UPU list, and the second information is used to determine the second header of the UPU container; according to the first UPU list, the first message authentication code, the count value and the second information, the UPU container is generated, the UPU container includes the second header, the first UPU list, the first message authentication code and the count value, the second header is outside the first UPU list, and the second header is used to carry the information from the network to the terminal device; the UPU container is sent to the terminal device.

[0069] In the above method, the data management network element may send the first UPU list, the first message authentication code, the count value, and the second information as independent information elements in a notification message to the mobility management network element, so that the mobility management network element constructs the UPU container. The data management network element provides the second information to the mobility management network element, so that the mobility management network element can construct the second header of the UPU container based on the second information, thereby implementing the construction of the UPU container.

[0070] In combination with the sixth aspect, in some implementations, the second information is the second header.

[0071] In combination with the sixth aspect or any implementation thereof, in some other implementations, the first header and / or the second header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

[0072] In combination with the sixth aspect or any implementation thereof, in some other implementations, the first header is located at a preset position in the first UPU list.

[0073] In combination with the sixth aspect or any implementation thereof, in some other implementations, the preset position is after the data set, and the data set is the last data set in the first UPU list.

[0074] In combination with the sixth aspect or any implementation thereof, in some other implementations, the preset position is before the data set, and the data set is the first data set in the first UPU list.

[0075] In combination with the sixth aspect or any implementation thereof, in some other implementations, the first header is after the data set, and the data set further includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is after the data set.

[0076] In combination with the sixth aspect or any implementation thereof, in some other implementations, the type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit of the 5th to 8th bits of the byte.

[0077] In a seventh aspect, a communication device is provided, which is configured to execute the method provided by any of the above aspects or its implementations. Specifically, the device may include units and / or modules, such as a processing unit and / or a transceiver unit, configured to execute the method provided by any of the above aspects or its implementations.

[0078] In one implementation, the apparatus is a data management network element, a terminal device, or a mobility management network element. When the apparatus is a data management network element, a terminal device, or a mobility management network element, the transceiver unit may be a transceiver, an input / output interface, or a communication interface; and the processing unit may be at least one processor. Optionally, the transceiver is a transceiver circuit. Optionally, the input / output interface is an input / output circuit.

[0079] In another implementation, the device is a chip, chip system, or circuit used in a data management network element, terminal equipment, or mobility management network element. When the device is a chip, chip system, or circuit used in a data management network element, terminal equipment, or mobility management network element, the transceiver unit may be an input / output interface, interface circuit, output circuit, input circuit, pin, or related circuit on the chip, chip system, or circuit; and the processing unit may be at least one processor, processing circuit, or logic circuit.

[0080] In an eighth aspect, a communication device is provided, which includes: a memory for storing programs; and at least one processor for executing computer programs or instructions stored in the memory to execute the method provided by any one of the above aspects or its implementation.

[0081] In one implementation, the apparatus is a data management network element, a terminal device, or a mobility management network element.

[0082] In another implementation, the device is a chip, a chip system or a circuit used in a data management network element, a terminal device or a mobility management network element.

[0083] In a ninth aspect, a communication device is provided, comprising: at least one processor and a communication interface, wherein the at least one processor is configured to retrieve a computer program or instruction stored in a memory through the communication interface to execute the method provided by any one of the above aspects or implementations thereof. The communication interface may be implemented in hardware or software.

[0084] In one implementation, the device further includes the memory.

[0085] In a tenth aspect, a processor is provided for executing the methods provided in the above aspects.

[0086] For the operations such as sending and acquiring / receiving involved in the processor, unless otherwise specified, or if they do not conflict with their actual functions or internal logic in the relevant descriptions, they can be understood as operations such as processor output, reception, and input, or as sending and receiving operations performed by the radio frequency circuit and antenna. This application does not limit this.

[0087] In an eleventh aspect, a computer-readable storage medium is provided, which stores a program code for execution by a device, wherein the program code includes a method for executing any one of the above aspects or its implementation.

[0088] In a twelfth aspect, a computer program product comprising instructions is provided, which, when run on a computer, enables the computer to execute the method provided by any one of the above aspects or its implementation.

[0089] In a thirteenth aspect, a chip is provided, comprising a processor and a communication interface, wherein the processor reads instructions stored in a memory through the communication interface and executes the method provided in any one of the above aspects or implementations thereof. The communication interface may be implemented in hardware or software.

[0090] Optionally, as an implementation method, the chip also includes a memory, in which a computer program or instruction is stored, and the processor is used to execute the computer program or instruction stored in the memory. When the computer program or instruction is executed, the processor is used to execute the method provided by any of the above aspects or its implementation methods.

[0091] When the method provided in this application is executed by a chip, this application does not limit the number of chips that implement the method. For example, the method can be executed by one chip or by two or more chips. Furthermore, when the number of chips implementing the method of this application is two or more, the chip manufacturers are not limited and can be the same manufacturer or different manufacturers.

[0092] In a fourteenth aspect, a communication system is provided, comprising at least one of the data management network element, terminal device or mobility management network element described above.

[0093] In a fifteenth aspect, a computer program is provided, which, when run on a computer, enables the method provided by any one of the above aspects or its implementation to be executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] FIG1 is a diagram of a network architecture applicable to an embodiment of the present application.

[0095] FIG2 is a schematic flow chart of the UPU process.

[0096] FIG3 is a schematic diagram of the format of a UPU container.

[0097] FIG4 is a schematic diagram of the data format of the UPU header.

[0098] FIG5 is a schematic diagram of the data format of the UPU list.

[0099] FIG6 is a schematic flow chart of the communication method provided in this application.

[0100] FIG. 7 is an example of the structure of the first UPU list.

[0101] FIG. 8 is another example of the structure of the first UPU list.

[0102] FIG. 9 is another example of the structure of the first UPU list.

[0103] FIG. 10 is another example of the structure of the first UPU list.

[0104] FIG11 is a schematic structural diagram of a device provided in an embodiment of the present application.

[0105] FIG12 is another schematic structural diagram of the device provided in an embodiment of the present application.

[0106] FIG13 is a schematic diagram of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0107] To facilitate understanding of the embodiments of the present application, the following explanations are made before introducing the embodiments of the present application.

[0108] "For indicating" or "indicating" may include direct indication and indirect indication, or "for indicating" or "indicating" may be explicitly and / or implicitly indicated. The first, second, and other numerical numbers are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application, such as distinguishing different messages, different information, etc. "Pre-definition" can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device, and the present application does not limit its specific implementation method. The "protocol" involved may refer to a standard protocol in the field of communications, for example, it may include the long term evolution (LTE) protocol, the new radio (NR) protocol and related protocols used in future communication systems, and the present application does not limit this. Words such as "exemplary", "for example", "exemplarily", "as (another) example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as an "example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or design schemes. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized. "At least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c. Where a, b and c can be single or multiple, respectively. Descriptions of network element A sending a message, information, or data to network element B, or network element B receiving a message, information, or data from network element A, are intended to clarify the network element to which the message, information, or data is sent, and do not limit whether the messages, information, or data are sent directly or indirectly through other network elements. Phrases such as "when," "under the circumstances," "if," and "if" all imply that the device will take appropriate action under certain objective circumstances. They do not specify a time limit, do not require the device to perform a judgment action, and do not imply any other limitations.

[0109] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0110] A communication system to which the embodiments of the present application can be applied is described below.

[0111] The embodiments of the present application can be applied to various communication systems, such as LTE system, frequency division duplex (FDD) system, time division duplex (TDD) system, universal mobile telecommunication system (UMTS), world-wide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) communication system, th generation, 5G) system or NR system, sixth generation (6 th generation, 6G) system or future communication system, etc. The 5G mobile communication system described in this application includes a non-standalone (NSA) 5G mobile communication system or a standalone (SA) 5G mobile communication system. The communication system can also be a public land mobile network (PLMN) network, a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, an Internet of Things (IoT) communication system, a vehicle to everything (V2X) communication system, an uncrewed aerial vehicle (UAV) communication system or other communication systems.

[0112] For example, Figure 1 illustrates a network architecture diagram applicable to embodiments of the present application. As shown in Figure 1 , the network architecture may specifically include three parts: a terminal device part, a data network (DN), and an operator network part. The following briefly describes the functions of the network elements in each part.

[0113] The terminal device portion may include a terminal device, which may also be referred to as user equipment (UE). The terminal device in this application is a device with wireless transceiver capabilities that can communicate with one or more core network (CN) devices via an access network device (or also referred to as an access device) in the radio access network (RAN) 140. The terminal device may also be referred to as an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent, or user device. The terminal device may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on water (e.g., ships); it may also be deployed in the air (e.g., airplanes, balloons, and satellites). The terminal device may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. Alternatively, the terminal device may also be a handheld device with wireless communication capabilities, a computing device, or other device connected to a wireless modem, an in-vehicle device, a wearable device, a drone device, or an Internet of Things, a terminal in the Internet of Vehicles, a terminal in any form in a 5G network and future networks, a relay user device, or a terminal in a future evolved 6G network, etc. Among them, the relay user device may be, for example, a 5G residential gateway (RG). For example, the terminal device may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical care, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The terminal device here refers to a 3GPP terminal. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

[0114] A data network, also known as a packet data network (PDN), is typically located outside of a carrier's network, such as a third-party network. Of course, in some implementations, the DN can also be deployed by the carrier, meaning the DN is part of the PLMN. A carrier's network can access multiple data network DNs, which can host a variety of services and provide data and / or voice services to terminal devices. Terminal devices can also access data network DNs through the carrier's network and use carrier services deployed on the data network DNs and / or services provided by third parties.

[0115] The operator network part includes but is not limited to the (radio) access network (R)AN) part and the core network (CN) part.

[0116] (R)AN can be regarded as a sub-network of the operator network, and is an implementation system between the service node and the terminal device in the operator network. To access the operator network, the terminal device must first pass through the (R)AN, and then connect to the service node of the operator network through the (R)AN. The access network device (RAN device) in the embodiment of the present application is a device that provides wireless communication functions for the terminal device, and can also be called a network device. The RAN device includes but is not limited to: the next generation node base station (gNB) in the 5G system, the evolved node B (eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (for example, home evolved node B, or home node B, HNB), the base band unit (BBU), the transmission point (TRP), the transmitting point (TP), the small base station device (pico), the mobile switching center, or the network equipment in the future network. In systems using different wireless access technologies, the names of devices with access network device functions may be different. The embodiments of this application do not limit the specific technologies and specific device forms used by the access network devices.

[0117] The CN part includes but is not limited to the following network functions (NF): user plane function (UPF), network exposure function (NEF), network function repository function (NRF), policy control function (PCF), UDM, UDR, network data analytics function (NWDAF), authentication server function (AUSF), access and mobility management function (AMF), session management function (SMF) and application function (AF).

[0118] The following is a brief description of the NF functions included in CN.

[0119] 1. UPF is the gateway for communication between the operator network and the data network DN. It mainly provides user plane functions such as forwarding and processing of user messages, connection with DN, session anchor point, and quality of service (QoS) policy execution.

[0120] 2. NEF is a control plane function that is primarily used to securely expose services and capabilities provided by 3GPP network functions to external parties (such as AF). NEF also allows authenticated and authorized application functions to securely provide information in the 3GPP network.

[0121] 3. NRF is a control plane function that can be used to maintain real-time information of network functions and services in the network.

[0122] 4. PCF is the control plane function, which supports a unified policy framework to govern network behavior, provide policy rules to other control functions, and contract information related to policy decisions.

[0123] 5. UDM is a control plane function, which is mainly responsible for storing the contract data of contracted users in the operator network.

[0124] 6. UDR is a control plane function, mainly responsible for data storage and retrieval, such as providing the UDM with the function of storing and retrieving contract data, providing the PCF with the function of storing and retrieving policy data, and storing and retrieving the user's NF group ID information.

[0125] 7. AUSF is a control plane function, usually used for level 1 authentication, that is, authentication between terminal equipment (subscribers) and operator networks.

[0126] 8. AMF is a control plane function that is mainly responsible for access control and mobility management of terminal devices accessing the operator's network, such as mobile state management, allocation of user temporary identity, authentication and authorization of users, etc.

[0127] 9. SMF is the control plane function, which is mainly responsible for session management (such as session establishment, modification and release), selection and control of UPF network functions, service and session continuity (SSC) mode selection, roaming and other session-related functions.

[0128] 10. AF is a control plane function that provides application layer information. AFs are divided into two main categories: the first category is deployed by the operator and is considered to be trusted by the operator. This type of AF can directly interact with other network functions in the network; the second category is AF that the operator does not allow direct access to network functions, such as third-party AFs. This type of AF can interact with other network functions in the NEF network.

[0129] In Figure 1, Nnef, Nnrf, Npcf, Nudm, Nudr, Nausf, Namf, Nsmf, N1, N2, N3, N4, N6 and N9 are interface serial numbers. For example, the meaning of the above interface serial numbers can be found in the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers. It should be noted that the interface name between the various network functions in Figure 1 is only an example. In a specific implementation, the interface name of the system architecture may also be other names, and this application does not limit this. In addition, the name of the message (or signaling) transmitted between the above-mentioned network elements is also only an example and does not constitute any limitation on the function of the message itself. In the network architecture shown in Figure 1, the network elements can communicate with each other through interfaces. The interface between the network elements can be a point-to-point interface or a service-oriented interface, which is not limited by this application.

[0130] It should be understood that the network architecture shown above is only an exemplary illustration, and the network architecture applicable to the embodiments of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiments of the present application.

[0131] It should also be understood that the AMF, SMF, UPF, PCF, UDM, AUSF, UDR, NEF, NRF, AF and other functions or network elements shown in Figure 1 can be understood as network elements for implementing different functions, for example, they can be combined into network slices as needed. These network elements can be independent devices, or they can be integrated into the same device to implement different functions, or they can be network elements in hardware devices, or they can be software functions running on dedicated hardware, or they can be virtualized functions instantiated on a platform (for example, a cloud platform). This application does not limit the specific form of the above network elements.

[0132] It should also be understood that the above naming is defined only to facilitate the distinction between different functions and should not constitute any limitation to this application. This application does not exclude the possibility of adopting other naming in 6G networks and other future networks. For example, in a 6G network, some or all of the above network elements may continue to use the terminology used in 5G, or may adopt other names.

[0133] To facilitate understanding of the embodiments of the present application, some terms involved in the embodiments of the present application are first explained.

[0134] 1. UE parameters update (UPU)

[0135] The UPU mechanism refers to the mechanism by which UDM updates UE parameters through the control plane process. After the UE successfully registers with the 5G system, the updated parameters can be securely delivered to the UE through UDM. In the process of securely delivering the updated parameters to the UE, UDM needs to rely on the security parameters calculated by AUSF (such as the UPU-MAC-I mentioned below). AUSF 、UPU-XMAC-I UE So before executing the UPU process, AUSF needs to complete the latest master authentication and store the latest K AUSF .

[0136] FIG2 is a schematic flow chart of the UPU process.

[0137] After the UE successfully authenticates and registers with the 5G system, the UDM can decide to proceed with the UPU process at any time. The UPU security process can be shown in Figure 2.

[0138] Step 201: UDM decides to execute UPU.

[0139] Exemplarily, when the UE registers to the 5G system, the UDM decides to perform UPUs through the control plane. The UDM then prepares a UPU list, where the UPU list may include parameters protected by a security grouping mechanism and / or UE parameters whose final consumer is a mobile equipment (ME). If the final consumer of the UE parameters to be updated (e.g., updated routing ID data) is a universal subscriber identity module (USIM), the UDM should use a security grouping mechanism to protect these parameters in order to update these parameters stored on the USIM.

[0140] Steps 202-203: UDM calls the Nausf_UPUProtection service operation and sends the UPU list to AUSF via the Nausf_UPUProtection service operation message to obtain the message authentication code. AUSF (UPU-MAC-I AUSF ) and count value UPU (Counter UPU ).

[0141] For example, the Nausf_UPUProtection message in step 202 includes the UE's SUPI and UPU list, and the Nausf_UPUProtection response message in step 203 carries UPU-MAC-I AUSF and Counter UPU .

[0142] Optionally, if the UDM requires the UE to respond to the successful security check of the UPU list it received, the UDM may carry an ACK indication in the Nausf_UPUProtection message to indicate that the UDM needs the expected UPU-XMAC-I UE The AUSF can carry UPU-XMAC-I in the Nausf_UPUProtection response message. UE .

[0143] AUSF can be based on K AUSF The key is calculated to obtain UPU-MAC-I AUSF , K AUSF K stored after completing the latest master authentication AUSF . In calculating UPU-MAC-I AUSF When the input parameters can include the UPU list and Counter provided by UDM UPU, so that through UPU-MAC-I AUSF , UE can verify the UPU list and Counter UPU Integrity during transmission. Through the expected UPU-XMAC-I UE , UDM can verify whether the UE has received the UPU list correctly.

[0144] Step 204, UDM shall call Nudm_SDM_Notification service operation to send UPU list, UPU-MAC-I AUSF and Counter UPU Sent to AMF.

[0145] If AMF supports UPU transparent container, then the Nudm_SDM_Notification message includes UPU transparent container, which includes UPU list, UPU-MAC-I AUSF and Counter UPU .

[0146] If AMF does not support UPU transparent container, then the Nudm_SDM_Notification message contains UPU list, UPU-MAC-I in the access and mobile subscription data. AUSF and Counter UPU An independent information element (IE).

[0147] Optionally, if the UDM requires the UE to respond with a successful security check confirmation of the UPU list it received, the UDM will temporarily store the UPU-XMAC-I UE .

[0148] Step 205: After receiving the Nudm_SDM_Notification message, the AMF sends a downlink (DL) non-access stratum (NAS) transport message (DL NAS transport) to the UE.

[0149] If a UPU transparent container is received from the UDM in step 204, the AMF forwards the UPU transparent container to the UE, i.e., includes the received UPU transparent container in the DL NAS transport message.

[0150] If the UDM provides the UPU list, UPU-MAC-I in step 204 AUSF and Counter UPUIndependent information element, then AMF according to UPU list, UPU-MAC-I AUSF and Counter UPU Construct a UPU transparent container and include the constructed UPU transparent container in the DL NAS transport message.

[0151] Step 206: After receiving the DL NAS transport message, the UE verifies the UPU-MAC-I AUSF .

[0152] For example, the UE receives the UPU list and the Counter UPU , using AUSF to calculate UPU-MAC-I AUSF UPU-MAC-I is calculated in the same way AUSF , and verify the calculated UPU-MAC-I AUSF UPU-MAC-I in the UPU transparent container in the DL NAS transport message AUSF Whether it matches.

[0153] If the two match, that is, UPU-MAC-I AUSF If the verification is successful and the UPU list includes parameters protected by the security packet mechanism, the ME forwards these security packets to the USIM.

[0154] If the two match, that is, UPU-MAC-I AUSF If the verification is successful and the UPU list includes parameters that are not protected by the security grouping mechanism, the ME updates its stored parameters according to the parameters received in the UPU list.

[0155] Step 207: If the UDM has requested the UE to confirm the successful security check of the UPU list, and the UE has successfully verified and updated the UPU list provided by the UDM, then the UE may send an uplink (UL) NAS Transport message to the serving AMF and carry the UPU-MAC-I in the UL NAS Transport message. UE .

[0156] Among them, UE receives Counter UPU , using UPU-XMAC-I calculated with AUSF UE UPU-MAC-I is calculated in the same way UE UPU-MAC-I UE Can be placed in a transparent container.

[0157] Step 208: If a UPU-MAC-I is received in the UL NAS transmission message, UE If a transparent container is present, the AMF sends a Nudm_SDM_Info message with the transparent container to the UDM.

[0158] Step 209: If the UDM has requested the UE to confirm the successful security check of the UPU list, the UDM will receive the UPU-MAC-I UE The UPU-XMAC-I temporarily stored in step 204 UE The comparison is performed to determine whether the UE has received the UPU list correctly.

[0159] For a more detailed description of the UPU process, please refer to the relevant standard protocols.

[0160] 2. UPU container

[0161] A UPU container is also called a UPU transparent container. When sent from the network to the UE, the purpose of the UPU container is to provide the UE with a UPU list and an optional ACK request and / or re-registration request. When sent from the UE to the network, the purpose of the UPU container is to indicate to the UE an acknowledgment of the successful receipt of the UE parameter update transparent container.

[0162] The following describes the format of the UPU sent from the network to the UE.

[0163] FIG3 is a schematic diagram of the format of a UPU container.

[0164] When sent from the network to the UE, the UPU container includes the UPU transparent container information element identifier (UE parametersupdatetransparentcontainer IEI), the length of the UPU transparent container content (lengthofUE parametersupdatetransparentcontainercontents), the UPU header (UE parametersupdateheader), the UPU-MAC-I AUSF , count value UPU (Counter UPU ) and UPU list (UE parametersupdatelist), the bytes occupied by each part are shown in the figure.

[0165] 1) UPU transparent container cell identifier: represents the identifier of the UPU container, used to uniquely identify the UPU container.

[0166] 2) Length of the UPU transparent container content: indicates the length of the UPU container.

[0167] 3) UPU header: indicates the header of the UPU container.

[0168] Figure 4 is a schematic diagram of the data format of the UPU header. As shown in Figure 4, the UPU header may include a UPU data type flag, an ACK flag, a re-registration (REG) flag, and five idle bits. The UPU data type flag, ACK flag, REG flag, and five idle bits respectively occupy bits 1 to 8 of the byte where the UPU header is located. The UPU data type flag is used to indicate whether the UPU container carries a UPU list or carries confirmation information for the successful reception of the UPU list. In other words, the UPU data type flag is used to indicate whether the UPU container exists in a downlink UPU message or an uplink UPU message. The ACK flag is used to indicate whether the UE is requested to reply with an acknowledgment message. The REG flag is used to indicate whether the UE is requested to re-register.

[0169] 4)UPU-MAC-I AUSF : The message authentication code of the UPU container is used to protect the integrity of the transmitted content.

[0170] 5) Counter UPU : Count value, used as a freshness parameter to protect the message transmission process from replay attacks.

[0171] 6) UPU list: used to carry parameters to be updated, also known as UPU data. This article uniformly uses the UPU list for description.

[0172] Figure 5 is a schematic diagram of the data format of a UPU list. As shown in Figure 5, a UPU list consists of several UPU datasets. Each UPU dataset includes a UPU dataset type field (UE parameters update data set type), a UPU dataset length field (length of UE parameters update data set), a UPU dataset field (UE parameters update data set), and four spare bits. The UPU dataset type field is used to indicate the type of the UPU dataset (or the type of UE parameters carried by the UPU dataset) and occupies four bits. The currently used type number range is 0001-0100. The UPU dataset length field is used to indicate the length of the UPU dataset. The UPU dataset field, also known as the UPU data field, is used to carry data (i.e., the parameters to be updated). The four spare bits occupy the same byte as the UPU dataset type field. Specifically, the UPU data type field occupies bits 1 to 4 of the byte, and bits 5 to 8 of the byte are spare bits.

[0173] From the above content, we can see that in the current UPU process, when calculating UPU-MAC-I AUSF When the input parameters include UPU list and Counter UPU , that is, UPU list and Counter UPU Integrity protection is performed, in other words, the contents of the UPU container after byte 21 are integrity protected. However, the header of the UPU container (i.e., the UPU header field) is not protected, and the UPU header is at risk of being tampered with during transmission.

[0174] To address the above issues, this application proposes a communication method and device that achieve integrity protection for the UPU header while minimizing changes to the message format. Specifically, this application can copy the UPU container header and place it in the UPU list. Since the current UPU process already protects the integrity of the UPU list, copying the UPU container header and placing it in the UPU list can also protect the UPU container header.

[0175] The following describes the method embodiments of the present application.

[0176] Figure 6 is a schematic flow chart of the communication method provided in this application. Method 600 can be performed by a UE or a module or unit in the UE, a mobility management network element or a module or unit in the mobility management network element, an authentication network element or a module or unit in the authentication network element, and a data management network element or a module or unit in the data management network element. For ease of description, the following description uniformly uses the UE, mobility management network element, authentication network element, and data management network element.

[0177] It should be noted that the mobility management network element, authentication network element and data management network element may have different names in different communication systems, and this application is not limited. For example, in the 5G system shown in Figure 1, the mobility management network element may be AMF, the authentication network element may be AUSF, and the data management network element may be UDM.

[0178] Method 600 includes at least part of the following.

[0179] Step 601: When it is necessary to update the parameters of the UE, the data management network element sends a first request message to the authentication network element, or in other words, the authentication network element receives the first request message from the data management network element.

[0180] The first request message includes an identifier of the UE and a first UPU list, wherein the first UPU list includes parameters of the UE to be updated, and the first request message is used to request security protection of the first UPU list. In addition to including the parameters of the UE to be updated, the first UPU list in the embodiment of the present application also includes a first header of a UPU container, wherein the UPU container is a container for carrying the first UPU list.

[0181] The first header is used to carry information from the network (or data management network element) to the UE. The UE can perform corresponding operations based on the information in the first header. Exemplarily, the first header may include at least one of a first flag, a second flag, and a third flag. The first flag is used to indicate that the UPU container carries a UPU list or carries confirmation information of successfully receiving the UPU list. For example, the first flag is a UPU data type flag. When the UPU data type flag is 0, it indicates that the UPU container carries a UPU list. When the UPU data type flag is 0, it indicates that the UPU container carries confirmation information of successfully receiving the UPU list. Step 601 corresponds to the case where the first flag is used to indicate that the UPU container carries the UPU list. The second flag is used to indicate whether to request the UE to reply with confirmation information or whether to request an ACK. For example, the second flag is an ACK flag. The third flag is used to indicate whether to request the UE to re-register or whether to request re-registration. For example, the third flag is a REG flag.

[0182] For example, the data management network element may call the Nausf_UPUProtection service operation request to perform security protection on the first UPU list, that is, the first request message may be a Nausf_UPUProtection message, the UE identifier may be the SUPI of the UE, and the first message authentication code may be UPU-MAC-I AUSF , the count value can be Counter UPU .

[0183] Optionally, step 602 may be included before step 601, in which the data management network element determines to update the UE's parameters. In other words, the data management network element decides to execute the UPU procedure for the UE. After the UE is successfully authenticated and registered with the network, the data management network element may decide to execute the UPU procedure at any time.

[0184] There are many structures of the first UPU list in the embodiment of the present application, which are not limited.

[0185] In a possible implementation, the first header is stored in the first UPU list as a new type of data set.

[0186] Exemplarily, the structure of the first UPU list in this implementation manner may be as shown in the following first structure.

[0187] 1) The first structure

[0188] The first UPU list includes a first data set and a second data set.

[0189] The first data set includes a first type field, a first length field, and a first data field. The first type field indicates that the first data set is a data set that carries the first header. Alternatively, the first type field indicates a first type, which indicates that the first data set is used to carry the first header. The first type is different from the type of currently used data sets, allowing the UE to distinguish it from the type of currently used data sets and allowing the UE to find the data set that carries the first header. The first length field indicates the length of the first data set. The first data field is used to carry the first header.

[0190] The second data set includes a second type field, a second length field, and a second data field. The second type field is used to indicate the type of the second data set, or the type of the parameter to be updated. The second length field is used to indicate the length of the second data set. The second data field is used to carry the parameter to be updated. Exemplarily, the parameter to be updated can be any one of the following data: routing ID update data (routingindicatorupdatedata), default configured NSSAI update data (defaultconfiguredNSSAI updatedata), disaster roaming information update data (disasterroaminginformationupdatedata), or ME routing ID update data (ME routingindicatorupdatedata).

[0191] It should be noted that the embodiments of the present application do not limit whether the first UPU list also includes other data sets. The first UPU list may include only the first data set and the second data set, or may include data sets other than the first data set and the second data set.

[0192] FIG. 7 is an example of the structure of the first UPU list.

[0193] As shown in Figure 7, the first UPU list consists of several UPU data sets, each of which contains the following three fields: a UPU data set type field, a UPU data set length field, and a UPU data set field. The UPU data set type field can correspond to the type field of the data set mentioned above, the UPU data set length field can correspond to the length field of the data set mentioned above, and the UPU data set field can correspond to the data field of the data set mentioned above. Among them, the UPU data set type field is used to indicate the type of the UPU data set, occupying the 1st to 4th bits of a byte, and the 5th to 8th bits of the byte are idle bits, and the value of the idle bit can be 0. The UPU data set length field is used to indicate the length of the UPU data set, occupying one byte. The UPU data set field is used to carry the data in the UPU data set, that is, the parameters to be updated, and can occupy several bytes.

[0194] FIG7 takes the example of the first header carried by UPU dataset m. As shown in FIG7 , the value of the UPU dataset type field of UPU dataset m is an unused 4-bit type number. Assuming the currently used type numbers are 0001-0100, the value of the UPU dataset type field of the mth dataset can be a type number other than 0001-0100. The UPU dataset field of UPU dataset m stores the first header. The value of the UPU dataset length field of UPU dataset m is the length of UPU dataset m.

[0195] It should be noted that the UPU data set m can be any one of the several data sets included in the first UPU list.

[0196] In another possible implementation, an additional field may be added to the first UPU list to store the first header.

[0197] Specifically, the first UPU list includes a data set and a first header. The data set includes a type field, a length field, and a data field. The type field indicates the type of the data set, the length field indicates the length of the data set, and the data field carries the data in the data set, namely, the parameters to be updated. The data set described here may be the data set adjacent to the first header. For ease of description, this data set will be referred to as the third data set below.

[0198] Optionally, the first header may be at a preset position in the first UPU list. Exemplarily, the structure of the first UPU list in this implementation may be as shown in the second and third structures below.

[0199] 2) The second structure

[0200] The preset position is after the third data set, which may be the last data set among all data sets included in the first UPU list. In other words, the first header is after the last data set in the first UPU list. The last data set in the first UPU list may refer to the data set corresponding to the last number after all data sets included in the UPU are numbered sequentially.

[0201] FIG. 8 is another example of the structure of the first UPU list.

[0202] As shown in Figure 8, the first UPU list consists of n UPU data sets and a first header. The n UPU data sets are numbered from 1 to n, with UPU data set n being the third data set, i.e., the last UPU data set. Each UPU data set contains the following three fields: a UPU data set type field, a UPU data set length field, and a UPU data set field. The UPU data set type field can correspond to the data set type field mentioned above, the UPU data set length field can correspond to the data set length field mentioned above, and the UPU data set field can correspond to the data field mentioned above. The UPU data set type field indicates the type of the UPU data set and occupies bits 1 to 4 of a byte. Bits 5 to 8 of the same byte are idle bits and can be 0. The UPU data set length field indicates the length of the UPU data set and occupies one byte. The UPU data set field carries the data in the UPU data set, i.e., the parameters to be updated, and can occupy several bytes. The first header can be located one byte after UPU data set n (i.e., the last UPU data set).

[0203] 3) The third structure

[0204] The preset position is before the third data set. The third data set may be the first data set among all data sets included in the first UPU list. In other words, the first header precedes the first data set in the first UPU list. The first data set in the first UPU list may be the data set corresponding to the first number after all data sets included in the UPU are numbered sequentially.

[0205] For example, if the UPU container starts with the 23rd byte and is the first UPU list, the first header may be located at the 23rd byte of the UPU container.

[0206] FIG. 9 is another example of the structure of the first UPU list.

[0207] As shown in Figure 9, the first UPU list consists of n UPU data sets and a first header. The n UPU data sets are numbered from 1 to n, with UPU data set 1 being the third data set, i.e., the first UPU data set. Each UPU data set contains the following three fields: a UPU data set type field, a UPU data set length field, and a UPU data set field. The UPU data set type field can correspond to the data set type field mentioned above, the UPU data set length field can correspond to the data set length field mentioned above, and the UPU data set field can correspond to the data field mentioned above. The UPU data set type field indicates the type of the UPU data set and occupies bits 1 to 4 of a byte. Bits 5 to 8 of the same byte are idle bits and can be 0. The UPU data set length field indicates the length of the UPU data set and occupies one byte. The UPU data set field carries the data in the UPU data set, i.e., the parameters to be updated, and can occupy several bytes. The first header can be located one byte before UPU data set 1 (i.e., the first UPU data set).

[0208] Optionally, the first header may be after any data set in the first UPU list, that is, the third data set may be any data set in the first UPU list. In this case, the third data set may be identified by a flag bit so that the receiving end of the first UPU list (such as a UE) can locate the third data set and obtain the first header after the third data set. Exemplarily, the structure of the first UPU list in this implementation may be as shown in the fourth structure below.

[0209] 4) The fourth structure

[0210] The first header follows the third data set. In addition to the type field, length field, and data field, the third data set also includes a fourth flag bit. This fourth flag bit is used to indicate whether the third data set follows the first header or whether the third data set does not follow the first header. For example, when the fourth flag bit is 1, it indicates that the third data set follows the first header; when the fourth flag bit is 0, it indicates that the third data set does not follow the first header. Step 601 may correspond to the case where the fourth flag bit is used to indicate that the third data set follows the first header.

[0211] Exemplarily, the fourth flag bit may occupy an idle bit in the third data set.

[0212] It should be noted that if the third data set is the last data set in the first UPU list, the first header can be placed after the data set. If the third data set is a data set other than the last data set in the UPU list, the first header is placed after the third data set and before the fourth data set. The fourth data set is the first data set after the third data set in the sort order.

[0213] FIG. 10 is another example of the structure of the first UPU list.

[0214] As shown in FIG10 , the first UPU list consists of n UPU data sets and a first header, and the n UPU data sets are numbered from 1 to n.

[0215] Each UPU data set in the first UPU list contains the following three fields: a UPU data set type field, a UPU data set length field, and a UPU data set field. The UPU data set type field may correspond to the type field of the data set mentioned above, the UPU data set length field may correspond to the length field of the data set mentioned above, and the UPU data set field may correspond to the data field of the data set mentioned above. Among them, the UPU data set type field is used to indicate the type of the UPU data set, occupying the 1st to 4th bits of a byte, and the 5th to 8th bits of the byte are idle bits, and the value of the idle bit can be 0. The UPU data set length field is used to indicate the length of the UPU data set, occupying one byte. The UPU data set field is used to carry the data in the UPU data set, that is, the parameters to be updated, and may occupy several bytes.

[0216] Figure 10 takes the third data set as UPU data set m as an example. One of the four idle bits of UPU data set m is used as the fourth flag bit (Figure 10 takes the first idle bit as an example) to indicate that there is a first header after UPU data set m.

[0217] In an embodiment of the present application, the third data set includes a fourth flag bit, which helps to ensure the compatibility of the UPU container during the transmission process. It can be understood that the value of the fourth flag bit can inform the receiving device of the UPU container (such as UE) whether there is a first header after the third data set. If the fourth flag bit indicates that there is no first header after the third data set, then the receiving device of the UPU container processes the UPU container according to the existing process. If the fourth flag bit indicates that there is a first header after the third data set, then the receiving device of the UPU container processes the UPU container according to the process mentioned in this application, which can take into account the transmission of the existing UPU container and the UPU container provided by the embodiment of the present application.

[0218] In addition, the method of identifying the third data set by the fourth flag bit can also be applied to the case where the third data set is a specified or fixed data set in the first UPU list, without limitation. If the third data set is a specified data set or a fixed data set, the fourth flag bit is optional, that is, the third data set may have a fourth flag bit or may not have a fourth flag bit. Taking the case where the third data set is fixed as the last data set as an example, since the third data set is fixed as the last data set, even if the last data set does not include the fourth flag bit, the transmitter of the first UPU list can also fixedly place the first header after the last data set of the first UPU list, and the receiver of the first UPU list can also fixedly read the first header placed after the last data set of the first UPU list.

[0219] The embodiments of the present application do not limit the specific manner in which the data management network element constructs the first UPU list.

[0220] A possible implementation method is that when the first UPU list adopts the first structure mentioned above, the data management network element can first construct a header of a UPU container for carrying the first UPU list (for the convenience of description, this header is referred to as the second header); the data management network element constructs multiple data sets. Specifically, the data management network element constructs data sets other than the first data set (such as the second data set) among the multiple data sets in an existing manner. When constructing the first data set among the multiple data sets, the data management network element sets the type of the first data set to the first type, which is used to indicate that the data field of the first data set stores a copy of the second header (for the convenience of description, the copy version is referred to as the first header), stores the first header in the data field of the first data set, and then calculates the length of the first data set and stores the obtained length in the length field of the first data set; then the data management network element assembles the multiple data sets into the first UPU list.

[0221] Another possible implementation method is that when the first UPU list adopts the second structure mentioned above, the data management network element can first construct a header of the UPU container for carrying the first UPU list (for the convenience of description, this header is called the second header); the data management network element constructs one or more data sets in an existing manner; after the data management network element assembles all the data sets together, it copies the second header (the copied version is the first header) and appends it to the last data set to obtain the first UPU list.

[0222] Another possible implementation method is that when the first UPU list adopts the third structure mentioned above, the data management network element can first construct a header of the UPU container for carrying the first UPU list (for the convenience of description, this header is called the second header); the data management network element constructs one or more data sets in an existing manner; after the data management network element assembles all the data sets together, it copies the second header (the copied version is the first header) and appends it before the first data set, thereby obtaining the first UPU list.

[0223] Another possible implementation method is that when the first UPU list adopts the above-mentioned fourth structure, the data management network element can first construct a header of the UPU container for carrying the first UPU list (for the convenience of description, this header is called the second header); the data management network element constructs one or more data sets in an existing manner; the data management network element assembles all data sets together; the data management network element arbitrarily selects a data set, copies the second header (the copied version is the first header) and appends it to the selected data set, and selects one from the free bits of the selected data set as the fourth flag bit, and sets the fourth flag bit to 1 to indicate that the data set is followed by the first header.

[0224] It should be noted that the above-mentioned construction method of the first UPU list is only exemplary. The first UPU list in the embodiment of the present application can also be constructed in other ways without limitation.

[0225] In addition, it should be noted that if the data management network element requires the UE to respond to the successful security check of the first UPU list it has received, the data management network element may also carry ACK indication information in the first request message to indicate that the data management network element needs a fourth message authentication code, wherein the fourth message authentication code is used by the data management network element to verify whether the UE has correctly received the first UPU list. For example, when the data management network element obtains security parameters from the authentication network element by calling the Nausf_UPUProtection service operation, the fourth message authentication code may be UPU-XMAC-I UE .

[0226] Step 603: The authentication network element sends a first response message to the data management network element, or in other words, the data management network element receives the first response message from the authentication network element.

[0227] The first response message includes a first message authentication code and a count value corresponding to the first message authentication code. The first message authentication code is used to protect the integrity of the first UPU list. The count value is used to prevent replay attacks. The count value corresponding to the first message authentication code can be understood as the count value used to calculate the first message authentication code.

[0228] Illustratively, after the authentication network element receives the first request message, the authentication network element may obtain a corresponding count value based on the received UE identifier, calculate a first message authentication code based on the received first UPU list and the obtained count value, and then send the first message authentication code and the count value to the data management network element via a first response message. The manner in which the authentication network element calculates the first message authentication code based on the received first UPU list and the count value corresponding to the UE can be referenced to Appendix A.19 of the standard protocol TS33.501 and is not described in detail here.

[0229] It should be noted that if the data management network element indicates to the authentication network element that the data management network element requires a fourth message authentication code, the authentication network element further calculates the fourth message authentication code and includes the fourth message authentication code in the first response message. After receiving the first response message, the data management network element may store the fourth message authentication code to subsequently verify whether the UE correctly received the first UPU list. The manner in which the authentication network element calculates the fourth message authentication code can be found in Appendix A.20 of the standard protocol TS33.501 and is not described in detail here.

[0230] For example, when the data management network element calls the Nausf_UPUProtection service operation, the first response message may be a Nausf_UPUProtection response message, and the first message authentication code may be a UPU-MAC-I AUSF , the count value can be Counter UPU , the fourth message authentication code can be UPU-XMAC-I UE .

[0231] Step 604: The data management network element sends a notification message to the mobility management network element, or in other words, the mobility management network element receives a notification message from the data management network element.

[0232] The notification message includes a first UPU list, a first message authentication code and a count value.

[0233] If the mobility management network element supports UPU containers, the data management network element constructs a UPU container based on the first UPU list, the first message authentication code, and the count value, and includes the UPU container in the notification message. For example, the structure of the UPU container may be as shown in FIG3 , including a UPU container information element identifier, the length of the UPU container content, a UPU header, a first message authentication code, a count value, and a first UPU list. The first UPU list includes a first header, which may correspond to the second header described above.

[0234] If the mobility management network element does not support UPU containers, the first UPU list, the first message authentication code, and the count value may be sent to the mobility management network element as independent information elements in a notification message, so that the mobility management network element can construct the UPU container. For example, they may be sent to the mobility management network element as independent information elements in access and mobility subscription data. Optionally, the notification message also includes second information for determining the second header, so that the mobility management network element can correctly construct the UPU container. Optionally, the second information may be a second header, that is, the data management network element may provide the constructed UPU header to the mobility management network element. Optionally, the second information may be information required to construct the second header, such as whether to request the UE to reply with confirmation information or whether to request the UE to re-register.

[0235] Exemplarily, the notification message may be a Nudm_SDM_Notification message.

[0236] Step 605: The mobility management network element sends a UPU container to the UE.

[0237] If the UPU container is received from the data management network element in step 604, the mobility management network element forwards the UPU container to the UE.

[0238] If the data management network element provides the first UPU list, the first message authentication code, and the count value as independent information elements in step 604, the mobility management network element constructs a UPU container based on the first UPU list, the first message authentication code, and the count value. Alternatively, if the data management network element also provides second information, the mobility management network element constructs a UPU container based on the first UPU list, the first message authentication code, the count value, and the second header.

[0239] Exemplarily, the mobility management network element may send the UPU container to the UE via a DL NAS transport message.

[0240] Step 606: The UE verifies the message authentication code.

[0241] Exemplarily, the UE calculates the second message authentication code based on the received first UPU list and count value in the same manner as the authentication network element calculates the first message authentication code, and performs integrity authentication based on the first message authentication code and the second message authentication code.

[0242] If the first message authentication code and the second message authentication code do not match, that is, if the integrity authentication fails, the UE discards the received UPU container. In one possible implementation, the UE may also send a UPU uplink message to the data management network element via the mobility management network element, notifying the data management network element that the integrity authentication of the first UPU list has failed. For example, the UE may include a fifth message authentication code in the UPU uplink message. The fifth message authentication code may be obtained based on the count value used when the integrity authentication was previously successful.

[0243] If the first message authentication code and the second message authentication code match, that is, the integrity authentication is successful, then the UE obtains the first header in the first UPU list and performs subsequent operations based on the first header. As an example, when the third flag bit of the first header indicates that the UE is requested to re-register, the UE re-registers. As another example, when the second flag bit of the first header indicates that the UE is requested to reply to the confirmation information, the UE can determine the confirmation information based on the received count value, wherein the confirmation information includes the third message authentication code, and the third message authentication code is used by the data management network element to verify whether the UE has correctly received the first UPU list. Then, the UE sends the confirmation information to the data management network element, and the specific description is shown in steps 607 to 608 below.

[0244] It should be noted that when the first message authentication code and the second message authentication code match, the UE can directly use the first header as the header of the UPU container, or the UE can compare the first header with the second header outside the first UPU list. When the first header is the same as the second header, the UE uses the first header or the second header as the header of the UPU container. When the first header is different from the second header, the UE uses the first header as the header of the UPU container.

[0245] In addition, if the UE fails to read the first header from the first UPU list, for example, because the UE does not support the UPU list in that format, the UE may send first information to the data management network element. The first information is used to indicate that the UE failed to read the first header from the UPU container, so that the data management network element is informed that the UE does not support the UPU container in that format. Subsequently, the data management network element may no longer send the UPU container in that format to the UE. For example, the UE may carry the first information in the Res field of the UPU uplink message. The first information may be the cause of the failure. The cause of the failure may be, for example, a format parsing failure.

[0246] The embodiments of the present application do not limit the specific method in which the UE obtains the first header.

[0247] In a possible implementation, when the first UPU list adopts the first structure described above, the UE obtains the first header from the first data field of the first data set according to the first type field.

[0248] Another possible implementation method is that when the first UPU list adopts the second structure and the third structure mentioned above, the UE obtains the first header from the third data set according to the preset position. For example, if the preset position is 8 bits after the last data set and adjacent to the last data set, then the UE can find the last data set and read the 8 bits after the data set, or the UE can directly read the last 8 bits of the first UPU list and use the read content as the first header. For another example, if the preset position is 8 bits before the first data set and adjacent to the first data set, then the UE can find the first data set and read the 8 bits before the data set, or the UE can directly read the first 8 bits of the first UPU list and use the read content as the first header.

[0249] In another possible implementation, when the first UPU list adopts the fourth structure described above, the UE locates the third data set in the first UPU list based on the fourth flag bit and reads the first header from the data field of the third data set. For example, the UE reads the UPU data from the UPU container, iterates through all data sets, locates the third data set with the first header appended by the fourth flag bit, then points the pointer to the end of the third data set with the first header appended, reads 8 bits from this position, and uses the read content as the first header.

[0250] In step 607, if the UDM has requested the UE to confirm the successful security check of the first UPU list (such as the UE determines that the UE needs to confirm the successful security check of the first UPU list based on the ACK flag in the header of the determined UPU container), and the UE has successfully verified and updated the first UPU list provided by the UDM, then the UE can send a UPU uplink message to the mobile management network element and carry a third message authentication code in the UPU uplink message.

[0251] The third message authentication code is used by the data management network element to verify whether the UE has correctly received the first UPU list. For example, the third message authentication code may be UPU-MAC-I UE .

[0252] Exemplarily, the UE calculates the third message authentication code based on the received count value in the same manner as the authentication network element calculates the fourth message authentication code. The manner in which the UE calculates the third message authentication code can be found in Appendix A.20 of the standard protocol TS33.501 and will not be described in detail here.

[0253] Exemplarily, the UPU uplink message may be carried in a UL NAS Transport message, and the third message authentication code may be carried in a transparent container.

[0254] Step 608: If the transparent container with the third message authentication code is received, the mobility management network element may send a user information message with the transparent container to the data management network element.

[0255] Exemplarily, the user information message may be a Nudm_SDM_Info message.

[0256] After receiving the user information message, the data management network element may compare the received third message authentication code with the fourth message authentication code stored in step 603 to determine whether the UE has correctly received the first UPU list.

[0257] It should be noted that the first information and the third message authentication code may be carried in the same uplink UPU message, that is, the first information is also sent through steps 607 and 608. The first information and the third message authentication code may also be carried in different uplink UPU messages without limitation.

[0258] It should also be noted that the numbering of the above-mentioned first UPU list is only for the convenience of description and distinction, and the first UPU list can also be replaced by the UPU list.

[0259] The above describes in detail the method embodiment provided by the present application in conjunction with Figures 6 to 10 , and the following describes the device embodiment of the present application in conjunction with Figures 11 to 13 .

[0260] It is understood that, in order to implement the functions in the above embodiments, the apparatuses in Figures 11 to 13 include hardware structures and / or software modules corresponding to the functions. Those skilled in the art should readily appreciate that, in conjunction with the various exemplary units and method steps described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software.

[0261] Figures 11 and 12 are schematic diagrams of possible apparatuses provided in embodiments of the present application. These apparatuses can be used to implement the functions of the UE, mobility management network element, authentication network element, or data management network element in the above method embodiments, thereby also achieving the beneficial effects of the above method embodiments.

[0262] As shown in FIG. 11 , the device 10 includes a transceiver unit 11 and a processing unit 12 .

[0263] When the apparatus 10 is used to implement the functions of the UE in FIG6 , the transceiver unit 11 is used to execute the UE's transceiver steps, such as steps 605 and 607, and the processing unit 12 is used to execute the UE's processing steps, such as step 606. When the apparatus 10 is used to implement the functions of the mobility management network element in FIG6 , the transceiver unit 11 is used to execute the mobility management network element's transceiver steps, such as steps 604, 605, 607, and 608, and the processing unit 12 is used to execute the mobility management network element's processing steps. When the apparatus 10 is used to implement the functions of the authentication network element in FIG6 , the transceiver unit 11 is used to execute the authentication network element's transceiver steps, such as steps 601 and 603, and the processing unit 12 is used to execute the authentication network element's processing steps. When the device 10 is used to implement the function of the data management network element in Figure 6, the transceiver unit 11 is used to execute the transceiver steps of the data management network element, such as step 601, step 603, step 604 and step 608, and the processing unit 12 is used to execute the processing steps of the data management network element, such as step 602, etc.

[0264] For a more detailed description of the transceiver unit 11 and the processing unit 12 , please refer to the relevant description in the above method embodiment, which will not be described again here.

[0265] As shown in FIG12 , the apparatus 20 includes a processor 21. The processor 21 is coupled to a memory 23, which is used to store instructions. When the apparatus 20 is used to implement the method described above, the processor 21 is used to execute the instructions in the memory 23 to implement the functions of the processing unit 12 described above.

[0266] Optionally, the device 20 further includes a memory 23 .

[0267] Optionally, the apparatus 20 further includes an interface circuit 22. The processor 21 and the interface circuit 22 are coupled to each other. It will be appreciated that the interface circuit 22 may be a transceiver or an input / output interface. When the apparatus 20 is used to implement the method described above, the processor 21 is configured to execute instructions to implement the functions of the processing unit 12, and the interface circuit 22 is configured to implement the functions of the transceiver unit 11.

[0268] Exemplarily, when the device 20 is a chip applied to a UE, a mobility management network element, an authentication network element, or a data management network element, the chip implements the functions of the UE, the mobility management network element, the authentication network element, or the data management network element in the above-mentioned method embodiments. The chip receives information from other modules (such as a radio frequency module or antenna) in the UE, the mobility management network element, the authentication network element, or the data management network element, where the information is sent by other devices to the UE, the mobility management network element, the authentication network element, or the data management network element; or the chip sends information to other modules (such as a radio frequency module or antenna) in the UE, the mobility management network element, the authentication network element, or the data management network element, where the information is sent by the UE, the mobility management network element, the authentication network element, or the data management network element to other devices.

[0269] 13 is a schematic diagram of a chip system 30 according to an embodiment of the present application. The chip system 30 (or also referred to as a processing system) includes a logic circuit 31 and an input / output interface 32.

[0270] The logic circuit 31 may be a processing circuit in the chip system 30. The logic circuit 31 may be coupled to a storage unit and call instructions in the storage unit so that the chip system 30 can implement the methods and functions of the various embodiments of the present application. The input / output interface 32 may be an input / output circuit in the chip system 30, outputting information processed by the chip system 30 or inputting data or signaling information to be processed into the chip system 30 for processing.

[0271] As a solution, the chip system 30 is used to implement the operations performed by the UE, the mobility management network element, the authentication network element or the data management network element in the above various method embodiments.

[0272] For example, the logic circuit 31 is used to implement the processing-related operations performed by the UE, mobility management network element, authentication network element or data management network element in the above method embodiments; the input / output interface 32 is used to implement the sending and / or receiving-related operations performed by the UE, mobility management network element, authentication network element or data management network element in the above method embodiments.

[0273] The present application also provides a communication device, comprising a processor coupled to a memory, the memory being configured to store computer programs or instructions and / or data, the processor being configured to execute the computer programs or instructions stored in the memory, or to read data stored in the memory, to perform the methods described in the above method embodiments. Optionally, there are one or more processors. Optionally, the communication device includes a memory. Optionally, there are one or more memories. Optionally, the memory is integrated with the processor or provided separately.

[0274] The present application also provides a chip, including a processor, the processor and a memory are coupled, the memory is used to store computer programs or instructions, and the processor is used to execute the computer programs or instructions stored in the memory to implement the methods performed by the UE, mobility management network element, authentication network element or data management network element in the above-mentioned method embodiments.

[0275] The present application also provides a computer-readable storage medium storing computer instructions for implementing the methods executed by the UE, mobility management network element, authentication network element or data management network element in the above-mentioned method embodiments.

[0276] The present application also provides a computer program product comprising instructions, which, when executed by a computer, implement the methods performed by the UE, the mobility management network element, the authentication network element or the data management network element in the above-mentioned method embodiments.

[0277] The present application also provides a communication system, which includes at least one of the UE, mobility management network element, authentication network element or data management network element in the above embodiments.

[0278] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0279] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0280] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disk, mobile hard disk, compact disc read-only memory (CD-ROM), or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and storage medium can be located in an ASIC. In addition, the ASIC can be located in a UE, a mobility management network element, an authentication network element, or a data management network element. Of course, the processor and storage medium can also exist as discrete components in a UE, a mobility management network element, an authentication network element, or a data management network element.

[0281] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are performed in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, or other programmable device. The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; an optical medium, such as a digital video disk; or a semiconductor medium, such as a solid-state drive.

[0282] In the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0283] Unless otherwise indicated, all technical and scientific terms used in the embodiments of the present application have the same meaning as those generally understood by those skilled in the art of the technical field of the application. The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit the scope of the application. It should be understood that the above are for illustration, and the examples above are only for helping those skilled in the art to understand the embodiments of the present application, rather than limiting the application embodiments to the specific numerical values ​​or specific scenarios illustrated. Those skilled in the art can obviously carry out various equivalent modifications or changes based on the examples given above, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0284] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, a first request message is sent to the authentication network element, the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message is used to request security protection for the first UPU list, the first UPU list includes a first data set and a second data set, the first data set includes a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying the first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the first length field is used to indicate the length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message including a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code being used to perform integrity protection on the first UPU list; The first UPU list, the first message authentication code and the count value are sent to the terminal device through a mobile management network element.

2. The method according to claim 1, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: Receive first information from the terminal device, where the first information is used to indicate that the terminal device fails to read the first header from the UPU container.

4. The method according to any one of claims 1 to 3, characterized in that The sending the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element includes: A notification message is sent to the mobile management network element, wherein the notification message includes the first UPU list, the first message authentication code and the count value, and the notification message also includes second information, wherein the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value and the second information are carried in the notification message in the form of independent cells, and the second header is used to carry the information from the network to the terminal device.

5. A communication method, characterized in that: The method comprises: Receive a user equipment parameter update UPU container, the UPU container including a first UPU list, a first message authentication code and a count value corresponding to the first message authentication code, the first UPU list including a first data set and a second data set, the first data set including a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying the first header of the UPU container, the first header is used to carry information from the network to the terminal device, the first length field is used to indicate the length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated of the terminal device, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; Determine a second message authentication code according to the first UPU list and the count value; When the first message authentication code matches the second message authentication code, the first header and the parameter to be updated are obtained, and subsequent operations are performed according to the first header.

6. The method according to claim 5, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

7. The method according to claim 5 or 6, characterized in that: The acquiring the first header includes: acquiring the first header in the first data field according to the first type field; The acquiring the parameter to be updated includes: acquiring the parameter to be updated in the second data field according to the second type field.

8. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, a first request message is sent to the authentication network element, where the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, where the first request message is used to request security protection for the first UPU list, where the first UPU list includes a data set and a first header of a UPU container, where the UPU container is used to carry the first UPU list, where the first header is used to carry information given by the network to the terminal device, where the data set includes a type field, a length field, and a data field, where the type field is used to indicate the type of the parameter to be updated, where the length field is used to indicate the length of the data set, and where the data field is used to carry the parameter to be updated; receiving a first response message from the authentication network element, the first response message including a first message authentication code and a count value corresponding to the first message authentication code, the first message authentication code being used to perform integrity protection on the first UPU list; The first UPU list, the first message authentication code and the count value are sent to the terminal device through a mobile management network element.

9. The method according to claim 8, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

10. The method according to claim 8 or 9, characterized in that: The first header is located at a preset position of the first UPU list.

11. The method according to claim 10, characterized in that The preset position is after the data set, and the data set is the last data set in the first UPU list.

12. The method according to claim 10, characterized in that The preset position is before the data set, and the data set is the first data set in the first UPU list.

13. The method according to claim 8 or 9, characterized in that: The first header is located after the data set. The data set further includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is located after the data set.

14. The method according to claim 13, characterized in that The type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit among the 5th to 8th bits of the byte.

15. The method according to any one of claims 8 to 14, characterized in that The method further comprises: Receive first information from the terminal device, where the first information is used to indicate that the terminal device fails to read the first header from the UPU container.

16. The method according to any one of claims 8 to 15, characterized in that The sending the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element includes: A notification message is sent to the mobile management network element, wherein the notification message includes the first UPU list, the first message authentication code and the count value, and the notification message also includes second information, wherein the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value and the second information are carried in the notification message in the form of independent cells, and the second header is used to carry the information from the network to the terminal device.

17. A communication method, characterized in that: The method comprises: Receive a user equipment parameter update UPU container, the UPU container including a first UPU list, a first message authentication code, and a count value corresponding to the first message authentication code, the first UPU list including a data set and a first header of the UPU container, the first header is used to carry information from the network to the terminal device, the data set includes a type field, a length field, and a data field, the type field is used to indicate the type of the parameter to be updated of the terminal device, the length field is used to indicate the length of the data set, and the data field is used to carry the parameter to be updated; Determine a second message authentication code according to the first UPU list and the count value; When the first message authentication code matches the second message authentication code, the first header and the parameter to be updated are obtained, and subsequent operations are performed according to the first header.

18. The method according to claim 17, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

19. The method according to claim 17 or 18, characterized in that The first header is located at a preset position of the first UPU list.

20. The method according to claim 19, characterized in that The preset position is after the data set, and the data set is the last data set in the first UPU list.

21. The method according to claim 19, characterized in that The preset position is before the data set, and the data set is the first data set in the first UPU list.

22. The method according to any one of claims 19 to 21, characterized in that The obtaining the first header includes: According to the preset position, the first head is obtained.

23. The method according to claim 17 or 18, characterized in that The first header is located after the data set. The data set further includes a fourth flag bit, and the fourth flag bit is used to indicate that the first header is located after the data set.

24. The method according to claim 3, characterized in that The type field and the fourth flag bit are in the same byte, the type field occupies the 1st to 4th bits of the byte, and the fourth flag bit occupies one bit among the 5th to 8th bits of the byte.

25. The method according to claim 23 or 24, characterized in that The obtaining the first header includes: According to the fourth flag bit, the first header after the data set is obtained.

26. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, the data management network element sends a first request message to the authentication network element, the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message is used to request security protection for the first UPU list, the first UPU list includes a first data set and a second data set, the first data set includes a first type field, a first length field and a first data field, the first type field is used to indicate that the type of the first data set is a data set carrying the first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the first length field is used to indicate the length of the first data set, the first data field is used to carry the first header, the second data set includes a second type field, a second length field and a second data field, the second type field is used to indicate the type of the parameter to be updated, the second length field is used to indicate the length of the second data set, and the second data field is used to carry the parameter to be updated; The authentication network element obtains a count value according to the identifier of the terminal device, and determines a first message authentication code according to the first UPU list and the count value, where the first message authentication code is used to perform integrity protection on the first UPU list; The authentication network element sends a first response message to the data management network element, where the first response message includes the first message authentication code and the count value; The data management network element sends the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element.

27. The method according to claim 26, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

28. The method according to claim 26 or 27, characterized in that The data management network element sends the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element, including: The data management network element sends a notification message to the mobility management network element, where the notification message includes the first UPU list, the first message authentication code, and the count value, and the notification message also includes second information, where the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value, and the second information are carried in the notification message in the form of independent information elements; The mobility management network element generates the UPU container according to the first UPU list, the first message authentication code, the count value and the second information, wherein the UPU container includes the second header, the first UPU list, the first message authentication code and The count value, the second header is outside the first UPU list, and the second header is used to carry information from the network to the terminal device; The mobility management network element sends the UPU container to the terminal device.

29. A communication method, characterized in that: The method comprises: In the case where the parameters of the terminal device need to be updated, the data management network element sends a first request message to the authentication network element, the first request message includes the identifier of the terminal device and the first user equipment parameter update UPU list, the first request message is used to request security protection for the first UPU list, the first UPU list includes a data set and a first header of a UPU container, the UPU container is used to carry the first UPU list, the first header is used to carry information from the network to the terminal device, the data set includes a type field, a length field and a data field, the type field is used to indicate the type of the parameter to be updated, the length field is used to indicate the length of the data set, and the data field is used to carry the parameter to be updated; The authentication network element obtains a count value according to the identifier of the terminal device, and determines a first message authentication code according to the first UPU list and the count value, where the first message authentication code is used to perform integrity protection on the first UPU list; The authentication network element sends a first response message to the data management network element, where the first response message includes the first message authentication code and the count value; The data management network element sends the first UPU list, the first message authentication code and the count value to the terminal device through the mobile management network element.

30. The method according to claim 29, characterized in that The first header includes at least one of a first flag bit, a second flag bit and a third flag bit, the first flag bit is used to indicate that the UPU container carries a UPU list, the second flag bit is used to indicate whether the terminal device is requested to reply with confirmation information, and the third flag bit is used to indicate whether the terminal device is requested to re-register.

31. The method according to claim 29 or 30, characterized in that The data management network element sends the first UPU list, the first message authentication code, and the count value to the terminal device through the mobility management network element, including: The data management network element sends a notification message to the mobility management network element, where the notification message includes the first UPU list, the first message authentication code, and the count value, and the notification message also includes second information, where the second information is used to determine the second header of the UPU container, and the first UPU list, the first message authentication code, the count value, and the second information are carried in the notification message in the form of independent information elements; The mobility management network element generates the UPU container according to the first UPU list, the first message authentication code, the count value and the second information, the UPU container including the second header, the first UPU list, the first message authentication code and the count value, the second header is outside the first UPU list, and the second header is used to carry information given by the network to the terminal device; The mobility management network element sends the UPU container to the terminal device.

32. A communication device, characterized in that: The method comprises a module or a unit for executing the method as claimed in any one of claims 1 to 31.

33. A communication device, characterized in that: It includes a processor and an interface circuit, wherein the interface circuit is used to receive signals from other communication devices outside the communication device and transmit them to the processor or send signals from the processor to other communication devices outside the communication device, and the processor is used to implement the method as described in any one of claims 1 to 31 through a logic circuit or executing code instructions.

34. The communication device according to claim 33, characterized in that The communication device is a chip or a chip system.

35. A computer-readable storage medium, characterized in that: The storage medium stores a computer program or instruction, and when the computer program or instruction is executed by the communication device, the method according to any one of claims 1 to 31 is implemented.

36. A computer program product, characterized in that It comprises a computer program which, when being executed, implements the method according to any one of claims 1 to 31.

37. A communication system, characterized in that: include: A data management network element for executing the method according to any one of claims 1 to 4, and a terminal device for executing the method according to any one of claims 5 to 7; or A data management network element for executing the method as claimed in any one of claims 8 to 16, and a terminal device for executing the method as claimed in any one of claims 17 to 25.

Images