Authentication processing method and apparatus, terminal and network side device

Abstract

The present application relates to the technical field of communications, and discloses an authentication processing method and apparatus, a terminal and a network side device. The authentication processing method in embodiments of the present application comprises: a first network function receives first information from a second network function or a third network function; the first network function sends second information to the third network function on the basis of the first information, the second information comprising authentication information; the third network function sends third information to an access network device; the access network device broadcasts fourth information; a user terminal receives the fourth information, and sends fifth information on the basis of the fourth information; and the first network function or the third network function receives the fifth information or a first response parameter, and authenticates the user terminal on the basis of the fifth information or the first response parameter.

Description

Authentication processing method, device, terminal and network side equipment

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese Patent Application No. 202311166531.3 filed in China on September 11, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present application belongs to the field of communication technology, and specifically relates to an authentication processing method, apparatus, terminal, and network-side equipment. Background Art

[0004] With the advancement of communication technology, low-power Ambient IoT (AIoT) technology has been introduced into communication systems. User terminals or devices in AIoT can be similar to tags, activated by an excitation signal. These devices are electronic devices with limited capabilities, making it difficult to authenticate AIoT user terminals using traditional authentication processes. Therefore, how to authenticate AIoT user terminals has become a pressing issue.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide an authentication processing method, apparatus, terminal, and network-side equipment that can solve the problem of user terminal authentication in AIoT.

[0007] In a first aspect, an authentication processing method is provided, comprising:

[0008] The first network function receives first information from the second network function or the third network function;

[0009] The first network function sends second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0010] The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0011] The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0012] The user terminal receives the fourth information and sends fifth information based on the fourth information, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0013] The first network function or the third network function receives the fifth information or the first response parameter, and authenticates the user terminal based on the fifth information or the first response parameter.

[0014] In a second aspect, an authentication processing method is provided, comprising:

[0015] When the user terminal receives the fourth information broadcast by the access network device, the user terminal sends the fifth information based on the fourth information;

[0016] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0017] The fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0018] The authentication information includes the challenge parameter or the random character string.

[0019] In a third aspect, an authentication processing method is provided, comprising:

[0020] The first network function receives first information from the second network function or the third network function;

[0021] The first network function sends second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0022] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0023] In a fourth aspect, an authentication processing method is provided, comprising:

[0024] The second network function sends first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0025] In a fifth aspect, an authentication processing method is provided, comprising:

[0026] The third network function receives second information, the second information including authentication information, the authentication information including a challenge parameter or a random string;

[0027] The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0028] The second information is sent by the first network function or the fourth network function.

[0029] In a sixth aspect, an authentication processing method is provided, comprising:

[0030] The fourth network function receives sixth information from the first network function, the sixth information including a challenge parameter or a random string, and a target identifier associated with the user terminal;

[0031] The fourth network function performs at least one of the following based on the sixth information:

[0032] sending a second response parameter to the first network function;

[0033] Authenticating the user terminal.

[0034] In a seventh aspect, an authentication processing method is provided, comprising:

[0035] The access network device receives third information from the third network function, where the third information includes any one of authentication information, a challenge parameter, and a random character string;

[0036] The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0037] The authentication information includes a challenge parameter or a random character string.

[0038] In an eighth aspect, an authentication processing system is provided, comprising a first network function, a second network function, a third network function, an access network device, and a user terminal, wherein:

[0039] The first network function is configured to receive first information from the second network function or the third network function; and send second information to the third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0040] The third network function is configured to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0041] The access network device is configured to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0042] The user terminal is configured to receive the fourth information and send fifth information based on the fourth information, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0043] The first network function or the third network function is configured to receive the fifth information or the first response parameter, and authenticate the user terminal based on the fifth information or the first response parameter.

[0044] In a ninth aspect, an authentication processing apparatus is provided, comprising:

[0045] A first sending module is configured to send fifth information based on the fourth information when receiving the fourth information broadcast by the access network device;

[0046] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0047] The fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0048] The authentication information includes the challenge parameter or the random character string.

[0049] In a tenth aspect, an authentication processing device is provided, comprising:

[0050] A first receiving module, configured to receive first information from the second network function or the third network function;

[0051] a second sending module, configured to send second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0052] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0053] In an eleventh aspect, an authentication processing apparatus is provided, comprising:

[0054] The third sending module is configured to send first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0055] In a twelfth aspect, an authentication processing apparatus is provided, comprising:

[0056] A second receiving module is configured to receive second information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string;

[0057] a fourth sending module, configured to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0058] The second information is sent by the first network function or the fourth network function.

[0059] In a thirteenth aspect, an authentication processing apparatus is provided, comprising:

[0060] a third receiving module, configured to receive sixth information from the first network function, the sixth information including a challenge parameter or a random string, and a target identifier associated with the user terminal;

[0061] A first execution module is configured to execute at least one of the following based on the sixth information:

[0062] sending a second response parameter to the first network function;

[0063] Authenticating the user terminal.

[0064] In a fourteenth aspect, an authentication processing apparatus is provided, comprising:

[0065] a fourth receiving module, configured to receive third information from a third network function, the third information including any one of authentication information, a challenge parameter, and a random character string;

[0066] a fifth sending module, configured to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0067] The authentication information includes a challenge parameter or a random character string.

[0068] In a fifteenth aspect, a terminal is provided, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the second aspect are implemented.

[0069] According to a sixteenth aspect, a terminal is provided, comprising a processor and a communication interface, wherein the communication interface is configured to, upon receiving fourth information broadcast by an access network device, send fifth information based on the fourth information;

[0070] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0071] The fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0072] The authentication information includes the challenge parameter or the random character string.

[0073] In the seventeenth aspect, a network side device is provided, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the third aspect are implemented, or the steps of the method described in the fourth aspect are implemented, or the steps of the method described in the fifth aspect are implemented, or the steps of the method described in the sixth aspect are implemented, or the steps of the method described in the seventh aspect are implemented.

[0074] In an eighteenth aspect, a network side device is provided, including a processor and a communication interface, wherein:

[0075] When the network-side device is a first network function, the communication interface is used to receive first information from a second network function or a third network function; and send second information to the third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0076] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0077] When the network side device is a second network function, the communication interface is used to send first information to the first network function, the first information is used to trigger the first network function to send second information to the third network function, the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0078] When the network side device is a third network function, the communication interface is used to receive second information, where the second information includes authentication information, where the authentication information includes a challenge parameter or a random string; and send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random string;

[0079] The second information is sent by the first network function or the fourth network function.

[0080] When the network-side device is the fourth network function, the communication interface is configured to receive sixth information from the first network function, the sixth information including a challenge parameter or a random string, and a target identifier associated with the user terminal; and perform at least one of the following based on the sixth information:

[0081] sending a second response parameter to the first network function;

[0082] Authenticating the user terminal.

[0083] When the network-side device is an access network device, the communication interface is used to receive third information from a third network function, the third information including any one of authentication information, a challenge parameter, and a random string; and broadcast fourth information, the fourth information including any one of the authentication information, the challenge parameter, and the random string;

[0084] The authentication information includes a challenge parameter or a random character string.

[0085] In the nineteenth aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the second aspect are implemented, or the steps of the method described in the third aspect are implemented, or the steps of the method described in the fourth aspect are implemented, or the steps of the method described in the fifth aspect are implemented, or the steps of the method described in the sixth aspect are implemented, or the steps of the method described in the seventh aspect are implemented.

[0086] In the twentieth aspect, a wireless communication system is provided, comprising: a terminal and a network side device, wherein the terminal can be used to execute the steps of the method described in the second aspect, and the network side device can be used to execute the steps of the method described in the third aspect, or implement the steps of the method described in the fourth aspect, or implement the steps of the method described in the fifth aspect, or implement the steps of the method described in the sixth aspect, or implement the steps of the method described in the seventh aspect.

[0087] In aspect 21, a chip is provided, comprising a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in aspect 2, or the method as described in aspect 3, or the steps of the method as described in aspect 4, or the steps of the method as described in aspect 5, or the steps of the method as described in aspect 6, or the steps of the method as described in aspect 7.

[0088] In aspect 22, a computer program / program product is provided, which is stored in a storage medium, and is executed by at least one processor to implement the method as described in aspect 2, or the method as described in aspect 3, or the steps of the method as described in aspect 4, or the steps of the method as described in aspect 5, or the steps of the method as described in aspect 6, or the steps of the method as described in aspect 7.

[0089] In an embodiment of the present application, a first network function receives first information from a second network function or a third network function; the first network function sends second information to the third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string; the third network function sends third information to the access network device, the third information including any one of the authentication information, the challenge parameter, and the random string; the access network device broadcasts fourth information, the fourth information including any one of the authentication information, the challenge parameter, and the random string; the user terminal receives the fourth information and sends fifth information based on the fourth information, the fifth information including a first response parameter, the first response parameter being generated based on the challenge parameter or the random string; the first network function or the third network function receives the fifth information or the first response parameter and authenticates the user terminal based on the fifth information or the first response parameter. In this way, since the user terminal authenticates based on the third information broadcast by the access network device, there is no need for the user terminal to authenticate after accessing the network, thereby simplifying the authentication process of the user terminal and meeting the authentication capability requirements of the user terminal in the AIoT. Therefore, the embodiment of the present application can effectively implement the authentication of the user terminal in the AIoT. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] FIG1 is a block diagram of a wireless communication system to which embodiments of the present application may be applied;

[0091] FIG2 is a flow chart of an authentication processing method according to an embodiment of the present application;

[0092] FIG3 is a second flow chart of an authentication processing method provided in an embodiment of the present application;

[0093] FIG4 is a third flow chart of an authentication processing method provided in an embodiment of the present application;

[0094] FIG5 is a fourth flow chart of an authentication processing method provided in an embodiment of the present application;

[0095] FIG6 is a fifth flow chart of an authentication processing method provided in an embodiment of the present application;

[0096] FIG7 is a sixth flow chart of an authentication processing method provided in an embodiment of the present application;

[0097] FIG8 is a seventh flow chart of an authentication processing method provided in an embodiment of the present application;

[0098] FIG9 is a schematic diagram of a structure of an authentication processing device according to an embodiment of the present application;

[0099] FIG10 is a second structural diagram of an authentication processing device provided in an embodiment of the present application;

[0100] FIG11 is a third structural diagram of an authentication processing device provided in an embodiment of the present application;

[0101] FIG12 is a fourth structural diagram of an authentication processing device provided in an embodiment of the present application;

[0102] FIG13 is a fifth structural diagram of an authentication processing device provided in an embodiment of the present application;

[0103] FIG14 is a sixth structural diagram of an authentication processing device provided in an embodiment of the present application;

[0104] FIG15 is a schematic structural diagram of a communication device provided in an embodiment of the present application;

[0105] FIG16 is a schematic structural diagram of a terminal provided in an embodiment of the present application;

[0106] FIG17 is a schematic structural diagram of a network-side device provided in an embodiment of the present application;

[0107] FIG18 is a schematic structural diagram of another network-side device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0108] The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same type, and do not limit the number of objects, for example, the first object can be one or more. In addition, "or" in this application represents at least one of the connected objects. For example, "A or B" covers three options, namely, Option 1: including A but not including B; Option 2: including B but not including A; Option 3: including both A and B. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0109] The term "indication" in this application can be either a direct indication (or explicit indication) or an indirect indication (or implicit indication). A direct indication can be understood as the sender explicitly informing the receiver of specific information, the operation to be performed, or the requested result, etc. in the instruction sent; an indirect indication can be understood as the receiver determining the corresponding information based on the instruction sent by the sender, or making a judgment and determining the operation to be performed or the requested result, etc. based on the judgment result.

[0110] It is worth noting that the technology described in the embodiments of the present application is not limited to the Long Term Evolution (LTE) / LTE-Advanced (LTE-A) system, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA) or other systems. The terms "system" and "network" in the embodiments of the present application are often used interchangeably, and the technology described can be used for the systems and radio technologies mentioned above, as well as for other systems and radio technologies. The following description describes a New Radio (NR) system for illustrative purposes, and NR terminology is used in most of the following description, but these technologies can also be applied to systems other than NR systems, such as 6th generation (6G) systems. th Generation, 6G) communication system.

[0111] FIG1 is a block diagram of a wireless communication system applicable to an embodiment of the present application. The wireless communication system includes a terminal 11 and a network-side device 12. The terminal 11 may be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer), a notebook computer, a personal digital assistant (PDA), a handheld computer, a netbook, an ultra-mobile personal computer (UMPC), a mobile internet device (MID), an augmented reality (AR), a virtual reality (VR) device, a robot, a wearable device (Wearable Device), an aircraft (Flight Vehicle), a vehicle-mounted device (VUE), a ship-mounted device, a pedestrian user equipment (PUE), a smart home (home appliances with wireless communication capabilities, such as refrigerators, televisions, washing machines, or furniture), a game console, a personal computer (PC), an ATM, or a self-service machine, or other terminal-side devices. Wearable devices include: smart watches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart bracelets, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. Among them, the vehicle-mounted device can also be called a vehicle-mounted terminal, a vehicle-mounted controller, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit, etc. It should be noted that the specific type of the terminal 11 is not limited in the embodiment of the present application. The network side device 12 may include an access network device or a core network device, wherein the access network device may also be called a radio access network (Radio Access Network, RAN) device, a radio access network function or a radio access network unit. The access network device may include a base station, a wireless local area network (WLAN) access point (AP) or a wireless fidelity (WiFi) node, etc.Among them, the base station can be referred to as Node B (NB), Evolved Node B (eNB), the next generation Node B (gNB), New Radio Node B (NR Node B), access point, Relay Base Station (RBS), Serving Base Station (SBS), Base Transceiver Station (BTS), radio base station, radio transceiver, Basic Service Set (BSS), Extended Service Set (ESS), Home Node B (HNB), Home evolved Node B (home evolved Node B), Transmission Reception Point (TRP) or other appropriate terms in the relevant field. As long as the same technical effect is achieved, the base station is not limited to specific technical vocabulary. It should be noted that in the embodiment of the present application, only the base station in the NR system is used as an example for introduction, and the specific type of the base station is not limited.

[0112] The core network equipment may include but is not limited to at least one of the following: core network node, core network function, mobility management entity (MME), access mobility management function (AMF), session management function (SMF), user plane function (UPF), policy control function (PCF), policy and charging rules function unit (PCRF), edge application service discovery function (EASDF), unified data management (UDM), unified data repository (UDR), home user server (HSS), centralized network configuration (CNC), network storage function (NRF), network exposure function (NEF), local NEF (L-NEF), binding support function (BSF), application function ( It should be noted that in the embodiments of the present application, only the core network device in the NR system is introduced as an example, and the specific type of the core network device is not limited.

[0113] For ease of understanding, some of the contents involved in the embodiments of this application are described below:

[0114] The traditional user terminal authentication process is as follows: the user terminal first connects to the network device, initiates a Radio Resource Control (RRC) connection, and then sends a Non-Access Stratum (NAS) message carrying the terminal's identity. The network device then searches for the terminal's context or subscription information, obtains an authentication vector, and authenticates the terminal based on the authentication vector. After successful authentication, the terminal is allowed to establish a connection and provide network services. The authentication process includes two-way authentication (the terminal authenticates the network, and the network device authenticates the terminal) and one-way authentication (the network device authenticates the terminal).

[0115] Since the authentication process of a traditional user terminal requires the terminal to perform multiple RRC interactions and NAS interactions to complete the authentication, which is not possible for low-power user equipment with limited capabilities, the authentication processing method of the present application is proposed.

[0116] The following describes in detail the authentication processing method provided in the embodiments of the present application through some embodiments and their application scenarios in conjunction with the accompanying drawings.

[0117] 2 , an embodiment of the present application provides an authentication processing method. As shown in FIG2 , the authentication processing method includes:

[0118] Step 201: A first network function receives first information from a second network function or a third network function.

[0119] Step 202: The first network function sends second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0120] Step 203: The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string.

[0121] Step 204: The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string.

[0122] Step 205: The user terminal receives the fourth information and sends fifth information based on the fourth information, where the fifth information includes a first response parameter generated based on the challenge parameter or the random character string.

[0123] Step 206: The first network function or the third network function receives the fifth information or the first response parameter, and authenticates the user terminal based on the fifth information or the first response parameter.

[0124] In the embodiment of the present application, the first network function can be understood as a tag information storage function, UDM, UDR, or authentication service function (AUSF), the second network function can be understood as NEF or AF, and the third network function can be understood as AMF. When the first network function is AUSF, the fourth network function can be understood as a tag information storage function, UDM, or UDR. The user terminal can also be referred to as a terminal.

[0125] Optionally, the transmission behavior between different network functions can be understood as direct or indirect transmission. For example, the first network function sending the second information to the third network function based on the first information can be understood as the first network function sending the second information directly or indirectly to the third network function based on the first information.

[0126] Optionally, after receiving the second information, the third network function may send the entire content of the second information to the access network device, or may send a portion of the second information to the access network device, or may send content generated or derived from the second information to the access network device. Furthermore, the third network function may determine which access network devices to send the content of the second information based on the content of the second information. In other words, the third information may include part or all of the second information. For example, authentication information may be sent, or a challenge parameter (Challenge) or random string (RAND) in the authentication information may be sent.

[0127] Optionally, in some embodiments, the first information may be used to determine the terminal to be authenticated. In some embodiments, the first information may be information or content that has no association with the user terminal.

[0128] Optionally, the access network device may carry the fourth information through an excitation signal; or may carry the fourth information through a system information (SI) message. In this case, the access network device may send an excitation signal and broadcast the fourth information through an SI message.

[0129] Optionally, after receiving the excitation signal, the user device detects the fourth information from the excitation signal, or monitors the broadcast message and detects the fourth information from the broadcast message (such as the SI message), and can send the fifth information based on the fourth information, so that the first network function or the third network function can authenticate the user terminal.

[0130] It should be noted that, in the embodiments of the present application, specific transmission behaviors may include the following cases depending on the network functions:

[0131] Case 1: NEF sends the first information to UDM / UDR, UDM / UDR sends the second information to AMF through AUSF, AMF sends the third information to the access network device, and the access network device broadcasts the fourth information; the user terminal sends the fifth information or the first response parameter to AMF, AMF (or through AUSF) sends the fifth information or the first response parameter to UDM / UDR, and then UDM / UDR performs authentication.

[0132] Case 2: NEF / AF sends the first information to (or through UDM / UDR to) AUSF, AUSF sends the second information to AMF, AMF sends the third information to the access network device, and the access network device broadcasts the fourth information; the user terminal sends the fifth information or the first response parameter to AMF, AMF sends the fourth information or the first response parameter to AUSF, which is then authenticated by AUSF, or AUSF sends the sixth information to UDM / UDR, which performs authentication and then sends the authentication result to AUSF, or UDM / UDR sends the second response parameter to AUSF, which is then authenticated by AUSF.

[0133] Case 3: For cases 1 and 2 above, NEF can be replaced by AMF.

[0134] Case 4: For the above cases 1 and 2, after AMF receives the fifth information, AMF also performs authentication.

[0135] It should be understood that the authentication of the user terminal includes: determining whether the current user terminal is a terminal device that needs to be authenticated, such as whether the corresponding identification (Identity, ID) belongs to the group corresponding to the group ID, or whether it is in one or more received terminal device IDs, and then verifying the first response parameter. If successful, the authentication is successful.

[0136] Optionally, the user terminal may calculate the first response parameter based on the challenge parameter or random character string and a stored key.

[0137] In an embodiment of the present application, a first network function receives first information from a second network function or a third network function; the first network function sends second information to the third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string; the third network function sends third information to the access network device, the third information including any one of the authentication information, the challenge parameter, and the random string; the access network device broadcasts fourth information, the fourth information including any one of the authentication information, the challenge parameter, and the random string; the user terminal receives the fourth information and sends fifth information based on the fourth information, the fifth information including a first response parameter, the first response parameter being generated based on the challenge parameter or the random string; the first network function or the third network function receives the fifth information or the first response parameter and authenticates the user terminal based on the fifth information or the first response parameter. In this way, since the user terminal authenticates based on the third information broadcast by the access network device, there is no need for the user terminal to authenticate after accessing the network, thereby simplifying the authentication process of the user terminal and meeting the authentication capability requirements of the user terminal in the AIoT. Therefore, the embodiment of the present application can effectively implement the authentication of the user terminal in the AIoT.

[0138] Optionally, in some embodiments, the first information includes at least one of a user identifier, a group identifier, a device identifier, and area information (such as geographic area information, a tracking area identifier list (TAI list), etc.).

[0139] In the embodiment of the present application, the above-mentioned identification identifier can be an identifier formed by intercepting part of the user identifier, group identifier or device identifier, which is used by the user terminal to determine whether it is related to it.

[0140] Optionally, in some embodiments, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0141] It should be noted that, in an embodiment of the present application, the above-mentioned second information may include the entire content of the first information, or the second information may be generated based on the first information. For example, the area information in the second information may be generated based on at least one of the user identifier, group identifier, and device identifier in the first information. In this case, the second information may include only the area information or include the area information and the corresponding identifier, or the corresponding identifier (that is, at least one of the user identifier, group identifier, and device identifier) ​​may be obtained based on the area information in the first information. At least one of the user identifier, group identifier, and device identifier in the second information, in this case, the second information may include only the obtained identifier, or may include the obtained identifier and area information (from the first information or derived from the area information in the first information, such as deriving the tracking area identifier list from the geographic area information).

[0142] It should be noted that, in some embodiments, before the first network function receives the first information from the second network function, the method further includes:

[0143] The second network function receives seventh information from the application function, the seventh information including at least one of a user identifier, a group identifier, a device identifier, and area information;

[0144] The first information is the seventh information or the first information is determined based on the seventh information.

[0145] Optionally, in some embodiments, the method further comprises at least one of the following:

[0146] In a case where the second information includes area information, the third network function determines the access network device based on the area information;

[0147] In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier;

[0148] In the case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier.

[0149] In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

[0150] Optionally, in some embodiments, the third information further includes a tag authentication indication and at least one of second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0151] In an embodiment of the present application, the above-mentioned target information is generated by the first target information. For example, the area information can be generated based on various identifiers in the first target information, or the corresponding identifier (i.e., at least one of the user identifier, group identifier, and device identifier) ​​can be obtained based on the area information in the first target information.

[0152] Optionally, in some embodiments, when the third information includes area information (such as a tracking area identifier list TAI list), the access network device broadcasts the fourth information including:

[0153] The access network device determines or selects a target cell based on the area information;

[0154] The access network device broadcasts the fourth information in the target cell.

[0155] Optionally, in some embodiments, the access network device broadcasting the fourth information includes:

[0156] The access network device broadcasts the fourth information based on the authentication information or the third information. For example, if the received message contains authentication information, the fourth information is broadcast. Alternatively, the access network device is configured with a cell serving the Internet of Things business. Upon receiving the authentication information or the third information, the fourth information is broadcast in the cell serving the Internet of Things business.

[0157] In an embodiment of the present application, the access network device may generate the fourth information to be broadcast based on the authentication information, and determine in which cells the fourth information is broadcast based on other information in the third information.

[0158] Optionally, in some embodiments, the fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

[0159] Optionally, in some embodiments, the fifth information further includes at least one of target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0160] It should be noted that in an embodiment of the present application, when the fourth information carries a group identifier, the fifth information may or may not carry a group identifier; when the fourth information carries a user identifier, the fifth information may or may not carry a user identifier; when the fourth information carries a device identifier, the fifth information may or may not carry a device identifier.

[0161] Optionally, in some embodiments, authenticating the user terminal based on the fifth information or the first response parameter includes:

[0162] The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0163] The fourth network function sends a second response parameter or an authentication result to the first network function based on the sixth information;

[0164] In a case where the fourth network function sends a second response parameter to the first network function, the first network function determines an authentication result based on the first response parameter and the second response parameter;

[0165] The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0166] In the embodiment of the present application, the first network function is AUSF, and the fourth network function is UDM. The specific transmission behaviors are as follows: NEF / AF sends the first information to AUSF, AUSF sends the second information to AMF, AMF sends the third information to the access network device, and the access network device broadcasts the fourth information; the user terminal sends the fifth information or the first response parameter to AMF, AMF sends the fifth information or the first response parameter to AUSF, AUSF sends the sixth information to UDM, UDM sends the authentication result or the second response parameter to AUSF, and when UDM sends the second response parameter to AUSF, AUSF performs authentication.

[0167] Optionally, in some embodiments, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0168] In an embodiment of the present application, the authentication information is not generated based on information related to the user terminal. For example, the authentication information includes the challenge parameter or random number mentioned above and also includes a network authentication parameter. However, the network authentication parameter is generated based on a group key or a network private key, and can also be generated based on the group key or the network private key and the challenge parameter or random number. The second response parameter is used by the first network function to authenticate the user terminal. Specifically, the second response parameter can be calculated based on the challenge parameter or the random number and a stored key or group key related to the user terminal.

[0169] Optionally, in some embodiments, the authentication information further includes a network authentication parameter, and the network authentication parameter is used for the user terminal to authenticate the network.

[0170] In an embodiment of the present application, the above-mentioned network authentication parameters can be authentication token (AUTN) parameters generated by using a key corresponding to a group identifier or a user terminal identifier, or an authentication token generated by a network key (or a network key and the above-mentioned challenge parameter or a random number). The network key can be a key agreed upon by the network and the IoT device operator (the key is downloaded by the network device operator or pre-set on the IoT terminal), or it can be a private key of the network (the IoT terminal obtains the public key of the network through an offline channel and verifies the network parameters based on the public key). The terminal can verify whether the network is a legitimate network based on the AUTN parameters. Since the network authentication parameters are carried in the authentication information, the terminal can authenticate the network and improve the security of the communication.

[0171] Optionally, in some embodiments, after the user terminal receives the fourth information and sends fifth information based on the fourth information, the method further includes:

[0172] The third network function receives the fifth information from the user terminal;

[0173] The third network function sends the fifth information or the first response parameter to the first network function.

[0174] In the embodiment of the present application, the third network function may also perform authentication on the user terminal. After receiving the fifth information, the third network function may authenticate the user terminal and may send all or part of the fifth information to the first network function for authentication.

[0175] Optionally, in some embodiments, after the first network function authenticates the user terminal based on the fifth information or the first response parameter, the method further includes:

[0176] The first network function sends an authentication result to the third network function or the second network function.

[0177] In an embodiment of the present application, after receiving the above-mentioned authentication result, the third network function can send the authentication result to the user terminal. If the authentication result is successful, the user terminal can perform subsequent information sending and receiving operations, and the network operates the user terminal to receive and send messages.

[0178] Optionally, referring to FIG3 , an embodiment of the present application further provides an authentication processing method. As shown in FIG3 , the authentication processing method includes:

[0179] Step 301: Upon receiving fourth information broadcast by an access network device, the user terminal sends fifth information based on the fourth information.

[0180] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0181] The fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0182] The authentication information includes the challenge parameter or the random character string.

[0183] Optionally, the fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier, and sending the fifth information based on the fourth information includes:

[0184] In a case where the user terminal is associated with at least one of the group identifier, the user identifier, the device identifier, and the identification identifier, the user terminal sends the fifth information.

[0185] Optionally, the fifth information further includes at least one of target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0186] Optionally, the authentication information further includes a network authentication parameter, and the sending the fifth information based on the fourth information includes:

[0187] In a case where the fourth information includes the authentication information, the user terminal authenticates the network based on the network authentication parameter;

[0188] If the authentication is successful, the user terminal sends the fifth information.

[0189] 4 , an embodiment of the present application further provides an authentication processing method. As shown in FIG4 , the authentication processing method includes:

[0190] Step 401: A first network function receives first information from a second network function or a third network function.

[0191] Step 402: The first network function sends second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0192] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0193] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0194] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0195] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used by the user terminal to authenticate the network.

[0196] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0197] Optionally, the method further includes:

[0198] The first network function receives fifth information or a first response parameter from the user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0199] The first network function authenticates the user terminal based on the fifth information or the first response parameter.

[0200] Optionally, the method further includes:

[0201] The first network function receives fifth information or a first response parameter from the user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0202] The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0203] The first network function receives a second response parameter or an authentication result from the fourth network function, where the second response parameter or the authentication result is determined based on the sixth information;

[0204] In a case where the first network function receives a second response parameter from a fourth network function, the first network function determines an authentication result based on the first response parameter and the second response parameter;

[0205] The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0206] Optionally, referring to FIG5 , an embodiment of the present application further provides an authentication processing method. As shown in FIG5 , the authentication processing method includes:

[0207] Step 501: A second network function sends first information to a first network function, where the first information is used to trigger the first network function to send second information to a third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0208] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0209] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0210] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0211] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used by the user terminal to authenticate the network.

[0212] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0213] Optionally, referring to FIG6 , an embodiment of the present application further provides an authentication processing method. As shown in FIG6 , the authentication processing method includes:

[0214] Step 601: A third network function receives second information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0215] Step 602: The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string.

[0216] The second information is sent by the first network function or the fourth network function.

[0217] Optionally, the method further includes:

[0218] The third network function receives fifth information from the user terminal, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0219] The third network function sends the fifth information or the first response parameter to the first network function, or authenticates the user terminal based on the first response parameter.

[0220] Optionally, after the third network function sends the fifth information or the first response parameter to the first network function, the method further includes:

[0221] The third network function receives the authentication result from the first network function.

[0222] Optionally, before the third network function receives the second information, the method further includes:

[0223] The third network function sends first information to the first network function, where the first information is used to trigger the first network function to send the second information.

[0224] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0225] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0226] Optionally, the method further comprises at least one of the following:

[0227] In a case where the second information includes area information, the third network function determines the access network device based on the area information;

[0228] In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier;

[0229] In a case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier;

[0230] In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

[0231] Optionally, the third information further includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0232] Optionally, the authentication information further includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

[0233] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0234] Optionally, referring to FIG. 7 , an embodiment of the present application further provides an authentication processing method. As shown in FIG. 7 , the authentication processing method includes:

[0235] Step 701: The fourth network function receives sixth information from the first network function, where the sixth information includes a challenge parameter or a random string, and a target identifier associated with a user terminal.

[0236] Step 702: The fourth network function performs at least one of the following based on the sixth information:

[0237] sending a second response parameter to the first network function;

[0238] Authenticating the user terminal.

[0239] Optionally, after authenticating the user terminal, the method further includes:

[0240] Sending an authentication result to the first network function.

[0241] Optionally, referring to FIG8 , an embodiment of the present application further provides an authentication processing method. As shown in FIG8 , the authentication processing method includes:

[0242] Step 801: The access network device receives third information from a third network function, where the third information includes any one of authentication information, a challenge parameter, and a random character string.

[0243] Step 802: The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string.

[0244] The authentication information includes a challenge parameter or a random character string.

[0245] Optionally, the access network device broadcasting the fourth information includes:

[0246] The access network device broadcasts the fourth information based on the authentication information or the third information.

[0247] Optionally, the fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

[0248] Optionally, the third information further includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0249] Optionally, when the third information includes area information, the access network device broadcasting the fourth information based on the third information includes:

[0250] The access network device determines or selects a target cell based on the area information;

[0251] The access network device broadcasts the fourth information in the target cell.

[0252] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0253] Optionally, the authentication information further includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

[0254] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0255] The embodiment of the present application further provides an authentication processing system, including a first network function, a second network function, a third network function, an access network device, and a user terminal, wherein:

[0256] The first network function is configured to receive first information from the second network function or the third network function; and send second information to the third network function based on the first information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0257] The third network function is configured to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0258] The access network device is configured to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0259] The user terminal is configured to receive the fourth information and send fifth information based on the fourth information, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0260] The first network function or the third network function is configured to receive the fifth information or the first response parameter, and authenticate the user terminal based on the fifth information or the first response parameter.

[0261] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0262] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0263] Optionally, the third network function is further configured to perform at least one of the following:

[0264] In a case where the second information includes area information, determining the access network device based on the area information;

[0265] In a case where the second information includes a user identifier, determining the access network device based on the user identifier;

[0266] In the case where the second information includes a group identifier, the access network device is determined based on the group identifier.

[0267] In a case where the second information includes a device identifier, the access network device is determined based on the device identifier.

[0268] Optionally, the third information further includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0269] Optionally, when the third information includes area information, the access network device is specifically configured to:

[0270] determining or selecting a target cell based on the area information;

[0271] The fourth information is broadcast in the target cell.

[0272] Optionally, the access network device is specifically configured to:

[0273] The access network device broadcasts the fourth information based on the authentication information or the third information.

[0274] Optionally, the fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

[0275] Optionally, the fifth information further includes at least one of target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0276] Optionally, the authentication processing system further includes a fourth network function:

[0277] The first network function is specifically configured to send sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0278] The fourth network function is configured to send a second response parameter or an authentication result to the first network function based on the sixth information;

[0279] In a case where the fourth network function sends a second response parameter to the first network function, the first network function is configured to determine an authentication result based on the first response parameter and the second response parameter;

[0280] The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0281] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0282] Optionally, the authentication information further includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

[0283] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0284] Optionally, the third network function is further configured to receive the fifth information from the user terminal; and send the fifth information or the first response parameter to the first network function.

[0285] Optionally, the first network function is further configured to send an authentication result to the third network function or the second network function.

[0286] The authentication processing method provided in the embodiment of the present application can be executed by an authentication processing device. In the embodiment of the present application, the authentication processing device provided in the embodiment of the present application is described by taking the authentication processing method executed by the authentication processing device as an example.

[0287] 9 , an embodiment of the present application further provides an authentication processing device. As shown in FIG9 , the authentication processing device 900 includes:

[0288] A first sending module 901 is configured to send fifth information based on the fourth information when receiving fourth information broadcast by the access network device;

[0289] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0290] The fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0291] The authentication information includes the challenge parameter or the random character string.

[0292] Optionally, the fourth information also includes at least one of a group identifier, a user identifier, a device identifier and an identification identifier, and the first sending module 901 is specifically used to send the fifth information when the user terminal is associated with at least one of the group identifier, user identifier, device identifier and identification identifier.

[0293] Optionally, the fifth information further includes at least one of target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0294] Optionally, the authentication information also includes network authentication parameters, and the first sending module 901 is specifically used to

[0295] authenticating the network based on the network authentication parameter in a case where the fourth information includes the authentication information;

[0296] If the authentication is successful, the fifth information is sent.

[0297] 10 , an embodiment of the present application further provides an authentication processing device. As shown in FIG10 , the authentication processing device 1000 includes:

[0298] A first receiving module 1001 is configured to receive first information from a second network function or a third network function;

[0299] A second sending module 1002 is configured to send second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string;

[0300] The first receiving module 1001 is further configured to receive fifth information or a first response parameter from a user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0301] The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

[0302] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0303] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0304] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used by the user terminal to authenticate the network.

[0305] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0306] Optionally, the authentication processing device 1000 further includes a first authentication module,

[0307] The first receiving module 1001 is further configured to: receive fifth information or a first response parameter from a user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0308] The first authentication module is configured to authenticate the user terminal based on the fifth information or the first response parameter.

[0309] Optionally, the authentication processing device 1000 further includes a first authentication module,

[0310] The first receiving module 1001 is further configured to: receive fifth information or a first response parameter from a user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string;

[0311] The second sending module 1002 is further configured to: send sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal;

[0312] The first receiving module 1001 is further configured to: receive a second response parameter or authentication result from a fourth network function, where the second response parameter or authentication result is determined based on the sixth information;

[0313] the first authentication module being configured to, upon receiving a second response parameter from a fourth network function, determine an authentication result based on the first response parameter and the second response parameter;

[0314] The second response parameter is generated based on the challenge parameter or the random character string, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

[0315] 11 , an embodiment of the present application further provides an authentication processing device. As shown in FIG11 , the authentication processing device 1100 includes:

[0316] The third sending module 1101 is configured to send first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

[0317] Optionally, the first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0318] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0319] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0320] Optionally, the authentication information further includes a network authentication parameter, and the network authentication parameter is used by the user terminal to authenticate the network.

[0321] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0322] 12 , an embodiment of the present application further provides an authentication processing device. As shown in FIG12 , the authentication processing device 1200 includes:

[0323] A second receiving module 1201 is configured to receive second information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string;

[0324] A fourth sending module 1202 is configured to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter, and the random character string;

[0325] The second information is sent by the first network function or the fourth network function.

[0326] Optionally, the authentication processing device 1200 further includes a second execution module.

[0327] The second receiving module 1201 is further configured to receive fifth information from the user terminal, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0328] The second execution module is used to send the fifth information or the first response parameter to the first network function, or authenticate the user terminal based on the first response parameter.

[0329] Optionally, the second receiving module 1201 is further used to receive an authentication result from the first network function.

[0330] Optionally, the fourth sending module 1202 is further used to send first information to the first network function, where the first information is used to trigger the first network function to send the second information.

[0331] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0332] Optionally, the second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0333] Optionally, the authentication processing device 1200 further includes a determination module configured to perform at least one of the following:

[0334] In a case where the second information includes area information, determining the access network device based on the area information;

[0335] In a case where the second information includes a user identifier, determining the access network device based on the user identifier;

[0336] In a case where the second information includes a group identifier, determining the access network device based on the group identifier;

[0337] In a case where the second information includes a device identifier, the access network device is determined based on the device identifier.

[0338] Optionally, the third information further includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0339] Optionally, the authentication information further includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

[0340] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0341] 13 , an embodiment of the present application further provides an authentication processing device. As shown in FIG13 , the authentication processing device 1300 includes:

[0342] A third receiving module 1301 is configured to receive sixth information from the first network function, where the sixth information includes a challenge parameter or a random string, and a target identifier associated with the user terminal;

[0343] The first execution module 1302 is configured to execute at least one of the following based on the sixth information:

[0344] sending a second response parameter to the first network function;

[0345] Authenticating the user terminal.

[0346] Optionally, the first execution module 1302 is further configured to send an authentication result to the first network function.

[0347] 14 , an embodiment of the present application further provides an authentication processing device. As shown in FIG14 , the authentication processing device 1400 includes:

[0348] A fourth receiving module 1401 is configured to receive third information from a third network function, where the third information includes any one of authentication information, a challenge parameter, and a random string;

[0349] a fifth sending module 1402, configured to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string;

[0350] The authentication information includes a challenge parameter or a random character string.

[0351] Optionally, the fifth sending module 1402 is specifically configured to:

[0352] The fourth information is broadcast based on the authentication information or the third information.

[0353] Optionally, the fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

[0354] Optionally, the third information further includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

[0355] Optionally, when the third information includes area information, the fifth sending module 1402 is specifically configured to:

[0356] determining or selecting a target cell based on the area information;

[0357] The fourth information is broadcast in the target cell.

[0358] Optionally, the authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

[0359] Optionally, the authentication information further includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

[0360] Optionally, the network authentication parameter is generated based on information not related to the user terminal.

[0361] The authentication processing device in the embodiments of the present application can be an electronic device, such as an electronic device with an operating system, or a component in an electronic device, such as an integrated circuit or chip. The electronic device can be a terminal, or it can be other devices other than a terminal. For example, the terminal can include but is not limited to the types of terminal 11 listed above, and other devices can be servers, network attached storage (NAS), etc., which are not specifically limited in the embodiments of the present application.

[0362] The authentication processing device provided in the embodiment of the present application can implement the various processes implemented in the method embodiments of Figures 3 to 8 and achieve the same technical effects. To avoid repetition, they will not be described here.

[0363] As shown in Figure 15, an embodiment of the present application also provides a communication device 1500, including a processor 1501 and a memory 1502. The memory 1502 stores a program or instruction that can be run on the processor 1501. When the program or instruction is executed by the processor 1501, the various steps of the above-mentioned authentication processing method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0364] The present application also provides a terminal including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is configured to execute a program or instruction to implement the steps of the method embodiment shown in FIG3 . This terminal embodiment corresponds to the aforementioned terminal-side method embodiment, and each implementation process and implementation method of the aforementioned method embodiment are applicable to this terminal embodiment and can achieve the same technical effects. Specifically, FIG16 is a schematic diagram of the hardware structure of a terminal implementing an embodiment of the present application.

[0365] The terminal 1600 includes but is not limited to: a radio frequency unit 1601, a network module 1602, an audio output unit 1603, an input unit 1604, a sensor 1605, a display unit 1606, a user input unit 1607, an interface unit 1608, a memory 1609 and at least some of the components of the processor 1610.

[0366] Those skilled in the art will appreciate that the terminal 1600 may also include a power supply (such as a battery) to power various components. The power supply may be logically connected to the processor 1610 via a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system. The terminal structure shown in FIG16 does not constitute a limitation of the terminal. The terminal may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be described in detail here.

[0367] It should be understood that in an embodiment of the present application, the input unit 1604 may include a graphics processing unit (GPU) 16041 and a microphone 16042, and the graphics processor 16041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 1606 may include a display panel 16061, and the display panel 16061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 1607 includes a touch panel 16071 and at least one of other input devices 16072. The touch panel 16071 is also called a touch screen. The touch panel 16071 may include two parts: a touch detection device and a touch controller. Other input devices 16072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0368] In the embodiment of the present application, after receiving downlink data from a network-side device, the RF unit 1601 may transmit the data to the processor 1610 for processing. Furthermore, the RF unit 1601 may send uplink data to the network-side device. Typically, the RF unit 1601 includes, but is not limited to, an antenna, an amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, and the like.

[0369] Memory 1609 can be used to store software programs or instructions and various data. Memory 1609 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store an operating system, applications or instructions required for at least one function (such as a sound playback function, an image playback function, etc.). In addition, memory 1609 may include volatile memory or non-volatile memory. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 1609 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0370] Processor 1610 may include one or more processing units. Optionally, processor 1610 integrates an application processor and a modem processor. The application processor primarily handles operations related to the operating system, user interface, and application programs, while the modem processor primarily processes wireless communication signals, such as a baseband processor. It is understood that the modem processor may not be integrated into processor 1610.

[0371] The radio frequency unit 1601 is configured to, upon receiving fourth information broadcast by the access network device, send fifth information based on the fourth information;

[0372] The fourth information includes any one of authentication information, challenge parameters and random character strings;

[0373] The fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string;

[0374] The authentication information includes the challenge parameter or the random character string.

[0375] It can be understood that the implementation process of each implementation method mentioned in this embodiment can refer to the relevant description of the user terminal side method embodiment and achieve the same or corresponding technical effects. To avoid repetition, it will not be repeated here.

[0376] The present application also provides a network-side device, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is configured to execute a program or instruction to implement the steps of the method embodiment shown in FIG8 . This network-side device embodiment corresponds to the aforementioned network-side device method embodiment, and each implementation process and implementation method of the aforementioned method embodiment are applicable to this network-side device embodiment and can achieve the same technical effects.

[0377] Specifically, embodiments of the present application also provide a network-side device. As shown in Figure 17, the network-side device 1700 includes an antenna 1701, a radio frequency device 1702, a baseband device 1703, a processor 1704, and a memory 1705. Antenna 1701 is connected to radio frequency device 1702. In the uplink direction, radio frequency device 1702 receives information via antenna 1701 and sends the received information to baseband device 1703 for processing. In the downlink direction, baseband device 1703 processes the information to be transmitted and sends it to radio frequency device 1702. Radio frequency device 1702 processes the received information and then sends it through antenna 1701.

[0378] The method executed by the network-side device in the above embodiment may be implemented in the baseband device 1703 , which includes a baseband processor.

[0379] The baseband device 1703 may include, for example, at least one baseband board, on which multiple chips are arranged, as shown in Figure 17, one of which is, for example, a baseband processor, which is connected to the memory 1705 through a bus interface to call the program in the memory 1705 and execute the network device operations shown in the above method embodiment.

[0380] The network side device may further include a network interface 1706 , which is, for example, a Common Public Radio Interface (CPRI).

[0381] Specifically, the network side device 1700 of the embodiment of the present application also includes: instructions or programs stored in the memory 1705 and can be run on the processor 1704. The processor 1704 calls the instructions or programs in the memory 1705 to execute the method of execution of each module shown in Figure 14 and achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0382] Specifically, the embodiment of the present application further provides a network-side device. As shown in FIG18 , the network-side device 1800 includes a processor 1801, a network interface 1802, and a memory 1803. The network interface 1802 is, for example, a common public radio interface (CPRI).

[0383] Specifically, the network side device 1800 of the embodiment of the present application also includes: instructions or programs stored in the memory 1803 and executable on the processor 1801. The processor 1801 calls the instructions or programs in the memory 1803 to execute the methods executed by the modules shown in Figures 10 to 13 and achieve the same technical effect. To avoid repetition, they will not be elaborated here.

[0384] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned authentication processing method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0385] The processor is the processor in the terminal described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. In some examples, the readable storage medium may be a non-transitory readable storage medium.

[0386] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned authentication processing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0387] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0388] An embodiment of the present application further provides a computer program / program product, which is stored in a storage medium. The computer program / program product is executed by at least one processor to implement the various processes of the above-mentioned authentication processing method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0389] An embodiment of the present application also provides a wireless communication system, including: a terminal and a network side device, wherein the terminal can be used to execute the steps of the authentication processing method of the user terminal side as described above, and the network side device can be used to execute the steps of the authentication processing method of the network side device as described above.

[0390] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0391] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of a computer software product plus a necessary general-purpose hardware platform, or of course, by hardware. The computer software product is stored in a storage medium (such as ROM, RAM, magnetic disk, optical disk, etc.) and includes a number of instructions for enabling a terminal or network-side device to execute the methods described in each embodiment of the present application.

[0392] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms of implementation methods without departing from the purpose of this application and the scope of protection of the claims. These implementation methods are all within the protection of this application.

Claims

1. An authentication processing method, comprising: The first network function receives first information from the second network function or the third network function; The first network function sends second information to a third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string; The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string; The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string; The user terminal receives the fourth information, and sends fifth information based on the fourth information, where the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string; The first network function or the third network function receives the fifth information or the first response parameter, and authenticates the user terminal based on the fifth information or the first response parameter.

2. The method according to claim 1, wherein: The first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

3. The method according to claim 1 or 2, wherein: The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

4. The method according to claim 3, further comprising at least one of the following: In the case where the second information includes area information, the third network function determines the access network device based on the area information; In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier; In the case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier. In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

5. The method according to any one of claims 1 to 4, wherein: The third information also includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

6. The method according to claim 5, wherein: In the case where the third information includes the area information, the access network device broadcasting the fourth information includes: The access network device determines or selects a target cell based on the area information; The access network device broadcasts the fourth information in the target cell.

7. The method according to any one of claims 1 to 6, wherein: The access network device broadcasts the fourth information including: The access network device broadcasts the fourth information based on the authentication information or the third information.

8. The method according to any one of claims 1 to 7, wherein: The fourth information also includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

9. The method according to any one of claims 1 to 8, wherein: The fifth information also includes at least one of the target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

10. The method according to claim 1 or 9, wherein: The authenticating the user terminal based on the fifth information or the first response parameter includes: The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal; The fourth network function sends a second response parameter or an authentication result to the first network function based on the sixth information; In a case where the fourth network function sends a second response parameter to the first network function, the first network function determines an authentication result based on the first response parameter and the second response parameter; The target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

11. The method according to any one of claims 1 to 10, wherein: The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

12. The method according to any one of claims 1 to 11, wherein: The authentication information also includes network authentication parameters, and the network authentication parameters are used for the user terminal to authenticate the network.

13. The method according to claim 12, wherein: The network authentication parameters are generated based on information not related to the user terminal.

14. The method according to any one of claims 1 to 13, wherein: After the user terminal receives the fourth information and sends fifth information based on the fourth information, the method further includes: The third network function receives the fifth information from the user terminal; The third network function sends the fifth information or the first response parameter to the first network function.

15. The method according to any one of claims 1 to 14, wherein: After the first network function authenticates the user terminal based on the fifth information or the first response parameter, the method further includes: The first network function sends an authentication result to the third network function or the second network function.

16. An authentication processing method, comprising: When the user terminal receives the fourth information broadcast by the access network device, the user terminal sends the fifth information based on the fourth information; The fourth information includes any one of authentication information, challenge parameters and random character strings; The fifth information includes a first response parameter, wherein the first response parameter is based on the challenge parameter or the random word String generation; The authentication information includes the challenge parameter or the random character string.

17. The method according to claim 16, wherein: The fourth information further includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier, and sending the fifth information based on the fourth information includes: In a case where the user terminal is associated with at least one of the group identifier, the user identifier, the device identifier and the identification identifier, the user terminal sends the fifth information.

18. The method according to claim 16 or 17, wherein: The fifth information also includes at least one of the target identifiers associated with the user terminal, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

19. The method according to any one of claims 16 to 18, wherein: The authentication information further includes a network authentication parameter, and the sending of the fifth information based on the fourth information includes: In a case where the fourth information includes the authentication information, the user terminal authenticates the network based on the network authentication parameter; When the authentication is successful, the user terminal sends the fifth information.

20. An authentication processing method, comprising: The first network function receives first information from the second network function or the third network function; The first network function sends second information to a third network function based on the first information, the second information including authentication information, the authentication information including a challenge parameter or a random string; The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

21. The method according to claim 20, wherein: The first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

22. The method according to claim 20 or 21, wherein: The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

23. The method according to any one of claims 20 to 22, wherein: The authentication information also includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

24. The method according to claim 23, wherein: The network authentication parameters are generated based on information not related to the user terminal.

25. The method according to any one of claims 20 to 24, wherein: The method further comprises: The first network function receives fifth information or a first response parameter from the user terminal, where the fifth information includes the first response parameter, and the first response parameter is generated based on the challenge parameter or the random string; The first network function authenticates the user terminal based on the fifth information or the first response parameter.

26. The method according to any one of claims 20 to 25, wherein: The method further comprises: The first network function receives fifth information or a first response parameter from the user terminal, wherein the fifth information includes The first response parameter is generated based on the challenge parameter or the random string; The first network function sends sixth information to the fourth network function, where the sixth information includes the challenge parameter or the random string, and a target identifier associated with the user terminal; The first network function receives a second response parameter or an authentication result from a fourth network function, wherein the second response parameter or the authentication result is determined based on the sixth information; In a case where the first network function receives a second response parameter from a fourth network function, the first network function determines an authentication result based on the first response parameter and the second response parameter; The second response parameter is generated based on the challenge parameter or the random character string, and the target identifier includes at least one of the following: a group identifier, a user identifier, and a device identifier.

27. An authentication processing method, comprising: The second network function sends first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string.

28. The method according to claim 27, wherein: The first information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

29. The method according to claim 27 or 28, wherein: The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

30. The method according to any one of claims 27 to 29, wherein: The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

31. The method according to any one of claims 27 to 30, wherein: The authentication information also includes network authentication parameters, and the network authentication parameters are used by the user terminal to authenticate the network.

32. The method according to claim 31, wherein: The network authentication parameters are generated based on information not related to the user terminal.

33. An authentication processing method, comprising: The third network function receives second information, the second information includes authentication information, the authentication information includes a challenge parameter or a random string; The third network function sends third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string; The second information is sent by the first network function or the fourth network function.

34. The method of claim 33, further comprising: The third network function receives fifth information from the user terminal, where the fifth information includes a first response parameter, where the first response parameter is generated based on the challenge parameter or the random character string; The third network function sends the fifth information or the first response parameter to the first network function, or based on The user terminal is authenticated based on the first response parameter.

35. The method of claim 34, wherein: After the third network function sends the fifth information or the first response parameter to the first network function, the method further includes: The third network function receives the authentication result from the first network function.

36. A method according to any one of claims 33 to 35, wherein: Before the third network function receives the second information, the method further includes: The third network function sends first information to the first network function, where the first information is used to trigger the first network function to send the second information.

37. A method according to any one of claims 33 to 36, wherein: The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

38. A method according to any one of claims 33 to 37, wherein: The second information further includes at least one of a tag authentication indication and first target information, and the first target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

39. The method according to claim 38, further comprising at least one of the following: In the case where the second information includes area information, the third network function determines the access network device based on the area information; In a case where the second information includes a user identifier, the third network function determines the access network device based on the user identifier; In a case where the second information includes a group identifier, the third network function determines the access network device based on the group identifier; In a case where the second information includes a device identifier, the third network function determines the access network device based on the device identifier.

40. The method according to any one of claims 33 to 39, wherein: The third information also includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

41. The method according to any one of claims 33 to 40, wherein: The authentication information also includes network authentication parameters, and the network authentication parameters are used for the user terminal to authenticate the network.

42. The method according to claim 41, wherein: The network authentication parameters are generated based on information not related to the user terminal.

43. An authentication processing method, comprising: The fourth network function receives sixth information from the first network function, the sixth information including a challenge parameter or a random string, and a target identifier associated with the user terminal; The fourth network function performs at least one of the following based on the sixth information: sending a second response parameter to the first network function; The user terminal is authenticated.

44. The method of claim 43, wherein: After authenticating the user terminal, the method further includes: Sending an authentication result to the first network function.

45. An authentication processing method, comprising: The access network device receives third information from the third network function, where the third information includes any one of authentication information, challenge parameters, and a random character string; The access network device broadcasts fourth information, where the fourth information includes any one of the authentication information, the challenge parameter, and the random character string; The authentication information includes a challenge parameter or a random character string.

46. ​​The method of claim 45, wherein: The access network device broadcasts the fourth information including: The access network device broadcasts the fourth information based on the authentication information or the third information.

47. The method according to claim 45 or 46, wherein: The fourth information also includes at least one of a group identifier, a user identifier, a device identifier, and an identification identifier.

48. A method according to any one of claims 45 to 47, wherein: The third information also includes at least one of a tag authentication indication and second target information, and the second target information includes at least one of a user identifier, a group identifier, a device identifier, and area information.

49. The method of claim 48, wherein: In the case where the third information includes area information, the access network device broadcasting the fourth information based on the third information includes: The access network device determines or selects a target cell based on the area information; The access network device broadcasts the fourth information in the target cell.

50. The method according to any one of claims 45 to 48, wherein: The authentication information is generated based on information not related to the user terminal, or the authentication information does not include a second response parameter, and the second response parameter is generated based on the challenge parameter or the random character string.

51. The method according to any one of claims 45 to 50, wherein: The authentication information also includes network authentication parameters, and the network authentication parameters are used for the user terminal to authenticate the network.

52. The method of claim 51, wherein: The network authentication parameters are generated based on information not related to the user terminal.

53. An authentication processing system, comprising a first network function, a second network function, a third network function, an access network device and a user terminal, wherein: The first network function is configured to receive first information from the second network function or the third network function; and send second information to the third network function based on the first information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random string; The third network function is used to send third information to the access network device, where the third information includes any one of the authentication information, the challenge parameter and the random character string; The access network device is used to broadcast fourth information, where the fourth information includes any one of the authentication information, the challenge parameter and the random character string; The user terminal is configured to receive the fourth information, and send fifth information based on the fourth information, wherein the fifth information includes a first response parameter, and the first response parameter is generated based on the challenge parameter or the random character string; The first network function or the third network function is used to receive the fifth information or the first response parameter, and authenticate the user terminal based on the fifth information or the first response parameter.

54. An authentication processing device, comprising: A first sending module, configured to send fifth information based on the fourth information when receiving fourth information broadcast by the access network device; The fourth information includes any one of authentication information, challenge parameters and random character strings; The fifth information includes a first response parameter, which is generated based on the challenge parameter or the random character string; The authentication information includes the challenge parameter or the random character string.

55. An authentication processing device, comprising: A first receiving module, configured to receive first information from a second network function or a third network function; A second sending module, configured to send second information to a third network function based on the first information, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string; The authentication information is generated based on information not related to the user terminal, or the authentication information does not include the second response parameter.

56. An authentication processing device, comprising: The third sending module is used to send first information to the first network function, where the first information is used to trigger the first network function to send second information to the third network function, where the second information includes authentication information, and the authentication information includes a challenge parameter or a random string.

57. An authentication processing device, comprising: A second receiving module, configured to receive second information, wherein the second information includes authentication information, and the authentication information includes a challenge parameter or a random character string; A fourth sending module, configured to send third information to the access network device, wherein the third information includes any one of the authentication information, the challenge parameter and the random character string; The second information is sent by the first network function or the fourth network function.

58. An authentication processing device, comprising: a third receiving module, configured to receive sixth information from the first network function, wherein the sixth information includes a challenge parameter or a random string, and a target identifier associated with the user terminal; A first execution module is configured to execute at least one of the following based on the sixth information: sending a second response parameter to the first network function; The user terminal is authenticated.

59. An authentication processing device, comprising: a fourth receiving module, configured to receive third information from a third network function, wherein the third information includes any one of authentication information, a challenge parameter, and a random character string; a fifth sending module, configured to broadcast fourth information, wherein the fourth information includes any one of the authentication information, the challenge parameter, and the random character string; The authentication information includes a challenge parameter or a random character string.

60. A terminal comprising a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the authentication processing method according to any one of claims 16 to 19 are implemented.

61. A network side device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the authentication processing method as described in any one of claims 20 to 52 are implemented.

62. A readable storage medium storing a program or instruction, wherein the program or instruction, when executed by a processor, implements the steps of the authentication processing method as described in any one of claims 16 to 52.

Images