Communication method and apparatus

Abstract

The present application relates to the technical field of communications, and discloses a communication method and apparatus. The method comprises: a terminal device sending a first deregistration request message to a network device, and receiving a security mode command message from the network device, the security mode command message being used to enable a first security context; on the basis of the security mode command message, sending a response message of the security mode command message to the network device, and enabling the first security context; receiving a response message of the first deregistration request message from the network device; and, on the basis of a current NAS security context (a first security context) and a non-current NAS security context (a second security context), attempting to perform integrity protection verification on the response message of the deregistration request message. Thus, when a conflict occurs between a security mode control process and a deregistration process, this helps to ensure that terminal device deregistration is completed.

Description

Communication method and device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of the People's Republic of China on September 27, 2023, with application number 202311283845.1 and application name "A Communication Method and Device", the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0004] The 5G mobility management (MM) common procedure (5GMM common procedure) may include the terminal device identity authentication process, authorization process, and security mode control process. The security mode control process may be performed within a specified process (such as a registration process or a service process). Since a deregistration process may also be performed within a specified process, a conflict may arise between the security mode control process and the deregistration process. For example, if a terminal device sends a deregistration request message to a network device while the network device sends a security mode command message to the terminal device, a conflict may arise between the security mode control process and the deregistration process.

[0005] However, when the security mode control process conflicts with the deregistration process, further research is needed on how the terminal device completes deregistration.

[0006] Summary of the Invention

[0007] The present application provides a communication method and apparatus for solving the problem that a terminal device cannot complete deregistration when a security mode control process conflicts with a deregistration process.

[0008] In a first aspect, the present application provides a communication method, which can be applied to a terminal device, a processor, chip, or chip system (such as a system-on-a-chip (SoC)) or functional module in the terminal device. Taking the application of this method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, where the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, where the security mode command message is used to enable a first security context; and if the security mode command message is received during the deregistration process, ignores the security mode command message.

[0009] Using the above method, when the security mode control process conflicts with the deregistration process, the terminal device can ignore the security mode command message (i.e., interrupt the security mode control process), so that the behavior of the terminal device and the network device is consistent, which facilitates ensuring that the terminal device completes the deregistration.

[0010] In one possible design, ignoring the security mode command message includes: not sending a response message to the security mode command message, and / or not enabling the first security context.

[0011] In one possible design, the method further includes: receiving a response message to the first deregistration request message from the network device; and performing integrity protection verification on the response message based on a second security context enabled by the terminal device.

[0012] In one possible design, the first deregistration request message does not carry the first ciphertext element.

[0013] In a second aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or chip system (such as SoC) or a functional module in the terminal device. Taking the application of this method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, where the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, where the security mode command message is used to enable a first security context; according to the security mode command message, sends a response message to the security mode command message to the network device, and enables the first security context; receives a response message to the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, performs an integrity protection check on the response message of the first deregistration request message according to the first security context; if the integrity protection check on the response message of the first deregistration request message fails according to the first security context, performs an integrity protection check on the response message of the first deregistration request message according to a second security context, where the second security context is a security context that the terminal device has enabled before enabling the first security context.

[0014] Using the above method, when the security mode control process conflicts with the deregistration process, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby ensuring that the terminal device completes the deregistration.

[0015] In one possible design, the method further includes: if the integrity protection check of the response message of the first deregistration request message fails according to the second security context, performing local deregistration; or, if the integrity protection check of the response message of the first deregistration request message fails according to the second security context, sending a second deregistration request message to the network device, the second deregistration request message being used by the terminal device to request deregistration.

[0016] In a third aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or chip system (such as SoC) or a functional module in the terminal device. Taking the application of this method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, where the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, where the security mode command message is used to enable a first security context; according to the security mode command message, sends a response message to the security mode command message to the network device, and enables the first security context; receives a response message to the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, performs an integrity protection check on the response message to the first deregistration request message according to the second security context, where the second security context is the security context that the terminal device has enabled before enabling the first security context.

[0017] In one possible design, the method further includes: if the integrity protection check on the response message of the first deregistration request message fails according to the second security context, then the integrity protection check on the response message of the first deregistration request message according to the first security context.

[0018] Using the above method, when the security mode control process conflicts with the deregistration process, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby ensuring that the terminal device completes the deregistration.

[0019] In one possible design, the method further includes: if the integrity protection check of the response message of the first deregistration request message fails according to the first security context, performing local deregistration; or, if the integrity protection check of the response message of the first deregistration request message fails according to the first security context, sending a second deregistration request message to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

[0020] In a fourth aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or chip system (such as SoC) or a functional module in the terminal device. Taking the application of this method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, where the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, where the security mode command message is used to enable a first security context; according to the security mode command message, sends a response message of the security mode command message to the network device, and enables the first security context; receives a response message to the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, and the response message of the first deregistration request message is a ciphertext message, then performs an integrity protection check on the response message of the first deregistration request message according to the first security context; or, if the security mode command message is received during the deregistration process, and the response message of the first deregistration request message is a plaintext message, then enters the deregistration state.

[0021] By adopting the above method, when the security mode control process conflicts with the deregistration process, the terminal device can decide whether to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context according to whether the deregistration acceptance message is in plain text, thereby ensuring that the terminal device completes the deregistration.

[0022] In a fifth aspect, the present application provides a communication method, which can be applied to a terminal device, a processor or chip or chip system (such as SoC) or a functional module in the terminal device. Taking the application of this method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, where the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, where the security mode command message is used to enable a first security context; if the security mode command message is received during the deregistration process and the first deregistration request message does not carry a first ciphertext element, then ignore the security mode command message; or, if the security mode command message is received during the deregistration process and the first deregistration request message carries the first ciphertext element, then send a response message to the security mode command message to the network device, and enable the first security context.

[0023] By using the above method, the terminal device can determine whether to interrupt the security mode control process based on whether the first deregistration request message carries the first ciphertext element, thereby avoiding the terminal device interrupting the security mode control process triggered by the network device's failure to perform integrity protection verification on the first ciphertext element, and facilitating the terminal device to complete deregistration.

[0024] In one possible design, ignoring the security mode command message includes: not enabling the first security context, and / or not sending a response message to the security mode command message.

[0025] In one possible design, when executing the method of ignoring the security mode command message, the method also includes: receiving a response message to the first deregistration request message from the network device; when the response message to the first deregistration request message is a ciphertext message, performing integrity protection verification on the response message according to the second security context enabled by the terminal device; or, when the response message to the first deregistration request message is a plaintext message, entering the deregistration state.

[0026] In one possible design, when executing the enabling of the first security context, the method also includes: receiving a response message to the first deregistration request message from the network device; performing an integrity protection check on the response message to the first deregistration request message according to the first security context; and in a case where the integrity protection check on the response message to the first deregistration request message according to the first security context fails, performing an integrity protection check on the response message to the first deregistration request message according to a second security context, where the second security context is a security context that has been enabled by the terminal device before enabling the first security context.

[0027] In one possible design, the method further includes: if the integrity protection check of the response message of the first deregistration request message fails according to the second security context, performing local deregistration; or, if the integrity protection check of the response message of the first deregistration request message fails according to the second security context, sending a second deregistration request message to the network device, the second deregistration request message being used by the terminal device to request deregistration.

[0028] In one possible design, when executing the enabling of the first security context, a response message to the first deregistration request message from the network device is received; and an integrity protection check is performed on the response message to the first deregistration request message based on the second security context, where the second security context is the security context that has been enabled by the terminal device before enabling the first security context.

[0029] In one possible design, the method further includes: if the integrity protection check on the response message of the first deregistration request message fails according to the second security context, then the integrity protection check on the response message of the first deregistration request message according to the first security context.

[0030] In one possible design, the method further includes: if the integrity protection check of the response message of the first deregistration request message fails according to the first security context, performing local deregistration; or, if the integrity protection check of the response message of the first deregistration request message fails according to the first security context, sending a second deregistration request message to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

[0031] In one possible design, when the enabling of the first security context is executed, a response message to the first deregistration request message from the network device is received; when the response message to the first deregistration request message is a ciphertext message, an integrity protection check is performed on the response message to the first deregistration request message according to the first security context; or, when the response message to the first deregistration request message is a plaintext message, the deregistration state is entered.

[0032] In one possible design, the response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained based on the first security context.

[0033] In a sixth aspect, the present application provides a communication method, which can be applied to a terminal device, a processor, chip, chip system (such as a SoC), or functional module in the terminal device. Taking the application of this method to a terminal device as an example, the terminal device sends a first deregistration request message to a network device, where the first deregistration request message is used by the terminal device to request deregistration; receives a security mode command message from the network device, where the security mode command message is used to enable a first security context; and if the security mode command message is received before the deregistration process is completed, performs local deregistration.

[0034] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can perform local deregistration, thereby ensuring that the terminal device completes the deregistration.

[0035] In one possible design, the method further includes: ignoring the security mode command message.

[0036] In one possible design, ignoring the security mode command message includes: not enabling the first security context, and / or not sending a response message to the security mode command message.

[0037] In one possible design, the first deregistration request message does not carry the first ciphertext element.

[0038] In a seventh aspect, the present application provides a communication method, which can be applied to a network device, a processor or chip or chip system (such as SoC) or functional module in the network device. Taking the application of this method to a network device as an example, the network device sends a security mode command message to a terminal device, where the security mode command message is used to enable a first security context; while waiting to receive a response message to the security mode command message, the network device receives a first deregistration request message from the terminal device, where the first deregistration request message is used for the terminal device to request deregistration; receives a response message to the security mode command message from the terminal device; enables the first security context based on the response message to the security mode command message; and sends a response message to the first deregistration request message to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained based on the first security context.

[0039] With the above method, when a conflict occurs between the security mode control process and the deregistration process, the network device does not interrupt the security mode control process, thereby ensuring that the terminal device completes the deregistration.

[0040] In one possible design, the method further includes: if the first deregistration request message carries a first ciphertext element, continuing to wait for receiving a response message to the security mode command message.

[0041] In an eighth aspect, the present application provides a communication method, which can be applied to a network device, a processor or chip or chip system (such as SoC) or a functional module in the network device. Taking the application of this method to a network device as an example, the network device receives a first deregistration request message from a terminal device, where the first deregistration request message is used by the terminal device to request deregistration, and the first deregistration request message carries a first ciphertext element; if the integrity protection check of the first ciphertext element fails according to the second security context, a security mode command message is sent to the terminal device, where the security mode command message is used to enable the first security context; a response message to the security mode command message from the terminal device is received; the first security context is enabled according to the response message to the security mode command message; and a response message to the first deregistration request message is sent to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

[0042] In one possible design, the response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained based on the first security context.

[0043] In one possible design, the method further includes:

[0044] An authentication request message is sent to the terminal device, where the authentication request message is used to request the terminal device to create a first security context.

[0045] In the ninth aspect, the present application provides a communication device, which has the ability to implement the functions involved in any one of the first to eighth aspects above. For example, the communication device includes modules or units or means corresponding to the operations involved in any one of the first to eighth aspects above. The functions or units or means can be implemented through software, or through hardware, or the corresponding software can be implemented through hardware.

[0046] In one possible design, the communication device includes a processing unit and a communication unit. The communication unit can be used to send and receive signals to enable communication between the communication device and other devices, for example, the communication unit is used to send system information to a terminal. The processing unit can be used to perform certain internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations described in any of the first to eighth aspects above.

[0047] In one possible design, the communication device includes a processor, which can be coupled to a memory. The memory can store the necessary computer programs or instructions for implementing the functions of any one of the first to eighth aspects. The processor can execute the computer programs or instructions stored in the memory. When the computer programs or instructions are executed, the communication device implements the method of any possible design or implementation of the first to eighth aspects.

[0048] In one possible design, the communication device includes a processor and a memory, and the memory may store the necessary computer programs or instructions for implementing the functions of any of the first to eighth aspects described above. The processor may execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements the method of any possible design or implementation of the first to eighth aspects described above.

[0049] In one possible design, the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design or implementation of the first to eighth aspects above.

[0050] It can be understood that in the above-mentioned ninth aspect, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. In addition, the above processors can be one or more, and the memories can be one or more. The memory can be integrated with the processor, or the memory and the processor can be set separately. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be set on different chips respectively. The embodiment of the present application does not limit the type of memory and the setting method of the memory and the processor.

[0051] In a tenth aspect, the present application provides a communication system, which may include a terminal device and a network device; wherein the terminal device is configured to execute the method of any possible design or implementation of the first to sixth aspects; the network device is configured to send the security mode command message to the terminal device; and send a response message to the first deregistration request message to the terminal device. Alternatively, the network device is configured to execute the method of any possible design or implementation of the seventh or eighth aspects; the terminal device is configured to send the first deregistration request message to the network device; and send a response message to the security mode command message to the network device.

[0052] In the eleventh aspect, the present application provides a computer-readable storage medium, in which a computer program (or computer-readable instructions) is stored. When a computer reads and executes part or all of the computer-readable instructions, the method in any possible design of the above-mentioned first to eighth aspects is executed.

[0053] Exemplarily, a computer-readable storage medium can be any available medium that can be accessed by a computer. By way of example and not limitation, a computer-readable medium can include a non-transitory computer-readable medium, a random-access memory (RAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a CD-ROM or other optical disk storage, a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer.

[0054] In a twelfth aspect, the present application provides a computer program product, which, when read and executed by a computer, enables the method in any possible design of the above-mentioned first to eighth aspects to be executed.

[0055] In the thirteenth aspect, the present application provides a chip (or chip system), which includes a processor, the processor is coupled to a memory, and the memory stores a computer program; the processor is used to call part or all of the computer program in the memory, so that the method in any possible design of the above-mentioned first to eighth aspects is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 is a schematic diagram of a network architecture;

[0057] FIG2 is a schematic diagram of a process flow of a 5G mobility management public process during a registration process;

[0058] FIG3 is a schematic diagram of a process in which a security mode control process conflicts with a deregistration process;

[0059] FIG4 is a flow chart corresponding to a communication method provided in an embodiment of the present application;

[0060] FIG5 is a flow chart of another communication method according to an embodiment of the present application;

[0061] FIG6 is a flow chart of another communication method according to an embodiment of the present application;

[0062] FIG7 is a flow chart corresponding to another communication method provided in an embodiment of the present application;

[0063] FIG8 is a flow chart corresponding to another communication method provided in an embodiment of the present application;

[0064] FIG9 is an exemplary block diagram of a device involved in an embodiment of the present application;

[0065] FIG10 is a schematic structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] Below with reference to the accompanying drawings in the embodiment of the present application, the technical scheme in the embodiment of the present application will be described. The terms "first", "second" etc. and other various terminology labels etc. (if any) in the specification and claims and the accompanying drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in a sequence other than the content illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or that are inherent to these processes, methods, products or equipment.

[0067] The technical solutions provided in this application can be applied to various communication systems, such as: fifth generation (5G) or new radio (NR) systems, long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, etc. The technical solutions provided in this application can also be applied to future communication systems, such as the sixth generation mobile communication system. The technical solutions provided in this application can also be applied to device to device (D2D) communication, vehicle-to-everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of Things (IoT) communication systems or other communication systems.

[0068] A 5G system applicable to an embodiment of the present application will be illustrated below with reference to (a) in FIG1 and (b) in FIG1 . It should be understood that the 5G system described herein is merely an example and does not constitute any limitation to the present application. It should also be understood that certain network elements in the 5G system may communicate using a service-based interface or a point-to-point interface. The following describes a 5G system framework based on a point-to-point interface and a 5G system framework based on a service-based interface, respectively, in conjunction with (a) in FIG1 and (b) in FIG1 .

[0069] As an exemplary illustration, FIG1(a) shows a schematic diagram of the network architecture of a 5G system 100a to which an embodiment of the present application is applicable. FIG1(b) shows a schematic diagram of the network architecture of a 5G system 100b based on a service-oriented interface. As shown in FIG1(a), the network architecture may include but is not limited to the following network elements (or referred to as functional network elements, functional entities, nodes, devices, etc.):

[0070] (Radio) access network (R)AN) equipment, access and mobility management function (AMF) network element, session management function (SMF) network element, user plane function (UPF) network element, policy control function (PCF) network element, unified data management (UDM) network element, application function (AF) network element, data network (DN), authentication server function (AUSF) network element, unified data management (UDM) network element, unified data repository (UDR), etc.

[0071] The following is a brief introduction to the network elements shown in (a) of Figure 1:

[0072] 1. User equipment (UE): This term may also be referred to as terminal equipment, terminal device, access terminal, subscriber unit, subscriber station, mobile station, mobile station (MS), mobile terminal (MT), remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent, or user device. A terminal can be a device that provides voice / data connectivity to a user, such as a handheld device or vehicle-mounted device with wireless connectivity. At present, some examples of terminals may include: mobile phones, tablet computers, computers with wireless transceiver functions (such as laptops, PDAs, etc.), mobile internet devices (MIDs), virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or future evolved public land mobile communication networks (PLMNs). terminals in network, PLMN, etc.

[0073] Furthermore, terminals can also be terminals in the Internet of Things (IoT) system. IoT is a crucial component of future information technology development. Its primary technical feature is connecting objects to the Internet through communications, thereby enabling intelligent networks that interconnect humans and machines, and objects and things. IoT technology, for example, utilizes narrowband (NB) technology to achieve massive connectivity, deep coverage, and power-saving terminals.

[0074] In addition, the terminal can also include smart printers, train detectors, etc. Its main functions include collecting data (part of the terminal equipment), receiving control information and downlink data from network equipment, and sending electromagnetic waves to transmit uplink data to network equipment.

[0075] It should be understood that the terminal can be any device that can access the network. The terminal and the access network device can communicate with each other using some air interface technology.

[0076] Alternatively, a terminal can function as a base station. For example, a terminal can act as a dispatching entity, providing sidelink signals between terminals in V2X or D2D applications. For example, a cell phone and a car can communicate with each other using sidelink signals. A cell phone and a smart home device can also communicate without relaying the communication signal through a base station.

[0077] 2. (Wireless) access network equipment: referred to as access network equipment in the embodiments of this application, it is used to provide network access functions for authorized user devices in a specific area, and can use transmission tunnels with different service qualities according to the level of the user device, business requirements, etc.

[0078] Access network equipment can manage wireless resources, provide access services to user equipment, and then complete the forwarding of control signals and data between user equipment and the core network. Access network equipment can also be understood as base stations in traditional networks.

[0079] Exemplarily, the access network device in the embodiment of the present application may be any communication device with wireless transceiver functionality for communicating with a user equipment. The access network device includes but is not limited to an evolved Node B (eNB) or a gNB in ​​a 5G system, or a transmission point (TRP or TP), or one or a group (including multiple antenna panels) of antenna panels of a base station in a 5G system, or may also be a network node constituting a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit (DU).

[0080] In some deployments, a gNB may include a centralized unit (CU) and a DU. The gNB may also include an active antenna unit (AAU). The CU implements some gNB functions, while the DU implements some gNB functions. For example, the CU is responsible for processing non-real-time protocols and services, implementing the functions of the radio resource control (RRC) and packet data convergence protocol (PDCP) layers. The DU is responsible for processing physical layer protocols and real-time services, implementing the functions of the radio link control (RLC), media access control (MAC), and physical (PHY) layers. The AAU implements some physical layer processing functions, RF processing, and active antenna-related functions. Because RRC layer information ultimately becomes PHY layer information, or is converted from PHY layer information, in this architecture, higher-layer signaling, such as RRC layer signaling, can also be considered to be sent by the DU, or by both the DU and the AAU. It is understood that an access network device can be a device that includes one or more of a CU node, a DU node, or an AAU node. In addition, the CU may be divided into an access network device in an access network, or may be divided into an access network device in a core network (CN), which is not limited in this application.

[0081] 3. UPF network element: used for packet routing and forwarding, as well as quality of service (QoS) processing of user plane data.

[0082] 4. AMF network element: The access and mobility management function network element is mainly used for mobility management and access management, etc. It can be used to implement other functions of MME except session management, such as access authorization / authentication.

[0083] 5. SMF network element: mainly used for session management, Internet protocol (IP) address allocation and management of user equipment, selection of endpoints of manageable user plane functions, policy control and charging function interfaces, and downlink data notification.

[0084] 6. PCF network element: A unified policy framework used to guide network behavior and provide policy rule information for control plane functional network elements (such as AMF, SMF, etc.).

[0085] 7. AF network element: used for data routing affected by applications, open function network element of wireless access network, interacting with the policy framework for policy control, etc.

[0086] 8. UDM network element: used to process UE identification, access authentication, registration and mobility management, etc.

[0087] 9. AUSF network element: used for authentication services, generating keys to achieve two-way authentication of user devices, and supporting a unified authentication framework.

[0088] 10. UDR: used to store the contract information of UDM network elements, policy information of PCF network elements, etc.

[0089] 11. DN: A DN is a network outside of a carrier network. A carrier network can access multiple DNs, and a variety of services can be deployed on the DN, providing data and / or voice services to terminal devices. For example, a DN is the private network of a smart factory. Sensors installed in the workshop of the smart factory can be terminal devices. A control server for the sensors is deployed in the DN, and the control server can provide services to the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, a DN is a company's internal office network. The mobile phones or computers of the company's employees can be terminal devices, and the employees' mobile phones or computers can access information, data resources, etc. on the company's internal office network.

[0090] In FIG1(a), Nausf, Nnef, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface sequence numbers. The meanings of these interface sequence numbers can be found in the 3GPP standard protocol and are not limited here.

[0091] In the network architecture shown in (a) of Figure 1, each network element can communicate with each other through the interfaces shown in the figure. For example, the UE and AMF can interact through the N1 interface, and the interaction message can be called an N1 message. The RAN and AMF can interact through the N2 interface, and the N2 interface can be used to send non-access stratum (NAS) messages, etc. The RAN and UPF can interact through the N3 interface, and the N3 interface can be used to transmit user plane data, etc. The SMF and UPF can interact through the N4 interface, and the N4 interface can be used to transmit information such as tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages. The UPF and DN can interact through the N6 interface, and the N6 interface can be used to transmit user plane data, etc. The relationship between other interfaces and each network element is shown in (a) of Figure 1. For the sake of brevity, they are not described in detail here.

[0092] As shown in Figure 1(b), this is a schematic diagram of a 5G network architecture based on a point-to-point interface. The functions of the network elements therein can be referred to the functions of the corresponding network elements in Figure 1(a), and will not be repeated here. The main difference between Figure 1(b) and Figure 1(a) is that the interfaces between the network elements in Figure 1(b) are point-to-point interfaces, rather than service-based interfaces.

[0093] In the architecture shown in Figure 1(b), the interface names and functions between the various network elements are as follows:

[0094] 1) N7: The interface between PCF and SMF, used to deliver protocol data unit (PDU) session granularity and service data flow granularity control policy.

[0095] 2) N15: Interface between PCF and AMF, used to deliver UE policies and access control related policies.

[0096] 3) N5: The interface between AF and PCF, used for issuing application service requests and reporting network events.

[0097] 4) N4: The interface between SMF and UPF is used to transfer information between the control plane and the user plane, including the control of the forwarding rules, QoS control rules, traffic statistics rules, etc. for the user plane and the reporting of information on the user plane.

[0098] 5) N11: The interface between SMF and AMF, used to transfer PDU session tunnel information between RAN and UPF, transfer control messages sent to UE, transfer radio resource control information sent to RAN, etc.

[0099] 6) N2: The interface between AMF and RAN, used to transmit radio bearer control information from the core network to the RAN.

[0100] 7) N1: The interface between AMF and UE, access-independent, used to deliver QoS control rules to the UE.

[0101] 8) N8: Interface between AMF and UDM, used by AMF to obtain access and mobility management related subscription data and authentication data from UDM, and AMF to register UE current mobility management related information with UDM.

[0102] 9) N10: Interface between SMF and UDM, used by SMF to obtain session management-related subscription data from UDM, and for SMF to register UE current session-related information with UDM.

[0103] 10) N35: Interface between UDM and UDR, used by UDM to obtain user contract data information from UDR.

[0104] 11) N36: Interface between PCF and UDR, used by PCF to obtain policy-related contract data and application data-related information from UDR.

[0105] 12) N12: Interface between AMF and AUSF, used by AMF to initiate the authentication process to AUSF, which can carry the user hidden identifier (SUCI) as the contract identifier.

[0106] 13) N13: Interface between UDM and AUSF, used by AUSF to obtain the user authentication vector from UDM to execute the authentication process.

[0107] To facilitate understanding of the embodiments of this application, some of the terms involved in this application are exemplified below. It is understood that the terms given below are explained using the 5G system as an example, but it should be understood that in other communication systems (such as the future sixth-generation communication system), the following terms may have other names, and this application does not limit this.

[0108] (1) 5G mobility management public process

[0109] 5G mobility management public processes may include terminal device identity authentication, authorization, and security mode control processes. 5G mobility management public processes may be embedded in designated processes, meaning they may be performed within designated processes; for example, designated processes may include registration processes and service processes.

[0110] In conjunction with Figure 2, a possible implementation is described below using "5G mobility management public process is performed in the registration process" as an example.

[0111] Figure 2 is a schematic diagram of a process flow of the 5G mobility management public process during the registration process. As shown in Figure 2, the process may include:

[0112] S201, the terminal device sends a registration request message to the AMF network element; accordingly, the AMF network element receives the registration request message.

[0113] Here, the registration request message is a NAS message and may include a registration type, such as initial registration. Optionally, the registration request message may also include a SUCI, such as a Subscription Permanent Identifier (SUPI) type, a home network identifier, a routing identifier, and a SUPI protection algorithm identifier. SUCI is an encrypted version of SUPI and is used to prevent SUPI from being leaked over the air and to ensure proper authentication between the terminal device and the network.

[0114] It is understood that the terminal device and the AMF network element can communicate through the access network device. For example, the terminal device can send an RRC message to the access network device, and the RRC message includes a registration request message. In response, after receiving the RRC message, the access network device can forward the registration request message to the AMF network element.

[0115] S202, the AMF network element sends an identity request message to the terminal device; accordingly, the terminal device receives the identity request message.

[0116] For example, if the AMF network element does not obtain the SUCI (for example, the terminal device does not provide the SUCI to the AMF network element, that is, the registration request message does not include the SUCI), the AMF network element may send an identity request message to the terminal device, and the identity request message is used to obtain the SUCI.

[0117] S203, the terminal device sends an identity response message to the AMF network element, where the identity response message includes SUCI.

[0118] S204, the AMF network element sends an authentication request message to the terminal device; accordingly, the terminal device receives the authentication request message.

[0119] Here, after completing the authentication of the terminal device, the AMF network element can derive the keys used for secure communication between the AMF network element and the terminal device (such as integrity protection keys and encryption keys), thereby completing the creation of the security context on the AMF side; then, the AMF network element sends an authentication request message to the terminal device to request the completion of the security context creation on the terminal device side.

[0120] Exemplarily, the authentication request message may carry a set of authentication parameters and also carry parameters for the terminal device to create a security context.

[0121] S205, the terminal device sends an authentication response message to the AMF network element; accordingly, the AMF network element receives the authentication response message.

[0122] For example, after receiving the authentication request message, the terminal device can trigger an authentication algorithm to generate a set of parameters. If the set of parameters is consistent with the authentication parameters carried in the authentication request message, the terminal device can be considered to be a legitimate network, thereby completing the terminal device's authentication of the network. The terminal device can then create a security context based on the parameters used to create the security context for the terminal device. The terminal device can send the authentication result to the AMF network element via an authentication response message.

[0123] S206, the AMF network element sends a security mode command (SMC) message to the terminal device; accordingly, the terminal device receives the security mode command message.

[0124] Here, the security mode command message is used to instruct the terminal device to enable a security context so as to securely process the NAS message.

[0125] Exemplarily, the security mode command message may include an identifier of the security context to be enabled.

[0126] S207, the terminal device sends a response message to the security mode command message to the AMF network element, and the response message is, for example, a security mode complete (SMP) message; accordingly, the AMF network element receives the security mode complete message and enables the security context according to the security mode complete message (the security context enabled by the AMF network element and the terminal device is the same).

[0127] S208, the AMF network element sends a response message to the registration request message to the terminal device, such as a registration accept message; accordingly, the terminal device receives the registration accept message.

[0128] It is understandable that S202 and S203 above are steps in the identity authentication process, S204 and S205 are steps in the authorization process, and S206 and S207 are steps in the security mode control process. Other possible steps may also be included in the identity authentication process, the authorization process, or the security mode control process. For example, the AMF network element may also communicate with other core network elements in the authentication process, and this embodiment of the present application does not limit this.

[0129] Furthermore, the above description uses the example of performing the identity authentication process, the authorization process, and the security mode control process during the registration process. In other possible scenarios, any one or two of the identity authentication process, the authorization process, and the security mode control process may also be performed during the registration process (or business process). For example, if the registration request message includes the SUCI, the identity authentication process may not be required.

[0130] (2) Security Context

[0131] The security context involved in the embodiments of the present application may be a non-access stratum (NAS) security context. By executing the above security mode control process, the terminal device and the network device can enable the same NAS security context and communicate based on the NAS security context, thereby improving the security of communication between the terminal device and the network device.

[0132] Exemplarily, a NAS security context may include a key for integrity protection / integrity protection verification, and optionally, a key for encryption / decryption. The NAS security context may be identified by a key identifier, such as a key set identifier for next generation radio access network (ngKSI). A NAS security context that is in use or active may be referred to as a current NAS security context, and a NAS security context that is not currently in use or in an inactive state may be referred to as a non-current NAS security context.

[0133] The terminal device may store the NAS security context in a universal subscriber identity module (USIM) or non-volatile memory in the terminal device. For example, if the USIM of the terminal device supports the storage of registration management parameters, the terminal device may store the current NAS security context on the USIM and mark the NAS security context stored on the USIM as valid. If the USIM of the terminal device does not support the storage of registration management parameters, the terminal device may store the NAS security context in non-volatile memory and mark the NAS security context stored in the non-volatile memory as valid.

[0134] Exemplarily, the registration request message may carry ngKSI. If the value of ngKSI is any value from 0 to 6, it indicates that there is a valid security context in the terminal device. If the value of ngKSI is 7, it indicates that there is no valid security context in the terminal device.

[0135] (3) Registration process

[0136] The deregistration process can be triggered by the terminal device or by the core network element. Taking the deregistration process triggered by the terminal device as an example, the terminal device can send a deregistration request message to the AMF network element (that is, the terminal device starts the deregistration process). The deregistration request message may include the deregistration type (for example, the deregistration type is non-shutdown, or shutdown); accordingly, after receiving the deregistration request message, the AMF network element can send a response message to the deregistration request message to the terminal device, and the response message is, for example, a deregistration acceptance message. If the terminal device has established a PDU session, the AMF network element can send a session context release request message to the SMF network element after receiving the deregistration request message to release the session context of the terminal device, and then send a deregistration acceptance message to the terminal device.

[0137] After receiving the deregistration acceptance message, the terminal device performs an integrity check on the deregistration acceptance message according to the security context. After the integrity check succeeds, the deregistration acceptance message is decrypted. After the decryption succeeds, the terminal device considers the deregistration process complete and enters the deregistration state. The deregistration state can be understood as the 5G Mobility Management Deregistration (5GMM-deregistered) state. In the 5GMM-deregistered state, the network device does not know the location of the terminal device and cannot access the terminal device.

[0138] According to the above description, the security mode control process can be carried out in a specified process (such as a registration process, a business process). Since the deregistration process may also be carried out in the specified process, there may be a conflict between the security mode control process and the deregistration process. For example, when the terminal device sends a deregistration request message to the AMF network element, the AMF network element sends a security mode command message to the terminal device, which will cause a conflict between the security mode control process and the deregistration process. Exemplarily, from the perspective of the terminal device, if the terminal device receives a security mode command message during the deregistration process, it can be determined that the security mode control process conflicts with the deregistration process; wherein, the deregistration process may refer to the process from the terminal device initiating the deregistration process (such as sending a deregistration request message) to the terminal device completing the deregistration process (such as receiving a deregistration acceptance message). From the perspective of the AMF network element, if the AMF network element receives a deregistration request message during the security mode control process, it can be determined that the security mode control process conflicts with the deregistration process; wherein, the security mode control process may refer to the process from the AMF network element initiating the security mode control process (such as sending a security mode command message) to the AMF network element completing the security mode control process (i.e., receiving a security mode completion message).

[0139] For terminal devices, the current protocol stipulates that once a terminal device receives a security mode command message, it activates a new security context based on the security mode command message. Therefore, if the security mode control process conflicts with the deregistration process, the terminal device can activate a new security context based on the security mode command message and perform integrity protection verification on the deregistration acceptance message based on the new security context.

[0140] For AMF network elements, the current protocol stipulates that when the security mode control process conflicts with the deregistration process, the AMF network element can interrupt the security mode control process, that is, the AMF network element does not enable a new security context (maintains the previously enabled security context, or maintains the plain text if the security context was not enabled before), and performs integrity protection on the deregistration acceptance message based on the previously enabled security context, and then sends the deregistration acceptance message to the terminal device.

[0141] For example, Figure 3 is a schematic diagram of a possible process where the security mode control process conflicts with the deregistration process. As shown in Figure 3, the process may include:

[0142] S301, the terminal device sends a registration request message to the AMF network element.

[0143] Exemplarily, there is no valid security context in the terminal device, and therefore the registration request message sent by the terminal device is a plaintext message.

[0144] S302, the terminal device and the AMF network element execute the authentication process.

[0145] Specifically, through the authentication process, the same security context can be created in the terminal device and the AMF network element.

[0146] Here, the specific implementation of the authentication process can refer to the existing technology and will not be repeated here.

[0147] Optionally, the terminal device and the AMF network element may also perform an identity authentication process before performing the authentication process, without specific limitation.

[0148] S303, the terminal device sends a deregistration request message to the AMF network element; accordingly, the AMF network element receives the deregistration request message.

[0149] For example, during the registration process of the terminal device, if the terminal device terminates the deregistration process for some reason and starts the deregistration process, the terminal device can send a deregistration request message to the AMF network element.

[0150] S304, the AMF network element sends a security mode command message to the terminal device; accordingly, the terminal device receives the security mode command message.

[0151] Assume that the terminal device sends a deregistration request message and the AMF network element sends a security mode command message at the same time (or the interval between the two is short), which causes a conflict between the security mode control process and the deregistration process.

[0152] S305, the terminal device enables the security context according to the security mode command message and sends a security mode completion message to the AMF network element; accordingly, the AMF network element receives the security mode completion message.

[0153] S306, the AMF network element sends a registration acceptance message to the terminal device.

[0154] S307: The terminal device discards the registration acceptance message.

[0155] Because the security mode control process conflicts with the deregistration process, the AMF network element interrupts the security mode control process (i.e., does not enable the security context) and sends a deregistration acceptance message to the terminal device in plain text. However, since the terminal device has enabled the security context but the received deregistration acceptance message is a plain text message, the terminal device will discard the plain text message, resulting in the terminal device being unable to complete the deregistration and thus unable to initiate a new round of registration.

[0156] From this, it can be seen that when the security mode control process conflicts with the deregistration process, the terminal device enables a new security context, but the AMF network element does not enable a new security context, that is, the behaviors of the terminal device and the AMF network element are inconsistent (the security contexts used are inconsistent), which will cause the deregistration process to fail to complete.

[0157] Based on this, an embodiment of the present application provides a communication method for solving the problem that the terminal device cannot complete deregistration when a security mode control process conflicts with the deregistration process.

[0158] The embodiments of the present application are described in detail below in conjunction with Examples 1 to 5. It is understandable that the technical solutions provided in the embodiments of the present application can be applied to wireless communications between multiple communication devices, such as multiple communication devices including terminal devices and network devices, wherein the network devices can be AMF network elements, or other devices having some or all of the functions of AMF network elements. In the embodiments of the present application, unless otherwise specified, "terminal device" can refer to the terminal device itself, or to a component in the terminal device, such as a chip or a chip system; "network device" can refer to the network device itself, or to a component in the network device, such as a chip or a chip system.

[0159] Example 1

[0160] In embodiment 1, when the security mode control process conflicts with the deregistration process, the network device can follow the provisions of the protocol (i.e., interrupt the security mode control process) and improve the implementation on the terminal device side to ensure that the terminal device completes the deregistration.

[0161] FIG4 is a flow chart of the communication method according to an embodiment of the present application. As shown in FIG4 , the flow may include:

[0162] S401: The terminal device sends a first deregistration request message to the network device.

[0163] The first deregistration request message may be used to request deregistration of the terminal device, or in other words, used by the terminal device to request deregistration; accordingly, the network device receives the first deregistration request message.

[0164] Exemplarily, the terminal device may send a first deregistration request message to the network device during a registration process or a business process. The embodiment of the present application does not limit the scenario in which the terminal device sends the first deregistration request message.

[0165] The deregistration requested by the first deregistration request message may be a non-shutdown deregistration, which is not restricted.

[0166] S402: The network device sends a security mode command message to the terminal device.

[0167] The security mode command message may be used to enable the first security context; accordingly, the terminal device receives the security mode command message.

[0168] For example, with respect to S401 and S402 above: from the perspective of the terminal device, the terminal device may receive the security mode command message from the network device after sending the first deregistration request message; from the perspective of the network device, the network device may receive the first deregistration request message from the terminal device after sending the security mode command message. Similar descriptions in other embodiments below (such as S501 and S502 in Example 2, S601 and S602 in Example 3, and S701 and S702 in Example 4) can be understood by reference.

[0169] S403: If the security mode command message is received during the deregistration process, the terminal device ignores the security mode command message.

[0170] Among them, the deregistration process may refer to the deregistration process initiated by the terminal device through the first deregistration request message, which belongs to the existing technology and will not be described in detail.

[0171] In addition, the security mode command message is received during the deregistration process of the terminal device, which can be understood or replaced by the security mode control process of the terminal device conflicting with the deregistration process. The above "the security mode command message is received during the deregistration process" can also be replaced by other descriptions, such as "the security mode command message is received before the end of the deregistration process" without restriction.

[0172] Exemplarily, after receiving the security mode command message, the terminal device can determine whether the security mode command message is received during the deregistration process. There can be many specific implementation methods. For example, when the terminal device starts the deregistration process (for example, sending a first deregistration request), it can enter the deregistration initiation state (or set a flag that the deregistration process is being executed). When receiving the security mode command message, it is determined whether the security mode command message is received during the deregistration process by determining whether the terminal device is in the deregistration initiation state. If the terminal device is in the deregistration initiation state, the security mode command message is received during the deregistration process; or, if the terminal device is not in the deregistration initiation state, the security mode command message is not received during the deregistration process.

[0173] The above “the terminal device ignores the safe mode command message” can also be replaced by other descriptions, such as “the terminal device interrupts the safe mode control process” or “the terminal device discards the safe mode command message”.

[0174] The terminal device ignoring the security mode command message may include: the terminal device not sending a response message to the security mode command message (for example, a security mode completion message), and / or not enabling the first security context.

[0175] S404: If the first deregistration request message is received during the process of waiting for a response message to the security mode command message, the network device does not enable the first security context.

[0176] After sending the security mode command message, the network device may wait to receive a response message to the security mode command message. If the network device receives a first deregistration request message while waiting to receive the response message to the security mode command message, the network device may determine that a conflict exists between the security mode control process and the deregistration process, and thus, may not enable the first security context. The network device may instead interrupt the security mode control process by not enabling the first security context.

[0177] For example, after the network device sends a security mode command message, it can start a timer (the duration of the timer is the duration of waiting for receiving a response message to the security mode command message). If a first deregistration request message is received during the timer, it can be determined that the first deregistration request message was received while waiting for receiving a response message to the security mode command message, that is, it is determined that the security mode control process and the deregistration process conflict. The embodiments of the present application do not limit the specific implementation of the network device determining whether the security mode control process and the deregistration process conflict.

[0178] Optionally, the above method further includes:

[0179] S405: The network device sends a response message to the first deregistration request message to the terminal device. The response message to the first deregistration request message is a ciphertext message obtained according to the second security context.

[0180] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message.

[0181] Taking the existence of a valid security context (such as the second security context) in the network device and the terminal device as an example, the network device and the terminal device can maintain, enable or use the second security context, that is, the second security context continues to be valid; in this case, the network device performs integrity protection and encryption on the deregistration acceptance message to be sent according to the second security context, and sends the deregistration acceptance message to the terminal device; in this case, the deregistration acceptance message is a ciphertext message.

[0182] S406: The terminal device performs integrity protection verification on the deregistration acceptance message according to the second security context.

[0183] Illustratively, if the integrity protection check of the deregistration accept message based on the second security context succeeds, the terminal device may decrypt the deregistration accept message based on the second security context. After successful decryption, the deregistration process is completed and the deregistration state is entered. Alternatively, if the integrity protection check of the deregistration accept message based on the second security context fails, the terminal device may perform local deregistration or re-initiate the deregistration process, such as by sending a second deregistration request message to the network device.

[0184] Using the above method, when the security mode control process conflicts with the deregistration process, both the terminal device and the network device can interrupt the security mode control process and communicate according to the second security context, so that the behavior of the terminal device and the network device is consistent, which facilitates ensuring that the terminal device completes the deregistration.

[0185] It is understood that the above is based on "a valid security context exists in the network device and the terminal device." In other examples, a valid security context does not exist in the terminal device and the network device. In this case, S405 can be replaced by S405-a, and S406 can be replaced by S406-a.

[0186] S405 - a , the network device sends a response message to the first deregistration request message to the terminal device, where the response message to the first deregistration request message is a plain text message.

[0187] S406-a, the terminal device receives a response message to the first deregistration request message and enters a deregistration state.

[0188] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, both the terminal device and the network device can interrupt the security mode control process and communicate in plain text, thereby making the behavior of the terminal device and the network device consistent, thereby ensuring that the terminal device completes the deregistration.

[0189] Example 2

[0190] In Example 2, when the security mode control process conflicts with the deregistration process, the network device may follow the provisions of the protocol (i.e., interrupt the security mode control process) or may not interrupt the security mode control process, and improve the implementation on the terminal device side to ensure that the terminal device completes the deregistration.

[0191] FIG5 is a flow chart of the communication method according to an embodiment of the present application. As shown in FIG5 , the flow may include:

[0192] S501: The terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration; accordingly, the network device receives the first deregistration request message.

[0193] S502: The network device sends a security mode command message to the terminal device, where the security mode command message is used to enable a first security context; accordingly, the terminal device receives the security mode command message.

[0194] S503, the terminal device sends a response message to the security mode command message to the network device according to the security mode command message, and enables the first security context; accordingly, the network device receives the response message to the security mode command message.

[0195] Here, the embodiment of the present application does not limit the order in which the terminal device enables the first security context and sends a response message to the security mode command message.

[0196] S504, the network device sends a response message to the first deregistration request message to the terminal device; correspondingly, the terminal device receives the response message to the first deregistration request message from the network device.

[0197] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message.

[0198] For example, before the terminal device enables the first security context, a valid security context (such as the second security context) exists in the terminal device and the network device. The second security context is the security context that was enabled before the terminal device enabled the first security context. Before the terminal device enables the first security context, the second security context is the current NAS security context. After the terminal device enables the first security context, the current NAS security context is switched to the first security context, and the second security context is a non-current NAS security context.

[0199] In this case, as a possible implementation, if the network device determines that the first deregistration request message was received while waiting for a response message to the security mode command message, the network device may interrupt the security mode control process, that is, the network device may not activate the first security context. For example, the network device maintains the second security context, processes the pending deregistration accept message according to the second security context (such as integrity protection and encryption), and sends the deregistration accept message to the terminal device, where the deregistration accept message is a ciphertext message.

[0200] As another possible implementation, if the network device determines that the first deregistration request message was received while waiting to receive a response message to the security mode command message, the network device may continue the security mode control process and, after receiving the response message to the security mode command message, enable the first security context. Furthermore, the network device processes the pending deregistration accept message (e.g., integrity protection and encryption) based on the first security context and sends a deregistration accept message to the terminal device, where the deregistration accept message is a ciphertext message.

[0201] S505: If the security mode command message is received during the deregistration process, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0202] S506: When the integrity protection check on the response message of the first deregistration request message fails according to the first security context, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the second security context.

[0203] For example, if the integrity protection check of the deregistration accept message based on the first security context succeeds, the terminal device can decrypt the deregistration accept message based on the first security context. After the decryption is successful, the deregistration process is completed and the deregistration state is entered. If the integrity protection check of the deregistration accept message based on the first security context fails, the terminal device can perform an integrity protection check on the deregistration accept message based on the second security context.

[0204] Further, optionally, if the integrity protection check of the deregistration accept message based on the second security context succeeds, the terminal device may decrypt the deregistration accept message based on the second security context, and after successful decryption, complete the deregistration process and enter the deregistration state. If the integrity protection check of the deregistration accept message based on the second security context fails, the terminal device may perform local deregistration; or the terminal device may re-initiate the deregistration process, such as sending a second deregistration request message to the network device.

[0205] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby increasing the possibility of successful integrity protection verification of the deregistration acceptance message and ensuring that the terminal device completes the deregistration.

[0206] In other examples, the above S505 can be replaced by S505 - a , and the above S506 can be replaced by S506 - a .

[0207] S505-a, if the security mode command message is received during the deregistration process, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the second security context.

[0208] S506-a, when the integrity protection check on the response message of the first deregistration request message fails according to the second security context, the terminal device performs an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0209] Illustratively, if the integrity protection check on the deregistration accept message is successful based on the second security context, the terminal device may decrypt the deregistration accept message based on the second security context. After successful decryption, the deregistration process is completed and the deregistration state is entered. If the integrity protection check on the deregistration accept message fails based on the second security context, the terminal device may perform an integrity protection check on the deregistration accept message based on the first security context.

[0210] Further, optionally, if the integrity protection check of the deregistration acceptance message according to the first security context succeeds, the terminal device may decrypt the deregistration acceptance message according to the first security context, and after successful decryption, complete the deregistration process and enter the deregistration state. If the integrity protection check of the deregistration acceptance message according to the first security context fails, the terminal device may perform local deregistration; or the terminal device may re-initiate the deregistration process, such as sending a second deregistration request message to the network device.

[0211] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context and the non-current NAS security context, thereby increasing the possibility of successful integrity protection verification of the deregistration acceptance message and ensuring that the terminal device completes the deregistration.

[0212] It is understood that the above description is based on "before the terminal device activates the first security context, a valid security context exists in the terminal device and the network device." In other examples, before the terminal device activates the first security context, no valid security context exists in the terminal device and the network device. In this case, S504 can be replaced by S504-b, S505 can be replaced by S505-b, and S506 can be replaced by S506-b.

[0213] S504-b, the network device sends a response message to the first deregistration request message to the terminal device; correspondingly, the terminal device receives the response message to the first deregistration request message from the network device.

[0214] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message.

[0215] As a possible implementation, if the security mode control process conflicts with the deregistration process, the network device may interrupt the security mode control process, that is, the network device may not enable the first security context. For example, the network device may maintain the plaintext and send a deregistration acceptance message to the terminal device, where the deregistration acceptance message is a plaintext message.

[0216] As another possible implementation, if the security mode control process conflicts with the deregistration process, the network device may continue the security mode control process, that is, the network device may enable the first security context. The network device processes the pending deregistration accept message according to the first security context (e.g., integrity protection and encryption), and sends the deregistration accept message to the terminal device, where the deregistration accept message is a ciphertext message.

[0217] S505-b, if the security mode command message is received during the deregistration process, and the response message to the first deregistration request message is a ciphertext message, the terminal device performs integrity protection verification on the response message to the first deregistration request message according to the first security context.

[0218] For example, if the integrity protection check of the response message to the first deregistration request message is successful according to the first security context, the terminal device may decrypt the deregistration acceptance message according to the first security context. After the decryption is successful, the deregistration process is completed and the deregistration state is entered. If the integrity protection check of the deregistration acceptance message fails according to the first security context, the terminal device may perform local deregistration; or the terminal device may re-initiate the deregistration process, such as sending a second deregistration request message to the network device.

[0219] S506-b, if the security mode command message is received during the deregistration process, and the response message to the first deregistration request message is a plain text message, the terminal device enters the deregistration state.

[0220] By adopting the above method, when the security mode control process conflicts with the deregistration process, the terminal device can decide whether to perform integrity protection verification on the deregistration acceptance message based on the current NAS security context according to whether the deregistration acceptance message is in plain text, thereby facilitating the terminal device to complete the deregistration.

[0221] Example 3

[0222] In Example 3, when the security mode control process conflicts with the deregistration process, the network device can follow the provisions of the protocol (i.e., interrupt the security mode control process) and improve the implementation on the terminal device side to ensure that the terminal device completes the deregistration.

[0223] FIG6 is a flow chart of the communication method according to an embodiment of the present application. As shown in FIG6 , the flow may include:

[0224] S601: The terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration; accordingly, the network device receives the first deregistration request message.

[0225] S602, the network device sends a security mode command message to the terminal device, where the security mode command message is used to enable the first security context; accordingly, the terminal device receives the security mode command message.

[0226] S603: If the security mode command message is received during the deregistration process, the terminal device performs local deregistration.

[0227] That is to say, if the security mode command message is received during the deregistration process, the terminal device does not need to wait for the deregistration acceptance message (or even if it receives the deregistration acceptance message, it can ignore the deregistration acceptance message, that is, there is no need to process the deregistration acceptance message), but instead performs local deregistration, thereby ensuring that the terminal device completes the deregistration.

[0228] Exemplarily, the terminal device may also ignore the security mode command message, for example, the terminal device does not send a response message to the security mode command message (ie, a full mode completion message), and / or does not enable the first security context.

[0229] By adopting the above method, when a conflict occurs between the security mode control process and the deregistration process, the terminal device can perform local deregistration, thereby ensuring that the terminal device completes the deregistration.

[0230] Example 4

[0231] In embodiment 4, when the security mode control process conflicts with the deregistration process, the terminal device can follow the provisions of the protocol (i.e., not interrupting the security mode control process) and improve the implementation on the network device side to ensure that the terminal device completes the deregistration.

[0232] FIG7 is a flow chart of the communication method according to an embodiment of the present application. As shown in FIG7 , the flow may include:

[0233] S701: The terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration.

[0234] S702, the network device sends a security mode command message to the terminal device, where the security mode command message is used to enable the first security context; accordingly, the terminal device receives the security mode command message.

[0235] S703 : The network device receives a first deregistration request message from the terminal device while waiting for a response message to the security mode command message.

[0236] Exemplarily, when the network device receives the first deregistration request message from the terminal device while waiting to receive a response message to the security mode command message, the network device may not interrupt the security mode control process and continue to wait to receive a response message to the security mode command message.

[0237] As a possible implementation, the network device receives a first deregistration request message while waiting to receive a response message to a security mode command message. If the first deregistration request message carries a first ciphertext element, the network device may not interrupt the security mode control process and continue to wait for receiving a response message to the security mode command message; optionally, if the first deregistration request message does not carry the first ciphertext element, the network device may interrupt the security mode control process (for example, stop waiting to receive a response message to the security mode command message) or not interrupt the security mode control process.

[0238] S704, the terminal device sends a response message to the security mode command message to the network device, and enables the first security context; accordingly, the network device receives the response message to the security mode command message.

[0239] Exemplarily, the response message to the safety mode command message may be a safety mode completion message.

[0240] Exemplarily, if the terminal device determines that the security mode control process conflicts with the deregistration process, the security mode control process may not be interrupted, and a response message of the security mode command message may be sent to the network device, and the first security context may be enabled.

[0241] S705: The network device activates the first security context according to the response message to the security mode command message.

[0242] S706: The network device sends a response message to the first deregistration request message to the terminal device. The response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

[0243] The embodiment of the present application does not limit the specific timing of the network device enabling the first security context. For example, the network device may enable the first security context when receiving a security mode completion message.

[0244] Exemplarily, the response message to the first deregistration request message may be a deregistration acceptance message. The network device may process the deregistration acceptance message to be sent according to the first security context (such as integrity protection and encryption), and then send it to the terminal device.

[0245] S707: The terminal device performs an integrity protection check on the response message of the first deregistration request message according to the first security context.

[0246] For example, if the integrity protection check of the deregistration acceptance message based on the first security context is successful, the terminal device may decrypt the deregistration acceptance message based on the first security context. After successful decryption, the deregistration process is completed and the terminal device enters the deregistration state. Alternatively, if the integrity protection check of the deregistration acceptance message based on the first security context fails, the terminal device may perform local deregistration or re-initiate the deregistration process, such as by sending a second deregistration request message to the network device.

[0247] With the above method, when the security mode control process conflicts with the deregistration process, the terminal device and the network device do not interrupt the security mode control process, thereby ensuring that the terminal device completes the deregistration.

[0248] Example 5

[0249] In embodiment five, when the security mode control process conflicts with the deregistration process, the terminal device can determine whether to interrupt the security mode control process based on whether the first deregistration request message carries a first ciphertext information element (IE) to ensure that the terminal device completes the deregistration.

[0250] FIG8 is a flow chart of the communication method according to an embodiment of the present application. As shown in FIG8 , the flow may include:

[0251] S801, the terminal device sends a first deregistration request message to the network device, where the first deregistration request message is used to request deregistration; accordingly, the network device receives the first deregistration request message.

[0252] Exemplarily, if there is no valid security context in the terminal device, the first deregistration request message sent by the terminal device does not carry the first ciphertext element. If there is a valid security context (i.e., the second security context) in the terminal device, the first deregistration request message sent by the terminal device may carry the first ciphertext element or may not carry the first ciphertext element. For example, if the terminal device needs to send relatively important information or privacy-related information (such as the duration of deregistration, etc.) to the network device, it can encrypt and integrity-protect these plaintext information according to the second security context to obtain the first ciphertext element, and send it to the network device through the first deregistration request message.

[0253] The first ciphertext information element may be a non-clear IE. The first deregistration request message includes a non-access stratum information container (NAS MSG container), and the non-clear IE may be carried in the non-access stratum information container.

[0254] S802, the network device sends a security mode command message to the terminal device, where the security mode command message is used to enable a first security context; accordingly, the terminal device receives the security mode command message.

[0255] From the perspective of the network device, the first implementation is: the first deregistration request message carries the first ciphertext element. After receiving the first deregistration request message, the network device sends a security mode command message to the terminal device because the integrity protection check on the first ciphertext element fails. For example, when the first deregistration request message carries the first ciphertext element, if due to some possible factors, the security contexts used by the network device and the terminal device are inconsistent (for example, there is a valid security context in the terminal device, but there is no valid security context in the network device), then after receiving the first deregistration request message, the network device may fail to perform integrity protection check on the first ciphertext element; therefore, the network device can send a security mode command message to the terminal device so that the security contexts used by the network device and the terminal device are consistent.

[0256] Optionally, before the network device sends the security mode command message to the terminal device, the network device and the terminal device may perform an authentication process so that the network device and the terminal device respectively create a new security context (such as a first security context).

[0257] Second implementation: before receiving the first deregistration reception message, the network device sends a security mode command message to the terminal device. There are many triggering factors for the network device to send the security mode command message, which are not specifically limited.

[0258] According to the above two implementations, the network device may send a security mode command message to the terminal device due to a failure in integrity protection check of the first ciphertext cell; or may send a security mode command message to the terminal device for other reasons.

[0259] From the perspective of the terminal device, after receiving the security mode command message, the terminal device may execute S803 or S804.

[0260] S803: If the security mode command message is received during the deregistration process and the first deregistration request message does not carry the first ciphertext element, the terminal device ignores the security mode command message.

[0261] For example, the implementation of the terminal device ignoring the security mode command message can refer to Example 1 or Example 3, which will not be repeated here.

[0262] S804, if the security mode command message is received during the deregistration process, and the first deregistration request message carries the first ciphertext element, the terminal device sends a response message of the security mode command message to the network device, and enables the first security context.

[0263] Exemplarily, when the first deregistration request message carries the first ciphertext element, if the terminal device receives a security mode command message during the deregistration process, it is possible that the network device sends the security mode command message to the terminal device after receiving the first deregistration request message because the network device fails to perform integrity protection verification on the first ciphertext element, or it is also possible that the network device sends the security mode command message to the terminal device before receiving the first deregistration reception message. Since the terminal device cannot determine whether the network device sends the security mode command message because the network device fails to perform integrity protection verification on the first ciphertext element, in order to avoid the terminal device interrupting the security mode control process triggered by the network device failing to perform integrity protection verification on the first ciphertext element, when the first deregistration request message carries the first ciphertext element, the terminal device can send a response message to the security mode command message (such as a security mode completion message) and enable the first security context.

[0264] The security mode complete message may carry a second ciphertext element, and the second ciphertext element and the first ciphertext element correspond to the same plaintext information. In other words, the terminal device may encrypt and integrity-protect the plaintext information (such as important information or privacy-related information) based on the first security context to obtain the second ciphertext element, and send it to the network device via the security mode complete message.

[0265] The following describes the implementation after S803 or S804 in combination with Situation 1 and Situation 2 respectively.

[0266] (1) Scenario 1:

[0267] In scenario 1, it is assumed that the network device in S802 sends the security mode command message due to a failure in integrity protection check on the first ciphertext cell (ie, the first implementation).

[0268] From the perspective of the network device: the network device can complete the message based on the security mode, enable the first security context, and perform an integrity protection check on the second ciphertext element based on the first security context. After the integrity protection check and decryption of the second ciphertext element based on the first security context are successfully completed, the plaintext information corresponding to the second ciphertext element can be obtained. Furthermore, the network device can send a deregistration acceptance message to the terminal device. The deregistration acceptance message is a ciphertext message processed based on the first security context.

[0269] From the perspective of the terminal device: after receiving the deregistration acceptance message, the terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the first security context and the second security context, referring to the description in Example 2.

[0270] (2) Scenario 2:

[0271] In scenario 2, it is assumed that the network device in S802 sends the security mode command message due to other reasons (except for the failure of integrity protection check on the first ciphertext cell) (ie, the second implementation).

[0272] The implementation in this case can refer to the description in Example 2. For example, the network device can interrupt the security mode control process, or it can not interrupt the security mode control process. The terminal device can attempt to perform integrity protection verification on the deregistration acceptance message based on the first security context and the second security context.

[0273] It can be understood that the above description is based on the example of "when the first deregistration request message does not carry the first ciphertext element, the terminal device ignores the security mode command message (i.e., interrupts the security mode control process)". In other embodiments, when the first deregistration request message does not carry the first ciphertext element, the terminal device may also not interrupt the security mode control process. Please refer to the description in Example 2 or Example 4 for details.

[0274] With respect to the above embodiments, it can be understood that:

[0275] (1) In the various embodiments of this application, unless otherwise specified or logically conflicting, the terms and / or descriptions between different embodiments are consistent and may be referenced to each other. The technical features in different embodiments may be combined to form new embodiments based on their inherent logical relationships. In addition, within the same embodiment, different implementations or different examples may also reference or refer to each other.

[0276] (2) The various numerical numbers involved in this application are only for the convenience of description and are not intended to limit the scope of this application. The step numbers in the above flowcharts are only examples of the execution process and do not constitute a restriction on the order of execution of the steps. That is, the size of the step numbers does not mean the order of execution. The execution order of each step should be determined by its function and internal logic. In addition, not all the steps shown in the flowcharts are required to be executed. Some steps can be added or deleted based on actual needs.

[0277] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the interaction between the terminal device and the network device. It is understandable that in order to implement the above functions, the terminal device and the network device may include hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0278] In the embodiments of the present application, the terminal device and the network device can be divided into functional units according to the above method examples. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or software functional units.

[0279] In the case of adopting an integrated unit, Figure 9 shows a possible exemplary block diagram of the device involved in the embodiments of the present application. As shown in Figure 9, the device 900 may include: a processing unit 902 and a communication unit 903. The processing unit 902 is used to control and manage the actions of the device 900. The communication unit 903 is used to support the communication between the device 900 and other devices. Optionally, the communication unit 903 is also called a transceiver unit, and may include a receiving unit and / or a sending unit, which are used to perform receiving and sending operations respectively. The device 900 may also include a storage unit 901 for storing program code and / or data of the device 900.

[0280] (1) The apparatus 900 may be a terminal device in the aforementioned embodiments (e.g., embodiments 1 to 5). The processing unit 902 may support the apparatus 900 in executing the actions of the terminal device in the aforementioned method embodiments. Alternatively, the processing unit 902 may primarily execute internal actions of the terminal device in the method embodiments, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0281] For example, in one embodiment, the communication unit 903 is used to: send a first deregistration request message to a network device, wherein the first deregistration request message is used by the terminal device to request deregistration; receive a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; according to the security mode command message, send a response message of the security mode command message to the network device, and enable the first security context; receive a response message of the first deregistration request message from the network device; the processing unit 902 is used to: if the security mode command message is received during the deregistration process, perform an integrity protection check on the response message of the first deregistration request message according to the first security context; in the event that the integrity protection check on the response message of the first deregistration request message fails according to the first security context, perform an integrity protection check on the response message of the first deregistration request message according to the second security context, wherein the second security context is the security context that the terminal device has enabled before enabling the first security context.

[0282] In one possible design, the processing unit 902 is further used to: if the integrity protection check of the response message of the first deregistration request message fails according to the second security context, then perform local deregistration; or, the communication unit 903 is further used to: if the integrity protection check of the response message of the first deregistration request message fails according to the second security context, then send a second deregistration request message to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

[0283] In another embodiment, the communication unit 903 is used to: send a first deregistration request message to the network device, wherein the first deregistration request message is used by the terminal device to request deregistration; receive a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; according to the security mode command message, send a response message of the security mode command message to the network device, and enable the first security context; receive a response message of the first deregistration request message from the network device; if the security mode command message is received during the deregistration process, the processing unit 902 is used to: perform integrity protection check on the response message of the first deregistration request message according to the second security context, wherein the second security context is a security context that has been enabled by the terminal device before enabling the first security context.

[0284] In one possible design, the processing unit 902 is further used to: if the integrity protection check of the response message of the first deregistration request message fails according to the second security context, then the integrity protection check of the response message of the first deregistration request message fails according to the first security context.

[0285] In one possible design, the processing unit 902 is further used to: if the integrity protection check of the response message of the first deregistration request message fails according to the first security context, then perform local deregistration; or, the communication unit 903 is further used to: if the integrity protection check of the response message of the first deregistration request message fails according to the first security context, then send a second deregistration request message to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

[0286] (2) The apparatus 900 may be a network device in the aforementioned embodiments (e.g., embodiments 1 to 5). The processing unit 902 may support the apparatus 900 in executing the actions of the network device in the aforementioned method embodiments. Alternatively, the processing unit 902 may primarily execute the internal actions of the network device in the method embodiments, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0287] For example, in one embodiment, the communication unit 903 is used to: send a security mode command message to the terminal device, wherein the security mode command message is used to enable a first security context; receive a first deregistration request message from the terminal device, wherein the first deregistration request message is used by the terminal device to request deregistration; receive a response message to the security mode command message from the terminal device; the processing unit 902 is used to: enable the first security context based on the response message of the security mode command message; the communication unit 903 is also used to: send a response message to the first deregistration request message to the terminal device, wherein the response message to the first deregistration request message is a ciphertext message obtained based on the first security context.

[0288] In another embodiment, the communication unit 903 is used to: receive a first deregistration request message from a terminal device, where the first deregistration request message is used by the terminal device to request deregistration, and the first deregistration request message carries a first ciphertext element; if the integrity protection check of the first ciphertext element fails according to the second security context, a security mode command message is sent to the terminal device, where the security mode command message is used to enable the first security context; receive a response message to the security mode command message from the terminal device; the processing unit 902 is used to: enable the first security context according to the response message of the security mode command message; the communication unit 903 is also used to: send a response message to the first deregistration request message to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

[0289] In one possible design, the response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained based on the first security context.

[0290] In one possible design, the communication unit 903 is further used to: send an authentication request message to the terminal device, where the authentication request message is used to request the terminal device to create a first security context.

[0291] It should be understood that the division of units in the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, the units in the device can all be implemented in the form of software calling through processing elements; or they can all be implemented in the form of hardware; or some units can be implemented in the form of software calling through processing elements, and some units can be implemented in the form of hardware. For example, each unit can be a separately established processing element, or it can be integrated into a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, called by a certain processing element of the device and execute the function of the unit. In addition, all or part of these units can be integrated together, or they can be implemented independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. In the implementation process, each operation of the above method or each unit above can be implemented by the integrated logic circuit of the hardware in the processor element or in the form of software calling through the processing element.

[0292] In one example, the unit in any of the above devices can be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASICs), or one or more digital singnal processors (DSPs), or one or more field programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms. For another example, when the unit in the device can be implemented in the form of a processing element scheduler, the processing element can be a processor, such as a general-purpose central processing unit (CPU), or other processor that can call a program. For another example, these units can be integrated together and implemented in the form of a SoC.

[0293] The above-mentioned receiving unit is an interface circuit of the device, which is used to receive signals from other devices. For example, when the device is implemented as a chip, the receiving unit is the interface circuit of the chip used to receive signals from other chips or devices. The above-mentioned sending unit is an interface circuit of the device, which is used to send signals to other devices. For example, when the device is implemented as a chip, the sending unit is the interface circuit of the chip used to send signals to other chips or devices.

[0294] Based on the above embodiments, the embodiments of the present application further provide a communication device. Referring to FIG10 , the communication device 1000 may include a processor 1001. Optionally, the communication device 1000 may further include a memory 1002. The memory 1002 may be disposed inside the communication device 1000 or outside the communication device 1000. Optionally, the communication device 1000 may further include a transceiver (not shown in FIG10 ).

[0295] Specifically, the processor 1001 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 1001 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0296] The processor 1001 and the memory 1002 are interconnected. Optionally, the processor 1001 and the memory 1002 are interconnected via a bus 1003; the bus 1003 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG10 shows only one thick line, but this does not mean that there is only one bus or one type of bus.

[0297] In an optional embodiment, the memory 1002 is used to store programs, etc. Specifically, the programs may include program code, which includes computer operating instructions. The memory 1002 may include RAM, or may also include non-volatile memory (non-volatile memory), such as one or more disk storage devices. The processor 1001 executes the application stored in the memory 1002 to implement the above functions, thereby realizing the functions of the communication device 1000.

[0298] Exemplarily, the communication device 1000 may be the terminal device in the above embodiment; or may be the network device in the above embodiment.

[0299] In one embodiment, when the communication device 1000 implements the functions of the terminal device in the above method embodiment, the transceiver may implement the transceiver operations performed by the terminal device in the above method embodiment; and the processor 1001 may implement other operations performed by the terminal device in the above method embodiment in addition to the transceiver operations. For specific details, please refer to the relevant descriptions in the above embodiments and will not be described in detail here.

[0300] In another embodiment, when the communication device 1000 implements the functions of the network device in the above method embodiment, the transceiver may implement the transceiver operations performed by the network device in the above method embodiment; and the processor 1001 may implement other operations performed by the network device in the above method embodiment in addition to the transceiver operations. For specific details, please refer to the relevant descriptions in the above embodiments and will not be described in detail here.

[0301] An embodiment of the present application also provides a communication system, which includes the terminal device and network device involved in the above embodiment.

[0302] The terms "system" and "network" in the embodiments of the present application can be used interchangeably. "At least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of A, B and C" includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects.

[0303] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0304] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each flow and / or box in the flow chart and / or block diagram, as well as the combination of the flow chart and / or box in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more flow charts and / or one or more boxes in the block diagram.

[0305] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0306] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0307] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; According to the security mode command message, sending a response message of the security mode command message to the network device, and enabling the first security context; receiving a response message to the first deregistration request message from the network device; If the security mode command message is received during the deregistration process, performing an integrity protection check on a response message of the first deregistration request message according to the first security context; In the event that an integrity protection check on a response message to the first deregistration request message fails according to the first security context, an integrity protection check is performed on the response message to the first deregistration request message according to a second security context, where the second security context is a security context that was enabled by the terminal device before the first security context was enabled.

2. The method according to claim 1, characterized in that The method further comprises: If the integrity protection check of the response message to the first deregistration request message according to the second security context fails, performing local deregistration; or, If the integrity protection check of the response message of the first deregistration request message fails according to the second security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

3. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; According to the security mode command message, sending a response message of the security mode command message to the network device, and enabling the first security context; receiving a response message to the first deregistration request message from the network device; If the security mode command message is received during the deregistration process, an integrity protection check is performed on the response message of the first deregistration request message according to the second security context, where the second security context is the security context that has been enabled by the terminal device before enabling the first security context.

4. The method according to claim 3, characterized in that: The method further comprises: If the integrity protection check performed on the response message of the first deregistration request message according to the second security context fails, the integrity protection check is performed on the response message of the first deregistration request message according to the first security context.

5. The method according to claim 4, characterized in that The method further comprises: If the integrity protection check of the response message to the first deregistration request message fails according to the first security context, local deregistration is performed; or, If the integrity protection check of the response message of the first deregistration request message fails according to the first security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

6. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; According to the security mode command message, sending a response message of the security mode command message to the network device, and enabling the first security context; receiving a response message to the first deregistration request message from the network device; If the security mode command message is received during the deregistration process, and the response message to the first deregistration request message is a ciphertext message, performing integrity protection check on the response message to the first deregistration request message according to the first security context; or, If the security mode command message is received during the deregistration process, and the response message of the first deregistration request message If it is a plain text message, it enters the deregistration state.

7. A communication method, characterized in that: The method is applied to a terminal device or a chip in the terminal device, and the method includes: Sending a first deregistration request message to the network device, where the first deregistration request message is used by the terminal device to request deregistration; receiving a security mode command message from the network device, wherein the security mode command message is used to enable a first security context; If the security mode command message is received during the deregistration process, and the first deregistration request message does not carry the first ciphertext information element, then ignoring the security mode command message; or, If the security mode command message is received during the deregistration process and the first deregistration request message carries the first ciphertext element, a response message of the security mode command message is sent to the network device, and the first security context is enabled.

8. The method according to claim 7, characterized in that The ignoring the safety mode command message comprises: The first security context is not enabled, and / or a response message to the security mode command message is not sent.

9. The method according to claim 7 or 8, characterized in that: In the case of executing the step of ignoring the safety mode command message, the method further includes: receiving a response message to the first deregistration request message from the network device; When the response message to the first deregistration request message is a ciphertext message, performing integrity protection check on the response message according to the second security context enabled by the terminal device; or When the response message to the first deregistration request message is a plain text message, the deregistration state is entered.

10. The method according to claim 7, characterized in that In the case of performing the enabling of the first security context, the method further includes: receiving a response message to the first deregistration request message from the network device; performing an integrity protection check on a response message to the first deregistration request message according to the first security context; In the event that an integrity protection check on a response message to the first deregistration request message fails according to the first security context, an integrity protection check is performed on the response message to the first deregistration request message according to a second security context, where the second security context is a security context that was enabled by the terminal device before the first security context was enabled.

11. The method according to claim 10, characterized in that The method further comprises: If the integrity protection check of the response message to the first deregistration request message according to the second security context fails, performing local deregistration; or, If the integrity protection check of the response message of the first deregistration request message fails according to the second security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

12. The method according to claim 7, characterized in that In the case of performing the enabling of the first security context, the method further includes: receiving a response message to the first deregistration request message from the network device; An integrity protection check is performed on a response message to the first deregistration request message according to the second security context, where the second security context is a security context that has been enabled by the terminal device before the first security context is enabled.

13. The method according to claim 12, characterized in that The method further comprises: If the integrity protection check performed on the response message of the first deregistration request message according to the second security context fails, the integrity protection check is performed on the response message of the first deregistration request message according to the first security context.

14. The method according to claim 13, characterized in that The method further comprises: If the integrity protection check of the response message to the first deregistration request message fails according to the first security context, local deregistration is performed; or, If the integrity protection check of the response message of the first deregistration request message fails according to the first security context, a second deregistration request message is sent to the network device, and the second deregistration request message is used by the terminal device to request deregistration.

15. The method according to claim 7, characterized in that In the case of performing the enabling of the first security context, the method further includes: receiving a response message to the first deregistration request message from the network device; When the response message to the first deregistration request message is a ciphertext message, performing integrity protection check on the response message to the first deregistration request message according to the first security context; or, When the response message to the first deregistration request message is a plain text message, the deregistration state is entered.

16. The method according to any one of claims 7 to 15, characterized in that The response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained according to the first security context.

17. A communication method, characterized in that: The method is applied to a network device or a chip in the network device, and the method comprises: Sending a security mode command message to the terminal device, where the security mode command message is used to enable the first security context; In the process of waiting for receiving a response message to the security mode command message, receiving a first deregistration request message from the terminal device, where the first deregistration request message is used by the terminal device to request deregistration; Receiving a response message to the security mode command message from the terminal device; enabling the first security context according to a response message to the security mode command message; A response message to the first deregistration request message is sent to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

18. The method according to claim 17, characterized in that The method further comprises: If the first deregistration request message carries the first ciphertext element, continue to wait for receiving a response message to the security mode command message.

19. A communication method, characterized in that: The method is applied to a network device or a chip in the network device, and the method comprises: receiving a first deregistration request message from a terminal device, where the first deregistration request message is used by the terminal device to request deregistration, and the first deregistration request message carries a first ciphertext information element; If the integrity protection check of the first ciphertext cell according to the second security context fails, sending a security mode command message to the terminal device, where the security mode command message is used to enable the first security context; Receiving a response message to the security mode command message from the terminal device; enabling the first security context according to a response message to the security mode command message; A response message to the first deregistration request message is sent to the terminal device, where the response message to the first deregistration request message is a ciphertext message obtained according to the first security context.

20. The method according to claim 19, characterized in that The response message of the security mode command message includes a second ciphertext element, the second ciphertext element and the first ciphertext element correspond to the same plaintext information, and the second ciphertext element is obtained according to the first security context.

21. The method according to claim 19 or 20, characterized in that The method further comprises: An authentication request message is sent to the terminal device, where the authentication request message is used to request the terminal device to create a first security context.

22. A communication system, characterized in that: The system includes a network device and a terminal device; The terminal device is used to perform the method according to any one of claims 1 to 16; The network device is used to send the security mode command message to the terminal device; And sending a response message of the first deregistration request message to the terminal device.

23. A communication system, characterized in that: The system includes a network device and a terminal device; The network device is used to perform the method according to any one of claims 17 to 21; The terminal device is used to send the first deregistration request message to the network device; And, sending a response message of the security mode command message to the network device.

24. A communication device, characterized in that: Comprising means for executing the method as claimed in any one of claims 1 to 21.

25. A communication device, characterized in that: It comprises a processor, the processor is coupled to a memory, and a computer program is stored in the memory; the processor is used to call part or all of the computer program in the memory so that the method as claimed in any one of claims 1 to 21 is executed.

26. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when part or all of the computer program is executed by a computer, the method according to any one of claims 1 to 21 is executed.

27. A computer program product, characterized in that When a computer reads and executes the computer program product, the method according to any one of claims 1 to 21 is executed.

Images