Communication method and communication apparatus

Abstract

Provided in the present application are a communication method and a communication apparatus. The method comprises: receiving a request message from a first terminal device, wherein the request message is used for requesting an access to a network, the request message carries first indication information indicating identity information of the first terminal device, first information corresponding to the identity information is stored in a storage system, and the first information comprises information required for authenticating the first terminal device; and acquiring the first information on the basis of the first indication information, and authenticating the first terminal device on the basis of the first information. On the basis of identity information of a terminal device, information that is required for authenticating the terminal device, corresponds to the identity information and is stored in a storage system is obtained, and the terminal device is authenticated on the basis of said information, thereby improving the flexibility of authentication on the terminal device.

Description

Communication method and communication device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on January 22, 2024, with application number 202410091369.1, and priority to the Chinese patent application with the invention name “Communication Method and Communication Device”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communications, and more particularly, to a communication method and a communication device. Background Art

[0003] In terms of mobile communication network security, the tasks on the network side include: authenticating and authorizing terminal devices accessing the network so that the terminal devices can access the operator's network, and then starting air interface encryption for the terminal devices' business communications.

[0004] In current communications systems, the network maintains a large amount of user identity information and uses this information to authenticate users when they access the network. This authentication method is called direct authentication. In direct authentication, network authentication occurs in the core network. Specifically, core network elements generate user authentication information and authenticate the terminal device based on this information. This existing direct authentication method limits the flexibility of user authentication. Summary of the Invention

[0005] The present application provides a communication method and a communication device, which can improve the flexibility of terminal device authentication.

[0006] On the first aspect, a communication method is provided. The method can be executed by an authentication entity, or can also be executed by a component of the authentication entity (such as a chip or circuit). There is no limitation on this. For the sake of ease of description, the following is explained as an example of execution by the authentication entity.

[0007] The method includes: receiving a request message from a first terminal device, the request message is used to request access to a network, the request message carries first indication information indicating identity information of the first terminal device, the first information corresponding to the identity information is stored in a storage system, and the first information includes information required to authenticate the first terminal device; obtaining the first information based on the first indication information; and authenticating the first terminal device based on the first information.

[0008] Based on the above solution, compared with the core network network element generating the authentication information of the terminal device and completing the authentication of the terminal device based on the authentication information, the authentication entity obtains the information required to authenticate the terminal device corresponding to the identity information stored in the storage system based on the identity information of the terminal device, and authenticates the terminal device based on the information, which can improve the flexibility of terminal device authentication.

[0009] Exemplarily, the storage system may be a blockchain system or a distributed storage system. By storing the first information corresponding to the identity information of the first terminal device in the storage system, the security of the user information may be improved.

[0010] In certain implementations of the first aspect, the authentication entity determines to authenticate the first terminal device before authenticating the first terminal device based on the first information.

[0011] Based on the above solution, by determining that the authentication entity authenticates the terminal device, a suitable authentication method can be selected when there are multiple authentication methods on the network side.

[0012] In certain implementations of the first aspect, determining to authenticate the first terminal device is based on second information, where the second information includes at least one of the following: second indication information, third indication information, fourth indication information, and capability information of the authentication entity;

[0013] Among them, the second indication information indicates that the terminal device served by the authentication entity is authenticated, and the second indication information comes from the operator node of at least one operator to which the authentication entity belongs; the third indication information indicates that the first terminal device is authenticated by the authentication entity, and the third indication information comes from the first terminal device; the fourth indication information is included in the first information, and the fourth indication information indicates that the first terminal device is authenticated by the authentication entity; the capability information indicates whether the authentication entity supports authentication of the terminal device served by the authentication entity.

[0014] Based on the above scheme, when there are multiple authentication methods on the network side, the information used by the authentication entity to authenticate the terminal device can be determined based on the indication information from the terminal device, the operator node of the operator to which the authentication entity belongs, the indication information included in the first information, or at least one of the capability information of the authentication entity, thereby improving the flexibility of terminal device authentication.

[0015] Exemplarily, if the first information includes the fourth indication information, after obtaining the first information according to the first indication information, it is determined to authenticate the first terminal device according to the fourth indication information included in the first information.

[0016] In certain implementations of the first aspect, the method further includes: before determining to authenticate the first terminal device, sending capability information of the authentication entity to a terminal device served by the authentication entity, the capability information indicating whether the authentication entity supports authenticating the terminal device served by the authentication entity. The terminal device served by the authentication entity includes the first terminal device.

[0017] Based on the above solution, by sending the capability information of the authentication entity to the terminal device, the terminal device can determine whether to be authenticated by the authentication entity based on the capability information.

[0018] In certain implementations of the first aspect, the method further includes: before authenticating the terminal device based on the first information, determining a first operator providing network services to the first terminal device, the first operator being one of at least one operator to which the authentication entity belongs.

[0019] Based on the above solution, the authentication entity may belong to at least one operator. By selecting an operator providing services to the terminal device from the at least one operator, the flexibility of the terminal device in selecting an operator may be improved.

[0020] In certain implementations of the first aspect, the first operator is determined based on third information, where the third information includes at least one of the following: an identifier of a network that the first terminal device requests to access, a load condition of a network of the at least one operator, and fifth indication information;

[0021] The fifth indication information indicates that the terminal device served by the authentication entity is allowed to access the network of the first operator, and the fifth indication information comes from an operator node belonging to any operator among the at least one operator.

[0022] Based on the above solution, the authentication entity can determine an operator that is suitable for providing network services to the terminal device based on the indication information of the terminal device, the load status of the network of at least one operator to which the authentication entity belongs, or the indication information of the operator node of at least one operator to which the authentication entity belongs, thereby improving the flexibility of the terminal device in selecting an operator. Furthermore, if the first operator is determined based on the load status of the network of at least one operator, the quality of the network service can be improved by determining that the first operator provides network services to the terminal device.

[0023] Exemplarily, the authentication entity receives, from the first terminal device, an identifier of a network that the first terminal device requests to access; and the authentication entity receives, from an operator node of each operator of the at least one operator, a load condition of the network of the each operator.

[0024] In certain implementations of the first aspect, before determining the first operator providing network services for the first terminal device, sixth indication information is sent to terminal devices served by the authentication entity, where the sixth indication information indicates at least one operator to which the authentication entity belongs. The terminal devices served by the authentication entity include the first terminal device, so that the first terminal device can determine that the network requested to be accessed is a network of one of the at least one operator.

[0025] Based on the above solution, by sending at least one operator to which the authentication entity belongs to the terminal device, the terminal device can select an operator that provides network services to the terminal device from the at least one operator, thereby improving the flexibility of the terminal device in selecting an operator.

[0026] In certain implementations of the first aspect, the first information includes the first public key of the first terminal device, that is, the authentication entity obtains the first public key of the first terminal device stored in the storage system according to the first indication information, and the authentication entity authenticates the first terminal device based on the first public key and the private key of the authentication entity.

[0027] Based on the above scheme, the authentication entity can obtain the public key of the terminal device and authenticate the terminal device based on the public key and the private key of the authentication entity, which can simplify the authentication process, reduce the delay of authenticating the terminal device, and ensure the timeliness of authenticating the terminal device.

[0028] In certain implementations of the first aspect, the first information includes the address of a smart contract, which is used to generate authentication parameters based on the root key of the first terminal device. The authentication entity obtains the authentication parameters according to the address of the smart contract and authenticates the first terminal device based on the authentication parameters.

[0029] Based on the above solution, the authentication entity can authenticate the terminal device by obtaining the smart contract that generates the authentication parameters, which can reduce the delay in authenticating the terminal device and ensure the timeliness of authenticating the terminal device.

[0030] In certain implementations of the first aspect, an authentication result obtained by authenticating the first terminal device is stored in a storage system.

[0031] Based on the above solution, by storing the authentication result obtained from authenticating the terminal device in the storage system, other authentication entities can verify the terminal device based on the authentication result, thereby reducing the delay of other authentication entities authenticating the terminal device.

[0032] In certain implementations of the first aspect, the first indication information includes any one of the following: identification information of the first terminal device, encrypted identification information of the first terminal device, and a first parameter; wherein the first parameter is used to identify a storage node in the storage system for storing the first information.

[0033] Based on the above scheme, by sending the identification information of the terminal device to the authentication entity, the authentication entity can obtain the authentication information of the terminal device based on the identification information of the terminal device; optionally, the encrypted identification information of the terminal device can also be sent to the authentication entity to ensure the security of the terminal device identification transmission; or, parameters for identifying the storage node can also be sent to the authentication entity so that the authentication entity obtains the authentication information of the terminal device from the storage node. By avoiding direct transmission of the identification information of the terminal device, the security of communication can be improved.

[0034] In certain implementations of the first aspect, a second public key is sent to a terminal device served by the authentication entity, where the second public key is the public key of the authentication entity and is used by the first terminal device to verify the authentication entity. The terminal device served by the authentication entity includes the first terminal device.

[0035] Based on the above solution, by sending the public key of the authentication entity to the terminal device, the terminal device can authenticate the authentication entity based on the public key of the authentication entity.

[0036] In certain implementations of the first aspect, the authentication entity is any one of the following: an access network device that provides services to the first terminal device, a centralized unit of the access network device that provides services to the first terminal device, an edge computing node, a core network element belonging to a second operator, and the second operator does not include the operator signed by the terminal device.

[0037] Based on the above solution, by authenticating the terminal device through the access network device that provides services to the first terminal device, the centralized unit of the access network device that provides services to the first terminal device, the edge computing node, or any communication device in the core network network element belonging to the second operator, the delay in authenticating the terminal device can be reduced, the timeliness of authenticating the terminal device can be guaranteed, and the flexibility of authenticating the terminal device can be improved.

[0038] On the second aspect, a communication method is provided. The method can be executed by a first terminal device, or can also be executed by a component of the first terminal device (such as a chip or circuit). There is no limitation on this. For the sake of ease of description, the following is explained using the execution by the first terminal device as an example.

[0039] The method includes: sending a request message to an authentication entity, the request message is used to request access to a network, the request message carries first indication information indicating the identity information of the first terminal device, the first information corresponding to the identity information is stored in a storage system, and the first information includes information required to authenticate the first terminal device; receiving a response message from the authentication entity, the response message indicating whether the authentication of the first terminal device by the authentication entity is successful.

[0040] Based on the above solution, by sending indication information indicating the identity information of the first terminal device to the authentication entity, the authentication entity can determine the information required to authenticate the first terminal device based on the indication information, thereby completing authentication of the first terminal device. Compared to a core network network element generating authentication information for a terminal device and completing authentication of the terminal device based on this authentication information, having the authentication entity complete authentication of the first terminal device based on the first information can increase the flexibility of authenticating the first terminal device.

[0041] Exemplarily, the storage system may be a blockchain system or a distributed storage system. By storing the identity information of the first terminal device and the first information corresponding to the identity information in the storage system, the security of the user information can be improved.

[0042] In certain implementations of the second aspect, third indication information is sent to the authentication entity, where the third indication information instructs the authentication entity to authenticate the first terminal device.

[0043] Based on the above solution, the terminal device can select the authentication entity that authenticates its identity information, which improves the flexibility of the authentication process.

[0044] In certain implementations of the second aspect, capability information of the authentication entity is received from the authentication entity, the capability information indicating whether the authentication entity supports authentication of the terminal device served by the authentication entity; and when the capability information indicates that the authentication entity supports authentication of the terminal device served by the authentication entity, the third indication information is sent to the authentication entity.

[0045] Based on the above solution, the first terminal device can determine that the authentication entity authenticates the first terminal device based on the capability information of the authentication entity.

[0046] In certain implementations of the second aspect, an identifier of the network that the first terminal device requests to access is sent to the authentication entity.

[0047] Based on the above solution, by sending the identifier of the network requested to be accessed to the authentication entity, the authentication entity can determine the operator providing network services to the terminal device according to the identifier of the network.

[0048] In certain implementations of the second aspect, before sending the identifier of the network that the first terminal device requests to access to the authentication entity, sixth indication information is received from the authentication entity, and the sixth indication information indicates at least one operator to which the authentication entity belongs; the identifier of the network that the first terminal device requests to access is determined based on the sixth indication information, and the network that the first terminal device requests to access belongs to one of the at least one operator.

[0049] Based on the above scheme, the first terminal device can determine at least one operator to which the authentication entity belongs based on the indication information indicating at least one operator to which the authentication entity belongs, thereby determining the operator providing network services to the first terminal device from the at least one operator, thereby improving the flexibility of the terminal device in selecting operators.

[0050] In certain implementations of the second aspect, the first indication information includes any one of the following: identification information of the first terminal device, encrypted identification information of the first terminal device, and a first parameter; wherein the first parameter identifies a storage node in the storage system used to store the first information.

[0051] In certain implementations of the second aspect, a second public key is received from the authentication entity, where the second public key is the public key of the authentication entity; and the authentication entity is authenticated based on the second public key.

[0052] Based on the above solution, the first terminal device can verify the authentication entity based on the public key received from the authentication entity, thereby reducing the delay of the first terminal device in verifying the authentication entity.

[0053] In certain implementations of the second aspect, if the operator signed by the first terminal device is the same as the operator to which the authentication entity belongs, the operator's signature on the second public key is verified based on the operator's public key.

[0054] Based on the above solution, the first terminal device can verify the authentication entity based on the operator's public key.

[0055] In certain implementations of the second aspect, if the operator signed by the first terminal device is different from the operator to which the authentication entity belongs, the signature of the storage node on the second public key is verified based on the public key of the storage node, and the storage node is the node that stores the first information in the storage system.

[0056] Based on the above solution, the first terminal device can verify the signature of the storage node on the second public key based on the public key of the storage node, thereby verifying the authentication entity.

[0057] In certain implementations of the second aspect, the authentication entity is any one of the following: an access network device that provides services to the first terminal device, a centralized unit of the access network device that provides services to the first terminal device, an edge computing node, a core network element belonging to a second operator, and the second operator does not include the operator signed by the terminal device.

[0058] Based on the above solution, by authenticating the terminal device through the access network device that provides services to the first terminal device, the centralized unit of the access network device that provides services to the first terminal device, the edge computing node, or any communication device in the core network network element belonging to the second operator, the delay of authenticating the terminal device can be reduced and the timeliness of authenticating the terminal device can be ensured.

[0059] On the third aspect, a communication device is provided, which can be used for the authentication entity of the first aspect. The communication device can be the authentication entity, or a device in the authentication entity (for example, a chip, or a chip system, or a circuit), or a device that can be used in combination with the authentication entity, or a logic module or software that can realize all or part of the functions of the authentication entity.

[0060] In one possible implementation, the communication device may include a module or unit corresponding to the method / operation / step / action described in the first aspect. The module or unit may be a hardware circuit, software, or a combination of hardware circuit and software.

[0061] In one possible implementation, the device includes a transceiver unit and a processing unit, the receiving unit is used to receive a request message from a first terminal device, the request message is used to request access to a network, the request message carries first indication information indicating identity information of the first terminal device, the first information corresponding to the identity information is stored in a storage system, and the first information includes information required to authenticate the first terminal device; the processing unit is used to obtain the first information based on the first indication information; the processing unit is also used to authenticate the first terminal device based on the first information.

[0062] In certain implementations of the third aspect, the processing unit is further configured to determine whether to authenticate the first terminal device.

[0063] In certain implementations of the third aspect, the processing unit is specifically configured to determine, based on the second information, to authenticate the first terminal device, where the second information includes at least one of the following: second indication information, third indication information, fourth indication information, and capability information of the device;

[0064] Among them, the second indication information indicates that the terminal device served by the device is authenticated, and the second indication information comes from the operator node of at least one operator to which the device belongs; the third indication information indicates that the first terminal device is authenticated by the device, and the third indication information comes from the first terminal device; the fourth indication information is included in the first information, and the fourth indication information indicates that the first terminal device is authenticated by the device; the capability information indicates whether the device supports authentication of the terminal device served by the device.

[0065] In certain implementations of the third aspect, the transceiver unit is further configured to send capability information of the apparatus to a terminal device served by the apparatus, the capability information indicating whether the apparatus supports authentication of the terminal device served by the apparatus. The terminal device served by the apparatus includes the first terminal device.

[0066] In certain implementations of the third aspect, the processing unit is further configured to determine a first operator that provides network services to the first terminal device, where the first operator is one of the at least one operator to which the apparatus belongs.

[0067] In certain implementations of the third aspect, the processing unit is further configured to determine the first operator based on third information, where the third information includes at least one of the following: an identifier of the network that the first terminal device requests to access, a load condition of the network of the at least one operator, and fifth indication information;

[0068] The fifth indication information indicates that the terminal device served by the apparatus is allowed to access the network of the first operator, and the fifth indication information comes from an operator node belonging to any operator among the at least one operator.

[0069] In certain implementations of the third aspect, the transceiver unit is further configured to send sixth indication information to a terminal device served by the apparatus, the sixth indication information indicating at least one operator to which the apparatus belongs. The terminal device served by the apparatus includes the first terminal device, so that the first terminal device can determine that the network requested to be accessed is a network of one of the at least one operator.

[0070] In certain implementations of the third aspect, the first information includes a first public key of the first terminal device, and the processing unit is specifically configured to authenticate the first terminal device based on the first public key and a private key of the apparatus.

[0071] In certain implementations of the third aspect, the first information includes the address of a smart contract, which is used to generate authentication parameters based on the root key of the first terminal device. The processing unit is specifically used to obtain the authentication parameters according to the address of the smart contract and authenticate the first terminal device based on the authentication parameters.

[0072] In certain implementations of the third aspect, the processing unit is further configured to store an authentication result obtained by authenticating the first terminal device in a storage system.

[0073] In certain implementations of the third aspect, the first indication information includes any one of the following: identification information of the first terminal device, encrypted identification information of the first terminal device, and a first parameter; wherein the first parameter is used to identify a storage node in the storage system for storing the first information.

[0074] In certain implementations of the third aspect, the transceiver unit is further used to send a second public key to the terminal device served by the apparatus, where the second public key is the public key of the apparatus, and the second public key is used by the first terminal device to verify the apparatus.

[0075] In certain implementations of the third aspect, the device is any one of the following: an access network device that provides services to the first terminal device, a centralized unit of the access network device that provides services to the first terminal device, an edge computing node, a core network element belonging to a second operator, and the second operator does not include the operator signed by the terminal device.

[0076] In a fourth aspect, a communication device is provided, which can be used for the first terminal device of the second aspect. The communication device can be the first terminal device, or a device in the first terminal device (for example, a chip, or a chip system, or a circuit), or a device that can be used in combination with the first terminal device, or a logic module or software that can realize all or part of the functions of the first terminal device.

[0077] In one possible implementation, the communication device may include a module or unit corresponding to the method / operation / step / action described in the second aspect. The module or unit may be a hardware circuit, software, or a combination of hardware circuit and software.

[0078] In one possible implementation, the device includes a transceiver unit, which is used to send a request message to an authentication entity, where the request message is used to request access to a network, and the request message carries first indication information indicating the identity information of the device; wherein the first information corresponding to the identity information is stored in a storage system, and the first information includes information required to authenticate the device.

[0079] In certain implementations of the fourth aspect, the transceiver unit is further configured to send third indication information to the authentication entity, where the third indication information indicates that the authentication entity authenticates the device.

[0080] In certain implementations of the fourth aspect, the transceiver unit is further used to receive capability information of the authentication entity from the authentication entity, the capability information indicating whether the authentication entity supports authentication of the terminal device served by the authentication entity; and when the capability information indicates that the authentication entity supports authentication of the terminal device served by the authentication entity, the third indication information is sent to the authentication entity.

[0081] In certain implementations of the fourth aspect, the transceiver unit is further configured to send, to the authentication entity, an identifier of the network that the device requests to access.

[0082] In certain implementations of the fourth aspect, the transceiver unit receives sixth indication information from the authentication entity, and the sixth indication information indicates at least one operator to which the authentication entity belongs; the device also includes a processing unit, which is used to determine the identifier of the network that the device requests to access based on the sixth indication information, and the network that the device requests to access belongs to one of the at least one operator.

[0083] In certain implementations of the fourth aspect, the first indication information includes any one of the following: identification information of the device, encrypted identification information of the device, and a first parameter; wherein the first parameter is used to identify a storage node in the storage system used to store the first information.

[0084] In certain implementations of the fourth aspect, the transceiver unit is further used to receive a second public key from the authentication entity, where the second public key is the public key of the authentication entity; and the processing unit is further used to authenticate the authentication entity based on the second public key.

[0085] In certain implementations of the fourth aspect, if the operator signed by the device is the same as the operator to which the authentication entity belongs, the processing unit is further configured to verify the operator's signature on the second public key based on the operator's public key.

[0086] In certain implementations of the fourth aspect, if the operator signed by the device is different from the operator to which the authentication entity belongs, the processing unit is also used to verify the signature of the storage node on the second public key based on the public key of the storage node, and the storage node is the node that stores the first information in the storage system.

[0087] In certain implementations of the fourth aspect, the authentication entity is any one of the following: an access network device that provides services to the device, a centralized unit of the access network device that provides services to the device, an edge computing node, a core network element belonging to a second operator, and the second operator does not include the operator signed by the terminal device.

[0088] In a fifth aspect, a communication device is provided, which includes a processor, which is used to enable the device to implement any aspect of the above-mentioned first and second aspects, as well as any possible implementation method of the first and second aspects, by executing a computer program (or computer executable instructions) stored in a memory and / or through a logic circuit.

[0089] Optionally, the device further includes a memory, which may be deployed separately from the processor or may be deployed centrally.

[0090] Optionally, the device further includes a communication interface, and the processor is coupled to the communication interface. The communication interface may be a transceiver or an input / output interface.

[0091] In one implementation, the device is an authentication entity, or a chip configured in the authentication entity, or a logic module or software that can implement all or part of the authentication entity's functions. When the device is a chip, the communication interface can be an input / output interface, interface circuit, output circuit, input circuit, pin, or related circuit on the chip or chip system. The processor can also be embodied as a processing circuit or a logic circuit.

[0092] In another implementation, the apparatus is a terminal device, or a chip configured in the terminal device, or a logic module or software that implements all or part of the terminal device's functions. When the apparatus is a chip, the communication interface may be an input / output interface, interface circuit, output circuit, input circuit, pin, or related circuit on the chip or chip system. The processor may also be embodied as a processing circuit or a logic circuit.

[0093] Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0094] In a specific implementation, the processor may be one or more chips, the input circuit may be an input pin, the output circuit may be an output pin, and the processing circuit may be a transistor, a gate circuit, a trigger, or various logic circuits. The input signal received by the input circuit may be, but is not limited to, received and input by a receiver, and the signal output by the output circuit may be, but is not limited to, output to and transmitted by a transmitter. The input circuit and the output circuit may be the same circuit, which functions as an input circuit and an output circuit at different times. The embodiments of the present application do not limit the specific implementation of the processor and various circuits.

[0095] In the sixth aspect, a chip system is provided, comprising: a processor, which is used to execute the computer program or instructions in the memory, so that the chip system implements any aspect of the above-mentioned first and second aspects, and the method in any possible implementation of the first and second aspects.

[0096] In the seventh aspect, a communication system is provided, comprising: an authentication entity and at least one of a terminal device, the authentication entity being used to execute the method of the above-mentioned first aspect and any possible implementation of the first aspect; the terminal device being used to execute the method of the above-mentioned second aspect and any possible implementation of the second aspect.

[0097] In an eighth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instructions). When the computer-readable storage medium is run on a computer, any aspect of the above-mentioned first aspect and second aspect, as well as any possible implementation method of the first aspect and second aspect, is implemented.

[0098] In the ninth aspect, a computer program product is provided, which includes a computer program (also referred to as code, or instructions). When the computer program is run, any one of the above-mentioned first and second aspects, and any possible implementation of the first and second aspects, is implemented.

[0099] The beneficial effects brought about by the third to ninth aspects mentioned above can be referred to the description of the beneficial effects in the first and second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] FIG1 is a schematic diagram of a communication network architecture applicable to an embodiment of the present application.

[0101] FIG2 is a schematic diagram of the architecture of a communication system applicable to an embodiment of the present application.

[0102] FIG3 is a schematic diagram of a network architecture applicable to an embodiment of the present application.

[0103] FIG4 is a schematic flow chart of an authentication process based on the EAP-AKA' architecture.

[0104] FIG5 is a schematic flowchart of a communication method 500 provided in this application.

[0105] FIG6 is a schematic flowchart of a method for encrypting the identification of a terminal device provided in the present application.

[0106] FIG7 is a schematic block diagram of a communication device 700 provided in this application.

[0107] FIG8 is a schematic block diagram of a communication device 800 provided in this application.

[0108] FIG9 is a schematic block diagram of a chip system 900 provided in this application. DETAILED DESCRIPTION

[0109] The technical solution in this application will be described below with reference to the accompanying drawings.

[0110] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, fifth generation (5G) systems, sixth generation (6G) systems, and other communication systems that have evolved after 5G.

[0111] Figure 1 is a schematic diagram of a communication network architecture applicable to an embodiment of the present application. As shown in Figure 1, the various parts involved in the network architecture are described below.

[0112] Terminal equipment 110: The terminal equipment in the embodiment of the present application may refer to a device that provides voice and / or data connectivity to a user, or a handheld device with wireless connection function, or other processing device connected to a wireless modem.

[0113] A terminal device may also be referred to as a terminal, access terminal, subscriber unit, user equipment (UE), subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication device, user agent, or user device. A terminal device is a device that includes wireless communication capabilities (providing voice / data connectivity to the user). For example, a handheld device with wireless connectivity or an in-vehicle device may be used. The terminal in the embodiments of the present application can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a train, an airplane, a mobile internet device (MID), a virtual reality (VR) terminal, an augmented reality (AR) terminal, a smart point of sale (POS) machine, customer-premises equipment (CPE), a light terminal device (light UE), a reduced capability UE (REDCAP UE), a wireless terminal in industrial control (such as a robot, etc.), a wireless terminal in the Internet of Vehicles (such as an on-board device, a whole vehicle device, an on-board module, a vehicle, an on-board chip, an on-board unit (OBU) or a telematics box (T-BOX), etc.), a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, etc. The present invention relates to wireless terminals in a smart city, wireless terminals in a smart city, wireless terminals in a smart home, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to a wireless modem, wearable devices, terminals in a 5G network or terminals in a network evolved after 5G, etc. It will be understood that all or part of the functions of the terminal device in this application may also be implemented by software functions running on hardware, or by virtualization functions instantiated on a platform (such as a cloud platform).

[0114] Wearable devices, also known as wearable smart devices, are a general term for wearable devices that use wearable technology to intelligently design and develop wearable devices for daily wear, such as glasses, gloves, watches, clothing, and shoes. Wearable devices are portable devices that are worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not just hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. In a broad sense, wearable smart devices include those that are fully functional, large in size, and can achieve full or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.

[0115] The terminal device of the present application may also be a module or unit for implementing terminal functions, such as a universal integrated circuit card (UICC). It should be understood that the UICC card is used for example only. In actual implementation, the UICC card can also be replaced with a device with similar functions to the UICC card, such as an embedded universal integrated circuit card (eUICC). In addition, the UICC card can also be called by other names, such as a blockchain universal integrated circuit card (B-UICC), which is not limited in the present application.

[0116] Radio access network (R)AN node 120: Provides network access for terminal devices in a specific area and uses transmission tunnels of varying quality based on the device level and service requirements. RAN nodes manage radio resources, provide access services to terminal devices, and forward control signals and terminal data between the device and the core network.

[0117] In one possible scenario, the RAN node may be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a base station in a 6G mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system. The RAN node may be a macro base station, a micro base station or an indoor station, a relay node or a donor node, or a wireless controller in a cloud radio access network (CRAN) scenario. Optionally, the RAN node may also be a server, a wearable device, a vehicle or an on-board device, etc. For example, the access network device in the V2X technology may be a road side unit (RSU). All or part of the functions of the RAN node in this application may also be implemented by software functions running on hardware, or by virtualization functions instantiated on a platform (e.g., a cloud platform). The RAN node in this application may also be a logical node, a logical module or software that can implement all or part of the functions of the RAN node.

[0118] In another possible scenario, multiple RAN nodes collaborate to assist the terminal in achieving wireless access, and different RAN nodes respectively implement part of the functions of the base station. For example, the RAN node can be a centralized unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU can be set separately, or they can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH).

[0119] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in an open radio access network (O-RAN) system, CU may also be referred to as an open-central unit (O-CU); DU may also be referred to as an open-distributed unit (O-DU); CU-CP may also be referred to as O-CU-CP, CU-UP may also be referred to as O-CU-UP, and RU may also be referred to as O-RU. For the sake of convenience of description, this application uses CU, CU-CP, CU-UP, DU and RU as examples for description. Any of the CU (or CU-CP, CU-UP), DU and RU in this application may be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0120] User plane network element 130: used for packet routing and forwarding, and quality of service (QoS) processing of user plane data.

[0121] In a 5G communication system, the user plane network element may be a user plane function (UPF) network element. In a communication system evolved after 5G, the user plane network element may still be a UPF network element, or may have other names, which are not limited in this application.

[0122] Data network (DN) 140: This is the data network that provides services to users. Typically, the client is located in the UE, and the server is located in the data network. A data network can be a private network, such as a local area network (LAN), an external network not controlled by the operator, such as the Internet, or a proprietary network jointly deployed by operators, such as a network that provides Internet Protocol (IP) Multimedia Subsystem (IMS) services.

[0123] In communication systems that evolve after 5G, the DN in the 5G communication system can be used, and entities with similar functions may be replaced with other names, which is not limited in this application.

[0124] Authentication server 150: used for authentication services, generating keys to implement two-way authentication of terminal devices, and supporting a unified authentication framework.

[0125] In a 5G communication system, the authentication server may be an authentication server function (AUSF) network element. In a communication system evolved after 5G, the authentication server function network element may still be an AUSF network element, or may have other names, which are not limited in this application.

[0126] Access management network element 160: mainly used for mobility management and access management, such as access authorization / authentication.

[0127] In a 5G communication system, the access management network element may be an access management function (AMF) network element. In a communication system evolved after 5G, the access management network element may still be an AMF network element, or may have other names, which are not limited in this application.

[0128] Session management network element 170: mainly used for session management, allocation and management of Internet Protocol (IP) addresses of terminal devices, selection of endpoints for manageable user plane functions, policy control and charging function interfaces, and downlink data notification.

[0129] In a 5G communication system, the session management network element may be a session management function (SMF) network element. In communication systems evolved after 5G, the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.

[0130] Slice selection network element 180: used to select a group of network slice instances for serving terminal devices and determine a group of access management network elements for serving terminal devices.

[0131] In a 5G communication system, the network open network element may be a network slice selection function (NSSF) network element. In a communication system evolved after 5G, the network open network element may still be an NSSF network element, or may have other names, which are not limited in this application.

[0132] Network exposure network element 190: used to expose network capabilities to third-party applications, enabling friendly docking of network capabilities with business requirements.

[0133] In a 5G communication system, the network exposure element may be a network exposure function (NEF) element. In a communication system evolving beyond 5G, the network exposure element may still be an NEF element, or may have other names, which are not limited in this application.

[0134] Network repository NE 1100: used to maintain real-time information of all network function services in the network.

[0135] In a 5G communication system, the network storage network element may be a network repository function (NRF) network element. In a communication system evolved after 5G, the network storage network element may still be an NRF network element, or may have other names, which are not limited in this application.

[0136] Policy control network element 1110: A unified policy framework used to guide network behavior and provide policy rule information to control plane functional network elements (such as AMF, SMF network elements, etc.).

[0137] In a 4G communication system, the policy control network element may be a policy and charging rules function (PCRF) network element. In a 5G communication system, the policy control network element may be a policy control function (PCF) network element. In a communication system evolved after 5G, the policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.

[0138] Data management network element 1120: used to process terminal device identification, access authentication, registration, and mobility management.

[0139] In a 5G communication system, the data management network element may be a unified data management (UDM) network element. In a communication system that evolves after 5G, the unified data management may still be a UDM network element, or may have other names, which are not limited in this application.

[0140] Application network element 1130: used for data routing affected by the application, network access, interaction with the policy framework for policy control, etc.

[0141] In a 5G communication system, the application network element may be an application function (AF) network element. In a communication system evolved after 5G, the application network element may still be an AF network element, or may have other names, which are not limited in this application.

[0142] The above network architecture may also include an authentication credential repository and processing function (ARPF) network element and a security anchor function (SEAF) network element (not shown in the figure). The ARPF is primarily used to store the user's root key and related authentication subscription data, and to calculate the 5G authentication vector. The SEAF is primarily used to derive the underlying non-access stratum (NAS) and access stratum (AS) keys based on the anchor key, and to compare authentication results.

[0143] In the above network architecture, N1, N2, N3, N4, N6, Nnssf, Nnef, Nnrf, Npcf, Nudm, Naf, Nausf, Namf, and Nsmf are interface sequence numbers. The meanings of the above interface sequence numbers can be found in the meanings defined in the 3GPP standard protocol, and this application does not limit the meanings of the above interface sequence numbers.

[0144] For example, the N2 interface is the interface between the RAN and the access management network element, used for transmitting radio parameters and NAS signaling; the N3 interface is the interface between the RAN and the user plane function network element, used for transmitting user plane data; the N4 interface is the interface between the session management function network element and the user plane function network element, used for transmitting information such as service policies, tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages. The N6 interface is the interface between the DN and the user plane function network element, used for transmitting user plane data.

[0145] Nnssf, Nnef, Nnrf, Npcf, Nudm, Naf, Nausf, Namf, and Nsmf are service-oriented interfaces, through which network elements can exchange information.

[0146] It should be noted that the interface names between the various network functions in the figure are merely examples. In specific implementations, the interface names of the system architecture may also be other names, and this application does not limit this. In addition, the names of the messages (or signaling) transmitted between the above-mentioned network elements are merely examples and do not constitute any limitation on the functions of the messages themselves.

[0147] It should be understood that the above-mentioned network architecture applied to the embodiment of the present application is only an example of the network architecture described from the perspective of traditional point-to-point architecture and service-oriented architecture. The network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present application.

[0148] It should be noted that the names of the various network elements and interfaces in this application are only examples, and this application does not exclude the possibility that the network elements may be named differently in the future, or that the functions of the network elements may be merged. As communication systems evolve, any device or network element that can implement the functions of the aforementioned network elements will fall within the scope of protection of this application.

[0149] It is understood that the aforementioned network elements or functions can be network components in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform). The aforementioned network elements or functions can be divided into one or more services, and further, services that exist independently of the network functions may also appear.

[0150] FIG2 is a schematic diagram of a network architecture applicable to an embodiment of the present application.

[0151] As shown in Figure 2, the network architecture includes the core network (CN), which is responsible for user access control, mobility management, session management, user security authentication, billing, and other services. It is composed of multiple functional units, which can be divided into functional entities of the control plane and data plane. The network architecture also includes the DN (refer to the description of the data network above) and the UPF network element (refer to the description of the user plane network element above). The DN is used to provide data networks for user services, and the UPF is mainly responsible for managing the transmission of user plane data, traffic statistics, etc. The network architecture also includes the UE and the RAN. The UE can be referred to in the description of terminal devices above. This terminal device can access the RAN through the air interface and initiate calls, access the Internet, and other services. The RAN can be referred to in the description above. It mainly provides wireless access services, schedules wireless resources to access terminal devices, and provides reliable wireless transmission protocols and data encryption protocols.

[0152] In order to introduce blockchain technology into the network architecture, a distributed ledger anchor function (DLAF) and a distributed ledger enabler (DLE) are added to the network architecture.

[0153] The DLAF is the anchor point for the overall management and association of the blockchain, performing blockchain management functions, DLE registration management, chain creation, and blockchain access control. The DLAF is typically deployed as a network function in the core network (CN-DLAF). A hierarchical structure may also exist, where it is deployed in the access network (RAN-DLAF), as shown in Figure 2(a).

[0154] The DLE is a blockchain-enabling module in the communications network. It receives configuration and management from the DLAF and distinguishes different on-chain node types based on their capabilities. It performs one or more of the following functions: transaction proposal, transaction endorsement / execution, deployment and execution of smart contracts, consensus, transaction / block synchronization, and ledger storage. The DLE exists at every node in the network, including the UE, RAN, and network functions (NFs) in the CN. This means that all nodes requiring blockchain capabilities can deploy the DLE. The DLE in the core network can also function as an independent NF, providing blockchain proxy capabilities to other NFs. In scenarios where the RAN's DU and CU are separated, the RAN-DLAF and DLE can be deployed in the CU. A DLE client can be deployed in the DU, accessing the DLE deployed in the CU through the DLE client, as shown in Figure 2(b).

[0155] FIG3 is a schematic diagram of the architecture of a communication system applicable to an embodiment of the present application.

[0156] As shown in FIG. 3 , the communication system includes at least one node (nodes 101 a to 101 i ) and a storage system 102 .

[0157] The storage system 102 may include one or more storage nodes.

[0158] The storage system 102 may include one or more of the following: a blockchain system, a distributed storage system, or a communication system.

[0159] Among them, the blockchain system may include one or more blockchain nodes, that is, the storage node corresponding to the blockchain system can be a blockchain node; the distributed storage system may include one or more distributed storage devices, that is, the storage node corresponding to the distributed storage system can be a distributed storage device; the communication system may include the communication equipment corresponding to the operator, that is, the storage node corresponding to the communication system can be the communication equipment corresponding to the operator.

[0160] It should be understood that blockchain nodes, storage devices in distributed storage systems, and communication devices can be terminal devices or network devices.

[0161] Each node in the at least one node (nodes 101a to 101i) can exchange information with the storage system 102. Optionally, if the at least one node includes multiple nodes, the nodes in the multiple nodes can directly exchange information with each other. The nodes in the at least one node (nodes 101a to 101i) can include terminal devices and / or network devices. Among them, the terminal device can be a device corresponding to the user; the network device can be a device corresponding to the card manufacturer or terminal manufacturer, a device corresponding to a trusted third party, an air card writing server, a device corresponding to the operator, or a device corresponding to an authoritative agency. The terminal manufacturer can also be called an equipment manufacturer, an equipment provider, etc.

[0162] Among them, the equipment corresponding to the card dealer or terminal manufacturer can be the equipment used to realize the business of the card dealer or terminal manufacturer, such as the equipment used by the card dealer or terminal manufacturer to write cards; the equipment corresponding to the operator is the equipment used to provide the operator's business, such as the operator's server, the operator's core network element, or access network equipment, etc.; the equipment corresponding to the authoritative organization is the equipment that can be used to provide the business of the authoritative organization, such as the server or host belonging to the authoritative organization; the equipment corresponding to the trusted third party can be the equipment that can be used to provide the business of the third-party trusted organization, such as the server or host belonging to the third-party trusted organization.

[0163] It is understandable that card vendors, terminal manufacturers, trusted third parties, operators or authoritative institutions are all used as examples, and in actual implementation, other organizations or institutions may also exist.

[0164] In order to facilitate understanding of the technical solutions of the embodiments of the present application, some terms or concepts that may be involved in the embodiments of the present application are first briefly described.

[0165] 1. Key

[0166] A key is a parameter that is input into an algorithm that converts plaintext to ciphertext or vice versa.

[0167] 2. Public and private keys

[0168] A public key and a private key are a key pair (one public key and one private key) derived through an algorithm. One key is publicly available, called the public key; the other is kept private, called the private key. This algorithm-derived key pair is guaranteed to be unique worldwide. When using this key pair, if one key is used to encrypt data, the other key must be used to decrypt it. For example, if data is encrypted using the public key of the key pair, it must be decrypted using the private key, and vice versa; otherwise, decryption will fail.

[0169] 3. Blockchain (BC)

[0170] Transactions on the network are generated and stored in blocks, linked chronologically to form a chain structure. Confirmed and proven transactions on the network are linked from the beginning of the blockchain to the latest block. The ledger formed by linking multiple blocks together is called a blockchain.

[0171] Blockchain technology implements a chained data structure that connects blocks of data and information in chronological order, using cryptographic methods to ensure tamper-proof and unforgeable distributed storage. Generally, the data and information in a blockchain can be referred to as a "transaction."

[0172] Blockchain technology is not a single technology, but a system that integrates point-to-point transmission, consensus mechanism, distributed data storage and cryptographic principles. The system has the technical characteristics of full disclosure and tamper-proof.

[0173] 1) Peer-to-peer transmission: Nodes participating in the blockchain are independent and peer-to-peer, and data and information are synchronized between nodes using peer-to-peer transmission technology. Nodes can be different physical machines or different instances in the cloud.

[0174] 2) Consensus Mechanism: The blockchain consensus mechanism refers to the process by which multiple participating nodes reach consensus on specific data and information through interaction under pre-set logical rules. Consensus mechanisms rely on well-designed algorithms, resulting in varying performance (e.g., transaction throughput (transactions per second, TPS), latency to reach consensus, and computational and transmission resource consumption) across different consensus mechanisms.

[0175] 3) Distributed Data Storage: Distributed storage in blockchains means that each participating node stores independent and complete data, ensuring that data storage is fully transparent across nodes. Unlike traditional distributed data storage, which divides data into multiple copies for backup or synchronous storage according to specific rules, blockchain distributed data storage relies on consensus among independent, equal-status nodes within the blockchain to achieve highly consistent data storage.

[0176] 4) Cryptography principles: Blockchain is usually based on asymmetric encryption technology to achieve trusted information dissemination, verification, etc.

[0177] The concept of a "block" is to organize one or more data records into "blocks," the size of which can be customized based on the specific application scenario. A "chain" is a data structure that connects these blocks of data records in chronological order using hashing technology. In a blockchain, each block consists of a "block header" and a "block body." The "block body" contains the transaction records packaged into the block, while the "block header" contains the root hash (HASH) of all transactions in the block and the HASH of the previous block. The blockchain's data structure ensures that the data stored on the blockchain is tamper-proof.

[0178] 4. Information / data on-chain

[0179] Information / data on-chain means that information / data is packaged in a block through a consensus mechanism to become a new block, and is linked to the previous block, becoming tamper-proof information / data on the chain.

[0180] 5. Smart Contracts

[0181] A smart contract is a computer protocol designed to communicate, verify, or execute a contract in an information-based manner. Blockchain-based smart contracts are visible to all users on the blockchain.

[0182] For example, smart contracts in the blockchain field have the following characteristics:

[0183] The rules are open and transparent, and the rules and information / data within the contract are visible to the outside world; all transactions are publicly visible, and there will be no false or hidden transactions.

[0184] Blockchain technology's qualities of transparency and immutability can be attributed to smart contracts. Smart contracts allow for trusted transactions without a third party, and these transactions are traceable and irreversible. Smart contracts are based on immutable data and can automatically execute predefined rules and terms.

[0185] 6. Self-control identity (scID)

[0186] The scID can be used to identify the identity information of the first node (e.g., any of nodes 101a to 101i). The scID can be decentralized root credentials / credentials (DRC), decentralized identity credentials / credentials (DIC), or decentralized self-control credentials (DSCC). For example, if the scID is a DRC, the DRC can be generated by a trusted node other than the first node, or the DRC can be generated by the first node based on the root credentials, such as the DIC.

[0187] scID can correspond to different business scenarios. For example, in business scenarios with high requirements for personal information confidentiality, scID can be DIC, which means that the business can be completed using DIC. For another example, in scenarios with low requirements for trust in the first node, SID can be DSCC, which means that the business can be completed using DSCC.

[0188] In current mobile communications, the process of UE accessing the network includes UE identity authentication (for example, the steps shown in FIG3 ) and UE access process (refer to existing relevant descriptions), which can be specifically divided into the following steps:

[0189] (1) Preliminary preparation: After the UE signs a contract with the operator, the UE's identity information is obtained. This identity information is bound to the UE's root key and stored in the UE's USIM card. At the same time, the identity information and the UE's root key corresponding to the identity information are stored in the UDM / UDR of the core network.

[0190] (2) Authentication process: The UE sends a request to the core network to access the network, which carries the UE's identity information; after receiving the UE's request to access the network, the core network initiates the authentication process through non-access stratum (NAS) signaling. The specific algorithm is an authentication algorithm based on a symmetric key (refer to the steps shown in Figure 3). In this authentication process, the UDM / UDR searches for the UE's root key corresponding to the UE's identity information based on the received UE's identity information, and generates an authentication vector based on the UE's root key; the UDM / UDR sends the authentication vector to the AUSF, and the AUSF further sends the challenge value in the authentication vector to the UE; the UE generates an authentication response based on the challenge value and its own preset root key, and returns it to the AUSF; the AUSF completes the identity authentication of the UE by comparing the authentication response generated by the UE with the authentication response generated by the core network. The AUSF returns an indication of authentication success or failure to the UE and the AMF / SEAF.

[0191] (3) Establishing a secure connection in the access network: The RAN is responsible for transparently transmitting signaling between the UE and the core network throughout the authentication process. After the AUSF successfully authenticates, the AMF requests the RAN to establish a UE context via NG application protocol (NGAP) signaling. After the RAN and UE negotiate a security algorithm, they activate access stratum (AS) security, trust the UE's identity, and provide services to the UE.

[0192] Figure 4 is a schematic flow chart of an authentication process based on the Extensible Authentication Protocol (EAP) AKA'. The authentication process includes the following contents.

[0193] S401, UDM / ARPF determines an authentication vector (AV).

[0194] After the UDM / ARPF receives the UE ID and SN name sent by the AUSF, it determines the AV based on the received information. The AV may include a five-tuple: an authentication random number (RAND), an authentication token (AUTN), an expected response parameter (XRES), a cipher key (CK), and an integrity key (IK).

[0195] Next, UDM / ARPF updates the AV according to the SN name and the key derivation function (KDF) algorithm. Specifically, it calculates CK' and IK' according to the SN name and the KDF algorithm, and uses the CK' and IK' to replace the CK and IK in the original AV.

[0196] S402, UDM / ARPF sends a UE identity authentication response to AUSF.

[0197] The UE authentication response sent by UDM / ARPF to AUSF may be Nudm_UEAuthentication_Get Response, which may include an updated authentication vector (denoted as AV'). The parameters used for authentication included in AV' may include (RAND, AUTN, XRES, CK', IK').

[0198] S403, AUSF sends a UE identity authentication response to SEAF.

[0199] The UE identity authentication response sent by the AUSF to the SEAF may be an EAP request message or an AKA'-challenge message, and the EAP-request or AKA'-challenge includes RAND and AUTN.

[0200] S404: SEAF sends an authentication request to the UE.

[0201] The authentication request (authentication request) sent by SEAF to the UE may be the forwarded EAP-request or AKA'-challenge received in step S403, where the EAP-request or AKA'-challenge includes RAND and AUTN.

[0202] Specifically, SEAF forwards the EAP-request or AKA'-challenge to the USIM of the UE.

[0203] S405: The UE calculates an authentication response.

[0204] Specifically, after the UE's USIM receives the RAND and AUTN in the EAP-request or AKA'-challenge, it verifies whether the AUTN is correct. If correct, the USIM calculates the reply RES, CK, and IK, and then sends RES, CK, and IK to the UE's ME. The ME then calculates CK' and IK' based on the SN name and the KDF algorithm. CK' and IK' can be used by the UE to generate a key corresponding to the AUSF's key.

[0205] S406: The UE sends an authentication response to the SEAF.

[0206] The authentication response sent by the UE to the SEAF may be an EAP response (EAP-response) message or an AKA'-challenge (AKA'-challenge) message, and the EAP-response and AKA'-challenge include RES.

[0207] S407, SEAF forwards the message received in step S406 to AUSF.

[0208] S408, AUSF verification response.

[0209] Among them, AUSF can compare RES with its own stored RES to see if they are equal. If they are equal, AUSF verifies the UE successfully.

[0210] Optionally, the AUSF and the UE may also exchange EAP-request / AKA'-notification messages and EAP-response / AKA'-notification messages in step S409.

[0211] S410, AUSF sends a UE identity authentication response to SEAF.

[0212] AUSF can generate an extended master session key (EMSK) from CK' and IK', and use the first 256 bits of EMSK as the AUSF key (denoted as K AUSF ), then according to K AUSF Derived SEAF key K SEAF and send the EAP success message and K SEAF Sent to SEAF.

[0213] S411, SEAF sends an N1 message to the UE.

[0214] The N1 message may be an EAP success message.

[0215] As can be seen above, when a UE accesses a network, it uses its identity information to pass network authentication and obtain the communication services provided by the network. This network-based authentication of the UE is considered direct authentication. This means that the network can directly obtain sensitive user information to verify the user's identity. The entity responsible for executing the UE's authentication process is referred to as the direct authentication entity. This authentication method limits the flexibility of user authentication.

[0216] Secondly, in the direct authentication process, the network side's identity verification of the user occurs in the core network, that is, the direct authentication entity that can directly obtain sensitive information such as user contract information and root keys is located in the core network. Since the authentication entity is generally deployed at a location far away from the user, the authentication signaling needs to be transmitted over a longer path, which may cause delays in user access to the network. In addition, as the number of terminals increases, if a large number of terminals initiate authentication to the core network in a short period of time, it may cause a surge in the traffic processed by the core network, causing network congestion. In addition, in the above authentication process, the UE needs to be bound to the operator, that is, each operator independently manages its own user identity system. Therefore, for users, they can only choose to access a specific operator. When users need to access multiple operators, they need to set up multiple card slots, which takes up space on the mobile phone; in addition, when users roam, they need to return to their home location for identity authentication.

[0217] In view of this, the present application proposes a communication method and a communication apparatus to securely and indirectly authenticate a terminal device and improve the flexibility of authenticating the terminal device.

[0218] The embodiments shown below do not particularly limit the specific structure of the execution subject of the method provided in the embodiments of the present application. As long as it is possible to communicate according to the method provided in the embodiments of the present application by running a program that records the code of the method provided in the embodiments of the present application, for example, the execution subject of the method provided in the embodiments of the present application can be an authentication entity, or a functional module in the authentication entity that can call and execute the program.

[0219] In order to facilitate understanding of the embodiments of the present application, the following explanations are made.

[0220] First, in this application, "used to indicate" can be understood as "enabling," and "enabling" can include both direct and indirect enabling. When describing information as enabling A, it can include the information directly enabling A or indirectly enabling A, but it does not necessarily mean that the information contains A.

[0221] The information enabled by the information is called information to be enabled. In the specific implementation process, there are many ways to enable the enabled information, such as but not limited to, directly enabling the information to be enabled, such as the information to be enabled itself or the index of the information to be enabled. The information to be enabled can also be indirectly enabled by enabling other information, wherein there is an association between the other information and the information to be enabled. It is also possible to enable only a part of the information to be enabled, while the other parts of the information to be enabled are known or agreed in advance. For example, it is also possible to enable specific information with the help of the arrangement order of each piece of information agreed in advance (such as specified in the protocol), thereby reducing the enabling overhead to a certain extent. At the same time, it is also possible to identify the common parts of each piece of information and enable them uniformly to reduce the enabling overhead caused by enabling the same information separately.

[0222] Second, the first, second, and various numerical numbers (e.g., "#1," "#2," etc.) shown in this application are for convenience of description only and are used to distinguish objects, such as messages, and are not intended to limit the scope of this application. They are not intended to describe a particular order or precedence. It should be understood that such descriptions can be interchanged where appropriate to describe solutions other than the embodiments of this application.

[0223] Third, in this application, "pre-set" and "pre-configured" may include pre-definition, such as protocol definition. "Pre-definition" may be implemented by pre-storing corresponding codes, tables, or other methods that can be used to indicate relevant information in a device (e.g., including each network element), and the specific implementation method is not limited.

[0224] Fourth, the terms "save" and "store" used in the embodiments of this application may refer to storage in one or more memories. The one or more memories may be provided separately or integrated into an encoder or decoder, a processor, or a communication device. The one or more memories may also be partially provided separately and partially integrated into a decoder, a processor, or a communication device. The memory may be any type of storage medium, and this application does not limit this.

[0225] Fifth, the term "and / or" in this document describes the relationship between related objects and can represent three types of relationships. For example, "A and / or B" can represent: A alone, A and B together, or B alone. Additionally, the character " / " in this document generally indicates an "or" relationship between the preceding and following objects.

[0226] Sixth, one information (e.g., information #1) involved in this application "includes" another information (e.g., information #2), which can be understood as information #1 explicitly carrying or implicitly carrying the information #2. For example, information #1 directly carries information #2; for another example, information #1 carries indication information indicating information #2, and the receiving device receiving information #1 can obtain information #2 based on the indication information, and the indication information used to indicate information #2 can be predefined or specified by the protocol, or it can be an explicit or implicit indication.

[0227] Below, without loss of generality, the communication method provided in the embodiment of the present application is described in detail by taking the interaction between network elements as an example.

[0228] Figure 5 is a schematic flow chart of a communication method provided in an embodiment of the present application. The method may include the following steps.

[0229] S510: The first terminal device sends a request message to the authentication entity. Correspondingly, the authentication entity receives the request message from the first terminal device.

[0230] In which, the authentication entity may be an access network device that provides services to the first terminal device, or, when the CU and DU of the access network device are separated, the authentication entity is the CU of the access network device; or the authentication entity is an edge computing node, or a core network element belonging to operator #1.

[0231] Exemplarily, when the authentication entity is the CU of the access network device, the request message sent by the first terminal device to the CU can be transparently transmitted through the DU of the access network device, that is, the first terminal device sends the request message to the DU, and the DU forwards the request message to the CU.

[0232] When the authentication entity is an edge computing node, the edge computing node can be an edge application server (EAS) deployed in an edge data network (EDN). The EDN can be a local data network, and the local DN can also be understood as an access point of a data network that is closer to the user's attachment point.

[0233] When the authentication entity is a core network element belonging to operator #1, operator #1 may be the operator with which the first terminal device has signed a contract, that is, the authentication entity may be a core network element of the operator with which the first terminal device has signed a contract. Operator #1 may also be an operator that has not signed a contract with the first terminal device (an example of the second operator), or in other words, operator #1 does not include the operator with which the first terminal device has signed a contract, that is, the authentication entity may also be a core network element of an operator that has not signed a contract with the first terminal device. For example, the core network element may be any one of the AMF, AUSF, and UDM.

[0234] The request message may be used to request network access and may carry first indication information indicating the identity information of the first terminal device. First information corresponding to the identity information may be stored in a storage system. The first information may include information required to authenticate the first terminal device. The storage system may refer to storage system 102 above, for example, a blockchain system, a distributed storage system, or a communication system.

[0235] Specifically, the first information may be stored on a storage node corresponding to the storage system. If the storage system is a blockchain system, the storage node may be a blockchain node. For example, the first information may be stored on the blockchain node in a block-like manner, i.e., the information is on-chain. If the storage system is a distributed storage system, the storage node may be a node in the distributed storage system. In some possible scenarios, the distributed storage node may be a blockchain node. If the storage system is a communication system, the storage node may be a device in the communication system, such as a functional network element capable of storing the subscription data of a terminal device.

[0236] Illustratively, the first indication information may include any one of the following information:

[0237] The identifier of the first terminal device, the encrypted identifier of the first terminal device, and the first parameter.

[0238] The identifier of the first terminal device includes but is not limited to the following identifiers:

[0239] scID, subscription permanent identifier (SUPI), subscription concealed identifier (SUCI), generic public subscription identifier (GPSI), permanent equipment identifier (PEI) or mobile subscriber international ISDN / PSTN number (MSISDN), where ISDN stands for integrated service digital network and PSTN stands for public switched telephone network.

[0240] It can be understood that the encrypted identification of the first terminal device can be obtained by encrypting the identification of the first terminal device. In the case where the first indication information is the encrypted identification of the first terminal device, the first terminal device can encrypt the identification of the first terminal device based on symmetric encryption (refer to the step shown in (a) of Figure 6) or asymmetric encryption (refer to the steps shown in (b) and (c) of Figure 6).

[0241] The first parameter can be used to identify the storage node. For example, if the storage node is a blockchain node, the first parameter can include the identifier of block #1 or the identifier of transaction #1. Block #1 or transaction #1 includes the corresponding relationship between the identity information of the first terminal device and the first information.

[0242] The block identifier is used to indicate a certain block (or a certain type of block). It should be understood that the block indicated by the block identifier may be a block with certain characteristics and is not limited to a specific block.

[0243] The transaction identifier is used to indicate a certain transaction (or a certain type of transaction), including but not limited to: transaction format, transaction type, etc. It should be understood that the transaction indicated by the transaction identifier can be a transaction with certain characteristics, and is not limited to a specific transaction.

[0244] That is, when the first information corresponding to the identity information is stored in the storage system, the terminal device can send the first parameter to the authentication entity, so that the authentication entity can obtain the first information stored in the storage node based on the first parameter.

[0245] Optionally, the method further includes: the authentication entity determines to authenticate the first terminal device.

[0246] Exemplarily, after receiving the request message, the authentication entity may determine to authenticate the first terminal device based on the second information, or in other words, the authentication entity determines whether to authenticate the first terminal device based on the second information.

[0247] The second information may include at least one of the following information: second indication information, third indication information, fourth indication information, and capability information of the authentication entity.

[0248] The second indication information comes from an operator node of at least one operator to which the authentication entity belongs, and the second indication information instructs to authenticate the terminal device served (connected) by the authentication entity, wherein the terminal device served by the authentication entity includes the first terminal device.

[0249] For example, when it is known that the authentication entity has the authentication capability to authenticate the terminal device served by the authentication entity, the operator node of the at least one operator instructs the authentication entity to authenticate the terminal device served by the authentication entity as a verifier.

[0250] For another example, upon learning that the authentication entity has the above-mentioned authentication capability, each of the at least one operator may instruct the authentication entity to act as the verifier to authenticate the terminal device served by the authentication entity based on the current network situation of each operator.

[0251] When the operator node instructs the authentication entity to act as the verifier, the operator node may notify the authentication entity to open the authentication capability through control plane signaling. Optionally, the operator node may also instruct the authentication entity on conditions for opening the authentication capability, such as the conditions including that the authentication entity performs authentication within a first time period (e.g., a number of consecutive hours starting from the current time).

[0252] The third indication information comes from the first terminal device. The third indication information indicates that the first terminal device is authenticated by the authentication entity. That is, the first terminal device can independently determine that its identity information is authenticated by the authentication entity.

[0253] Exemplarily, the third indication information may be carried in the request message, that is, the first terminal device instructs the authentication entity to authenticate the identity information of the first terminal device as the verifier while requesting to access the network.

[0254] Before sending the third indication information to the authentication entity, the first terminal device may also determine that the authentication entity authenticates its identity information, or in other words, determine to send the third indication information to the authentication entity, through the following information:

[0255] (1) Information of the verification party specified when the first terminal device signed the contract.

[0256] For example, when the first terminal device signs a contract with an operator, it negotiates with the contracted operator to determine that the authentication entity will serve as the verification party.

[0257] (2) The service type when the first terminal device accesses the network.

[0258] Exemplarily, when determining that the service type is a first type of service, the first terminal device determines that the authentication entity authenticates its identity information. The first type of service may be a service that has a high latency requirement for accessing the network.

[0259] For example, the first type of service is an emergency service, such as a user needs to make a call to the police or an emergency department.

[0260] (3) Capability information of the authentication entity.

[0261] The capability information indicates whether the authentication entity supports authentication of the terminal device served (connected) by the authentication entity; in other words, the capability information indicates whether the authentication entity has the capability to authenticate the terminal device it serves.

[0262] For example, when it is learned from the capability information that the authentication entity has the capability to authenticate the terminal device it serves, the first terminal device determines that the authentication entity authenticate its identity information.

[0263] Optionally, the authentication entity sends (eg, broadcasts) capability information of the authentication entity to the terminal device served by the authentication entity; correspondingly, the first terminal device receives the capability information from the authentication entity.

[0264] The fourth indication information is included in the first information, and the fourth indication information indicates that the authentication entity authenticates the first terminal device. That is, the authentication entity can determine that the authentication entity authenticates the first terminal device through the fourth indication information included in the first information.

[0265] In one possible implementation, after receiving the first indication information, the authentication entity obtains the first information based on the first indication information (the specific process can refer to the description in S520). After obtaining the first information, it determines to authenticate the first terminal device based on the fourth indication information included in the first information.

[0266] Optionally, in the case where the authentication entity has the capability to authenticate the terminal device it serves, the authentication entity may directly determine to authenticate the terminal device it serves. The capability information is described above.

[0267] Optionally, the method further includes: the authentication entity determining a first operator providing network services for the first terminal device, where the first operator is one of at least one operator to which the authentication entity belongs. That is, if the authentication entity belongs to at least one operator, the authentication entity selects an operator from the at least one operator to provide network services for the first terminal device.

[0268] Exemplarily, the authentication entity may determine the first operator according to the third information; or in other words, the authentication entity determines the first operator from the at least one operator based on the third information.

[0269] The third information may include at least one of the following information: an identifier of the network that the first terminal device requests to access, a load condition of the network of the at least one operator, and fifth indication information. The fifth indication information may come from an operator node of any operator among the at least one operator (denoted as operator #1), and the fifth indication information indicates that the terminal device served by the authentication entity is allowed to access the network of operator #1, where operator #1 is the first operator.

[0270] If the third information includes the identifier of the network that the first terminal device requests to access, the identifier of the network that the first terminal device requests to access may come from the first terminal device, that is, the authentication entity determines the first operator through the identifier of the network that the first terminal device requests to access.

[0271] Specifically, the authentication entity can determine the network requested for access based on the identifier of the network requested for access, thereby determining the operator to which the network belongs (i.e., the first operator). Exemplarily, the identifier of the network requested for access can be carried in the request message #1, or can be sent separately through other uplink messages, without limitation.

[0272] Optionally, before sending the identifier of the network to be accessed to the authentication entity, the first terminal device may determine an operator that provides network services to the first terminal device.

[0273] In one example, a first terminal device receives indication information #1 (an example of the sixth indication information) from an authentication entity, where indication information #1 indicates at least one operator to which the authentication entity belongs; the first terminal device determines the first operator from the at least one operator based on indication information #1.

[0274] For example, the first terminal device may determine the first operator based on the signal quality of the network of the at least one operator. If the first terminal device selects an operator with better network signal quality among the at least one operator as the first operator, for example, the first terminal device may scan the frequency band of each operator among the at least one operator, compare the received broadcast messages of the operator, and select the operator with better signal quality as the first operator.

[0275] In another example, the user may statically configure the operator that the first terminal device preferentially accesses, or in other words, configure the operator that preferentially provides network services to the first terminal device through configuration information, that is, configure the first operator.

[0276] For example, a user can statically configure the operator that the first terminal device preferentially accesses through a human-machine interface, and the configuration principle can be, for example, operators that can provide more favorable packages, operators with better local service quality, etc.

[0277] For another example, when signing a contract with the first terminal device, the user can report his or her operator requirements, such as an operator that can provide more favorable packages or an operator with cheaper prices; the first terminal device matches the operator that wants to access the network this time based on the demand information.

[0278] If the third information includes the load condition of the network of the at least one operator, the load condition of the network of the at least one operator may be determined by an operator node of each operator of the at least one operator.

[0279] Exemplarily, the operator node of each operator determines the current network load situation of each operator and dynamically indicates the network load situation of each operator to the authentication entity.

[0280] For example, the at least one operator includes operator A and operator B, and the operator nodes of operator A and operator B respectively calculate the network load of each operator through the ratio of the number of users currently carried by the network to the maximum number of users carried by the network; the operator node can notify the authentication entity of the network load of each operator through control plane signaling; thereby, the authentication entity can select the operator with smaller network load as the first operator.

[0281] It should be understood that the operator node used to determine the operator network load mentioned above can be a functional network element (for example, SMF, UPF) in the operator's core network, or the operator's operation administration and maintenance (OAM) node.

[0282] If the third information includes the fifth indication information, the fifth indication information may come from the first operator.

[0283] Exemplarily, the first operator may be determined through negotiation among the at least one operator.

[0284] For example, the at least one operator includes operator A and operator B. Operator A and operator B negotiate to determine that a terminal device in a certain cell accesses the network of operator A within a first time period and accesses the network of operator B within a second time period. Then, the operator node of operator A can send an indication message #2 (an example of the fifth indication message) to the authentication entity, indicating that the terminal device served by the authentication entity is allowed to access the network of operator A (an example of the first operator) within the first time period, and / or, the operator node of operator B can send an indication message #3 (an example of the fifth indication message) to the authentication entity, indicating that the terminal device served by the authentication entity is allowed to access the network of operator B (an example of the first operator) within the second time period; thereby, the authentication entity determines that the first operator in the first time period is operator A according to the indication message #2, and / or determines that the first operator in the second time period is operator B according to the indication message #3.

[0285] For another example, operator A and operator B negotiate to determine the first operator based on the current network load. The first operator may be an operator with a smaller network load.

[0286] It should be understood that this application does not limit the order in which the authentication entity determines to authenticate the first terminal device and determines the first operator.

[0287] S520: The authentication entity obtains the first information based on the first indication information.

[0288] The first information includes information required to authenticate the first terminal device. Exemplarily, the first information includes a public key corresponding to the first terminal device and / or an address of smart contract #2.

[0289] Smart Contract #2 can be used to generate authentication parameters for authenticating the first terminal device based on the first terminal device's root key. For example, the operator contracted by the first terminal device can package the process of calculating the authentication parameters based on the first terminal device's root key into a smart contract (i.e., Smart Contract #2) and upload it to the blockchain.

[0290] Optionally, the first information also includes information about the operator that the first terminal device expects to access (ie, an example of fourth indication information).

[0291] Optionally, the first information further includes indication information #5, which may indicate an authentication method used to authenticate the first terminal device, for example, an authentication method based on a symmetric key and an authentication method based on an asymmetric key.

[0292] Exemplarily, if the first indication information is the identifier of the terminal device, the authentication entity obtains the first information corresponding to the first terminal device from the storage system through the identifier of the first terminal device; if the first indication information is the encrypted identifier of the first terminal device, the authentication entity decrypts the identifier of the first terminal device according to the different encryption algorithms used by the first terminal device (for details, please refer to the steps of the method shown in Figures 6 (a) to 6 (c)), and obtains the first information from the storage system through the identifier of the first terminal device; if the first information includes the first parameter, the authentication entity determines the storage node storing the first information based on the first parameter, and obtains the first information from the storage node.

[0293] Specifically, if the storage system is a distributed storage system or a communication system, the authentication entity may directly obtain the first information from the storage system through the identifier of the first terminal device.

[0294] If the storage system is a blockchain system (the storage node is a blockchain node), and the authentication entity is a blockchain node on the blockchain, the authentication entity obtains the first information directly from the blockchain through the identification of the first terminal device.

[0295] If the authentication entity is not a blockchain node on the blockchain, the authentication entity obtains the first information through a proxy node of the blockchain.

[0296] The proxy node may be used to query the first information stored in the blockchain using the identifier of the first terminal device, the identifier of transaction #1, or the identifier of block #1. Alternatively, if the network uses a decentralized shared profile repository (dSPR) to store the first information, the authentication entity may obtain the first information by invoking a resolution service provided by the dSPR.

[0297] S530: The authentication entity authenticates the first terminal device based on the first information.

[0298] Exemplarily, the authentication entity may authenticate the first terminal device based on a symmetric key authentication method or an asymmetric key authentication method. For example, the authentication entity determines to authenticate the first terminal device based on a symmetric key authentication method or an asymmetric key authentication method according to the instruction of instruction information #5.

[0299] The following describes the two authentication methods with specific examples.

[0300] 1. Authentication method based on symmetric keys.

[0301] The authentication entity's authentication based on this authentication method may include the following steps:

[0302] S1.1, the authentication entity determines the address of smart contract #2 based on the first information.

[0303] S1.2, the authentication entity obtains smart contract #2 from the blockchain according to the address of smart contract #2, and calls smart contract #2 to obtain authentication parameters.

[0304] Exemplarily, when the authentication entity is a blockchain node, the authentication entity obtains smart contract #2 from the blockchain according to the address of smart contract #2, and calls smart contract #2 to obtain authentication parameters.

[0305] For example, the authentication entity inputs input parameters required to calculate the authentication parameters, such as the input parameters including a random number, a service network name, etc., to obtain the authentication parameters.

[0306] In the case where the authentication entity is not a blockchain node, the authentication entity can obtain the authentication parameters through the blockchain proxy node.

[0307] For example, the authentication entity sends input parameters and the address of Smart Contract #2 to the blockchain proxy node, and the blockchain proxy node obtains the authentication parameters. Alternatively, the authentication entity sends the address of Smart Contract #2 to the blockchain proxy node, obtains Smart Contract #2, and then calls Smart Contract #2 to obtain the authentication parameters.

[0308] Exemplarily, the authentication parameter mentioned above may be an authentication vector (authentic vector, AV).

[0309] For example, the authentication vector is an extensible authentication protocol-authentication and key agreement (EAP-AKA) AV, which includes parameters such as a random number (RAND), an authentication token (AUTN), an expected response parameter (XRES), a cipher key (CK), and an integrity key (IK).

[0310] For another example, the authentication vector is a 5G home environment authentication vector (5G HE AV), and the 5G HE AV may include parameters such as RAND, AUTN, and XRES.

[0311] It should be understood that the above authentication parameter being an authentication vector is merely an example and is not intended to be limiting in this application. Mutual authentication between the first terminal device and the authentication entity can be achieved through the authentication parameter. For example, the authentication parameter may be a trusted random number, i.e., a random number trusted by both the authentication entity and the first terminal device. Another example is a timestamp, where the timestamp is a trusted clock trusted by both the authentication entity and the first terminal device, such as clock information generated by a clock endorsed by an endorser.

[0312] S1.3, the authentication entity sends parameter #1 to the first terminal device.

[0313] Exemplarily, parameter #1 may be a partial parameter in the authentication parameters.

[0314] That is, the authentication entity sends part of the authentication parameters to the first terminal device, so that the first terminal device determines other parameters according to the part of the parameters, and the authentication entity authenticates the first terminal device based on the other parameters.

[0315] For example, the parameter #1 may include RAND and AUTN.

[0316] Optionally, S1.4, the first terminal device verifies the authentication entity based on the parameter #1.

[0317] For example, the first terminal device may verify the AUTN in parameter #1 to verify the legitimacy of the authentication entity.

[0318] If the first terminal device passes the verification of the authentication entity, the first terminal device can obtain output parameters such as CK, IK, XRES*, etc. based on the root key stored in itself and the received parameter #1 (such as RAND).

[0319] S1.5, the first terminal device sends parameter #2 to the authentication entity.

[0320] The parameter #2 may include some parameters of the output parameters obtained by the first terminal device in S5, such as: XRES*.

[0321] S1.6, the authentication entity authenticates the first terminal device by comparing parameter #2 with the authentication parameter.

[0322] For example, the authentication entity compares XRES with XRES*, and if they are the same, the authentication is successful.

[0323] Based on the above solution, the operator node can deploy a smart contract to enable all other nodes that can call the smart contract or have the authority to read blockchain data to obtain authentication parameters through the smart contract, so that the authentication entity can authenticate the terminal device without obtaining sensitive user information.

[0324] 2. Authentication method based on asymmetric key.

[0325] The authentication entity's authentication based on this authentication method may include the following steps:

[0326] S2.1. The authentication entity determines the public key of the first terminal device (denoted as public key #1, an example of the first public key) based on the first information.

[0327] S2.2, the authentication entity generates a random number r1, encrypts r1 with the public key #1 (recorded as ciphertext #4), and sends the ciphertext #4 to the first terminal device.

[0328] Optionally, S2.3, the authentication entity sends its public key (denoted as public key #2) to the first terminal device.

[0329] It can be understood that if the authentication entity has sent the public key #2 to the first terminal device in the aforementioned steps, this step may not be performed.

[0330] Optionally, S2.4, if the first terminal device has not verified the public key #2, the first terminal device verifies the public key #2.

[0331] For the specific verification method, please refer to the description in S603a.

[0332] S2.5, the first terminal device uses the private key corresponding to the public key #1 (denoted as private key #1) to decrypt the ciphertext #4 to obtain r1'.

[0333] S2.6, the first terminal device generates a random number r2, encrypts the random number r2 and r1' using the public key #2 to generate a ciphertext #5, and sends the ciphertext #5 to the authentication entity.

[0334] Optionally, if the first terminal device receives multiple public keys of the authentication entity (for example, multiple certificates of the authentication entity), then in this step, the first terminal device may also send indication information indicating the public key used for encryption to the authentication entity.

[0335] S2.7, the authentication entity uses the private key corresponding to public key #2 (denoted as private key #2) to decrypt ciphertext #5 to obtain r1", and authenticates the first terminal device based on r1".

[0336] Exemplarily, if it is verified that r1″=r1, the authentication entity successfully authenticates the first terminal device.

[0337] Optionally, in S2.8, the authentication entity decrypts ciphertext #5 using private key #2 to obtain r2', and sends the first message encrypted with r2' (denoted as ciphertext #6) to the first terminal device. Accordingly, the first terminal device receives ciphertext #6 and decrypts it using r2.

[0338] If the first terminal device determines that the format of the first message is correct, the first terminal device successfully authenticates the authentication entity.

[0339] Subsequently, r2 can also be used as the encryption key for the communication process between the two parties.

[0340] It should be understood that the above asymmetric key-based authentication process is only an example and this application is not limited thereto. For example, the authentication entity and the first terminal device may also generate a shared key based on public key #1, public key #2, and a key exchange algorithm, and implement mutual authentication based on the shared key.

[0341] The above authentication method can realize two-way authentication between the first terminal device and the authentication entity.

[0342] In a possible implementation, the method further includes: the authentication entity sending a response message to the first terminal device, where the response message may indicate whether the authentication entity successfully authenticates the first terminal device.

[0343] Exemplarily, the response message may explicitly indicate whether the authentication of the first terminal device is successful. For example, the response message may carry an authentication result, and the authentication result may include indication information indicating whether the authentication of the first terminal device is successful or failed (the authentication result may be specifically described in S540); or, the response message may implicitly indicate whether the authentication of the first terminal device is successful. For example, the type of the response message is used to indicate whether the authentication of the first terminal device is successful. For example, the response message is a security policy negotiation message or an access response message. The first terminal device receives the security policy negotiation message or the access response message, which indicates that the authentication entity has successfully authenticated the first terminal device. This application does not limit the type of response message indicating that the authentication entity has failed to authenticate the terminal device.

[0344] Optionally, the method further includes:

[0345] S540: The authentication entity saves the authentication result obtained by authenticating the first terminal device in the storage system.

[0346] The authentication result can be used as a reference for subsequent authentication of the first terminal device. For example, if another node (which can be the authentication entity or another authentication entity) needs to authenticate the first terminal device later, the other node can obtain the authentication result from the storage system and determine whether to further authenticate the first terminal device based on the authentication result.

[0347] The storage system may refer to the description in S510. For example, if the storage system is a blockchain system, the authentication result may be stored in a blockchain node. For example, the authentication result may be stored on the blockchain node in a block-by-block manner, such as the authentication result corresponding to the identifier of block #2 or the identifier of transaction #2. If the storage system is a distributed storage system, the authentication result may be stored on a distributed storage node.

[0348] Specifically, if the authenticating entity is a blockchain node, it can synchronize the authentication result with other blockchain nodes and save it to the blockchain after consensus. If the authenticating entity is not a blockchain node, it can send the authentication result to a blockchain proxy node, which will generate a blockchain transaction / block based on the authentication result, synchronize it with other blockchain nodes, and save it to the chain after consensus. The blockchain proxy node can also return the on-chain authentication result to the authenticating entity. Alternatively, if the authenticating entity has permission to read blockchain data, the blockchain proxy node can also send the authentication entity the identifier of the transaction / block for which the authentication result is on-chain.

[0349] The authentication result may include indication information indicating whether the authentication of the first terminal device is successful or failed. Optionally, the authentication result may also include at least one of the following information:

[0350] The identity of the authenticator (e.g., the identifier of the authentication entity, IP address, etc.), the identity information of the first terminal device (e.g., the identifier of the first terminal device, the identifier of the transaction that obtained the identifier of the first terminal device, or the identifier of the block, etc.), the timestamp of the authentication, and the signature of the authenticator (i.e., the authentication entity).

[0351] It should be understood that if the authentication result is stored on the blockchain, the authentication result can be stored on the chain as a transaction. At this time, since the transaction format includes the signature of the node generating the transaction and the timestamp of the transaction being uploaded to the chain, the authentication result may not include the authentication timestamp and the signature of the authenticator.

[0352] Based on the above solution, storing the authentication results on the blockchain can save signaling overhead. Secondly, by leveraging the blockchain's non-repudiation characteristics, the authentication results are permanently stored on the chain, making it easier for network administrators to view the working status of the authentication entity, and further configure computing and storage resources for the authentication entity, indirectly authenticate the entity's permissions, etc. For example, when a malicious terminal device accesses the network, if the authentication entity passes the authentication of the malicious terminal device, when the malicious terminal device launches an attack on the network, and the network locates the malicious user device, the authentication entity can be located by querying the authentication result, and security software updates and upgrades can be performed on the authentication entity.

[0353] Optionally, the authentication entity sends the authentication result, or the identifier of the transaction or block in which the authentication result is located, to a core network element (for example, a direct authentication entity) in the network to which the first terminal device accesses.

[0354] Exemplarily, the authentication result may be carried in a response message, and the response message is described in reference to S530.

[0355] Optionally, the authentication entity sends the authentication result to the first terminal device.

[0356] Exemplarily, when the authentication result indicates that the authentication of the first terminal device has failed, the authentication entity sends the authentication result to the first terminal device. Optionally, the authentication entity indicates the reason for the authentication failure to the first terminal device.

[0357] For example, reasons for authentication failure may include the following:

[0358] (1) Based on the identifier of the first terminal device, the encrypted identifier of the first terminal device, the identifier of block #1, or the identifier of transaction #1, no valid identifier of the first terminal device is found on the blockchain or in the dSPR.

[0359] (2) The first information is not correctly parsed and the authentication method cannot be obtained.

[0360] (3) The authentication process according to the authentication method indicated by the first information fails. Optionally, the reasons for the failure may include failure to obtain the correct address of smart contract #2, failure to call smart contract #2, failure to receive parameters returned by the first terminal device, etc.

[0361] (4) The result of authentication performed according to the authentication method indicated by the first information is that the first terminal device is an illegal user.

[0362] After receiving the authentication result indicating authentication failure, the first terminal device may perform corresponding processing based on the cause of the authentication failure.

[0363] For example, for the reasons listed above for authentication failure, the first terminal device performs the following processing respectively:

[0364] (1) Resending the identity of the first terminal device, the encrypted identity of the first terminal device, the identity of block #1, or the identity of transaction #1, or the first terminal device feedbacks to the contracted operator online or offline, so that the contracted operator re-uploads the identity information of the first terminal device to the blockchain or saves it to the dSPR.

[0365] (2) Resending the identifier of the first terminal device, the encrypted identifier of the first terminal device, the identifier of block #1, or the identifier of transaction #1, or the first terminal device provides feedback to the contracted operator online or offline, so that the contracted operator re-uploads the first information corresponding to the identifier of the first terminal device to the blockchain or saves it to the dSPR.

[0366] (3) Resending the identification of the first terminal device, the encrypted identification of the first terminal device, the identification of block #1, or the identification of transaction #1, or the first terminal device provides feedback to the contracted operator online or offline, so that the contracted operator can re-upload the authentication method corresponding to the first terminal device to the blockchain or save it to the dSPR.

[0367] (4) Re-initiating a request to access the network after the first time period, or indicating in the request message to access the network that authentication should be performed by a direct authentication entity.

[0368] Based on the above solution, by indicating the reason for authentication failure to the terminal device, the terminal device can re-initiate authentication based on the reason, thereby improving the success rate of terminal device authentication.

[0369] Figure 6 shows a schematic flow chart of a method for encrypting the identification of a terminal device provided by this application. The method shown in Figure 6 also provides a method for an authentication entity to decrypt the identification of a terminal device. Specifically, Figure 6 (a) shows a method for encrypting the identification of a terminal device based on an asymmetric key; Figures 6 (b) and 6 (c) show two methods for encrypting the identification of a terminal device based on a symmetric key.

[0370] As shown in FIG5(a), the method includes the following steps.

[0371] S601a, UE#1 (an example of the first terminal device) generates a temporary public-private key pair (including private key #3 and public key #3).

[0372] For example, UE#1 may generate a random number (denoted as random number #1) as the private key #3, and generate the public key #3 based on an elliptic curve algorithm.

[0373] S602a, UE#1 generates (or derives) a symmetric key #1 based on the private key #3 and the public key #2, and encrypts the identifier of UE#1 based on the symmetric key #1.

[0374] The public key #2 may be the public key of the authentication entity.

[0375] Optionally, before S602a, the authentication entity broadcasts its public key (public key #2) to the UE served by the authentication entity. Accordingly, UE #1 receives the public key #2 from the authentication entity.

[0376] Optionally, before S602 a, the method further includes:

[0377] S603a, UE#1 verifies the validity of the public key #2.

[0378] For example, UE#1 may verify the public key #2 based on an operator-endorsed certificate and / or a blockchain-endorsed certificate.

[0379] For example, assuming that UE#1 is contracted by operator A and the authentication entity belongs to operator B, UE#1 verifies public key #2 as follows:

[0380] If operator A is the same as operator B, UE#1 can use operator A's public key obtained during contract signing to verify operator A's signature on public key #2.

[0381] If operator A is different from operator B, UE#1 may verify the storage node's signature on public key #2 based on the storage node's root certificate (a certificate endorsed by the storage node).

[0382] For example, if the storage node is a blockchain node, UE#1 can verify the blockchain's signature on public key #2 based on a pre-set blockchain root certificate (a blockchain-endorsed certificate). It is understood that when UE#1's identity information and the first information corresponding to that identity information are uploaded to the blockchain for storage, the blockchain-endorsed certificate will be pre-set in UE#1, and the authentication entity will also obtain the blockchain-endorsed certificate when it is uploaded to the blockchain.

[0383] In this example, the authentication entity may include two certificates: one endorsed by the operator and one endorsed by the blockchain. The authentication entity may send both certificates to a terminal device (e.g., UE#1). If the terminal device verifies one of the certificates, it can be considered to have successfully authenticated the authentication entity's public key.

[0384] S604a, UE#1 sends the encrypted UE#1 identity (denoted as ciphertext #1) and public key #3 to the authentication entity. Correspondingly, the authentication entity receives the encrypted UE#1 identity and public key #3 from UE#1.

[0385] Exemplarily, the ciphertext #1 and the public key #3 may be carried in the request message #1. The request message #1 is described with reference to S510.

[0386] Optionally, the request message #1 also carries indication information indicating the type of the transmitted parameter. The transmitted parameter type is any of the following: a ciphertext identifier, a plaintext identifier, or an index of a query identifier (such as a block or transaction identifier). For example, the indication information may indicate that the transmitted parameter is a ciphertext identifier.

[0387] By sending indication information indicating the type of transmission parameters to the authentication entity, the authentication entity can obtain the authentication information of UE#1 according to different types of parameters. For example, if the indication information indicates that the type of transmission parameter is an encrypted identifier of UE#1, the authentication entity first decrypts the identifier of UE#1, and then obtains the authentication information of UE#1 according to the identifier of UE#1; if the indication information indicates that the type of transmission parameter is a plaintext identifier, the authentication entity directly obtains the authentication information of UE#1 according to the identifier of UE#1; if the indication information indicates that the type of transmission parameter is an index of a query identifier, the authentication entity directly obtains the authentication information of UE#1 based on the index of the query identifier.

[0388] S605a: The authentication entity generates a symmetric key k based on the public key #3 and the authentication entity's private key (denoted as private key #2), and decrypts the ciphertext #1 based on the symmetric key k to obtain the identity of UE #1.

[0389] Figure 6(b) shows a method for encrypting the terminal device's identity using a symmetric key. In this method, the authentication entity can obtain the identity of UE#1 through a smart contract. As shown in Figure 6(b), this method includes the following steps.

[0390] Before UE#1 encrypts the identifier of UE#1, UE#1 obtains information #1 when signing a contract with operator A. The information #1 may include multiple pre-shared keys (PSKs), and each of the multiple PSKs may correspond to a PSK identifier.

[0391] Exemplarily, information #1 may be stored in an operator node of operator A (e.g., a direct authentication entity, or other nodes such as a UDM or UDR); or, if blockchain technology is employed, the information #1 may also be stored by operator A on the blockchain.

[0392] S601b, the operator node of operator A uploads smart contract #1 to the blockchain node.

[0393] The smart contract #1 includes an algorithm for decrypting any of the multiple psks to obtain the identifier of UE #1. The smart contract #1 may be referred to as a decryption smart contract or other name, which is not limited in this application.

[0394] Optionally, the operator node of operator A sends the address of smart contract #1 to other nodes in the blockchain.

[0395] Among them, other nodes in the blockchain include the authentication entity, that is, the authentication entity can receive the address of smart contract #1 sent from the core network element of operator A.

[0396] S602b, UE#1 (an example of the first terminal device) uses psk#1 to encrypt the identification of UE#1.

[0397] For example, the psk#1 is any one of a plurality of preset keys.

[0398] S603b, UE#1 sends the UE#1 identity encrypted by psk#1 (denoted as ciphertext #2) and the identity of psk#1 to the authentication entity. Correspondingly, the authentication entity receives the ciphertext #2 and the identity of psk#1 from UE#1.

[0399] Exemplarily, the ciphertext #2 and the identifier of psk #1 may be carried in the request message #1. The request message #1 is described with reference to S510.

[0400] Optionally, the request message #1 also carries indication information indicating the type of the transmission parameter. For example, the indication information indicates that the transmission parameter is a ciphertext identifier.

[0401] Optionally, the request message #1 also carries the address of the smart contract #1. For example, UE #1 can obtain the address of the smart contract #1 when signing the contract.

[0402] S604b: The authentication entity obtains the identity of UE#1 based on the identity of psk#1 and smart contract #1.

[0403] For example, the authentication entity queries smart contract #1 according to the address of smart contract #1, and inputs the received ciphertext #2 and the identifier of psk #1 into smart contract #1 to obtain the decrypted identifier of UE #1.

[0404] Optionally, the authentication entity can also obtain the transaction ID or block ID of the UE#1 identifier stored on the blockchain based on the psk#1 identifier and the smart contract #1, or obtain the address of the first information corresponding to the UE#1 identifier, or obtain the parameters indicating the authentication method in the first information corresponding to the UE#1 identifier.

[0405] Figure 6(c) illustrates a method for encrypting the terminal device's identity using a symmetric key. In this method, the authentication entity can obtain the identity of UE#1 through the operator node of the contracted operator. As shown in Figure 6(c), the method includes the following steps.

[0406] Before UE#1 encrypts the identifier of UE#1, UE#1 obtains information #1 when signing a contract with operator A. The information #1 may include multiple pre-shared keys (PSKs). Optionally, each of the multiple PSKs may correspond to a PSK identifier.

[0407] Exemplarily, information #1 may be stored in an operator node of operator A (e.g., a direct authentication entity, or other nodes such as a UDM or UDR); or, if blockchain technology is employed, the information #1 may also be stored by operator A on the blockchain.

[0408] S601c, UE#1 (an example of the first terminal device) uses psk#1 to encrypt the identification of UE#1.

[0409] For example, the psk#1 is one of multiple preset keys.

[0410] S602c: UE#1 sends the UE#1 identifier encrypted with psk#1 (denoted as ciphertext #3), the psk#1 identifier, and the indication information indicating operator A to the authentication entity. In response, the authentication entity receives ciphertext #3, the psk#1 identifier, and the indication information from UE#1.

[0411] Exemplarily, the ciphertext #3, the identifier of psk #1 and the indication information may be carried in the request message #1. The request message #1 is described with reference to S510.

[0412] Optionally, the request message #1 also carries indication information indicating the type of the transmission parameter, and the type of the transmission parameter can refer to the description in S604a. For example, the indication information indicates that the transmission parameter is a ciphertext identifier.

[0413] By sending indication information indicating the type of transmission parameters to the authentication entity, the authentication entity can obtain the authentication information of UE#1 based on different types of parameters. For example, if the indication information indicates that the type of transmission parameters is the encrypted identifier of UE#1, the authentication entity first decrypts the identifier of UE#1, and then obtains the authentication information of UE#1 based on the identifier of UE#1.

[0414] S603c: The authentication entity obtains the identity of UE#1 from the operator node of operator A based on the identity of psk#1.

[0415] When the operator to which the authentication entity belongs (denoted as operator B) is the same as operator A, the authentication entity can send the ciphertext #3 and the identifier of psk#1 to the operator node of operator A, so that the operator node obtains the psk#1 based on the identifier of psk#1 and information #1, and decrypts the ciphertext #3 based on the psk#1 to obtain the identifier of UE#1; the authentication entity receives the identifier of UE#1 from the operator node.

[0416] In the case where operator B is different from operator A, if the two operators belong to the same blockchain, the authentication entity selects the operator node of operator A from the blockchain, and sends the ciphertext #3 and the identifier of psk#1 to the operator node of operator A, so that the operator node obtains the psk#1 based on the identifier of psk#1 and information #1, and decrypts the ciphertext #3 based on the psk#1 to obtain the identifier of UE#1.

[0417] If the two operators do not belong to the same blockchain, but the authentication entity has saved the address of the operator node of operator A (for example, a connection was established between the authentication entity and the operator node of operator A before this step, and the address of the operator node of operator A was saved), then the authentication entity sends the ciphertext #3 and the identifier of psk#1 to the operator node according to the address of the operator node, so that the operator node obtains the psk#1 according to the identifier of psk#1 and information #1, and decrypts the ciphertext #3 according to the psk#1 to obtain the identifier of UE#1.

[0418] If the authentication entity does not store the address of the operator node of operator A, it may return an indication of network access failure to UE#1.

[0419] The communication method provided in the embodiment of the present application is described in detail above in conjunction with Figures 5 and 6. It should be understood that the order of the sequence numbers of the above-mentioned processes does not necessarily indicate the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0420] It should also be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0421] It should also be understood that in some of the above embodiments, exemplary descriptions are mainly given using devices in existing network architectures (such as core network devices, access network devices, and terminal devices). It should be understood that the embodiments of this application do not limit the specific form of the devices. For example, devices that can achieve the same functions in the future are applicable to the embodiments of this application.

[0422] It can be understood that in the above-mentioned method embodiments, the methods and operations implemented by devices (such as the above-mentioned core network devices, access network devices and terminal devices, etc.) can also be implemented by components of the devices (such as chips or circuits).

[0423] The above communication method is mainly introduced from the perspective of interaction between various network elements. It is understandable that, in order to implement the above functions, each network element includes a hardware structure and / or software module that performs the corresponding function.

[0424] The communication device provided in the embodiment of the present application is described in detail below with reference to Figures 7 to 9. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for matters not described in detail, reference can be made to the method embodiment above. For the sake of brevity, they will not be repeated here.

[0425] FIG7 shows a schematic diagram of a communication device 700 provided in an embodiment of the present application.

[0426] The device 700 includes an interface unit 710, which can be used to implement corresponding communication functions. The interface unit 710 can also be called a communication interface, a communication unit, or a transceiver unit.

[0427] Optionally, the apparatus 700 may further include a processing unit 720 , which may be configured to perform data processing.

[0428] Optionally, the device 700 also includes a storage unit, which can be used to store instructions and / or data. The processing unit 720 can read the instructions and / or data in the storage unit so that the device can implement the actions of different devices in the aforementioned method embodiments.

[0429] In one possible design, the device 700 can be the authentication entity in the aforementioned embodiment, or a component of the authentication entity (e.g., a chip). The device 700 can implement the steps or processes performed by the authentication entity in the above method embodiment. Specifically, the interface unit 710 can be used to perform the operations related to sending and receiving of the authentication entity in the above method embodiment; and the processing unit 720 can be used to perform the operations related to processing of the authentication entity in the above method embodiment.

[0430] In another possible design, the apparatus 700 may be the first terminal device in the aforementioned embodiment, or may be a component (e.g., a chip) of the first terminal device. The apparatus 700 may implement the steps or processes corresponding to those performed by the first terminal device in the above method embodiment. The interface unit 710 may be configured to perform the operations related to transmission and reception of the first terminal device in the above method embodiment; and the processing unit 720 may be configured to perform the operations related to processing of the first terminal device in the above method embodiment.

[0431] FIG8 is a schematic block diagram of a communication device 800 provided in an embodiment of the present application.

[0432] The apparatus 800 includes a processor 810 coupled to a memory 820. Optionally, the apparatus 800 further includes the memory 820. The memory 820 is configured to store computer programs or instructions and / or data. The processor 810 is configured to execute the computer programs or instructions stored in the memory 820, or read data stored in the memory 820, to perform the methods in the above method embodiments.

[0433] Optionally, there are one or more processors 810 .

[0434] Optionally, there are one or more memories 820 .

[0435] Optionally, the memory 820 is integrated with the processor 810 or provided separately.

[0436] Optionally, as shown in Figure 8, the apparatus 800 further includes a communication interface 830, which is used to receive and / or send signals. For example, the processor 810 is used to control the communication interface 830 to receive and / or send signals.

[0437] For example, the communication interface 830 may be a transceiver, a circuit, a bus, a module, or other types of communication interfaces. The communication interface 830 may also be referred to as an interface.

[0438] As a solution, the apparatus 800 is used to implement the operations performed by the authentication entity in the above various method embodiments.

[0439] For example, the processor 810 is configured to execute computer programs or instructions stored in the memory 820 to implement operations related to the authentication entity in the above various method embodiments.

[0440] As another solution, the apparatus 800 is used to implement the operations performed by the first terminal device in each of the above method embodiments.

[0441] For example, the processor 810 is used to execute the computer program or instructions stored in the memory 820 to implement the relevant operations of the first terminal device in each of the above method embodiments.

[0442] During implementation, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 810 or by instructions in the form of software. The method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 820, and the processor 810 reads the information in the memory 820 and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0443] It should be understood that in the embodiments of the present application, the processor may be one or more integrated circuits for executing relevant programs to execute the method embodiments of the present application.

[0444] A processor (e.g., processor 810) may include one or more processors and be implemented as a combination of computing devices. The processor may include one or more of the following: a microprocessor, a microcontroller, a digital signal processor (DSP), a digital signal processing device (DSPD), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a programmable logic device (PLD), gating logic, transistor logic, discrete hardware circuits, processing circuits, or other suitable hardware, firmware, and / or a combination of hardware and software to perform the various functions described in this disclosure. The processor may be a general-purpose processor or a special-purpose processor. For example, processor 810 may be a baseband processor or a central processing unit. A baseband processor may be used to process communication protocols and communication data. A central processing unit may be used to enable the device to execute software programs and process data in the software programs. In addition, a portion of the processor may also include non-volatile random access memory. For example, the processor may also store information about the device type.

[0445] In this application, the term "program" is used broadly to refer to software. Non-limiting examples of software include program code, program, subroutine, instruction, instruction set, code, code segment, software module, application, or software application. The program can be executed in a processor and / or computer to cause the device to perform the various functions and / or processes described in this application.

[0446] The memory (e.g., memory 820) can store data required by the processor (e.g., processor 810) when executing software. The memory can be implemented using any suitable storage technology. For example, the memory can be any available storage medium that can be accessed by the processor and / or computer. Non-limiting examples of storage media include random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM), removable media, optical disk storage, magnetic disk storage media, magnetic storage devices, flash memory, registers, state memory, remotely mounted storage, local or remote memory components, or any other medium capable of carrying or storing software, data, or information and accessible by a processor / computer. It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0447] The memory (e.g., memory 820) and the processor (e.g., processor 810) may be provided separately or integrated together. Optionally, when the memory and the processor are integrated together, the memory may be a cache. The memory may be used to connect to the processor so that the processor can read information from the memory and store and / or write information in the memory. The memory may be integrated into the processor. The memory and the processor may be provided in an integrated circuit (e.g., the integrated circuit may be provided in a UE or other network node).

[0448] 9 is a schematic block diagram of a chip system 900 provided in an embodiment of the present application. The chip system 900 (or also referred to as a processing system) includes a logic circuit 910 and an input / output interface 920.

[0449] Among them, the logic circuit 910 can be a processing circuit in the chip system 900, used to implement the methods and functions of each embodiment of the present application. Optionally, the logic circuit 910 can be coupled to a storage unit and call instructions in the storage unit so that the chip system 900 can implement the methods and functions of each embodiment of the present application. The input / output interface 920 can be an input and output circuit in the chip system 900, outputting information processed by the chip system 900, or inputting data or signaling information to be processed into the chip system 900 for processing.

[0450] As a solution, the chip system 900 is used to implement the operations performed by the authentication entity in the above various method embodiments.

[0451] For example, the logic circuit 910 is used to implement the processing-related operations performed by the authentication entity in the above method embodiment; the input / output interface 920 is used to implement the sending and / or receiving-related operations performed by the authentication entity in the above method embodiment.

[0452] As another solution, the chip system 900 is used to implement the operations performed by the first terminal device in the above method embodiments.

[0453] For example, the logic circuit 910 is used to implement the processing-related operations performed by the first terminal device in the above method embodiment; the input / output interface 920 is used to implement the sending and / or receiving-related operations performed by the first terminal device in the above method embodiment.

[0454] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the methods executed by a communication device (such as an authentication entity, a first terminal device) in the above-mentioned method embodiments are stored.

[0455] An embodiment of the present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by a communication device (such as an authentication entity, a first terminal device) in the above-mentioned method embodiments.

[0456] An embodiment of the present application further provides a communication system, which includes at least one of the authentication entity and the first terminal device in the above embodiments.

[0457] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0458] In the above-mentioned embodiments, unless otherwise specified or provided for, the terms and / or descriptions of the different embodiments are consistent and can be referenced to each other. The technical features of the different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0459] In the embodiments of this application, words such as "exemplarily" and "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as an "exemplary" in this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of the word "exemplary" is intended to present concepts in a concrete manner.

[0460] It should be understood that references to "embodiments" throughout this specification mean that a particular feature, structure, or characteristic associated with the embodiment is included in at least one embodiment of the present application. Therefore, various embodiments throughout this specification do not necessarily refer to the same embodiment. Furthermore, these particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0461] It should be understood that in the various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The names of all nodes and messages in this application are merely names set by this application for the convenience of description. The names in the actual network may be different. It should not be understood that this application limits the names of various nodes and messages. On the contrary, any name with the same or similar function as the node or message used in this application is regarded as the method or equivalent replacement of this application, and is within the scope of protection of this application.

[0462] It should also be understood that in this application, "when", "if" and "if" all mean that the network element will make corresponding processing under certain objective circumstances, which is not a time limit, and does not require the network element to make judgment actions when implementing it, nor does it mean that there are other limitations.

[0463] It should be noted that in the embodiments of the present application, "pre-setting", "pre-configuration", etc. can be achieved by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in a device (for example, a terminal device). This application does not limit its specific implementation method, such as the preset rules, preset constants, etc. in the embodiments of the present application.

[0464] Additionally, the terms "system" and "network" are often used interchangeably herein.

[0465] As used herein, the term "at least one of" or "at least one of" refers to all or any combination of the listed items. For example, "at least one of A, B, and C" can mean: A alone, B alone, C alone, A and B together, B and C together, and A, B, and C together. As used herein, "at least one" means one or more. "A plurality" means two or more.

[0466] It should be understood that in each embodiment of the present application, "B corresponding to A" means that B is associated with A and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B based solely on A, but B can also be determined based on A and / or other information.

[0467] In addition, "of", "corresponding", "relevant", "corresponding" and "associated" are sometimes used interchangeably. It should be noted that when the distinction is not emphasized, the meanings they intend to express are consistent. The terms "include", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0468] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0469] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0470] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0471] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0472] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0473] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0474] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A communication method, characterized in that, Applied to an authentication entity, the method includes: Receiving a request message from a first terminal device, the request message being used to request access to the network, the request message carrying first indication information indicating the identity information of the first terminal device, the first information corresponding to the identity information being stored in a storage system, and the first information including information required for authenticating the first terminal device; Obtaining the first information based on the first indication information; Authenticating the first terminal device based on the first information.

2. The method according to claim 1, wherein Before authenticating the first terminal device based on the first information, the method further includes: Determining to authenticate the first terminal device.

3. The method according to claim 2, wherein The determining to authenticate the first terminal device includes: Determining to authenticate the first terminal device according to second information, the second information including at least one of the following: Second indication information, the second indication information indicating to authenticate the terminal devices served by the authentication entity, and the second indication information coming from an operator node of at least one operator to which the authentication entity belongs; Third indication information, the third indication information indicating that the authentication entity authenticates the first terminal device, and the third indication information coming from the first terminal device; Fourth indication information, the fourth indication information being included in the first information, and the fourth indication information indicating that the authentication entity authenticates the first terminal device; or, Capability information of the authentication entity, the capability information indicating whether the authentication entity supports authenticating the terminal devices served by the authentication entity.

4. The method according to claim 2 or 3, characterized in that, Before determining to authenticate the first terminal device, the method further includes: Sending the capability information of the authentication entity to the terminal devices served by the authentication entity, the capability information indicating whether the authentication entity supports authenticating the terminal devices served by the authentication entity.

5. The method according to any one of claims 1 to 4, characterized in that Before authenticating the terminal device based on the first information, the method further includes: Determining a first operator that provides network services for the first terminal device, the first operator being one of at least one operator to which the authentication entity belongs.

6. The method according to claim 5, wherein The determining a first operator that provides network services for the first terminal device includes: Determining the first operator according to third information, the third information including at least one of the following: An identifier of the network to which the first terminal device requests access, the load of the networks of the at least one operator, or fifth indication information; Wherein, the fifth indication information indicates that the terminal devices served by the authentication entity are allowed to access the network of the first operator, and the fifth indication information comes from an operator node belonging to any one of the at least one operator.

7. The method according to claim 5 or 6, characterized in that, Before determining a first operator that provides network services for the first terminal device, the method further includes: Sending sixth indication information to the terminal devices served by the authentication entity, the sixth indication information indicating at least one operator to which the authentication entity belongs.

8. The method according to any one of claims 1 to 7, characterized in that, The first information includes a first public key of the first terminal device, and authenticating the first terminal device based on the first information includes: Authenticate the first terminal device based on the first public key and the private key of the authentication entity.

9. The method according to any one of claims 1 to 7, characterized in that, The first information includes the address of the smart contract, and the smart contract is used to generate authentication parameters based on the root key of the first terminal device. Authenticating the first terminal device based on the first information includes: Obtain the authentication parameters according to the address of the smart contract; Authenticate the first terminal device based on the authentication parameters.

10. The method according to claim 8 or 9, characterized in that The method further includes: Save the authentication result obtained by authenticating the first terminal device in the storage system.

11. The method according to any one of claims 1 to 10, characterized in that The first indication information includes any one of the following: The identification information of the first terminal device, the encrypted identification information of the first terminal device, the first parameter; Wherein, the first parameter is used to identify the storage node in the storage system for saving the first information.

12. The method according to any one of claims 1 to 11, characterized in that, The method further includes: Send a second public key to the terminal device served by the authentication entity, where the second public key is the public key of the authentication entity, and the second public key is used for the first terminal device to verify the authentication entity.

13. The method according to any one of claims 1 to 12, characterized in that, The authentication entity is any one of the following: An access network device that provides services for the first terminal device, a centralized unit of the access network device that provides services for the first terminal device, an edge computing node, a core network element belonging to a second operator, and the second operator does not include the operator with which the terminal device subscribes.

14. A communication method, characterized in that, Applied to the first terminal device, the method includes: Send a request message to the authentication entity, where the request message is used to request access to the network, and the request message carries first indication information indicating the identity information of the first terminal device. The first information corresponding to the identity information is saved in the storage system, and the first information includes the information required to authenticate the first terminal device; Receive a response message from the authentication entity, where the response message indicates whether the authentication of the first terminal device by the authentication entity is successful.

15. The method according to claim 14, wherein The method further includes: Send third indication information to the authentication entity, where the third indication information indicates that the authentication entity authenticates the first terminal device.

16. The method according to claim 15, wherein Before sending the third indication information to the authentication entity, the method further includes: Receive the capability information of the authentication entity, where the capability information indicates whether the authentication entity supports authenticating the terminal devices served by the authentication entity; Sending the third indication information to the authentication entity includes: In the case that the capability information indicates that the authentication entity supports authenticating the terminal devices served by the authentication entity, send the third indication information to the authentication entity.

17. The method according to any one of claims 14 to 16, characterized in that, The method further includes: Send the identification of the network to which the first terminal device requests access to the authentication entity, and the identification of the network to which the first terminal device requests access is used to determine a first operator, and the first operator is used to provide network services for the first terminal device.

18. The method according to claim 17, wherein Before sending the identification of the network to which the first terminal device requests access to the authentication entity, the method further includes: Receive sixth indication information from the authentication entity, where the sixth indication information indicates at least one operator to which the authentication entity belongs; Determine an identifier of a network to which the first terminal device requests access according to the sixth indication information, where the network to which the first terminal device requests access belongs to one of the at least one operator.

19. The method according to any one of claims 14 to 18, characterized in that, The first indication information includes any one of the following: Identifier information of the first terminal device, encrypted identifier information of the first terminal device, a first parameter; Wherein, the first parameter is used to identify a storage node in the storage system for storing the first information.

20. The method according to any one of claims 14 to 19, characterized in that, The method further includes: Receive a second public key from the authentication entity, where the second public key is a public key of the authentication entity; Authenticate the authentication entity according to the second public key.

21. The method according to claim 20, wherein The authenticating the authentication entity according to the second public key includes: If an operator subscribed by the first terminal device is the same as an operator to which the authentication entity belongs, verify a signature of the operator on the second public key based on a public key of the operator; If an operator subscribed by the first terminal device is different from an operator to which the authentication entity belongs, verify a signature of a storage node on the second public key based on a public key of the storage node, where the storage node is a node in the storage system that stores the first information.

22. The method according to any one of claims 14 to 21, characterized in that The authentication entity is any one of the following: An access network device providing services for the first terminal device, a centralized unit of the access network device providing services for the first terminal device, an edge computing node, a core network element belonging to a second operator, where the second operator does not include the operator subscribed by the terminal device.

23. A communication device, characterized in that, The apparatus includes a transceiver unit and a processing unit, The transceiver unit is configured to receive a request message from a first terminal device, where the request message is used to request access to a network, and the request message carries first indication information indicating identity information of the first terminal device, where first information corresponding to the identity information is stored in a storage system, and the first information includes information required for authenticating the first terminal device; The processing unit is configured to obtain the first information based on the first indication information; The processing unit is further configured to authenticate the first terminal device based on the first information.

24. The device according to claim 23, characterized in that, The processing unit is further configured to: Determine to authenticate the first terminal device.

25. The device according to claim 24, characterized in that, Specifically, the processing unit is configured to: Determine to authenticate the first terminal device according to second information, where the second information includes at least one of the following: Second indication information, where the second indication information indicates to authenticate a terminal device served by the apparatus, and the second indication information comes from an operator node of at least one operator to which the apparatus belongs; Third indication information, where the third indication information indicates that the apparatus authenticates the first terminal device, and the third indication information comes from the first terminal device; Fourth indication information, where the fourth indication information is included in the first information, and the fourth indication information indicates that the apparatus authenticates the first terminal device; or, Capability information of the device, where the capability information indicates whether the device supports authenticating the terminal devices served by the device.

26. The device according to claim 24 or 25, characterized in that, The transceiver unit is further configured to: Send the capability information of the device to the terminal devices served by the device, where the capability information indicates whether the device supports authenticating the terminal devices served by the device.

27. The device according to any one of claims 23 to 26, characterized in that, The processing unit is further configured to: Determine a first operator that provides network services for the first terminal device, where the first operator is one of at least one operator to which the device belongs.

28. The device according to claim 27, wherein, Specifically, the processing unit is configured to: Determine the first operator according to third information, where the third information includes at least one of the following: An identifier of the network to which the first terminal device requests access, the load of the networks of the at least one operator, or fifth indication information; Wherein, the fifth indication information indicates that the terminal devices served by the device are allowed to access the network of the first operator, and the fifth indication information comes from an operator node belonging to any one of the at least one operator.

29. The device according to claim 27 or 28, characterized in that, The transceiver unit is further configured to: Send sixth indication information to the terminal devices served by the device, where the sixth indication information indicates at least one operator to which the device belongs.

30. The device according to any one of claims 23 to 29, characterized in that, The first information includes the first public key of the first terminal device, and specifically, the processing unit is configured to: Authenticate the first terminal device based on the first public key and the private key of the device.

31. The device according to any one of claims 23 to 29, characterized in that, The first information includes the address of a smart contract, where the smart contract is used to generate authentication parameters based on the root key of the first terminal device, and specifically, the processing unit is configured to: Obtain the authentication parameters according to the address of the smart contract; Authenticate the first terminal device based on the authentication parameters.

32. The device according to claim 30 or 31, characterized in that, The processing unit is further configured to: Save the authentication result obtained by authenticating the first terminal device in a storage system.

33. The device according to any one of claims 23 to 32, characterized in that, The first indication information includes any one of the following: The identification information of the first terminal device, the encrypted identification information of the first terminal device, a first parameter; Wherein, the first parameter is used to identify the storage node in the storage system for saving the first information.

34. The device according to any one of claims 23 to 33, characterized in that The transceiver unit is further configured to: Send a second public key to the terminal devices served by the device, where the second public key is the public key of the device, and the second public key is used for the first terminal device to verify the device.

35. The device according to any one of claims 23 to 34, characterized in that The device is any one of the following: An access network device that provides services for the first terminal device, a centralized unit of an access network device that provides services for the first terminal device, an edge computing node, a core network element belonging to a second operator, where the second operator does not include the operator with which the terminal device is subscribed.

36. A communication device, characterized in that, The device includes a transceiver unit, and the transceiver unit is configured to: Send a request message to an authentication entity, where the request message is used to request access to the network, and the request message carries first indication information indicating the identity information of the device, and the first information corresponding to the identity information is saved in a storage system, and the first information includes information required for authenticating the device. Receive a response message from the authentication entity, where the response message indicates whether the authentication of the device by the authentication entity is successful.

37. The device according to claim 36, characterized in that, The transceiver unit is further configured to: Send third indication information to the authentication entity, where the third indication information indicates that the authentication entity authenticates the device.

38. The device according to claim 37, wherein The transceiver unit is further configured to: Receive the capability information of the authentication entity from the authentication entity, where the capability information indicates whether the authentication entity supports authenticating the terminal devices served by the authentication entity; Specifically, the transceiver unit is configured to: Send the third indication information to the authentication entity when the capability information indicates that the authentication entity supports authenticating the terminal devices served by the authentication entity.

39. The device according to any one of claims 36 to 38, characterized in that The transceiver unit is further configured to: Send the identifier of the network to which the device requests access to the authentication entity, where the identifier of the network to which the device requests access is used to determine a first operator, and the first operator is used to provide network services for the device.

40. The device according to claim 39, wherein The device further includes a processing unit, and the transceiver unit is further configured to: Receive sixth indication information from the authentication entity, where the sixth indication information indicates at least one operator to which the authentication entity belongs; The processing unit is configured to determine the identifier of the network to which the device requests access according to the sixth indication information, and the network to which the device requests access belongs to one of the at least one operator.

41. The device according to any one of claims 36 to 40, characterized in that, The first indication information includes any one of the following: The identifier information of the device, the encrypted identifier information of the device, a first parameter; Wherein, the first parameter is used to identify the storage node in the storage system for storing the first information.

42. The device according to any one of claims 36 to 41, characterized in that The transceiver unit is further configured to receive a second public key from the authentication entity, where the second public key is the public key of the authentication entity; The processing unit is further configured to authenticate the authentication entity according to the second public key.

43. The device according to claim 42, characterized in that, Specifically, the processing unit is configured to: If the operator subscribed by the device is the same as the operator to which the authentication entity belongs, verify the signature of the operator on the second public key based on the public key of the operator; If the operator subscribed by the device is different from the operator to which the authentication entity belongs, verify the signature of the storage node on the second public key based on the public key of the storage node, where the storage node is the node in the storage system for storing the first information.

44. The device according to any one of claims 36 to 43, characterized in that, The authentication entity is any one of the following: An access network device providing services for the device, a centralized unit of an access network device providing services for the device, an edge computing node, a core network element belonging to a second operator, and the second operator does not include the operator subscribed by the terminal device.

45. A communication device, characterized in that, The device is used to execute the method according to any one of claims 1 to 22.

46. A communication device, characterized in that, Including: A processor, where the processor is configured to cause the device to execute the method according to any one of claims 1 to 22 by executing a computer program stored in a memory and / or by a logic circuit.

47. The device according to claim 46, characterized in that, The device further includes the memory.

48. A communication device, characterized in that, Including: A processor and a communication interface; Wherein, the communication interface is configured to receive code instructions and transmit them to the processor, and the processor is configured to cause the device to execute the method according to any one of claims 1 to 22 by executing a computer program stored in the memory and / or by means of a logic circuit.

49. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a computer program or instructions, which, when running on a computer, cause the computer to execute the method according to any one of claims 1 to 22.

50. A computer program product, characterized in that, The computer program product includes a computer program or instructions, which, when running on a computer, cause the computer to execute the method according to any one of claims 1 to 22.

51. A communication system, characterized in that, Comprising an authentication entity and a first terminal device, the authentication entity is configured to execute the method according to any one of claims 1 to 13, and the first terminal device is configured to execute the method according to any one of claims 14 to 22.

Images