Communication method and device

Abstract

The present application relates to a communication method and a device. The method comprises: receiving a first message from a first core network device, wherein the first message carries a first instruction used for instructing a first AIoT device to adjust a radio frequency state, the first message further carries a first verification parameter generated on the basis of a first key and used for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

Description

Communication method and device TECHNICAL FIELD

[0001] The present application relates to the field of communication, and more particularly, to a communication method and device. BACKGROUND

[0002] In related research, an Ambient Power-enabled IoT (AIoT) device can access a communication system or a communication network for data interaction. With the development of technology, there is a demand for performing management operations on the radio frequency (or radio frequency capability) of the AIoT device, such as permanently disabling, temporarily disabling, enabling, and the like, the radio frequency capability of the AIoT device. However, how to implement the management operation on the radio frequency capability of the AIoT device by a device of the communication system, such as a core network side, and ensure the security of the management operation, becomes a problem to be solved.

[0003] SUMMARY

[0004] Embodiments of the present application provide a communication method and device.

[0005] Embodiments of the present application provide a communication method performed by a first AIoT device, comprising:

[0006] receiving a first message from a first core network device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

[0007] Embodiments of the present application provide a communication method performed by a first core network device, comprising:

[0008] sending a first message to a first AIoT device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

[0009] Embodiments of the present application provide a first AIoT device, comprising:

[0010] The first communication unit is configured to receive a first message from a first core network device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, wherein the first key is shared by the first AIoT device and the first core network device.

[0011] The first core network device is provided in an embodiment of the present application, comprising:

[0012] The second communication unit is configured to send a first message to a first environment Internet of Things (AIoT) device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, wherein the first key is shared by the first AIoT device and the first core network device.

[0013] By using the above scheme, the first AIoT device side determines whether to execute the first instruction for instructing it to adjust a radio frequency state carried by the first message sent by the first core network device through a first verification parameter carried by the first message, and the first verification parameter is generated based on a first key shared by the first AIoT device and the first core network device. In this way, the management operation of the first AIoT device by the core network side can be realized, and since the first key is shared by the first AIoT device and the first core network device, the security and reliability of the management operation of the first AIoT device by the core network side can be ensured on the basis of avoiding sending security information such as a key or a password for verification over the air interface. BRIEF DESCRIPTION OF DRAWINGS

[0014] FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present application.

[0015] FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present application.

[0016] FIG. 3 is a schematic flowchart of a communication method according to another embodiment of the present application.

[0017] FIG. 4 is an exemplary flowchart of a communication method according to still another embodiment of the present application.

[0018] FIG. 5 is a schematic flowchart of permanently disabling a radio frequency capability according to an embodiment of the present application.

[0019] FIG. 6 is a schematic flowchart of using a radio frequency capability according to an embodiment of the present application.

[0020] FIG. 7 is a schematic block diagram of a first AIoT device according to an embodiment of the present application.

[0021] FIG. 8 is a schematic block diagram of a first core network device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example, LTE, LTE-A, NR, evolution of NR, WLAN, WiFi, or other communication systems, etc.

[0023] The embodiments of the present application describe various embodiments in combination with network devices and terminals. The terminals can be mobile or fixed, and can also be referred to as mobile stations, user units, etc. The terminals can be stations in WLAN, and can be smart terminals, wireless modems, notebook computers, tablet computers, etc. In the embodiments of the present application, the terminals can be VR terminals / AR terminals, industrial control terminals, unmanned terminals, remote medical terminals, smart grid terminals, transportation safety terminals, smart city terminals, or wireless terminals of smart homes, etc. As an example but not limitation, in the embodiments of the present application, the terminals can also be wearable devices.

[0024] In the embodiments of the present application, the network devices can be devices for communicating with the terminals. The network devices can be access points in WLAN, can be evolved base stations in LTE, or relay stations, or network devices in vehicle-mounted devices, wearable devices, and NR networks, or network devices in future evolved PLMN networks, or network devices in non-ground networks, etc. As an example but not limitation, in the embodiments of the present application, the network devices can have mobile characteristics, for example, the network devices can be mobile devices.

[0025] In order to facilitate the understanding of the technical solutions of the embodiments of the present application, the related technologies of the embodiments of the present application are described below. The following related technologies can be combined with the technical solutions of the embodiments of the present application as optional solutions, and all belong to the protection scope of the embodiments of the present application.

[0026] FIG. 1 illustrates a communication system 100. The communication system includes a network device 110 and a terminal 120. In a possible implementation, the communication system 100 can include a plurality of network devices 110, and each network device 110 can include a number of terminals 120 within its coverage, which is not limited in the embodiments of the present application. In a possible implementation, the communication system 100 can further include a mobility management entity, an access and mobility management function, and other network entities, which are not limited in the embodiments of the present application. The network device can include an access network device and a first core network device. That is, the communication system can include a plurality of core networks for communicating with the access network device. The access network device can be a base station of an LTE, LTE-A, or NR system. For example, the communication system shown in FIG. 1 can include network devices and terminals with communication functions, and can further include other devices in the communication system, such as a network controller, a mobility management entity, and other network entities, which are not limited in the embodiments of the present application.

[0027] FIG. 2 is a schematic flowchart of a communication method performed by a first AIoT device according to an embodiment of the present application. The method includes at least part of the following content.

[0028] S210, receiving a first message from a first core network device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

[0029] FIG. 3 is a schematic flowchart of a communication method performed by a first core network device according to an embodiment of the present application. The method includes at least part of the following content.

[0030] S310, sending a first message to a first AIoT device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

[0031] The first core network device can be any kind of core network device on the core network side, and the first core network device can transmit messages with the first AIoT device, or the first core network device and the first AIoT device can transmit messages through an intermediate node.

[0032] The first core network device can be any one of network functions (NFs) in a 5GC (5G core network), or the first core network device can be any one of NFs on the core network side under a distributed NAS (Non-Access Stratum) architecture. For example, the first core network device can include at least one of the following: an AMF (Access and Mobility Management Function), an AUSF (Authentication Server Function), an AIoT NF, an AIoT MF (Management Function), and the like.

[0033] The first AIoT device can be any one of one or more AIoT devices within a coverage range of the first core network device or managed by the first core network device. In some possible scenarios, the first AIoT device can also be replaced by a UE or a general terminal.

[0034] The intermediate node can include a terminal or an access network device, and the intermediate node can also be alternatively referred to as one of a relay device, an intermediate device, a proxy device, and the like. In the case where the terminal is the intermediate node, the terminal can also be referred to as any one of a relay UE, an intermediate node UE, a proxy UE, and the like.

[0035] In some possible embodiments, before sending the first message, the first core network device can further perform the following processing: receiving a third message from an application function (AF), wherein the third message is used by the first core network device to determine that the first AIoT device performs one of the following operations: permanently disabling a radio frequency, using a radio frequency, temporarily disabling a radio frequency.

[0036] In some embodiments, the first core network device receiving the third message from the application function can be that the first core network device receives the third message from the application function forwarded by a second core network device. The processing of the second core network device can be that the second core network device receives the third message from the AF and sends the third message to the first core network device. The processing of the application function can be that the application function sends the third message to the first core network device through the second core network device.

[0037] The way in which the application function generates the third message or the trigger reason is not limited in this embodiment. For example, the second core network device can be a network exposure function (NEF) or the like.

[0038] The second core network device receives a third message from the application function, and processing of sending the third message to the first core network device can include: the second core network device receives the third message from the application function, checks whether the application function is authorized to request the AIoT command service, and forwards the third message to the first core network device in a case where it is determined that the application function is authorized to request the AIoT command service. The manner in which the second core network device checks whether the application function is authorized to request the AIoT command service can be configured according to actual conditions. For example, the second core network device can check, locally and / or in a UDM (Unified Data Management), whether authorization information that the application function is authorized to request the AIoT service is saved, and if the authorization information that the application function is authorized to request the AIoT service is saved locally and / or in the UDM, it can be determined that the application function is authorized to request the AIoT command service. It should be understood that this is only an example for illustrative purposes, and the present embodiment does not limit or exhaustively enumerate the manner in which the second core network device checks whether the application function is authorized to request the AIoT command service.

[0039] In some embodiments, the third message carries at least one of the following: an identifier of one or more AIoT devices, and location information, wherein the location information is used to determine the one or more AIoT devices, and the one or more AIoT devices include the first AIoT device.

[0040] Taking the first AIoT device as an example of any one of the one or more AIoT devices, the identifier of the first AIoT device can include a temporary identifier of the first AIoT device or a permanent identifier of the first AIoT device. For example, the identifier of the first AIoT device can be represented as AIoT ID or first AIoT ID, and the like.

[0041] The permanent identifier of the first AIoT device can also be referred to as a real identifier or a long-term identifier of the first AIoT device. The permanent identifier of the first AIoT device can be pre-stored in the first AIoT device, the AF, and the AF can also pre-provide the permanent identifier of the first AIoT device to the network side (at least including the first core network device); or the permanent identifier of the first AIoT device can be pre-stored in the first AIoT device, the AF, and the first core network device.

[0042] The composition of the permanent identifier of the first AIoT device can be configured or determined according to actual conditions. For example, the permanent identifier of the first AIoT device can be composed of at least one of the following five parts: a home domain network identifier, a network routing identifier, an ID for identifying a third party, an ID for identifying a specific first AIoT device, and an identifier of the first AIoT device defined by a third party. This is only an example, and the embodiment does not limit the specific composition of the permanent identifier.

[0043] The temporary identifier of the first AIoT device is different from the permanent identifier of the first AIoT device. The temporary identifier of the first AIoT device can be used by the third party server (such as AF) and the device on the core network side to uniquely identify the first AIoT device. The composition format or content of the temporary identifier of the first AIoT device is not limited by the embodiment.

[0044] The related description of the identifier of each AIoT device in the one or more AIoT devices is the same as that of the first AIoT device, and therefore will not be described again.

[0045] The location information can include one or more geographical area ranges and / or one or more network location information.

[0046] Any one geographical area range can include: the geographic coordinates of the center point of the geographical area range, the geographic coordinates of one or more boundary positions of the geographical area range, and the like. The geographic coordinates can be represented in GPS coordinates or other coordinate systems related to geographic positions. The embodiment does not limit or exhaustively enumerate the representation of geographic coordinates.

[0047] Any one network location information can include at least one of the following: tracking area (TA) related information and cell related information. The TA related information can include at least one of the following: a TAC (Tracking Area Code) corresponding to the TA and a TAI (TA Identity) corresponding to the TA. The cell related information can include a Cell ID or a PCI (Physical Cell Identifier).

[0048] The third message can carry one or more commands. Any one of the one or more commands can include one of the following: permanently disabling a radio frequency (RF), using a radio frequency, and temporarily disabling a radio frequency.

[0049] In an embodiment, the third message carries an identity of the AIoT device, i.e., the identity of the first AIoT device, and a command. The command can be a first command, which can include any one of permanently disabling the radio frequency, using the radio frequency, and temporarily disabling the radio frequency.

[0050] The first core network device can determine, based on the identity of the first AIoT device and the first command carried by the third message, that the application function expects or needs or instructs the first AIoT device to perform an operation that is one of permanently disabling the radio frequency, using the radio frequency, and temporarily disabling the radio frequency.

[0051] In an embodiment, the third message carries identities of a plurality of AIoT devices and a first command. The plurality of AIoT devices includes the first AIoT device and can be at least part of all AIoT devices in a group to which the first AIoT device belongs. The first command has the same description as the aforementioned embodiments and will not be repeated here.

[0052] The first core network device can determine, based on the identity of each AIoT device and the first command carried by the third message, that the application function expects or needs or instructs each AIoT device to perform an operation that is one of permanently disabling the radio frequency, using the radio frequency, and temporarily disabling the radio frequency. For example, the plurality of AIoT devices includes the first AIoT device and a second AIoT device, and the third message carries the identity of the first AIoT device, the identity of the second AIoT device, and a first command for permanently disabling the radio frequency capability. The first core network device can determine, based on the identity of the first AIoT device, the identity of the second AIoT device, and the first command for permanently disabling the radio frequency capability carried by the third message, that the application function expects or needs or instructs the first AIoT device and the second AIoT device to perform the operation of permanently disabling the radio frequency capability.

[0053] In an embodiment, the third message carries an identity of each AIoT device in a plurality of AIoT devices and a plurality of commands. Different commands in the plurality of commands are associated with different identities of the AIoT devices. The plurality of AIoT devices have the same description as the aforementioned embodiments and will not be repeated here. The commands corresponding to the identities of different AIoT devices in the plurality of AIoT devices can be the same or different. Each command in the plurality of commands can include any one of permanently disabling the radio frequency, using the radio frequency, and temporarily disabling the radio frequency.

[0054] The third message is used by the first core network device to determine operations performed by each of the plurality of AIoT devices, including one of permanently disabling a radio frequency, using a radio frequency, and temporarily disabling a radio frequency. For example, if the third information carries an identifier of a first AIoT device, an identifier of a second AIoT device, a first command in the plurality of commands is a command for permanently disabling a radio frequency capability, and a second command in the plurality of commands is a command for temporarily disabling a radio frequency capability, wherein the first command is associated with the identifier of the first AIoT device, and the second command is associated with the identifier of the second AIoT device; the first core network device can determine, based on the third message, that the application function expects or needs or instructs the first AIoT device to perform an operation of permanently disabling a radio frequency capability, and the second AIoT device to perform an operation of temporarily disabling a radio frequency capability.

[0055] In an embodiment, the third message can carry location information and the first command.

[0056] The location information is used by the first core network device to determine one or more AIoT devices, and the first command is used by the first core network device to determine operations performed by each of the one or more AIoT devices. The one or more AIoT devices can be at least one of all AIoT devices in a group to which the first AIoT device belongs.

[0057] The processing of the first core network device can further include determining one or more AIoT devices based on the location information, wherein any one of the one or more AIoT devices is the first AIoT device; and determining, based on the first command, that the application function expects or needs or instructs operations performed by each of the one or more AIoT devices to include one of permanently disabling a radio frequency, using a radio frequency, and temporarily disabling a radio frequency.

[0058] Optionally, determining the one or more AIoT devices based on the location information can include, in a case where the location information includes one or more geographical area ranges, selecting, from all optional AIoT devices, one or more AIoT devices located within each geographical area range based on a pre-stored geographical location of each of the optional AIoT devices within a self coverage range or all optional AIoT devices managed by the self.

[0059] Optionally, determining the one or more AIoT devices based on the location information can comprise: in a case where the location information comprises one or more geographical area ranges, determining network location information corresponding to each of the one or more geographical area ranges, and selecting one or more AIoT devices matching each of the network location information from all the optional AIoT devices based on pre-stored network addresses of each of the optional AIoT devices within a coverage range of the first core network device or managed by the first core network device. The network address can comprise at least one of a TAC, a TAI, a Cell ID, and a PCI.

[0060] Optionally, determining the one or more AIoT devices based on the location information can comprise: in a case where the location information comprises one or more network location information, selecting one or more AIoT devices matching each of the network location information from all the optional AIoT devices based on pre-stored network addresses of each of the optional AIoT devices within a coverage range of the first core network device or managed by the first core network device.

[0061] For example, if the third information carries a geographical area range and a first command of permanently disabling a radio frequency, the first core network device determines the first AIoT device and the second AIoT device based on the geographical area range, and determines that the application function expects or needs or instructs the first AIoT device and the second AIoT device to perform an operation of permanently disabling a radio frequency capability based on the first command.

[0062] In some possible implementation manners, after the first core network device determines the operation that the application function expects or needs or instructs the first AIoT device to perform based on the third message, the first core network device can send a first message to the first AIoT device.

[0063] In some embodiments, after the first core network device determines the operation that the application function expects or needs or instructs the first AIoT device to perform based on the third message, the first core network device generates a first instruction. In this embodiment, the first instruction can also be referred to as a first instruction corresponding to the first AIoT device.

[0064] Optionally, the first instruction is used to instruct one of the following: the first AIoT device to permanently disable a radio frequency, and the first AIoT device to use a radio frequency. Optionally, the first instruction is used to instruct the first AIoT device to temporarily disable a radio frequency.

[0065] The first core network device determines or generates the first instruction in one of the following manners: in a case where it is determined based on the third message that the first AIoT device performs the operation of permanently disabling the radio frequency, determining the first instruction as an instruction for instructing the first AIoT device to permanently disable the radio frequency; in a case where it is determined based on the third message that the first AIoT device performs the operation of temporarily disabling the radio frequency, determining the first instruction as an instruction for instructing the first AIoT device to temporarily disable the radio frequency; in a case where it is determined based on the third message that the first AIoT device performs the operation of using the radio frequency, determining the first instruction as an instruction for instructing the first AIoT device to use the radio frequency.

[0066] In some embodiments, the first core network device can generate the first verification parameter. In this embodiment, the first verification parameter can also be referred to as the first verification parameter corresponding to the first AIoT device (or the first instruction corresponding to the first AIoT device).

[0067] The first verification parameter is calculated based on the first key and at least one of the following: the identity of the first AIoT device, the length of the identity of the first AIoT device, the identity of the group to which the first AIoT device belongs, the length of the identity of the group to which the first AIoT device belongs, the first count value, the length of the first count value, the first random number, and the length of the first random number.

[0068] The first key is one of the following: a root key of the first AIoT device, a third key between the first AIoT device and the first core network device, a fourth key between the first AIoT device and the application function, a preconfigured parameter, and a group key of the group to which the first AIoT device belongs.

[0069] The root key of the first AIoT device can be pre-stored in the first AIoT device and the first core network device.

[0070] The fourth key between the first AIoT device and the application function can be represented as K AF The generation manner of the fourth key is not limited in this embodiment. For example, on the first AIoT device side, the fourth key can be pre-generated and / or pre-stored by the first AIoT device. On the application function side, the fourth key can be sent by other devices to the application function, or pre-generated and stored by the application function. On the first core network device side, the fourth key can be pre-sent or configured to the first core network device by the application function; for example, the application function can carry the fourth key in the third message; or the first core network device can request the fourth key from the application function, and the application function sends the fourth key to the first core network device; or the application function generates the fourth key and sends it to the first core network device.

[0071] The pre-configuration parameter can also be referred to as a pre-configuration parameter corresponding to the first AIoT device, which can be generated by the application function, and can be a password generated by the application function. The generation manner of the pre-configuration parameter is not limited in the embodiment. For example, on the side of the first AIoT device, the pre-configuration parameter can be sent to the first AIoT device by the application function and saved by the first AIoT device; on the side of the first core network device, the pre-configuration parameter can be pre-sent or pre-configured to the first core network device by the application function; for example, the application function can carry the pre-configuration parameter in the third message; or the first core network device can request the pre-configuration parameter from the application function, and the application function can send the pre-configuration parameter to the first core network device.

[0072] The group key of the group to which the first AIoT device belongs can be a group key pre-saved or pre-obtained by the plurality of AIoT devices in the group to which the first AIoT device belongs and the first core network device. The generation manner of the group key is not limited in the embodiment.

[0073] In an example, the third key can be a key shared by the first AIoT device and the first core network device.

[0074] Optionally, the third key can be a key generated in other processes and shared by the first AIoT device and the first core network device. The other processes can include an authentication process or an authentication procedure, and the like, and all possible processes are not limited or enumerated here. For example, assuming that the first core network device is an AUSF, the third key can include one of the following: K AUSF , CK (Ciphering Key, encryption key), IK (Integrity Key, integrity key).

[0075] It should be pointed out that when the first AIoT device and the first core network device complete the processing of other processes, the third key is owned by the first AIoT device and the first core network device, and it does not mean that the third key is necessarily derived by the first core network device on the side of the core network. For example, the third key shared by the first AIoT device and the AMF can include K AMF , CK (Ciphering Key, encryption key), IK (Integrity Key, integrity key). AMF which can be derived by other core network devices (such as SEAF) and sent to the AMF, and the K AMF on the side of the first AIoT device can be derived by the first AIoT device.

[0076] Optionally, the third key can be derived or derived based on a higher-level key shared by the first AIoT device and the first core network device. For example, the first core network device is an AMF, and the higher-level key shared by the first AIoT device and the AMF can include K AMF , the first AIoT device and the AMF can derive the third key based on K AMF , which can be K NAS (for example, K NASenc or K NASint ).

[0077] In an example, the third key is calculated based on the fourth key and a shared parameter between the first AIoT device and the first core network device.

[0078] The shared parameter between the first AIoT device and the first core network device can be configured according to actual conditions. For example, the shared parameter between the first AIoT device and the first core network device can at least include a higher-level key shared by the first AIoT device and the first core network device. For example, the first core network device is an AMF, and the shared parameter between the first AIoT device and the first core network device can at least include a higher-level key K AMF shared by the first AIoT device and the AMF. That is, the third key can be generated based on K AF and K AMF . It should be understood that this is only an example for illustration, and in actual processing, the third key can also be generated based on the fourth key and other more parameters, as long as the parameters for generating the third key are shared by the first AIoT device and the first core network device, which is within the protection scope of the present embodiment, and is not limited or exhausted here.

[0079] The first counter value can be generated by the first core network device based on a counter maintained by itself.

[0080] The first random number can be generated by the first core network device, and the first core network device can generate the first random number in a manner based on a pseudo-random number generator or in other manners, which are not exhausted or limited here.

[0081] It should be understood that the above is only an exemplary description of the input parameters or contents that can be used to calculate the first verification parameter, and more other input parameters or contents can be used to calculate the first verification parameter in actual processing. In some possible examples, the contents or input parameters used to calculate the first verification parameter can include a fixed value in addition to at least one of the first key, the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, the first count value, the length of the first count value, the first random number, and the length of the first random number. The fixed value can be pre-stored on the first core network device and the first AIoT device side and assigned by a third party, for example, the fixed value can be represented as FC, and the value can be 0x7E. Here, all possible representations and values of the fixed value are not limited or enumerated.

[0082] The first calculation manner used to calculate the first verification parameter can be configured according to actual conditions, for example, the first calculation manner can be at least one of the following: a first authentication function (such as an f1 function defined in 3GPP), a second authentication function (such as an f2 function defined in 3GPP), a third key generation function (such as an f3 function defined in 3GPP), a fourth key generation function (such as an f4 function defined in 3GPP), a fifth key generation function (such as an f5 function defined in 3GPP), a hash algorithm, an advanced encryption standard (AES), ACSON, SNOW 3G (Snow Third Generation), ZUC (ZU Chongzhi), XOR calculation, direct connection calculation, KDF (Key Derivation Function). The hash algorithm can be represented as HASH(), which can include HMAC-SHA-256 (Hash based Message Authentication Code-Secure Hash Algorithm-256), or other lightweight hash algorithms (such as any one of SPECK, SIMON algorithm, etc.), which are not enumerated in the present embodiment. It should be understood that this is only an exemplary description, and the first calculation manner can include more possibilities in actual processing, and all possible calculation functions (or algorithms) of the first calculation manner are not enumerated here.

[0083] For example, the first core network device generating or calculating the first verification parameter can be: adopting a first calculation manner, calculating the first verification parameter based on the first key, the identifier of the first AIoT device, and at least one of the following: the length of the identifier of the first AIoT device, the first count value, the length of the first count value, the first random number, the length of the first random number, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, and a fixed value.

[0084] For example, the first verification parameter can be calculated by the following formula: f(K, AIoT1 ID, Counter T1), where f can be any one of the algorithms or functions in the first calculation manner, K represents the first key, AIoT1 ID represents the identifier of the first AIoT device, and Counter T1 represents the first count value.

[0085] The above is only an example of calculating the first verification parameter. In actual processing, as long as the first key is used and various possible parameters and their combinations involved in the above embodiments are used as input parameters, it is within the protection scope of the present embodiment, and is not limited or exhausted here.

[0086] In some embodiments, the first message further carries at least one of the following: the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number.

[0087] After the first AIoT device receives the first message, the method further includes: calculating a first check parameter based on the first key and at least one of the following: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, the first count value, the length of the first count value, the first random number, and the length of the first random number; and verifying whether to execute the first instruction based on the first verification parameter and the first check parameter. Wherein the related description of the first key is the same as the foregoing embodiments, and the specific calculation process of the first check parameter should be the same as the calculation of the first verification parameter in the foregoing embodiments, and is not repeated here.

[0088] Verifying whether to execute the first instruction based on the first verification parameter and the first check parameter can include one of the following: in the case that the first verification parameter and the first check parameter are the same, determining to execute the first instruction (or determining that the verification result is to execute the first instruction); and in the case that the first verification parameter and the first check parameter are different, determining not to execute the first instruction (or determining that the verification result is not to execute the first instruction).

[0089] Additionally, the first AIoT device can further perform the following processing: the first AIoT device verifies whether the identity of the first AIoT device carried in the first message matches the identity of the first AIoT device itself, and if so, calculates the first check parameter; and / or the first AIoT device verifies whether the group identity of the group in which the first AIoT device is located carried in the first message matches the identity of the group in which the first AIoT device is located, and if so, calculates the first check parameter.

[0090] Optionally, after the first AIoT device determines not to execute the first instruction, the first AIoT device can end the processing or can feed back a message to the first core network device indicating that the verification of the first check parameter fails. This embodiment does not limit or exhaust all possible processing after the first AIoT device determines not to execute the first instruction.

[0091] Optionally, after the first AIoT device determines to execute the first instruction, the first AIoT device can include: the first AIoT device executes the first instruction.

[0092] In the case where the first instruction is used to instruct the first AIoT device to permanently disable the radio frequency, the first AIoT device executing the first instruction can include: the first AIoT device performs the operation of permanently disabling the radio frequency based on the first instruction. The first AIoT device performing the operation of permanently disabling the radio frequency based on the first instruction can be: the first AIoT device adjusts the current radio frequency state to a state of permanently disabling the radio frequency capability based on the first instruction, and the current radio frequency state can be a state of using the radio frequency capability or a state of temporarily disabling the radio frequency capability.

[0093] If the first AIoT device performs the operation of permanently disabling the radio frequency, the first AIoT device cannot be enabled by an operation or an instruction to wake up. Optionally, if the first AIoT device performs the operation of permanently disabling the radio frequency capability as instructed by the first instruction, the first AIoT device cannot send and receive messages, and the first AIoT device cannot be enabled by an operation or an instruction to wake up.

[0094] The first AIoT device performing the operation of permanently disabling the radio frequency can also be referred to as the first AIoT device performing the operation of permanently disabling the RF capability, or the first AIoT device adjusting the radio frequency state to a permanently disabled state. The operation of permanently disabling the radio frequency can also be represented as the Permanently disable operation.

[0095] In the case that the first instruction is used to instruct the first AIoT device to temporarily disable the radio frequency, the first AIoT device performing the first instruction can refer to the first AIoT device performing the operation of temporarily disabling the radio frequency based on the first instruction. Wherein, the first AIoT device performing the operation of temporarily disabling the radio frequency based on the first instruction can be that the first AIoT device adjusts the state of using the radio frequency capability to the state of temporarily disabling the radio frequency based on the first instruction.

[0096] If the first AIoT device performs the operation of temporarily disabling the radio frequency, the first AIoT device can be woken up by an enable operation or instruction. Alternatively, if the first AIoT device temporarily disables the radio frequency capability, the first AIoT device can receive a message, cannot send a message, and the first AIoT device can be woken up by an enable operation or instruction.

[0097] The operation of the first AIoT device performing the temporarily disabling the radio frequency can also be referred to as the operation of the first AIoT device performing the temporarily disabling the radio frequency capability, or the operation of the first AIoT device adjusting the radio frequency state to the temporarily disabling state. The operation of temporarily disabling the radio frequency can also be represented as the Temporarily disable operation.

[0098] In the case that the first instruction is used to instruct the first AIoT device to use the radio frequency, the first AIoT device performing the first instruction can include that the first AIoT device performs the operation of waking up from temporarily disabling the radio frequency to using the radio frequency capability based on the first instruction. The operation of using the radio frequency can also be alternatively referred to as the operation of enabling the radio frequency capability, or the operation of using the radio frequency capability, or the operation of enabling the radio frequency, or the enable operation.

[0099] Optionally, the first AIoT device determines that the first instruction is executed, and the first AIoT device can include one of the following: in a case where the first instruction is used to instruct the first AIoT device to permanently disable the radio frequency, the first AIoT device sends a response message of the first message to the first core network device before permanently disabling the radio frequency capability, and the response message of the first message is used to indicate that the first AIoT device determines to perform the operation of permanently disabling the radio frequency capability; in a case where the first instruction is used to instruct the first AIoT device to temporarily disable the radio frequency, the first AIoT device sends a response message of the first message to the first core network device before temporarily disabling the radio frequency capability, and the response message of the first message is used to indicate that the first AIoT device determines to perform the operation of temporarily disabling the radio frequency capability; in a case where the first instruction is used to instruct the first AIoT device to use the radio frequency, the first AIoT device sends a response message of the first message to the first core network device after being woken up from the state of temporarily disabling the radio frequency capability to the state of using the radio frequency capability, and the response message of the first message is used to indicate that the first AIoT device completes the operation of being woken up from the state of temporarily disabling the radio frequency capability to the state of using the radio frequency capability.

[0100] The first AIoT device sends a response message of the first message to the first core network device before permanently disabling the radio frequency capability can refer to that the first AIoT device sends the response message of the first message to the first core network device before being adjusted from the current radio frequency state to the state of permanently disabling the radio frequency capability. The current radio frequency state can be the state of using the radio frequency capability or the state of temporarily disabling the radio frequency capability.

[0101] The first AIoT device sends a response message of the first message to the first core network device before temporarily disabling the radio frequency capability can refer to that the first AIoT device sends the response message of the first message to the first core network device before being adjusted from the state of using the radio frequency capability to the state of temporarily disabling the radio frequency.

[0102] The first AIoT device sends a response message of the first message to the first core network device can be that the first AIoT device sends the response message of the first message to the first core network device through an intermediate node. After receiving the response message of the first message, the first core network device can further include: sending the response message of the first message from the first AIoT device to the application function through the second core network device (or directly to the application function).

[0103] In some embodiments, the first message can further carry a first message authentication code for verifying the first message. The first message authentication code is calculated based on the perfect security key between the first AIoT device and the first core network device and at least one of the first instruction, the first verification parameter, the identity of the first AIoT device, the identity of the group to which the first AIoT device belongs, a first count value, and a first random number.

[0104] The first message authentication code (Message Authentication Code, MAC, corresponding to the first AIoT device) can be denoted as MAC1 or first MAC.

[0105] At least one of the first instruction, the first verification parameter, the identity of the first AIoT device, the identity of the group to which the first AIoT device belongs, a first count value, and a first random number can be content carried by the first message or the first message itself. It should be pointed out that the content carried by the first message can also include but is not limited to the above content, and the present embodiment does not limit or exhaustively enumerate the content carried by the first message.

[0106] The first core network device can calculate the first message authentication code using an integrity protection algorithm, which can be pre-configured or pre-negotiated by the first AIoT device and the first core network device. For example, the integrity protection algorithm can be any one of ZUC, Snow3G, 128-bit aes, etc. Here, all possible integrity protection algorithms are not limited or exhausted, as long as the same integrity protection algorithm is used on the first AIoT device and the first core network device side, it is within the protection scope of the present embodiment.

[0107] The input parameters used to calculate the first message authentication code include the perfect security key, the content carried by the first message, and the length of the first message. The content carried by the first message can be denoted as MESSAGE or MESSAGE-1 or first MESSAGE. The length of the first message can be denoted as LENGTH or LENGTH-1. The perfect security key is pre-derived or derived by the first AIoT device and the first core network device, and the specific derivation manner is not limited in the present embodiment, and the length thereof can be 128 bits. For example, the perfect security key between the first AIoT device and the AMF can be 128-bit K NASint .

[0108] Further, the input parameters used for calculating the first message authentication code can further include at least one of the following: a first integrity protection count value, a first bearer identifier, first transmission direction indication information, and the like. The first integrity protection count value can be denoted as COUNT, and the length thereof can be 32 bits. The first integrity protection count value can be incremented by one each time integrity protection / checking is performed. The first bearer identifier can be denoted as BEARER ID, and the length thereof can be 5 bits. The first transmission direction indication information can be denoted as DIRECTION, and the length thereof can be 1 bit. When the first transmission direction indication information takes a first value (such as 0), it indicates uplink, and when the first transmission direction indication information takes a second value (such as 1), it indicates downlink. In this example, the first transmission direction indication information takes the second value. The first value and the second value are different within the protection scope of this embodiment, and are not limited or exhausted.

[0109] For example, the first core network device can calculate the first message authentication code (first MAC) using an integrity protection algorithm and the following input parameters: 128-bit K NASint , 32-bit COUNT, 5-bit BEARER ID, 1-bit DIRECTION, the MESSAGE itself, and the length LENGTH of the MESSAGE.

[0110] After the first AIoT device receives the first message, the method further includes: calculating, by the first AIoT device, a first message check code based on the first AIoT device and the first core network device, and at least one of the following: the first instruction, the first verification parameter, the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number; and verifying, by the first AIoT device, the first message based on the first message check code and the first message authentication code.

[0111] The first message check code can be denoted as XMAC1, or first XMAC, or first MAC'. The first AIoT device calculates the first message check code in the same manner as the first core network device calculates the first message authentication code, and no repeated description is provided.

[0112] The verifying the first message based on the first message check code and the first message authentication code can include one of the following: determining that the first message is verified to pass or succeed in a case where the first message check code and the first message authentication code are the same; and determining that the first message fails to be verified in a case where the first message check code and the first message authentication code are different. Here, the first message being verified to pass or succeed can refer to at least one of the following: the first message passing an integrity check, the first core network device being authenticated, and the identity of the first core network device being authenticated. The first message failing to be verified can refer to at least one of the following: the first message failing an integrity check, the first core network device failing to be authenticated, and the identity of the first core network device failing to be authenticated.

[0113] In this embodiment, the first AIoT device verifying the first message can be performed before verifying the first verification parameter, that is, the first AIoT device calculates the first check parameter in a case where it is determined that the first message is verified to pass or succeed.

[0114] In addition, the method can further include: determining not to execute the first instruction in a case where it is determined that the first message fails to be verified or the first verification parameter and the first check parameter are different.

[0115] The related processing after the first AIoT device determines to execute the first instruction or determines not to execute the first instruction is the same as in the foregoing embodiments, and will not be repeated.

[0116] In some embodiments, the first core network device can also encrypt the first message corresponding to the first AIoT device. That is, the first message can carry first ciphertext data (or first ciphertext data corresponding to the first AIoT device) and a first message authentication code.

[0117] Optionally, the first core network device can calculate the first message authentication code based on the first plaintext data, and then encrypt the first plaintext data to obtain the first ciphertext data. The first plaintext data (or first plaintext data corresponding to the first AIoT device) includes at least one of the following: the first instruction, the first verification parameter, the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, a first count value, and a first random number.

[0118] The first message authentication code is calculated based on a first secret key between the first AIoT device and the first core network device and the first plaintext data. Since the first plaintext data includes the same content as the content carried by the first message in the foregoing embodiments, the specific manner of calculating the first message authentication code in this example is the same as in the foregoing embodiments, and will not be repeated.

[0119] The first ciphertext data can be calculated based on the confidentiality key between the first AIoT device and the first core network device and the first plaintext data.

[0120] The confidentiality key is pre-derived or derived by the first AIoT device and the first core network device, and a specific derivation manner is not limited in the embodiment. For example, the first core device is an AMF, and the confidentiality key between the first AIoT device and the AMF can be a 128-bit K NASenc .

[0121] The first ciphertext data can be calculated based on the confidentiality key between the first AIoT device and the first core network device and the first plaintext data.

[0122] The input parameters used for calculating the first ciphertext data include the confidentiality key and the first plaintext data, and can further include at least one of the following: the length of the first plaintext data, a confidentiality count value, a bearer identifier, transmission direction indication information, the length (LENGTH) required by a key stream (KEYSTREAM), and the like. The confidentiality count value can be calculated based on a NAS COUNT and a second specified value, and the second specified value can be configured according to actual conditions, for example, it can be 0x00, and the NAS COUNT is a 24-bit uplink or downlink COUNT value associated with the current NAS connection.

[0123] After the first AIoT device receives the first message, the following operations can be included: decrypting the first ciphertext data to obtain the first plaintext data based on the confidentiality key between the first AIoT device and the first core network device; calculating a first message check code based on the confidentiality key between the first AIoT device and the first core network device and the first plaintext data; verifying the first message based on the first message check code and the first message authentication code; in a case where it is determined that the first message is verified or successful, calculating a first verification parameter; verifying whether to execute the first instruction based on the first verification parameter and the first check parameter; and in a case where the first verification parameter and the first check parameter are the same, determining to execute the first instruction.

[0124] The confidentiality key, the first plaintext data, and the first ciphertext data are the same as those in the preceding embodiments. The decryption algorithm used by the first AIoT device to decrypt the first ciphertext data should correspond to the encryption algorithm used by the first core network device to encrypt the first plaintext data. Both the decryption algorithm and the encryption algorithm can be preconfigured or pre-agreed, and thus are not repeated here. The first AIoT device calculates the first message authentication code in the same way as the first core network device, and thus is not repeated here. The first AIoT device calculates the first check parameter in the same way as in the preceding embodiments, and thus is not repeated here.

[0125] Optionally, the first core network device can first encrypt the first plaintext data to obtain the first ciphertext data, and then calculate the first message authentication code based on the first ciphertext data.

[0126] The first plaintext data is the same as that in the preceding embodiments, and the way of calculating the first ciphertext data is also the same as that in the preceding embodiments, and thus is not repeated here.

[0127] The first message authentication code is calculated based on the perfect protection key between the first AIoT device and the first core network device and the first ciphertext data. Specifically, the input parameters used to calculate the first message authentication code include the perfect protection key, the first ciphertext data, the length of the first ciphertext data, the first perfect protection count value, the first bearer identifier, and the first transmission direction indication information. The difference from the preceding embodiments is that the first ciphertext data is carried in the first message or the first message itself in this case. The rest of the related processing for calculating the first message authentication code is the same as that in the preceding embodiments, and thus is not repeated here.

[0128] After the first AIoT device receives the first message, the following operations can be included: calculating a first message authentication code based on the perfect protection key between the first AIoT device and the first core network device and the first ciphertext data; verifying the first message based on the first message authentication code and the first message authentication code; in the case where the first message is verified to be passed or successful, decrypting the first ciphertext data based on the confidentiality key between the first AIoT device and the first core network device to obtain the first plaintext data; calculating a first check parameter; verifying whether to execute the first instruction based on the first verification parameter and the first check parameter; and in the case where the first verification parameter and the first check parameter are the same, determining to execute the first instruction.

[0129] The first AIoT device calculates the first message check code, which should be the same as the process of the first core network device calculating the first message authentication code, and thus is not described repeatedly. The related descriptions of the confidentiality key, the first plaintext data, and the first ciphertext data are the same as those in the foregoing embodiments, and are not described repeatedly. The specific processing manner of the first AIoT device calculating the first check parameter is the same as that in the foregoing embodiments, and thus is not described repeatedly.

[0130] In this embodiment, the related processing after the first AIoT device determines to execute the first instruction or determines not to execute the first instruction is also the same as that in the foregoing embodiments, and thus is not described repeatedly.

[0131] Whether the first core network device encrypts the first message can be configured according to actual conditions or can be determined according to some specified rules or specified manners. For example, the specified rules or specified manners can be that, in the case where the first instruction is used to instruct the first AIoT device to permanently disable the radio frequency, the first message can not be encrypted; in the case where the first instruction is used to instruct the first AIoT device to use the radio frequency or the first AIoT device temporarily disables the radio frequency, the first message can be encrypted or can not be encrypted. It should be understood that this is only an exemplary description, and whether the first core network device encrypts the first message can also be determined based on other rules or other manners, which is not limited or exhausted in this embodiment.

[0132] In some possible implementation manners, after the first core network device determines, based on the third message, that the application function expects or needs or instructs each AIoT device in the plurality of AIoT devices to perform an operation, the first core network device can send one or more first messages to the plurality of AIoT devices, wherein the plurality of AIoT devices includes the first AIoT device.

[0133] For example, the first core network device can generate one first instruction, that is, the plurality of AIoT devices correspond to the same first instruction; and the first core network device can calculate the same first verification parameter corresponding to each AIoT device by using the same parameter or content, that is, the first verification parameters corresponding to different AIoT devices are the same.

[0134] The plurality of AIoT devices are the plurality of AIoT devices in the group to which the first AIoT device belongs, and the group key of the group to which the first AIoT device belongs is used as the first key corresponding to each AIoT device; and the first verification parameter is calculated based on the group key of the group to which the first AIoT device belongs and at least one of the following: the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, the first count value, the length of the first count value, the first random number, the length of the first random number, and a fixed value.

[0135] In this example, the first core network device can generate a first message, the first message carrying the first instruction and the first verification parameter corresponding to the plurality of AIoT devices, and the first message can further carry at least one of the following: the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number.

[0136] Optionally, the first message can further carry the identifier of each of the plurality of AIoT devices, and correspondingly, the input parameter used to calculate the first verification parameter can further include the identifier of each of the plurality of AIoT devices.

[0137] For example, the first message can not carry the identifier of the group to which the first AIoT device belongs, and can carry the identifier of each of the plurality of AIoT devices. That is, the first message can carry the first instruction and the first verification parameter, and the first message can further carry at least one of the following: the identifier of each of the plurality of AIoT devices, the first count value, and the first random number. Correspondingly, the first verification parameter is calculated based on the group key of the group to which the first AIoT device belongs and at least one of the following: the identifier of each of the plurality of AIoT devices, the length of the identifier of each of the AIoT devices, the first count value, the length of the first count value, the first random number, the length of the first random number, and a fixed value.

[0138] For example, the first message can carry the identifier of the group to which the first AIoT device belongs and the identifier of each of the plurality of AIoT devices. That is, the first message can carry the first instruction and the first verification parameter, and the first message can further carry at least one of the following: the identifier of the group to which the first AIoT device belongs, the identifier of each of the plurality of AIoT devices, the first count value, and the first random number. Correspondingly, the first verification parameter is calculated based on the group key of the group to which the first AIoT device belongs and at least one of the following: the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, the identifier of each of the plurality of AIoT devices, the length of the identifier of each of the AIoT devices, the first count value, the length of the first count value, the first random number, the length of the first random number, and a fixed value.

[0139] Optionally, if the first message is to be integrity protected and / or encrypted, the group integrity key and / or the group confidentiality key corresponding to the group to which the first AIoT device belongs can be used to perform the integrity protection and / or encryption, which is not limited or exhaustive here.

[0140] Exemplarily, the first core network device can generate a plurality of first instructions, and different first instructions in the plurality of first instructions correspond to different AIoT devices. The first core network device can calculate a first verification parameter corresponding to each AIoT device by using a parameter or content corresponding to each AIoT device, that is, the first verification parameters corresponding to different AIoT devices can be different.

[0141] Taking the first AIoT device as an example, the first key corresponding to the first AIoT device is one of the following: a root key of the first AIoT device, a third key between the first AIoT device and the first core network device, a fourth key between the first AIoT device and the application function, and a preconfigured parameter corresponding to the first AIoT device. Here, the preconfigured parameters corresponding to different AIoT devices are different, and the preconfigured parameter corresponding to each AIoT device is configured by the application function, and the related description is the same as the foregoing embodiments, and will not be repeated. That is, in this example, the first key corresponding to the first AIoT device can refer to a key different from other AIoT devices in the group to which the first AIoT device belongs, such as a key in addition to the group key.

[0142] The first verification parameter corresponding to the first AIoT device is calculated based on the first key corresponding to the first AIoT device, the identifier of the first AIoT device, and at least one of the following: the length of the identifier of the first AIoT device, the first count value, the length of the first count value, the first random number, the length of the first random number, the group identifier of the group to which the first AIoT device belongs, the length of the group identifier of the group to which the first AIoT device belongs, and a fixed value. The generation or calculation process of the first verification parameter corresponding to each AIoT device is the same as the generation or calculation process of the first verification parameter corresponding to the first AIoT device, and the only difference is that different first keys and different parameters or contents are used when calculating the first verification parameters corresponding to different AIoT devices, and therefore will not be repeated.

[0143] In this example, the first core network device can generate a plurality of first messages, and different first messages correspond to different AIoT devices. Taking the first AIoT device as an example, the first message corresponding to the first AIoT device carries the first instruction corresponding to the first AIoT device and the first verification parameter corresponding to the first AIoT device, and the first message can further carry at least one of the following: the identifier of the first AIoT device, the first count value, and the first random number.

[0144] The processing that can be performed by each AIoT device in the plurality of AIoT devices after receiving the first message is the same as the processing performed by the first AIoT device after receiving the first message, and therefore will not be repeated.

[0145] With reference to FIG. 4, an exemplary description is provided for the communication method provided by the embodiment:

[0146] Step 400: It is assumed that the first AIoT device and the network (such as the core network) have completed registration and established a NAS-like security context. The NAS-like security context can be an existing NAS security context, or can be a security context of other newly defined protocol layers. That is, in the example, the NAS-like security (or NAS-like security) can refer to the NAS security involved in the related art, or can be a newly defined security of other protocol layers. The other protocol layers can include an AIoT layer, or an application layer between the AIoT device and the AF, and the like, and all possible other protocol layers are not limited or enumerated here.

[0147] Step 401: The AF sends an AIoT Command request (i.e., a third message) to the NEF, and the request message at least contains: AIoT ID (identification of one or more AIoT devices), location information, Command (such as at least one of temporarily disable, permanently disable, enable, and the like), and the like.

[0148] In some possible scenarios, the AMF may need to perform an Inventory operation to obtain the AIoT ID of the first AIoT device before sending the AIoT Command request message to the first AIoT device, and in this case, the AIoT ID in the AIoT Command request sent by the AF in step 401 can include a temporary ID of the first AIoT device.

[0149] Step 402: The NEF performs authorization check, that is, the NEF checks whether the AF is authorized to request the AIoT Command service.

[0150] Step 403: The NEF forwards the AIoT Command request message to the AMF. Here, the AMF can also be replaced by other core network devices such as AIoT NF, and the AMF or AIoT NF is the first core network device in the foregoing embodiment.

[0151] Step 404a: The AMF first calculates a first verification parameter using a function f. The input parameters for calculating the first verification parameter are at least one of the first key K, the first AIoT ID, the length of the first AIoT ID, the first counter Counter, the length of the first counter Counter, the first random number R, the length of the first random number R, and a fixed value assigned by a third party such as FC = 0x7E, for example, f(K, AIoT ID, Counter). The function f is any one or more of the first calculation methods in the foregoing embodiments; the first key is described in the foregoing embodiments and is not repeated here.

[0152] Step 404b: The AMF performs integrity protection on the AIoT Command request message (i.e., the first message), such as calculating MAC1 using CP-based NAS security (KNASint, NAS integrity algorithm).

[0153] The AMF can also encrypt (encryption protection) the AIoT Command request message. Whether the AMF encrypts the AIoT Command request message can be determined according to actual conditions. For example, for the AIoT Command request message carrying a first instruction to permanently disable the radio frequency capability, encryption protection is not required; for the AIoT Command request message carrying a first instruction to temporarily disable the radio frequency or enable the radio frequency, encryption protection is optional.

[0154] Step 405: The AMF forwards the AIoT Command request message (first message) to the first AIoT device through an intermediate node, and the message at least contains the first AIoT ID, the first verification parameter, and the first count value. The AIoT Command request message also includes a first instruction, and the related description of the first instruction is the same as in the foregoing embodiments and is not repeated here. The intermediate node can be a RAN (Radio Access Network) or an intermediate node UE.

[0155] Step 406: The first AIoT device calculates MAC1' and performs integrity verification on the AIoT Command request message. After verification, the first AIoT ID carried in the AIoT Command request message is verified. After verification, the first check parameter is calculated. If the first verification parameter and the first check parameter match successfully, the first AIoT device performs the operation indicated by the first instruction in the AIoT Command request message, such as any one of temporarily disabling, permanently disabling, enabling, and the like.

[0156] Steps 407-409 (optional): If the AF needs the first AIoT device to feed back a response message, the first AIoT device sends the response message (ACK) (i.e. the response message of the first message) to the AMF through the intermediate node before temporarily / permanently disabling the RF capability or after enabling the RF capability; the AMF forwards the response message (ACK) to the NEF; and the NEF forwards the response message (ACK) to the AF.

[0157] It should be noted that if the AIoT Command request indicated by the AF in step 401 includes the IDs of multiple AIoT devices, or if the AIoT Command request indicated by the AF in step 401 includes location information and the AMF can determine multiple AIoT devices based on the location information, in step 405, the AMF can send a corresponding AIoT Command request message to each of the multiple AIoT devices in addition to sending the AIoT Command request message to the first AIoT device. The manner of generating the AIoT Command request message corresponding to each AIoT device is the same as that of generating the AIoT Command request message corresponding to the first AIoT device, and thus is not described again. Further, the processing of each AIoT device after receiving the AIoT Command request message corresponding thereto is the same as the processing of the first AIoT device after receiving the AIoT Command request message corresponding thereto, and thus is not described again.

[0158] In some possible implementation manners, in a case where the first core network device determines, based on the third message, that the application function expects or needs or indicates the first AIoT device to perform any one of the operations of permanently disabling the radio frequency and using the radio frequency, the first core network device can first determine that the first instruction (the first instruction corresponding to the first AIoT device) is used to instruct the first AIoT device to temporarily disable the radio frequency.

[0159] In the present embodiment, the first core network device generates the first authentication parameter corresponding to the first AIoT device, generates and sends the first message corresponding to the first AIoT device, and the like, which are the same as in the above embodiments. The first AIoT device receives the first message, authenticates whether to execute the first instruction, and the like, which are the same as in the above embodiments. In addition, the processing of the first AIoT device after determining not to execute the first instruction is also the same as in the above embodiments, and thus is not described again.

[0160] In some embodiments, the first AIoT device determines to execute the first instruction, and the method further includes: sending, to the first core network device, a response message of the first message, where the response message of the first message carries one of: a first count value, a first random number. Correspondingly, the first core network device, after sending the first message, the method further includes: receiving the response message of the first message from the first AIoT device, where the response message of the first message carries one of: the first count value, the first random number.

[0161] In a case where the first message carries the first count value, the response message of the first message carries the first count value. In a case where the first message carries the first random number, the response message of the first message carries the first random number.

[0162] Specifically, sending the response message of the first message to the first core network device can include: before being adjusted from the state of using the radio frequency capability to temporarily disabling the radio frequency capability, sending the response message of the first message to the first core network device, where the response message of the first message is used to indicate that the first AIoT device determines to execute the operation of temporarily disabling the radio frequency capability. After sending the response message of the first message, the first AIoT device can execute the operation of being adjusted from the state of using the radio frequency capability to temporarily disabling the radio frequency capability. The transmission mode of the response message of the first message is the same as that of the foregoing embodiments, and will not be described herein.

[0163] After the first core network device receives the response message of the first message, the method further includes: sending a second message to the first AIoT device, where the second message carries a second instruction, and the second instruction is used to indicate one of: the first AIoT device permanently disables the radio frequency, and the first AIoT device uses the radio frequency. Correspondingly, after the first AIoT device sends the response message of the first message, the method further includes: receiving the second message from the first core network device. The second instruction can refer to the second instruction corresponding to the first AIoT device.

[0164] Optionally, in a case where the first core network device determines, based on the third message, that the application function expects or needs or indicates that the first AIoT device executes the operation of permanently disabling the radio frequency, the first core network device determines that the second instruction is used to indicate that the first AIoT device permanently disables the radio frequency.

[0165] Optionally, the first core network device can determine that the second instruction is used to instruct the first AIoT device to use the radio frequency in a case where it is determined based on the third message that the application function expects or needs or instructs the first AIoT device to perform an operation of using the radio frequency. The second instruction used to instruct the first AIoT device to use the radio frequency can refer to the second instruction used to instruct the first AIoT device to perform an operation of using the radio frequency.

[0166] In an embodiment, the second message further carries a second verification parameter generated based on a second key for verifying whether to execute the second instruction, wherein the second key is shared by the first AIoT device and the first core network device. The second message further carries at least one of the following: the second count value, the second random number.

[0167] After the first AIoT device receives the second message, the method further includes: calculating a second verification parameter based on the second key; and verifying whether to execute the second instruction based on the second verification parameter and the second verification parameter. In this embodiment, the second key is the same as the first key, and the first key has been described in detail in the foregoing embodiments, which will not be repeated here.

[0168] The second count value can be generated by the first core network device based on a counter maintained by the first core network device, and the second count value is different from the first count value. The second count value can be represented as COUNTER T2. In some examples, the second count value can be greater than the first count value.

[0169] The second random number can be generated by the first core network device, and the second random number is different from the first random number. The manner in which the first core network device generates the second random number is not exhaustively listed or limited.

[0170] On the side of the first core network device, the second verification parameter is calculated based on the second key and at least one of the following: the second count value, the length of the second count value, the second random number, and the length of the second random number. On the side of the first AIoT device, the second verification parameter is calculated based on the second key and at least one of the following: the second count value, the length of the second count value, the second random number, and the length of the second random number.

[0171] The second calculation manner used for calculating the second verification parameter and the second check parameter can be configured according to actual conditions, for example, the second calculation manner can be at least one of the following: the first authentication function, the second authentication function, the third key generation function, the fourth key generation function, the fifth key generation function, the hash algorithm, AES, ACSON, SNOW 3G, ZUC, XOR calculation, direct connection calculation, and KDF. The second calculation manner can be the same as or different from the first calculation manner in the foregoing embodiments, as long as the first AIoT device and the first core network device use the same second calculation manner, which is within the protection scope of the present embodiment.

[0172] For example, in addition to the second random number and / or the second count value, more parameters can be used for calculating the second verification parameter, for example, at least one of the following can be used: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, and a fixed value. Correspondingly, the second message can also carry at least one of the identifier of the first AIoT device and the identifier of the group to which the first AIoT device belongs. It should be pointed out that, because this part of content is the same as the first message, the second message can also not carry at least one of the identifier of the first AIoT device and the identifier of the group to which the first AIoT device belongs. The present embodiment does not limit whether the second message carries at least one of the identifier of the first AIoT device and the identifier of the group to which the first AIoT device belongs.

[0173] For example, the first core network device can generate or calculate the second verification parameter in the following manner: using the second calculation manner, calculating the second verification parameter based on the second key, the second count value, and at least one of the following: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the length of the second count value, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, and a fixed value. Correspondingly, on the first AIoT device side, the second check parameter is calculated based on the second key, and includes: using the second calculation manner, calculating the second check parameter based on the second key, the second count value, and at least one of the following: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the length of the second count value, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, and a fixed value.

[0174] It should be noted that the above is only an exemplary description of calculating the second verification parameter and the second check parameter. In actual processing, as long as the second key, the second count value and / or the second random number are used, and the same parameters or contents are used to calculate the second verification parameter and the second check parameter, it is within the protection scope of the present embodiment, and here the exhaustive enumeration is not performed.

[0175] On the first AIoT device side, based on the second verification parameter and the second check parameter, it is verified whether to execute the second instruction, including one of the following: in the case that the second verification parameter and the second check parameter are the same, and the second count value and the first count value are different, it is determined to execute the second instruction; in the case that the second verification parameter and the second check parameter are the same, and the second random number and the first random number are different, it is determined to execute the second instruction. In this way, the second count value or the second random number can be used as a freshness value, and the freshness of the second message is further ensured to avoid replay attacks.

[0176] Optionally, the second count value can be greater than the first count value, and in the case that the second verification parameter and the second check parameter are the same, and the second count value and the first count value are different, the first AIoT device determines to execute the second instruction, which can be: in the case that the second verification parameter and the second check parameter are the same, and the second count value is greater than the first count value, it is determined to execute the second instruction.

[0177] In addition, the following one can also be included: in the case that the second verification parameter and the second check parameter are different, it is determined not to execute the second instruction; in the case that the second verification parameter and the second check parameter are the same, and the second count value and the first count value are the same, it is determined not to execute the second instruction; in the case that the second verification parameter and the second check parameter are the same, and the second random number and the first random number are the same, it is determined not to execute the second instruction.

[0178] Optionally, the following can also be included: verifying whether an identity carried by the second message matches a self identity, and if so, calculating the second check parameter; and / or the first AIoT device verifies whether a group identity of a group in which the first AIoT device is located carried by the second message matches an identity of a group in which the first AIoT device is located, and if so, calculating the second check parameter.

[0179] Optionally, the processing after the first AIoT device determines not to execute the second instruction is similar to the processing after it is determined not to execute the first instruction, and no repeated description is made.

[0180] Optionally, after the first AIoT device determines to execute the second instruction, the first AIoT device can directly execute the second instruction.

[0181] Optionally, the first AIoT device determines that the execution of the second instruction can include one of the following: in the case where the second instruction is used to instruct the first AIoT device to permanently disable the radio frequency, the first AIoT device sends a response message of the second message to the first core network device before being adjusted from the temporarily disabled radio frequency capability to the permanently disabled radio frequency capability, wherein the response message of the second message is used to indicate that the first AIoT device determines to perform the operation of permanently disabling the radio frequency capability; in the case where the second instruction is used to instruct the first AIoT device to use the radio frequency, the first AIoT device sends a response message of the second message to the first core network device after being woken up from the temporarily disabled radio frequency capability state to the radio frequency using capability state, wherein the response message of the second message is used to indicate that the first AIoT device completes the operation of being woken up from the temporarily disabled radio frequency capability state to the radio frequency using capability state.

[0182] The related transmission process of the first AIoT device sending the response message of the second message to the first core network device and the first core network device receiving and sending the response message of the second message to the AF is similar to the transmission process of the response message of the first message in the foregoing embodiments, and is not described herein.

[0183] In some embodiments, the response message of the first message can also carry a second message authentication code, which can be calculated based on the perfect security key between the first AIoT device and the first core network device and the content carried by the response message of the first message. The content carried by the response message of the first message includes at least one of the following: the first count value, the first random number.

[0184] The second message authentication code can be represented as MAC2 or second MAC.

[0185] The calculation of the second message authentication code can also use an integrity protection algorithm that is pre-configured or pre-agreed by the first AIoT device and the first core network device. The input parameters used to calculate the second message authentication code include: the perfect security key, the content carried by the response message of the first message, the length of the response message of the first message, the second perfect security count value, the second bearer identifier, the second transmission direction indication information, and the like. The second perfect security count value can be represented as COUNT2, and its length can be 32 bits. The second perfect security count value can be incremented by one each time the integrity protection / verification is performed. The second bearer identifier can be represented as a bearer (BEARER) ID, and its length can be 5 bits. In the present example, the value of the second transmission direction indication information can be 0.

[0186] The first core network device, after receiving the response message of the first message, can comprise: calculating a second message check code based on the perfect secret key and the content carried by the response message of the first message; verifying the response message of the first message based on the second message check code and the second message authentication code. Here, the second message check code can be represented as XMAC2, or second XMAC, or second MAC'. The processing mode of the first core network device for calculating the second message check code should be the same as that of the first AIoT device for calculating the second message authentication code, and therefore no repeated description is made.

[0187] Verifying the response message of the first message based on the second message check code and the second message authentication code can comprise one of the following: in the case where the second message check code and the second message authentication code are the same, determining that the response message of the first message is verified to pass or succeed; in the case where the second message check code and the second message authentication code are different, determining that the response message of the first message is verified to fail. Here, the response message of the first message being verified to pass or succeed can refer to at least one of the following: the integrity check of the response message of the first message succeeds or passes, the authentication of the first AIoT device succeeds or passes, the identity authentication of the first AIoT device succeeds or passes; the response message of the first message being verified to fail can refer to at least one of the following: the integrity check of the response message of the first message fails, the authentication of the first AIoT device fails, the identity authentication of the first AIoT device fails.

[0188] The first core network device can be determined to verify the response message of the first message to pass or succeed, and send a second message to the first AIoT device.

[0189] In some embodiments, the second message can also carry a third message authentication code (a third message authentication code corresponding to the first AIoT device) for verifying the second message.

[0190] The third message authentication code is calculated based on the perfect secret key between the first AIoT device and the first core network device and the content carried by the second message, which can include a second instruction, a second verification parameter, and can also include at least one of the following: an identifier of the first AIoT device, an identifier of the group where the first AIoT device is located, a second count value, and a second random number.

[0191] The input parameters that can be used for calculating the third message authentication code can include at least one of the following in addition to the integrity key and the content carried by the second message: a length of the second message, a third integrity count value, a third bearer identifier, and third transmission direction indication information, wherein the third integrity count value is different from the first integrity count value, the third bearer identifier can be the same as the first bearer identifier, and the third transmission direction indication information can be the same as the first transmission direction indication information. The specific generation or calculation process of the third message authentication code is similar to the generation or calculation process of the first message authentication code in the foregoing embodiments, and will not be repeated.

[0192] The processing of the first AIoT device after receiving the second message can include: calculating a third message check code based on the integrity key and the content carried by the second message; and verifying the second message based on the third message check code and the third message authentication code. Here, the third message check code can be represented as XMAC3, or third XMAC, or third MAC'. The processing manner of the first AIoT device for calculating the third message check code should be the same as the processing manner of the first core network device for calculating the third message authentication code, and therefore will not be repeated.

[0193] Verifying the second message based on the third message check code and the third message authentication code can include one of the following: in the case where the third message check code and the third message authentication code are the same, determining that the verification of the second message is passed or successful; and in the case where the third message check code and the third message authentication code are different, determining that the verification of the second message fails. Here, the verification of the second message being passed or successful can mean that the integrity check of the second message is successful or passed; and the verification of the second message failing can mean that the integrity check of the second message fails.

[0194] In this embodiment, the processing of the first AIoT device for verifying the second message can be performed before verifying the second verification parameter. That is, the first AIoT device determines that the verification of the second message is passed or successful in the case where the third message check code and the third message authentication code are the same; in the case where it is determined that the verification of the second message is passed or successful, the second check parameter is calculated based on the second key; and whether to execute the second instruction is verified based on the second verification parameter and the second check parameter. In addition, it can also include: in the case where the verification of the second message fails, it is determined that the second instruction is not executed.

[0195] The related processing of the first AIoT device for verifying whether to execute the second instruction based on the second verification parameter and the second check parameter is the same as that in the foregoing embodiments; and the related processing of the first AIoT device after determining to execute the second instruction or determining not to execute the second instruction is the same as that in the foregoing embodiments, and therefore will not be repeated.

[0196] In some embodiments, the second message can also be encrypted, i.e., the second message can carry second cipher-text data and a third message authentication code.

[0197] The second cipher-text data can be calculated based on the confidentiality key and second plain-text data, which can include at least one of the following: the second instruction, the second verification parameter, the identity of the first AIoT device, the identity of the group to which the first AIoT device belongs, the second count value, and the second random number. The specific calculation method of the second cipher-text data is similar to that of the first cipher-text data in the foregoing embodiments, and thus will not be described herein.

[0198] Optionally, the first core network device can calculate a third message authentication code based on the second plain-text data, and then encrypt the second plain-text data to obtain the second cipher-text data. The related description of the first core network device calculating the third message authentication code based on the second plain-text data is similar to the related description of the first core network device calculating the first message authentication code based on the first plain-text data in the foregoing embodiments, and thus will not be described herein.

[0199] After the first AIoT device receives the second message, the first AIoT device can include the following: decrypting the second cipher-text data based on the confidentiality key to obtain the second plain-text data; calculating a third message check code based on the confidentiality key and the second plain-text data; verifying the second message based on the third message check code and the third message authentication code; in a case where it is determined that the second message is verified to pass or succeed, calculating a second check parameter based on the second key; and verifying whether to execute the second instruction based on the second verification parameter and the second check parameter.

[0200] The related description of the confidentiality key, the second plain-text data, and the second cipher-text data is the same as that in the foregoing embodiments. The decryption algorithm used by the first AIoT device should correspond to the encryption algorithm used by the first core network device, and thus will not be described herein. The processing of the first AIoT device calculating the third message check code is also the same as that of the first AIoT device calculating the third message authentication code in the foregoing embodiments, and thus will not be described herein.

[0201] Optionally, the first core network device can first encrypt the second plain-text data to obtain the second cipher-text data, and then calculate the third message authentication code based on the second cipher-text data. The related description of the first core network device calculating the third message authentication code based on the second cipher-text data is similar to the related description of the first core network device calculating the first message authentication code based on the first cipher-text data in the foregoing embodiments, and thus will not be described herein.

[0202] The first AIoT device receiving the first message can comprise: calculating a third message check code based on the confidentiality key and the second ciphertext data; verifying the second message based on the third message check code and the third message authentication code; in the case of determining that the second message is verified to pass or succeed, decrypting the second ciphertext data based on the confidentiality key to obtain second plaintext data; calculating a second check parameter based on the second key; verifying whether to execute the second instruction based on the second verification parameter and the second check parameter.

[0203] The first AIoT device calculates the third message check code, which should be the same as the process of the first core network device calculating the third message authentication code; the confidentiality key, the second plaintext data, and the second ciphertext data are described as in the previous embodiments, and are not repeated.

[0204] In this embodiment, the related processing after the first AIoT device determines to execute the second instruction or determines not to execute the second instruction is also the same as the previous embodiments, and therefore is not repeated.

[0205] In addition, as described in the previous embodiments, the first core network device can send the first message to multiple AIoT devices, and accordingly, each AIoT device receives the first message. The first core network device sending the first message to multiple AIoT devices and the related description are the same as the previous embodiments, and are not repeated.

[0206] Further, the first core network device can send the second message to multiple AIoT devices, and the first core network device can generate one or more second instructions, one or more second verification parameters, and send one or more second messages.

[0207] For example, in the case that multiple AIoT devices correspond to the same second instruction, one second message carrying the second instruction can be sent to multiple AIoT devices. The second verification parameter carried by the second message can be calculated based on the group key of the group where the first AIoT device is located, the second count value, and at least one of the following: the length of the second count value, the identifier of the group where the first AIoT device is located, the length of the identifier of the group where the first AIoT device is located, the identifier of each AIoT device in the multiple AIoT devices, the length of the identifier of each AIoT device in the multiple AIoT devices, and a fixed value, using a second calculation method. The second message can carry the second instruction, the second verification parameter, and the second count value (and / or the second random number), and the second message can further carry at least one of the following: the identifier of the group where the first AIoT device is located, and the identifier of each AIoT device in the multiple AIoT devices.

[0208] Optionally, if the second message is to be integrity protected and / or encrypted, the group integrity protection key and / or the group confidentiality key corresponding to the group to which the first AIoT device belongs can be used to perform, which is not described herein.

[0209] For example, in the case that different AIoT devices correspond to different second instructions, different second messages corresponding to different AIoT devices can be sent. For example, the second message corresponding to the first AIoT device can carry a second verification parameter calculated by the second calculation manner based on the first key (the same as the second key) corresponding to the first AIoT device, the second count value, and at least one of the length of the second count value, the identifier of the first AIoT device, the length of the identifier of the first AIoT device, and a fixed value.

[0210] The processing that each of the plurality of AIoT devices can perform after receiving the second message is the same as the processing that the first AIoT device performs after receiving the second message in the foregoing embodiments, and thus will not be described again.

[0211] In some embodiments, after the first AIoT device determines to execute the first instruction, the method further includes sending a response message of the first message to the first core network device, where the response message of the first message carries a second random number. Correspondingly, the processing of the first core network device after sending the first message can further include receiving the response message of the first message from the first AIoT device, where the response message of the first message carries the second random number.

[0212] Specifically, sending the response message of the first message to the first core network device can include that the first AIoT device sends the response message of the first message to the first core network device before adjusting the state of using the radio frequency capability to temporarily disable the radio frequency capability, where the response message of the first message is used to indicate that the first AIoT device determines to execute the operation of temporarily disabling the radio frequency capability. After the first AIoT device sends the response message of the first message to the first core network device, the operation of adjusting the state of using the radio frequency capability to temporarily disable the radio frequency capability can be performed. The transmission manner of the response message of the first message is the same as that in the foregoing embodiments, and thus will not be described again.

[0213] The second random number can be generated by the first AIoT device. The manner in which the first AIoT device generates the second random number is not limited in this embodiment. For example, the second random number is different from the first random number in the foregoing embodiments, and the second random number can be denoted as RAND. The second random number can also be referred to as the second random number corresponding to the first AIoT device.

[0214] In one embodiment, the second random number is used to update an input parameter for generating the second authentication parameter.

[0215] The processing of the first core network device further includes: sending a second message to the first AIoT device, wherein the second message carries a second instruction, and the second instruction is used to indicate one of the following: the first AIoT device permanently disables the radio frequency, and the first AIoT device uses the radio frequency. Correspondingly, after the first AIoT device sends the response message of the first message, the method further includes: receiving the second message from the first core network device, wherein the second message carries a second instruction, and the second instruction is used to indicate one of the following: the first AIoT device permanently disables the radio frequency, and the first AIoT device uses the radio frequency. The first core network device determines the second instruction in the same way as the previous embodiment, and no repeated description is made.

[0216] The second message further carries a second authentication parameter. After the first AIoT device receives the second message, the method further includes: calculating a second check parameter based on the second key; and verifying whether to execute the second instruction based on the second authentication parameter and the second check parameter. In this embodiment, the second key is the same as the first key.

[0217] On the side of the first core network device, the second authentication parameter is calculated based on the second key and at least one of the following: a second random number, and a length of the second random number. On the side of the first AIoT device, the second check parameter is calculated based on the second key and at least one of the following: a second random number, and a length of the second random number.

[0218] On the side of the first core network device and the first AIoT device, the second calculation manner used for calculating the second authentication parameter and calculating the second check parameter is the same as the related description of the previous embodiment, and no repeated description is made.

[0219] For example, the parameters or contents used for calculating the second verification parameter can include more parameters in addition to the second random number (or can also include the length of the second random number), such as at least one of the following: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, and a fixed value. Correspondingly, on the first AIoT device side, the second verification parameter is calculated based on the second key, and the calculation includes: using a second calculation manner to calculate the second verification parameter based on the second key, the second random number, and at least one of the following: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the length of the second random number, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, and a fixed value. It should be noted that the above is only an example of calculating the second verification parameter and the second verification parameter, and the entire parameters or contents that can be used to calculate the second verification parameter are not limited or exhausted here.

[0220] On the first AIoT device side, whether to execute the second instruction is verified based on the second verification parameter and the second verification parameter, including: in the case where the second verification parameter and the second verification parameter are the same, it is determined to execute the second instruction. In addition, it can also include: in the case where the second verification parameter and the second verification parameter are different, it is determined not to execute the second instruction. The related processing after the first AIoT device determines not to execute the second instruction or executes the second instruction is the same as that in the foregoing embodiments, and is not repeated here.

[0221] Optionally, the response message of the first message can also carry a second message authentication code, which can be calculated based on the perfect secret key between the first AIoT device and the first core network device and the content carried in the response message of the first message. The content carried in the response message of the first message includes at least the second random number.

[0222] After the first core network device receives the response message of the first message, the following processing can be performed: calculating a second message verification code based on the perfect secret key between the first AIoT device and the first core network device and the content carried in the response message of the first message; verifying the response message of the first message based on the second message verification code and the second message authentication code. Further, the first core network device can determine that the verification of the response message of the first message is passed or successful, and then send a second message to the first AIoT device.

[0223] The processing mode of the first AIoT device calculating the second message authentication code, the first core network device calculating the second message check code, and the like is similar to the foregoing embodiments, and the only difference is that the content carried in the response message of the first message is replaced by at least the second random number, and thus repeated description is not performed.

[0224] Optionally, the second message can also carry a third message authentication code (a third message authentication code corresponding to the first AIoT device) for verifying the second message. The third message authentication code is calculated based on the perfect security key between the first AIoT device and the first core network device and the content carried in the second message. The content carried in the second message can include the second instruction, the second verification parameter, and can also include at least one of the identifier of the first AIoT device and the identifier of the group to which the first AIoT device belongs.

[0225] The input parameters that can be used for calculating the third message authentication code include, in addition to the perfect security key and the content carried in the second message, other parameters or content that are the same as those in the foregoing embodiments, and thus repeated description is not performed.

[0226] The processing of the first AIoT device after receiving the second message is also similar to the foregoing embodiments, and thus repeated description is not performed.

[0227] Optionally, the second message can also be encrypted, that is, the second message can carry second ciphertext data and the third message authentication code. Correspondingly, after receiving the second message, the first AIoT device can perform decryption to obtain second plaintext data, calculate a third message check code, and verify whether to execute the second instruction based on the second verification parameter and the second check parameter. The confidentiality key, the second plaintext data, the second ciphertext data, the decryption algorithm used by the first AIoT device for decrypting the second ciphertext data, the encryption algorithm used by the first core network device for encrypting the second plaintext data, the processing of calculating the third message check code, the processing of the first core network device calculating the third message authentication code, and the like used in the execution of the above processing by the first AIoT device and the first core network device in this embodiment are similar to the foregoing embodiments, and the only difference is that the second plaintext data no longer includes the second random number and the second count value in this embodiment, and thus repeated description is not performed.

[0228] In an embodiment, the second key is generated based on the second random number and the first key.

[0229] On the first AIoT device side, after sending the response message of the first message, the second key can be generated or calculated based on the second random number and the first key. On the first core network device side, after receiving the response message of the first message, the second key can be generated or calculated based on the second random number and the first key.

[0230] In this embodiment, the calculation manner used for generating or calculating the second key can be configured according to actual conditions, for example, can be any one of the following: KDF, a first authentication function (such as the f1 function defined in 3GPP), a second authentication function (such as the f2 function defined in 3GPP), a third key generation function (such as the f3 function defined in 3GPP), a fourth key generation function (such as the f4 function defined in 3GPP), a fifth key generation function (such as the f5 function defined in 3GPP), and the like. Here, the calculation manner used for generating or calculating the second key is not limited or enumerated, as long as the first AIoT device and the first core network device use the same calculation manner to calculate or generate the second key, which is within the protection scope of this embodiment.

[0231] In addition to the second random number and the first key, other input parameters can also be used for generating or calculating the second key. The other input parameters used for calculating the second key can be configured according to actual conditions, for example, can include at least one of the identifier of the first AIoT device, the identifier of the first core network device, and the like, as long as the first AIoT device and the first core network device use the same input parameters to calculate or generate the second key, which is within the protection scope of this embodiment.

[0232] The processing of the first core network device can further include: sending a second message to the first AIoT device, wherein the second message carries a second instruction, and the second instruction is used to instruct one of the following: the first AIoT device permanently disables the radio frequency, and the first AIoT device uses the radio frequency. Correspondingly, after the first AIoT device sends the response message of the first message, the method further includes: receiving the second message from the first core network device, wherein the second message carries a second instruction, and the second instruction is used to instruct one of the following: the first AIoT device permanently disables the radio frequency, and the first AIoT device uses the radio frequency. Preferably, the scheme provided in this embodiment is especially suitable for the scenario where the second instruction is used to instruct the first AIoT device to use the radio frequency.

[0233] The second message further carries a second verification parameter. On the side of the first core network device, the second verification parameter is calculated based on the second key and at least one of the following: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the identifier of the group where the first AIoT device is located, the length of the identifier of the group where the first AIoT device is located, a first count value, the length of the first count value, a first random number, and the length of the first random number. Among them, the first count value and the first random number are carried in the first message, and their related descriptions are the same as those in the foregoing embodiments, which will not be repeated here.

[0234] On the first AIoT device side, the second verification parameter is calculated based on the second key, and the second check parameter is calculated based on the second key and at least one of the following: the identifier of the first AIoT device, the length of the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the length of the identifier of the group to which the first AIoT device belongs, the first count value, the length of the first count value, the first random number, and the length of the first random number.

[0235] On the first core network device and the first AIoT device side, the second verification parameter is calculated, and the second calculation method used to calculate the second check parameter is the same as the related description of the foregoing embodiments, and thus no further description is provided herein.

[0236] The foregoing is an exemplary description of the calculation of the second verification parameter and the second check parameter. In actual processing, as long as the second key obtained by updating the first key is used to calculate the second verification parameter, and the same parameters or contents are used to calculate the second verification parameter and the second check parameter, it is within the protection scope of the present embodiment, and thus no further limitation or enumeration is provided herein.

[0237] On the first AIoT device side, the second verification parameter and the second check parameter are used to verify whether the second instruction is executed, including: in the case where the second verification parameter and the second check parameter are the same, determining to execute the second instruction. In addition, it can also include: in the case where the second verification parameter and the second check parameter are different, determining not to execute the second instruction. The related processing after the first AIoT device determines not to execute the second instruction or executes the second instruction is the same as the foregoing embodiments, and thus no further description is provided herein.

[0238] Optionally, the response message of the first message can also carry a second message authentication code, which can be calculated based on the perfect secret key between the first AIoT device and the first core network device and the content carried in the response message of the first message. Here, the first AIoT device calculates the second message authentication code, the first core network device calculates the second message check code, and the processing mode of verifying the response message of the first message is similar to the foregoing embodiments, and thus no further description is provided herein.

[0239] Optionally, the second message can also carry a third message authentication code (the third message authentication code corresponding to the first AIoT device) used to verify the second message. The third message authentication code is calculated based on the perfect secret key between the first AIoT device and the first core network device and the content carried in the second message. The content carried in the second message can include the second instruction and the second verification parameter, and can also include at least one of the following: the identifier of the first AIoT device and the identifier of the group to which the first AIoT device belongs.

[0240] The input parameters that can be used to calculate the third message authentication code are the same as those in the previous embodiments, except for the perfect secret key and the content carried by the second message. The first AIoT device receives the second message, calculates the third message authentication code based on the perfect secret key between the first AIoT device and the first core network device and the content carried by the second message, and verifies the second message based on the third message authentication code and the third message authentication code. The related processing is the same as that in the previous embodiments, and is not repeated.

[0241] Alternatively, the second message can also be encrypted, that is, the second message can carry second ciphertext data and a third message authentication code. Correspondingly, after receiving the second message, the first AIoT device can perform decryption to obtain second plaintext data, calculate a third message authentication code, and verify whether to execute the second instruction based on the second verification parameter and the second verification parameter. The confidentiality key, the second plaintext data, the second ciphertext data, the decryption algorithm used by the first AIoT device to decrypt the second ciphertext data, the encryption algorithm used by the first core network device to encrypt the second plaintext data, the processing of calculating the third message authentication code, and the processing of calculating the third message authentication code used by the first AIoT device and the first core network device in the above processing in this embodiment are similar to those in the previous embodiments, except that the second plaintext data no longer includes a second random number and a second count value. Therefore, it is not repeated.

[0242] In this embodiment, the related processing after the first AIoT device determines to execute the second instruction or determines not to execute the second instruction is the same as that in the previous embodiments, and is not repeated.

[0243] In addition, as described in the previous embodiments, the first core network device can send the first message to each AIoT device in the plurality of AIoT devices. Correspondingly, the processing that each AIoT device can perform after receiving the respective first message is the same as the processing after the first AIoT device receives the first message, and therefore is not repeated.

[0244] In this embodiment, a processing mode for permanent disable is provided, which is exemplarily illustrated in combination with FIG. 5. In this example, the processing is performed in two steps, that is, temporary disable is performed first, and then permanent disable is performed. Different counters are used to calculate the verification parameters, and permanent disable is performed only when counter2 is greater than counter1. The intermediate node shown in FIG. 5 can be a RAN or an intermediate node UE. The specific process is as follows:

[0245] Steps 500-505 are similar to the description of the aforementioned steps 400-405 in FIG. 4, except that in the present example, step 501: the AF sends an AIoT Command request (i.e., the third message in the aforementioned embodiment) to the NEF, where the Command in the request message is to temporarily disable the radio frequency capability; the AMF includes the first count value, the first AIoT ID, the first authentication parameter, and the first MAC in the AIoT Command request message (the first message) sent in step 505, and the first instruction included in the AIoT Command request message (the first message) is to instruct the first AIoT device to temporarily disable the radio frequency, which will not be described herein again.

[0246] Step 506: the first AIoT device calculates a first MAC' and performs integrity verification on the AIoT Command request message; after the verification is passed, the first verification parameter is calculated; if the first authentication parameter and the first verification parameter are successfully matched, step 507 is performed.

[0247] Step 507: the first AIoT device sends a temporarily disable response message (i.e., the response message of the first message in the aforementioned embodiment) to the AMF, and then performs the temporarily disable operation (i.e., temporarily disables the RF capability) instructed by the first instruction in the AIoT Command request message. The temporarily disable response message carries the first count value, a second MAC, and an acknowledgement response (ACK).

[0248] Step 508: the AMF calculates a second authentication parameter using a second count value (counter T2); optionally, the AMF can also calculate a third MAC to perform integrity protection on the permanent disable indication message to be sent by the AMF. Optionally, the AMF can encrypt the permanent disable indication message.

[0249] Step 509: the AMF sends the second authentication parameter, the second count value (which can also include the first AIoT ID (the identifier of the first AIoT device), and the third MAC) to the first AIoT device in a permanent disable indication message (i.e., the second message in the aforementioned embodiment). The permanent disable indication message can also carry a second instruction to instruct the first AIoT device to permanently disable the radio frequency.

[0250] Step 510: the first AIoT device needs to ensure that Counter T2>Counter T1 in addition to comparing the second authentication parameter, and then performs steps 511-513 before performing the permanent disable RF capability. Steps 511-513 are similar to the description of steps 407-409 in FIG. 4, which will not be described again.

[0251] In the step 510, the first AIoT device calculates a third MAC', performs integrity verification on the permanently disable indication message, and, after the verification, calculates a second check parameter. If the second verification parameter and the second check parameter successfully match, it is determined whether the second count value is greater than the first count value. If the second count value is greater than the first count value, it is determined that the operation of permanently disabling the RF capability is performed.

[0252] In combination with FIG. 6, a processing mode of using the RF capability provided by the present embodiment is exemplarily illustrated. The present example can be applicable to various possible scenarios, such as a scenario of periodically collecting data by a sensor. In the scenario, the AF can issue an AIoT Command request, and the 5GC can first perform the temporarily disable indication and then perform the indication of using the RF. The intermediate node shown in FIG. 6 can also be the RAN or the intermediate node UE. The specific process is as follows:

[0253] The steps 600-606 are similar to the related description of the steps 400-406 in the aforementioned FIG. 4. The difference is that, in the present example, in the step 601, the AF sends an AIoT Command request (i.e., the third message in the aforementioned embodiment) to the NEF. The Command in the request message is to use the RF capability. In the step 605, the AMF sends an AIoT Command request message (the first message) including the first AIoT ID, the first verification parameter, and the first MAC. The AIoT Command request message (the first message) includes a first instruction for instructing the first AIoT device to temporarily disable the RF. Details are not described herein.

[0254] In the step 607, the first AIoT device sends a temporarily disable response message (i.e., the response message of the first message in the aforementioned embodiment) to the AMF, and then performs the temporarily disable operation (i.e., the temporarily disable RF capability) instructed by the first instruction in the AIoT Command request message. The temporarily disable response message carries the first count value, a second random number (RAND), and an acknowledgement response (ACK).

[0255] In the step 608, the AMF calculates a second verification parameter using the second random number. Optionally, the AMF can also calculate a third MAC to perform integrity protection on the indication message of using the RF. Optionally, the AMF can encrypt the indication message of using the RF.

[0256] Step 609: The AMF carries the second verification parameter, the first AIoT ID (the identifier of the first AIoT device), and the third MAC in the radio frequency indication message (i.e., the second message in the foregoing embodiment) sent to the first AIoT device. The radio frequency indication message can also carry a second instruction for instructing the first AIoT device to use the radio frequency.

[0257] Step 610: The first AIoT device calculates the third MAC' and performs integrity verification on the radio frequency indication message. After the verification is passed, the second check parameter is calculated. If the second verification parameter and the second check parameter match successfully, it is determined that the operation using the radio frequency capability is performed. After the first AIoT device performs the operation using the radio frequency capability, steps 611-613 are performed. The steps 611-613 are similar to the related description of steps 407-409 shown in FIG. 4, except that the enable response message is used to indicate that the first AIoT device uses or enables the radio frequency capability in the present example, and thus no further description is provided.

[0258] In an alternative example, after the first AIoT device sends the second random number to the AMF in step 607, the first AIoT device can update the second key based on the second random number and the first key; in step 608, the AMF can update the second key based on the second random number and the first key, and then calculate the second verification parameter based on the second key; in step 610, the first AIoT device can calculate the second check parameter using the updated second key. The other related description of the alternative example is the same as steps 600-613 shown in FIG. 6, and thus no further description is provided.

[0259] By using the above scheme, the first AIoT device determines whether to execute the first instruction carried in the first message for indicating it to adjust the radio frequency state based on the first verification parameter in the first message sent by the first core network device, and the first verification parameter is generated based on the first key shared by the first AIoT device and the first core network device. In this way, the management operation of the first AIoT device by the core network side can be implemented, and since the first key is shared by the first AIoT device and the first core network device, the security and reliability of the management operation of the first AIoT device by the core network side can be ensured based on the fact that the key or the security information for verification is not sent over the air.

[0260] FIG. 7 is a schematic diagram of the composition structure of the first AIoT device according to an embodiment of the present application, which includes:

[0261] The first communication unit 701 is configured to receive a first message from a first core network device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

[0262] The first AIoT device further includes a first processing unit 701 configured to calculate a first verification parameter based on the first key and at least one of the following: an identifier of the first AIoT device, a length of the identifier of the first AIoT device, an identifier of a group to which the first AIoT device belongs, a length of the identifier of the group to which the first AIoT device belongs, a first count value, a length of the first count value, a first random number, and a length of the first random number; and verify whether to execute the first instruction based on the first verification parameter and the first verification parameter.

[0263] The first message further carries a first message authentication code for verifying the first message.

[0264] The first processing unit is configured to calculate a first message verification code based on at least one of the following: the first instruction, the first verification parameter, the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number, and the perfect security key between the first AIoT device and the first core network device; and verify the first message based on the first message verification code and the first message authentication code.

[0265] The first message further carries at least one of the following: the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number.

[0266] The first instruction is used to instruct one of the following: the first AIoT device to permanently disable the radio frequency, and the first AIoT device to use the radio frequency.

[0267] The first instruction is used to instruct the first AIoT device to temporarily disable the radio frequency.

[0268] The first communication unit is configured to receive a second message from the first core network device, wherein the second message carries a second instruction for instructing one of the following: the first AIoT device to permanently disable the radio frequency, and the first AIoT device to use the radio frequency.

[0269] The second message also carries a second verification parameter generated based on a second key, for verifying whether to execute the second instruction, wherein the second key is shared by the first AIoT device and the first core network device.

[0270] The first processing unit is configured to calculate a second verification parameter based on the second key, and verify whether to execute the second instruction based on the second verification parameter and the second verification parameter.

[0271] The first processing unit is configured to calculate a second verification parameter based on the second key and at least one of the following: a second count value, a length of the second count value, a second random number, and a length of the second random number.

[0272] The first processing unit is configured to perform one of the following: in a case where the second verification parameter and the second verification parameter are the same, and the second count value and the first count value are different, determine to execute the second instruction; and in a case where the second verification parameter and the second verification parameter are the same, and the second random number and the first random number are different, determine to execute the second instruction.

[0273] The first communication unit is configured to send, to the first core network device, a response message of the first message, wherein the response message of the first message carries one of the following: a first count value and a first random number.

[0274] The second message also carries at least one of the following: the second count value and the second random number.

[0275] The second key is the same as the first key.

[0276] The first processing unit is configured to calculate the second verification parameter based on the second key and at least one of the following: an identifier of the first AIoT device, a length of the identifier of the first AIoT device, an identifier of a group to which the first AIoT device belongs, a length of the identifier of the group to which the first AIoT device belongs, a first count value, a length of the first count value, a first random number, and a length of the first random number.

[0277] The second key is generated based on a second random number and the first key.

[0278] The first communication unit is configured to send, to the first core network device, a response message of the first message, wherein the response message of the first message carries the second random number.

[0279] The first key is one of the following: a root key of the first AIoT device, a third key between the first AIoT device and the first core network device, a fourth key between the first AIoT device and an application function, a preconfigured parameter, and a group key of a group to which the first AIoT device belongs.

[0280] FIG. 8 is a schematic diagram of a constituent structure of a first core network device according to an embodiment of the present application, including:

[0281] The second communication unit 801 is configured to send a first message to a first AIoT device, where the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

[0282] The first verification parameter is calculated based on the first key and at least one of the following: an identifier of the first AIoT device, a length of the identifier of the first AIoT device, an identifier of a group to which the first AIoT device belongs, a length of the identifier of the group to which the first AIoT device belongs, a first count value, a length of the first count value, a first random number, and a length of the first random number.

[0283] The first message further carries a first message authentication code for verifying the first message, where the first message authentication code is calculated based on a perfect forward secrecy key between the first AIoT device and the first core network device and at least one of the following: the first instruction, the first verification parameter, the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number.

[0284] The first message further carries at least one of the following: the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number.

[0285] The first instruction is used to instruct one of the following: the first AIoT device to permanently disable a radio frequency, and the first AIoT device to use a radio frequency.

[0286] The first instruction is used to instruct the first AIoT device to temporarily disable a radio frequency.

[0287] The second communication unit is configured to send a second message to the first AIoT device, where the second message carries a second instruction for instructing one of the following: the first AIoT device to permanently disable a radio frequency, and the first AIoT device to use a radio frequency.

[0288] The second message also carries a second verification parameter generated based on a second key, for verifying whether to execute the second instruction, wherein the second key is shared by the first AIoT device and the first core network device.

[0289] The second verification parameter is calculated based on the second key and at least one of the following: a second count value, a length of the second count value, a second random number, a length of the second random number.

[0290] The second communication unit is configured to receive a response message of the first message from the first AIoT device, wherein the response message of the first message carries one of the following: a first count value, a first random number.

[0291] The second message also carries at least one of the following: the second count value, the second random number.

[0292] The second key is the same as the first key.

[0293] The second verification parameter is calculated based on the second key and at least one of the following: an identity of the first AIoT device, a length of the identity of the first AIoT device, an identity of a group to which the first AIoT device belongs, a length of the identity of the group to which the first AIoT device belongs, a first count value, a length of the first count value, a first random number, a length of the first random number.

[0294] The second key is generated based on a second random number and the first key.

[0295] The second communication unit is configured to receive a response message of the first message from the first AIoT device, wherein the response message of the first message carries the second random number.

[0296] The first key is one of the following: a root key of the first AIoT device, a third key between the first AIoT device and the first core network device, a fourth key between the first AIoT device and an application function, a preconfigured parameter, a group key of a group to which the first AIoT device belongs.

[0297] The second communication unit is configured to receive a third message from an application function, wherein the third message is used for the first core network device to determine that the first AIoT device performs one of the following operations: permanently disables a radio frequency, uses a radio frequency, temporarily disables a radio frequency.

[0298] The third message carries at least one of the following: an identifier of one or more AIoT devices, and location information used to determine the one or more AIoT devices, wherein the one or more AIoT devices include the first AIoT device.

[0299] The device of the embodiments of the present application can realize the corresponding functions of each device in the foregoing communication method embodiments. The processes, functions, implementation manners, and advantages of each module (submodule, unit, or component, etc.) in the device correspond to the descriptions in the foregoing method embodiments, which will not be described herein again. It should be noted that the functions described with respect to each module (submodule, unit, or component, etc.) in the device of the embodiments of the present application can be realized by different modules (submodules, units, or components, etc.) or by the same module (submodule, unit, or component, etc.).

[0300] It should be understood that the magnitude of the serial numbers of the processes in the various embodiments of the present application does not mean the execution sequence, and the execution sequence of the processes should be determined according to their functions and inherent logic. It can be clearly understood by those skilled in the art that, for the convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments, which will not be described herein again. The above merely describes the specific embodiments of the present application, and the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of communication performed by a first AIoT device, comprising: receiving a first message from a first core network device, wherein the first message carries a first instruction indicating the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

2. The method of claim 1, wherein, The method further comprises: calculating a first check parameter based on the first key and at least one of the following: an identity of the first AIoT device, a length of the identity of the first AIoT device, an identity of a group in which the first AIoT device is located, a length of the identity of the group in which the first AIoT device is located, a first count value, a length of the first count value, a first random number, a length of the first random number; verifying whether to execute the first instruction based on the first verification parameter and the first check parameter.

3. The method of claim 1 or 2, wherein, The first message further carries a first message authentication code for verifying the first message.

4. The method of claim 3, wherein, The method further comprises: calculating a first message check code based on a perfect forward secrecy key between the first AIoT device and the first core network device and at least one of the following: the first instruction, the first verification parameter, the identity of the first AIoT device, the identity of the group in which the first AIoT device is located, the first count value, the first random number; verifying the first message based on the first message check code and the first message authentication code.

5. The method according to any one of claims 1 to 4, wherein, The first message further carries at least one of the following: the identity of the first AIoT device, the identity of the group in which the first AIoT device is located, the first count value, the first random number.

6. The method according to any one of claims 1 to 5, wherein, The first instruction is used to indicate one of the following: the first AIoT device to permanently disable the radio frequency, the first AIoT device to use the radio frequency.

7. The method according to any one of claims 1-5, wherein, The first instruction is used to indicate the first AIoT device to temporarily disable the radio frequency.

8. The method of claim 7, wherein, The method further comprises: receiving a second message from the first core network device, wherein the second message carries a second instruction indicating one of the following: the first AIoT device to permanently disable the radio frequency, the first AIoT device to use the radio frequency.

9. The method of claim 8, wherein, The second message further carries a second verification parameter generated based on a second key for verifying whether to execute the second instruction, wherein the second key is shared by the first AIoT device and the first core network device.

10. The method of claim 9, wherein, The method further comprises: calculating a second check parameter based on the second key; verifying whether to execute the second instruction based on the second verification parameter and the second check parameter.

11. The method of claim 10, wherein, The calculating the second check parameter based on the second key comprises: calculating the second check parameter based on the second key and at least one of the following: a second count value, a length of the second count value, a second random number, a length of the second random number.

12. The method of claim 11, wherein, The verifying whether to execute the second instruction based on the second verification parameter and the second check parameter comprises one of the following: determining to execute the second instruction in a case where the second verification parameter and the second check parameter are same, and the second count value and the first count value are different; determining to execute the second instruction in a case where the second verification parameter and the second check parameter are same, and the second random number and the first random number are different.

13. The method of claim 11 or 12, wherein, The method further includes: sending, to the first core network device, a response message of the first message, where the response message of the first message carries one of the following: the first count value, the first random number.

14. The method of any one of claims 11-13, wherein, The second message further carries at least one of the following: the second count value, the second random number.

15. The method of any one of claims 9-14, wherein, The second key is same as the first key.

16. The method of claim 10, wherein, The second key is same as the first key. The second key is same as the first key.

17. The method of any one of claims 9, 10, 16, wherein, The second key is same as the first key.

18. The method of claim 11 or 17, wherein, The second key is same as the first key. The method further includes:

19. The method of any one of claims 1-18, wherein, sending, to the first core network device, a response message of the first message, where the response message of the first message carries one of the following: the first count value, the first random number. The first key is one of the following: a root key of the first AIoT device, a third key between the first AIoT device and the first core network device, a fourth key between the first AIoT device and an application function, a preconfigured parameter, a group key of a group to which the first AIoT device belongs.

20. A communication method performed by a first core network device, comprising:

21. The method of claim 20, wherein, sending, to a first environmental Internet of Things (AIoT) device, a first message, where the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key and used to verify whether the first instruction is executed, the first key being shared by the first AIoT device and the first core network device.

22. The method of claim 20 or 21, wherein, The first verification parameter is calculated based on the first key and at least one of the following: an identifier of the first AIoT device, a length of the identifier of the first AIoT device, an identifier of a group to which the first AIoT device belongs, a length of the identifier of the group to which the first AIoT device belongs, a first count value, a length of the first count value, a first random number, and a length of the first random number. The first message further carries a first message authentication code used to verify the first message, where the first message authentication code is calculated based on a perfect forward secrecy key between the first AIoT device and the first core network device and at least one of the following: the first instruction, the first verification parameter, the identifier of the first AIoT device, the identifier of the group to which the first AIoT device belongs, the first count value, and the first random number.

23. The method of any one of claims 20-22, wherein, The first message further carries at least one of the following: an identity of the first AIoT device, an identity of a group to which the first AIoT device belongs, a first count value, a first random number.

24. The method of any one of claims 20-23, wherein, The first instruction is used to instruct one of the following: the first AIoT device to permanently disable a radio frequency, the first AIoT device to use a radio frequency.

25. The method of any one of claims 20-23, wherein, The first instruction is used to instruct the first AIoT device to temporarily disable a radio frequency.

26. The method of claim 25, wherein, The method further comprises: sending, to the first AIoT device, a second message, wherein the second message carries a second instruction used to instruct one of the following: the first AIoT device to permanently disable a radio frequency, the first AIoT device to use a radio frequency.

27. The method of claim 26, wherein, The second message further carries a second verification parameter generated based on a second key and used to verify whether the second instruction is executed, wherein the second key is shared by the first AIoT device and the first core network device.

28. The method of claim 27, wherein, The second verification parameter is calculated based on the second key and at least one of the following: a second count value, a length of the second count value, a second random number, a length of the second random number.

29. The method of claim 28, wherein, The method further comprises: receiving a response message of the first message from the first AIoT device, wherein the response message of the first message carries one of the following: a first count value, a first random number.

30. The method of claim 28 or 29, wherein, The second message further carries at least one of the following: the second count value, the second random number.

31. The method of any one of claims 27-30, wherein, The second key is the same as the first key.

32. The method of claim 27, wherein, The second verification parameter is calculated based on the second key and at least one of the following: an identity of the first AIoT device, a length of the identity of the first AIoT device, an identity of a group to which the first AIoT device belongs, a length of the identity of the group to which the first AIoT device belongs, a first count value, a length of the first count value, a first random number, a length of the first random number.

33. The method of claim 27 or 32, wherein, The second key is generated based on a second random number and the first key.

34. The method of claim 28 or 33, wherein, The method further comprises: receiving a response message of the first message from the first AIoT device, wherein the response message of the first message carries the second random number.

35. The method of any one of claims 20-34, wherein, The first key is one of the following: a root key of the first AIoT device, a third key between the first AIoT device and the first core network device, a fourth key between the first AIoT device and an application function, a preconfigured parameter, a group key of a group to which the first AIoT device belongs.

36. The method of any one of claims 20-35, wherein, The method further comprises: receiving a third message from an application function, wherein the third message is used for the first core network device to determine that the first AIoT device performs one of the following operations: permanently disables a radio frequency, uses a radio frequency, temporarily disables a radio frequency.

37. The method of claim 36, wherein, The third message carries at least one of the following: identities of one or more AIoT devices, location information used to determine the one or more AIoT devices, wherein the one or more AIoT devices include the first AIoT device.

38. A first environment Internet of Things (AIoT) device, comprising: The first communication unit is configured to receive a first message from a first core network device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

39. A first core network device comprising: The second communication unit is configured to send a first message to a first environment Internet of Things (AIoT) device, wherein the first message carries a first instruction for instructing the first AIoT device to adjust a radio frequency state, and the first message further carries a first verification parameter generated based on a first key for verifying whether to execute the first instruction, and the first key is shared by the first AIoT device and the first core network device.

Images