Communication method, apparatus and device, and storage medium

Abstract

The present application belongs to the technical field of network security. Disclosed are a communication method, apparatus and device, and a storage medium. In the present application, a first communication device performs identity authentication and session key negotiation with a second communication device on the basis of first random identity information and a first shared key, wherein the first random identity information is identity information used by the first communication device in a current session between the first communication device and the second communication device; and after negotiating a session key, the first communication device updates the first random identity information to second random identity information for identity authentication in a subsequent session. That is, in each session, the first communication device may use a piece of negotiated random identity information to perform identity authentication with the second communication device and acquire a session key, thereby reducing the leakage risk of identity information of a user.

Description

Communication methods, devices, equipment and storage media

[0001] This application claims priority to Chinese Patent Application No. 202411582079.3, filed on November 6, 2024, entitled "Communication Method, Apparatus, Device and Storage Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of network security technology, and in particular to a communication method, apparatus, device and storage medium. Background Technology

[0003] Currently, in wireless communication systems, terminals and core network equipment can perform mutual authentication and key negotiation when establishing a session to achieve secure communication. For example, in 5G mobile communication systems, terminals and core network equipment can also use 5G-authentication and key agreement (5G-AKA) based on a pre-shared key (PSK) for authentication and key negotiation. In 5G-AKA, the terminal uses the public key provided by the core network equipment to hide its own identity information and transmits the hidden identity information to the core network equipment. In this case, if the public key on the core network side is leaked, the terminal's identity information may also be leaked. Therefore, 5G-AKA poses a risk of leaking user identity information. Furthermore, in 5G-AKA, if a network attacker intercepts the message carrying the hidden identity information transmitted by the terminal to the core network equipment, the attacker can replay the intercepted message to the core network equipment to obtain the correlation between sessions, thereby threatening user privacy and security. Summary of the Invention

[0004] This application provides a communication method, apparatus, device, and storage medium that can achieve secure communication while protecting user identity information from being leaked.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] A first aspect provides a communication method applied to a first communication device, the method comprising: acquiring first random identity information and a first shared key of the first communication device, wherein the first random identity information is identity information used by the first communication device in a current session with a second communication device, and the first shared key is a master key shared by the first communication device and the second communication device; authenticating with the second communication device based on the first random identity information and the first shared key; after successful authentication with the second communication device, generating a first session key based on the first shared key, and updating the first random identity information to second random identity information based on the first session key, wherein the second random identity information is identity information used by the first communication device in a next session with the second communication device, and the first session key is a shared session key between the first communication device and the second communication device in the current session.

[0007] In this system, the first communication device can be a client device, and the second communication device can be a server device. For example, the first communication device can be a terminal in a wireless communication system, and correspondingly, the second communication device can be a core network device in the wireless communication system. Alternatively, the first communication device can be a client device in a data communication system, and the second communication device can be a server in the data communication system. Or, the first communication device can be a client device in a cloud computing environment, and the second communication device can be a cloud server in the cloud computing environment, etc.

[0008] In this application, the first communication device authenticates with the second communication device based on a first random identity information and a first shared key. After successful authentication, the first communication device generates a session key shared with the second communication device based on the first shared key. The first random identity information is the identity information used by the first communication device in the current session with the second communication device. After generating the shared session key for the current session, the first communication device updates the first random identity information to a second random identity information for authentication in the next session. Therefore, in this application, the first communication device can use a pre-agreed random identity information to interact with the second communication device in each session, thereby achieving mutual authentication and key negotiation, and protecting the true user identity information of the first communication device. Furthermore, even if an attacker intercepts a message carrying random identity information in a session and replays the message in a subsequent session, the second communication device cannot respond correctly to the replayed message because the random identity information used in each session is different. Thus, the attacker cannot obtain the correlation between sessions based on the second communication device's response, thereby protecting user privacy and security.

[0009] Optionally, the process of authenticating the second communication device based on the first random identity information and the first shared key may include: generating a first message verification code (MAC) based on the first shared key, first auxiliary information, the first random identity information, and the identity information of the second communication device; sending a first message to the second communication device, the first message including the first auxiliary information, the first random identity information, and the first MAC; receiving a second message, the second message including a second MAC, the second MAC being generated by the second communication device based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device after the first MAC is verified, the second shared key being the master key shared by the second communication device and the first communication device; and authenticating the second communication device based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the second communication device, and the second MAC.

[0010] In this application, both the first and second communication devices can use the MAC authentication mechanism to interact during the identity authentication process. This can protect the integrity and authenticability of the exchanged information and achieve secure authentication.

[0011] Optionally, the first auxiliary information includes a first random number and a first count value C1, where C1 is the current count value of the first counter in the first communication device, and the first shared key is obtained by updating the initial shared key C1 times by the first communication device; the second auxiliary information includes a second random number and a second count value C2, where C2 is the current count value of the second counter in the second communication device, and the second shared key is obtained by updating the initial shared key C2 times by the second communication device; the second message also includes C2, and the initial shared key is the initial master key shared by the first communication device and the second communication device.

[0012] In this application, the first communication device may be equipped with a first counter, the count value of which is used to count the number of times the shared key in the first communication device is updated. The second communication device may be equipped with a second counter, the count value of which is used to count the number of times the shared key in the second communication device is updated. Thus, when the first and second communication devices perform authentication, they not only verify whether the shared keys held by both parties are the same, but also verify whether the count values ​​of the first and second counters are equal; that is, they verify whether the update status of the shared keys held by both parties is the same, or in other words, they verify whether the processing operations of the shared keys by both parties are consistent. In this way, authentication is achieved through dual verification of the shared key itself and the update operations of the shared key, thereby improving authentication security.

[0013] Optionally, the process of authenticating the second communication device based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the second communication device, and the second MAC may include: if the current count value of the first counter is not less than C2, then a verification MAC corresponding to the second MAC is generated based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device; if the second MAC is equal to the corresponding verification MAC, then the authentication of the second communication device is successful.

[0014] In this application, after receiving the second MAC and C2 sent by the second communication device, if the current count value of its own first counter is not less than C2, it indicates that the update status of the first shared key is the same as the update status of the second shared key, or the update status of the first shared key is ahead of the update status of the second shared key. In this case, the first communication device does not need to update the first shared key, but can directly use the current first shared key to verify the second MAC.

[0015] Optionally, the process of authenticating the second communication device based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the second communication device, and the second MAC may include: if the current count value of the first counter is less than C2, then based on the difference D1 between C2 and the current count value of the first counter, update the first shared key D1 times, and update the current count value of the first counter to C2; based on the updated first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, generate a verification MAC corresponding to the second MAC; if the second MAC is equal to the corresponding verification MAC, then the authentication of the second communication device is successful.

[0016] In this application, after receiving the second MAC and C2 sent by the second communication device, if the current count value of its own first counter is less than C2, it indicates that the update status of the first shared key is behind the update status of the second shared key. In this case, the first communication device can first update the first shared key to make the update status of the first shared key and the second shared key consistent, and then use the updated first shared key to verify the second MAC.

[0017] Optionally, after the identity authentication of the second communication device is successful, the method further includes: generating a third MAC based on the first shared key, the first random number, the second random number, the third counter value C3, the C2, the first random identity information, and the identity information of the second communication device, wherein the C3 is equal to the current counter value; sending a third message to the second communication device, wherein the third message includes the third MAC and the C3, and the third message is used to authenticate the identity of the first communication device.

[0018] In this application, after the first communication device successfully authenticates the identity of the second communication device, it can also use its current first shared key and the count value of the first counter to generate a third MAC, so that the second communication device can authenticate the identity of the first communication device based on the third MAC.

[0019] Optionally, the first shared key is a master key shared by the first communication device and the second communication device in the current session. After generating the first session key based on the first shared key, the method further includes: updating the first shared key N times to obtain a third shared key, wherein the third shared key is a master key shared by the first communication device and the second communication device in the next session, and N is a preset value; and updating the current count value of the first counter based on N.

[0020] In this application, the master key shared by the first communication device and the second communication device can be updated with each session update. In other words, the shared key used by the first communication device and the second communication device to generate the session key is different in each session. In this case, even if the shared key in a certain session is leaked, the session key in each session cannot be deduced based on the leaked shared key. Therefore, it is impossible to obtain the data transmitted in each session by decrypting the session key. It can be seen that the authentication and session key negotiation method provided in this application can achieve forward security.

[0021] Optionally, in this application, the authentication process can be initiated by the first communication device. In this case, the second message sent by the aforementioned second communication device to the first communication device also includes the second random number.

[0022] Optionally, in this application, the authentication process can also be initiated by a second communication device. In this case, the second communication device can first send a broadcast message to the first communication device, the broadcast message including the second random number. Accordingly, after receiving the broadcast message from the second communication device, the first communication device can obtain the first random identity information and the first shared key.

[0023] Optionally, the process of updating the first random identity information to the second random identity information based on the first session key may include: generating the second random identity information based on the first session key, the first random number, and the second random number, and replacing the first random identity information with the second random identity information.

[0024] In this application, after successful authentication with the second communication device, the first communication device can determine that the second random number from the second communication device has not been tampered with, and that its own first shared key and the second shared key of the second communication device are the same. Based on this, the first communication device can calculate the session key using the same algorithm as the second communication device, based on its own shared key. That is, the first and second communication devices can calculate the same session key, i.e., the first session key, based on the same shared key. Thus, both the first and second communication devices can use their shared session key and the jointly held first and second random numbers to calculate the same new random identity information for use in the next session.

[0025] Optionally, the first communication device communicates with the second communication device through a third communication device. In this process, during the authentication process between the first and second communication devices, the first communication device may also generate a third session key based on the first shared key; and perform authentication with the third communication device based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device; after successful authentication with the third communication device, the third session key is determined as the shared session key with the third communication device.

[0026] Optionally, the process of authenticating with the third communication device based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device may include: receiving a fourth MAC sent by the third communication device, wherein the fourth MAC is generated by the third communication device based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device, and the second session key is generated by the second communication device based on the second shared key; authenticating the third communication device based on the third session key, the identity information of the third communication device, the fixed identity information of the first communication device, and the fourth MAC; if the authentication of the third communication device is successful, generating a fifth MAC based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device; sending the fifth MAC to the third communication device, wherein the fifth MAC is used to authenticate the first communication device; and if a fourth message is received from the third communication device, determining that the authentication with the third communication device is successful, wherein the fourth message is used to indicate that the third communication device has successfully authenticated the first communication device.

[0027] In this application, the first communication device can communicate with the second communication device through a third communication device. Furthermore, the first communication device can, with the assistance of the second communication device, perform authentication and key negotiation with the third communication device based on a shared key with the second communication device. This not only prevents the first communication device from accessing a third communication device with security risks but also ensures the security of subsequent data transmission between the first and third communication devices.

[0028] Optionally, the first random identity information is the initial random identity information of the first communication device, and the method further includes: negotiating the initial random identity information with the second communication device based on the initial shared key, the fixed identity information of the first communication device, and the identity information of the second communication device, wherein the initial shared key is the initial master key shared by the first communication device and the second communication device.

[0029] Optionally, the process of negotiating the initial random identity information with the second communication device based on the initial shared key, the fixed identity information of the first communication device, and the identity information of the second communication device may include: generating a sixth MAC based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and a third random number; sending a fifth message to the second communication device, the fifth message including the fixed identity information of the first communication device, the third random number, and the sixth MAC; receiving a sixth message from the second communication device, the sixth message including a fourth random number and a seventh MAC, the seventh MAC being generated by the second communication device based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number if the verification of the sixth MAC is successful; verifying the seventh MAC based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number; and if the verification of the seventh MAC is successful, generating the initial random identity information based on the initial shared key, the third random number, and the fourth random number, and storing the initial random identity information.

[0030] In this application, before the first communication device and the second communication device establish a session for the first time, the first communication device and the second communication device can obtain an initial shared key and negotiate an initial random identity information to be used in the first session based on the initial shared key. This allows the first communication device and the second communication device to use the initial random identity information to perform mutual authentication and negotiate a shared session key based on the initial shared key when establishing a session for the first time, thereby protecting the user identity information of the terminal from being leaked.

[0031] Secondly, a communication method is provided, applied in a second communication device, the method comprising: authenticating with a first communication device based on first random identity information and a second shared key, wherein the first random identity information is the identity information used by the first communication device in the current session with the second communication device, and the second shared key is a master key shared by the second communication device and the first communication device; after successful authentication with the first communication device, generating a first session key based on the second shared key, and updating the first random identity information to second random identity information based on the first session key, wherein the second random identity information is the random identity information used by the first communication device in the next session with the second communication device, and the first session key is a shared session key between the second communication device and the first communication device in the current session.

[0032] The second communication device can be a server-side device. For example, it can be a core network device in a wireless communication system, a server in a data communication system, or a cloud server in the cloud computing field.

[0033] In this application, the second communication device can authenticate itself with the first communication device based on the first random identity information of the first communication device and its own stored second shared key. After successful authentication, it generates a session key shared with the first communication device based on the second shared key. The first random identity information is the identity information of the first communication device in the current session, negotiated between the second and first communication devices. After generating the shared session key for the current session, both the second and first communication devices update the first random identity information to the second random identity information for authentication in the next session. Therefore, in this application, each time the second communication device establishes a session with the first communication device, it can use a pre-negotiated random identity information of the first communication device to interact with it, thereby achieving mutual authentication and obtaining the session key. Thus, the communication method provided in this application does not rely on third-party services for authentication and key acquisition, and the authentication process uses the device's random identity information. Therefore, while achieving secure communication, it can reduce the risk of leakage of user identity information.

[0034] Optionally, the process of authenticating the first communication device based on the first random identity information and the second shared key may include: receiving a first message sent by the first communication device, the first message including first auxiliary information, the first random identity information, and a first MAC, the first MAC being generated based on the first shared key, the first auxiliary information, the first random identity information, and the identity information of the second communication device, the first shared key being a master key shared by the first communication device and the second communication device; obtaining the second shared key based on the first random identity information; verifying the first MAC based on the second shared key, the first auxiliary information, the first random identity information, and the identity information of the second communication device; if the verification of the first MAC is successful, generating a second MAC based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device; and sending a second message to the first communication device, the second message including the second MAC, the second message being used to authenticate the second communication device.

[0035] In this application, both the first and second communication devices can use the MAC authentication mechanism to interact during the identity authentication process. This can protect the integrity and authenticability of the exchanged information and achieve secure authentication.

[0036] Optionally, the first auxiliary information includes a first random number and a first count value C1, where C1 is the current count value of the first counter in the first communication device, and the first shared key is obtained by updating the initial shared key C1 times by the first communication device. The initial shared key is a shared key between the first communication device and the second communication device. Based on this, the process of generating a second MAC based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device if the first MAC verification passes may include: if the first MAC verification passes, determining whether C1 is greater than the current count value of the second counter in the second communication device; if C1 is not greater than the current count value of the second counter, generating a second MAC based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device. The second auxiliary information includes a second random number and a second count value C2, where C2 is equal to the current count value of the second counter, and the second shared key is obtained by updating the initial shared key C2 times by the second communication device. The second message also includes C2.

[0037] In this application, the first communication device may be equipped with a first counter, the count value of which is used to count the number of times the shared key in the first communication device is updated. The second communication device may be equipped with a second counter, the count value of which is used to count the number of times the shared key in the second communication device is updated. Thus, when the first and second communication devices perform authentication, they not only verify whether the shared keys held by both parties are the same, but also verify whether the count values ​​of the first and second counters are equal; that is, they verify whether the update status of the shared keys held by both parties is the same, or in other words, they verify whether the processing operations of the shared keys by both parties are consistent. In this way, authentication is achieved through dual verification of the shared key itself and the update operations of the shared key, thereby improving authentication security.

[0038] If, after comparing C1 and C2, C2 is not less than C1, it indicates that the update status of the second shared key is the same as that of the first shared key, or that the update status of the second shared key is ahead of that of the first shared key. In this case, the second communication device does not need to update the second shared key, but can directly use the current second shared key to generate a second MAC, which is then used by the first communication device to authenticate the identity of the second communication device.

[0039] Optionally, if C1 is greater than the current count value of the second counter, then based on the difference D2 between C1 and the current count value of the second counter, the second shared key is updated D2 times, and the current count value of the second counter is updated to C1; based on the updated second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, the second MAC is generated, the second auxiliary information includes the second random number and the second count value C2, C2 is equal to the current count value of the second counter, and the second message also includes C2.

[0040] In this application, if the current count value of the second counter in the second communication device is less than C1, it indicates that the update status of the first shared key is behind the update status of the second shared key. In this case, the second communication device can first update the second shared key to make the update status of the second shared key consistent with that of the first shared key. Then, the updated second shared key and the updated count value of the second counter are used to calculate the second MAC, so that the first communication device can verify the shared keys held by both parties and the update status of the shared keys based on the second MAC.

[0041] Optionally, after sending the second message to the first communication device, the method further includes: receiving a third message sent by the first communication device, the third message including a third MAC and a third counter value C3, wherein the third MAC is generated by the first communication device after successfully authenticating the identity of the second communication device, based on the first shared key, the first random number, the second random number, C2, C3, the first random identity information, and the identity information of the second communication device, and C3 is equal to the current count value of the first counter; verifying the third MAC based on the second shared key, the first random number, the second random number, C2, C3, the first random identity information, and the identity information of the second communication device, and determining whether the current count value of the second counter is equal to C3; if the verification of the third MAC is successful, and the current count value of the second counter is equal to C3, then the identity authentication of the first communication device is successful.

[0042] In this application, after the first communication device successfully authenticates the identity of the second communication device, it can also use its current first shared key and the count value of the first counter to generate a third MAC. Accordingly, the second communication device can authenticate the identity of the first communication device based on the third MAC.

[0043] Optionally, the second shared key is a master key shared by the second communication device and the first communication device in the current session with the first communication device. After generating the first session key based on the second shared key, the method further includes: updating the second shared key N times to obtain a third shared key, the third shared key being a master key shared by the second communication device and the first communication device in the next session with the first communication device, where N is a preset value; and updating the current count value of the second counter based on N.

[0044] In this application, the master key shared by the first communication device and the second communication device can be updated with each session update. In other words, the shared key used by the first communication device and the second communication device to generate the session key is different in each session. In this case, even if the shared key in a certain session is leaked, the session key for each session cannot be deduced based on the leaked shared key. Therefore, it is impossible to obtain the data transmitted in each session by decrypting the session key. It can be seen that the authentication and session key negotiation method provided in this application can achieve forward security.

[0045] Optionally, in this application, the authentication process can be initiated by the first communication device. In this case, the second message sent by the aforementioned second communication device to the first communication device also includes the second random number.

[0046] Optionally, in this application, the authentication process can also be initiated by a second communication device. In this case, the second communication device can first send a broadcast message to the first communication device, the broadcast message including the second random number.

[0047] Optionally, the process of updating the first random identity information to the second random identity information based on the first session key may include: generating the second random identity information based on the first session key, the first random number, and the second random number; and replacing the first random identity information with the second random identity information.

[0048] In this application, after successful authentication with the first communication device, the second communication device can determine that the first random number from the first communication device has not been tampered with, and that the first shared key in the first communication device and its own second shared key are the same. Based on this, the second communication device can calculate the session key using the same algorithm as the first communication device, based on its own shared key. That is, the first and second communication devices can calculate the same session key, i.e., the first session key, based on the same shared key. Thus, both the first and second communication devices can use their first session key and the shared first and second random numbers from this session to calculate the same new random identity information for use in the next session.

[0049] Optionally, the second communication device communicates with the first communication device through a third communication device. During the authentication process with the first communication device based on the first random identity information and the second shared key, the second communication device may also send a second session key to the third communication device, so that the third communication device can authenticate with the first communication device based on the second session key. After the authentication with the first communication device is successful, the second session key is determined as the shared session key with the first communication device. The second session key is generated by the second communication device based on the second shared key.

[0050] In this application, the first communication device can communicate with the second communication device through a third communication device. Based on this, the second communication device can provide a second session key to the third communication device using a second shared key shared with the first communication device. This allows the first communication device to generate a third session key using a first shared key shared with the second communication device, and then use the third session key for authentication and key negotiation with the third communication device. This not only prevents the first communication device from accessing a third communication device with security risks, but also ensures the security of subsequent data transmission between the first and third communication devices.

[0051] Optionally, the first random identity information is the initial random identity information of the first communication device, and the method further includes: negotiating the initial random identity information with the first communication device based on the fixed identity information of the first communication device, the identity information of the second communication device, and the initial shared key, wherein the initial shared key is an initial master key shared by the first communication device and the second communication device.

[0052] Optionally, negotiating the initial random identity information with the first communication device based on the fixed identity information of the first communication device, the identity information of the second communication device, and the initial shared key includes: receiving a fifth message from the first communication device, the fifth message including the fixed identity information of the first communication device, a third random number, and the sixth MAC, the sixth MAC being generated based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and the third random number; obtaining the initial shared key based on the fixed identity information of the first communication device; and, based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and the third random number, negotiating the initial random identity information with the first communication device. The sixth MAC is verified; if the verification of the sixth MAC is successful, the initial random identity information is generated based on the initial shared key, the third random number, and the fourth random number, and the initial shared key and the initial random identity information are stored accordingly; based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number, a seventh MAC is generated, and a sixth message is sent to the first communication device, the sixth message including the fourth random number and the seventh MAC, so that the first communication device generates the initial random identity information based on the initial shared key, the third random number, and the fourth random number if the verification of the seventh MAC is successful.

[0053] In this application, before the first communication device and the second communication device establish a session for the first time, the first communication device and the second communication device can obtain an initial shared key and negotiate an initial random identity information to be used in the first session based on the initial shared key. This allows the first communication device and the second communication device to use the initial random identity information to perform mutual authentication and negotiate a shared session key based on the initial shared key when establishing a session for the first time, thereby protecting the user identity information of the terminal from being leaked.

[0054] Thirdly, a communication method is provided, applied in a third communication device, the method comprising: receiving a second session key sent by a second communication device, the second session key being generated based on a second shared key, the second shared key being a master key shared by the second communication device and the first communication device; authenticating with the first communication device based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device; and, after successful authentication with the first communication device, determining the second session key as a shared session key with the first communication device.

[0055] In this system, the first communication device communicates with the second communication device via a third communication device. The third communication device can be used to connect the first communication device to a network. For example, the third communication device can be a wireless network access device in a wireless communication system, such as a base station; or, in the field of data communication or cloud computing, the third communication device can be a routing device such as a router or switch used to connect client devices to a server.

[0056] Optionally, the process of authenticating the first communication device based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device may include: generating a fourth MAC based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device; sending the fourth MAC to the first communication device, the fourth MAC being used to authenticate the third communication device; receiving a fifth MAC sent by the first communication device, the fifth MAC being generated by the first communication device based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device when the authentication of the third communication device is successful, the third session key being generated based on a first shared key, the first shared key being the master key shared by the first communication device and the second communication device; and authenticating the first communication device based on the second session key and the fifth MAC.

[0057] In this application, the first communication device can communicate with the second communication device through a third communication device. Furthermore, the third communication device, with the assistance of the second communication device, can perform authentication and key negotiation with the first communication device. This not only prevents the first communication device from accessing a third communication device with security risks but also ensures the security of subsequent data transmission between the first and third communication devices.

[0058] Fourthly, a communication method is provided, the method comprising: a first communication device acquiring first random identity information and a first shared key, wherein the first random identity information is identity information used by the first communication device and a second communication device in a current session, and the first shared key is a master key shared by the first communication device and the second communication device; the first communication device and the second communication device mutually authenticate each other based on their respective first shared key, second shared key, and first random identity information, wherein the second shared key is a master key shared by the second communication device and the first communication device; after successful authentication with the second communication device, the first communication device generates a first session key based on the first shared key, and updates the first random identity information to second random identity information based on the first session key; after successful authentication with the first communication device, the second communication device generates the first session key based on the second shared key, and updates the first random identity information to the second random identity information based on the first session key.

[0059] Optionally, the first communication device communicates with the second communication device through a third communication device. The method further includes: the second communication device sending a second session key to the third communication device, the second session key being generated by the second communication device based on the second shared key; the third communication device and the first communication device respectively authenticating each other based on their own second session key, third session key, identity information of the third communication device, and fixed identity information of the first communication device, the third session key being generated by the first communication device based on the first shared key; after the third communication device successfully authenticates with the first communication device, it determines the second session key as a shared session key with the first communication device; after the first communication device successfully authenticates with the third communication device, it determines the third session key as a shared session key with the first communication device.

[0060] Fifthly, a communication device is provided, the communication device comprising at least one module, the at least one module being configured to perform the communication method described in the first, second, third, or fourth aspects above.

[0061] A sixth aspect provides a communication device, the communication device including a processor, the processor being configured to execute at least one program instruction or code stored in a memory to implement the communication method described in the first, second, or third aspect above.

[0062] A seventh aspect provides a communication system comprising a first communication device and a second communication device, wherein the first communication device is configured to perform the communication method described in the first aspect, and the second communication device is configured to perform the communication method described in the second aspect. Optionally, the communication system further comprises a third communication device configured to perform the communication method described in the third aspect.

[0063] Alternatively, the communication system may include a first communication device, a second communication device, and a third communication device, wherein the first communication device, the second communication device, and the third communication device are used to perform the communication method described in the fourth aspect above.

[0064] Eighthly, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a computer device, cause the computer device to perform the communication method described in the first, second, or third aspect above.

[0065] Ninthly, a computer program product containing instructions is provided, which, when run on a computer device, causes the computer device to perform the communication method described in the first, second, or third aspect above.

[0066] The technical effects achieved by the fourth to ninth aspects mentioned above are similar to those achieved by the corresponding technical means in the first, second, and third aspects, and will not be repeated here. Attached Figure Description

[0067] Figure 1 is an architecture diagram of a wireless communication system to which the communication method provided in the embodiments of this application is applied;

[0068] Figure 2 is a schematic diagram of the initialization and pairing process of a terminal and a core network device according to an embodiment of this application;

[0069] Figure 3 is a flowchart of a terminal negotiating initial random identity information with a core network device according to an embodiment of this application;

[0070] Figure 4 is a flowchart of a terminal and core network equipment performing mutual authentication and negotiating shared session keys according to an embodiment of this application;

[0071] Figure 5 is a flowchart of mutual identity authentication between a terminal and a core network device provided in an embodiment of this application;

[0072] Figure 6 is a flowchart of identity authentication and key negotiation between a terminal, a base station, and a core network device according to an embodiment of this application;

[0073] Figure 7 is a flowchart of another method for identity authentication and key negotiation between a terminal, a base station, and a core network device provided in an embodiment of this application.

[0074] Figure 8 is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0075] Figure 9 is a schematic diagram of another communication device provided in an embodiment of this application;

[0076] Figure 10 is a schematic diagram of another communication device provided in an embodiment of this application;

[0077] Figure 11 is a schematic diagram of the structure of a communication device provided in an embodiment of this application. Detailed Implementation

[0078] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0079] Before providing a detailed explanation of the embodiments of this application, let's first introduce the application scenarios involved in the embodiments of this application.

[0080] Currently, in wireless communication systems, such as 5G communication systems, terminals and core network equipment can use the PSK-based 5G authentication and key agreement (5G-AKA) for authentication and key negotiation.

[0081] In 5G-AKA, the terminal uses the public key provided by the core network equipment to hide its subscription permanent identifier (SUPI), obtaining a subscription concealed identifier (SUCI), and then transmits the SUCI to the core network equipment. In this scenario, if the public key on the core network side is leaked, the terminal's SUPI may also be leaked. Therefore, 5G-AKA poses a risk of leaking user identity information. Furthermore, in 5G-AKA, if a network attacker intercepts a message carrying the SUCI transmitted by the terminal to the core network equipment, the attacker can replay the intercepted message in subsequent sessions between the terminal and the core network equipment. If the core network equipment responds correctly to the replayed message in a particular session, it indicates that the terminal corresponding to that session is the same terminal as the one with the intercepted message. In this way, the attacker can link the two sessions, thus obtaining a correlation between them. Based on this correlation, the attacker can further exploit user privacy, posing a threat to user privacy and security.

[0082] In addition, currently, in the network, the communicating parties can also achieve secure communication based on digital certificates, user identity identifiers, or pre-shared keys (PSKs).

[0083] In certificate-based communication, when a communication device applies for an authorized digital certificate, it provides its identity information to a third-party Certificate Authority (CA). This poses a risk of identity leakage for the CA. Furthermore, certificate-based communication relies on a complex Public Key Infrastructure (PKI) system, which has high maintenance costs. In addition, certificate-based communication involves asymmetric algorithms; however, some low-capacity communication devices, such as Internet of Things (IoT) terminals, cannot support asymmetric algorithms due to limited physical resources.

[0084] In user-identified communication, the communication device can use its own identity as a public key and provide it to a third-party key generation center (KGC). The KGC can then generate a private key for the communication device based on this identity. However, since the KGC obtains both the communication device's identity and private key, there is a risk of leaking user identity information. Furthermore, the private key generated by the KGC involves key escrow operations, which are complex and costly. In addition, user-identified communication uses asymmetric algorithms, making it unsuitable for low-capacity communication devices such as IoT terminals.

[0085] In PSK-based communication, a key distribution center can configure the PSK for both communicating parties. However, this also poses a risk of the key distribution center leaking user identity information. Furthermore, if the key distribution center configures the same PSK for multiple communication devices, and even one device leaks its PSK, the communication security of all those devices will be compromised. Therefore, PSK-based communication has relatively low security.

[0086] To address the problems existing in the various communication methods described above, this application provides a communication method. Taking a first communication device and a second communication device as examples, the first communication device authenticates itself with the second communication device based on first random identity information and a first shared key. After successful authentication, it generates a session key shared with the second communication device based on the first shared key. The first random identity information is the identity information negotiated between the first and second communication devices for the current session. After generating the shared session key for the current session, the first communication device updates the first random identity information to a second random identity information for authentication in the next session. Therefore, in this application embodiment, the first communication device can use a negotiated random identity information to interact with the second communication device in each session, thereby achieving mutual authentication and session key acquisition. Compared to 5G-AKA, because the first communication device uses different random identity information for authentication and key negotiation with the second communication device in each session, the true user identity information of the first communication device is protected. Furthermore, even if an attacker intercepts a message containing random identity information in a session and replays the message in a subsequent session, the second communication device cannot respond correctly to the replayed message because the random identity information used in each session is different. Thus, the attacker cannot obtain the correlation between sessions based on the response of the second communication device, thereby protecting user privacy and security.

[0087] Furthermore, compared to the aforementioned communication methods based on digital certificates, user identity identifiers, and PSKs, the communication method provided in this application does not rely on third-party services for authentication and key acquisition. Therefore, while achieving secure communication, it can reduce the risk of leakage of user identity information. Moreover, the communicating parties in this application embodiment can calculate the shared session key in the current session using a stored shared key. That is, the communicating parties use a symmetric algorithm to generate the key, resulting in lower communication and computational complexity. Therefore, it is more suitable for low-capability communication devices such as IoT terminals.

[0088] Finally, since the communication method provided in this application does not rely on a PKI system, it has lower communication costs compared to digital certificate-based communication methods. Furthermore, because the communication method provided in this application involves the two communicating parties interacting to obtain and store the shared session key for each session, it does not involve key escrow issues compared to user identity-based communication methods; and compared to PSK-based communication methods, it avoids the problem of one device leaking a session key while simultaneously threatening the communication security of multiple devices, thus offering higher security.

[0089] It should also be noted that in PSK-based 5G-AKA, the terminal and core network equipment can use a pre-set shared key to generate session keys. In this case, once the shared key is leaked, the session key for each session can be inferred based on this shared key. Consequently, the data transmitted by the terminal and core network equipment during the session will also be leaked. Therefore, PSK-based 5G-AKA lacks forward security. To address this issue, in the communication method provided in this application embodiment, the shared key between the terminal and the core network equipment can be updated with each session update. In other words, the shared key used by the terminal and the core network equipment to generate the session key is different in each session. In this case, even if the shared key in a certain session is leaked, the session key for each subsequent session cannot be inferred based on the leaked shared key, thus preventing the acquisition of the data transmitted in each session and achieving forward security.

[0090] The communication system used in the communication method provided in the embodiments of this application will be described next.

[0091] The communication method provided in this application can be applied to fields such as wireless communication, data communication, and cloud computing. For example, taking the application of this communication method in the field of wireless communication as an example, Figure 1 shows an architecture diagram of a wireless communication system to which the communication method provided in this application is applied. As shown in Figure 1, the wireless communication system may include a terminal 101, a radio access network (RAN) device 102, and a core network device 103.

[0092] Terminal 101 is a device with wireless transceiver capabilities, capable of sending signals to or receiving signals from RAN equipment 102. Terminal 101 can also be referred to as a terminal device, user equipment (UE), mobile station (MS), or mobile terminal (MT). For example, terminal 101 can be a handheld device, in-vehicle device, wearable device, or computing device with wireless communication capabilities, such as a mobile phone, tablet computer, laptop computer, PDA, mobile internet device (MID), smart bracelet, or smart glasses. Terminal 101 can also be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in autonomous driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home, an ambient IoT (A-IoT) terminal, a passive IoT (P-IoT) terminal, and so on. In the embodiments of this application, the apparatus for implementing the functions of the terminal can be referred to as the terminal. Alternatively, an apparatus capable of supporting the terminal in implementing the functions may be installed in the terminal; for example, the apparatus may be a chip system. The chip system may consist of chips or may include chips and other discrete components.

[0093] RAN device 102, also known as RAN node, RAN entity, or access node, is used to help terminal 101 access the communication system wirelessly. In one application scenario, RAN device 102 can be a base station, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next-generation NodeB (gNB) in a 5th generation (5G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system.

[0094] Core network equipment 103 is a collective term for various functional entities on the network side used to manage users, data transmission, and base station configuration. For example, core network equipment 103 may include access and mobility management function (AMF) entities, user plane function (UPF) entities, session management function (SMF) entities, unified data management (UDM) entities, authentication server function (AUSF) entities, network slice selection function (NSSF) entities, and operation administration and maintenance (OAM) entities, etc.

[0095] In this embodiment of the application, when the terminal 101 accesses the network, it can use the communication method provided in this embodiment of the application to interact with the core network device 103 through the RAN device 102, so as to perform mutual authentication with the core network device 103 and generate a session key, thereby realizing secure communication between the core network device 103 and the terminal 101.

[0096] It should be noted that the aforementioned wireless communication systems can be, for example, 5G communication systems, long term evolution (LTE) communication systems, enhanced long term evolution (eLTE) communication systems, and other future-oriented communication systems.

[0097] Furthermore, the above is merely an example of a communication system for the communication method provided in this application embodiment when applied to the field of wireless communication. As can be seen from the foregoing description, the communication method provided in this application embodiment can also be applied to the fields of data communication, cloud computing, etc. Based on this, in one possible scenario, when the communication method provided in this application embodiment is applied to the field of data communication, the communication system to which this communication method is applicable may include a terminal, a forwarding device, and a server. The terminal communicates with the server through the forwarding device, which can be a network device such as a router or switch. In this case, when the terminal establishes a session with the server, the terminal and the server can perform mutual authentication and negotiate a session key using the communication method provided in this application embodiment, thereby ensuring the communication security between the terminal and the server.

[0098] In another possible scenario, when the communication method provided in this application is applied to the field of cloud computing, the communication system to which the communication method is applicable may include a terminal and a cloud server. In this case, when the terminal establishes a connection with the cloud server, the terminal and the cloud server can perform mutual authentication and negotiate session keys through the communication method provided in this application, thereby ensuring the communication security between the terminal and the server.

[0099] The communication method provided in the embodiments of this application will be described in detail below.

[0100] In this embodiment, the first communication device authenticates itself with the second communication device based on first random identity information and a first shared key. After successful authentication, the first communication device generates a session key shared with the second communication device based on the first shared key. The first random identity information is the identity information negotiated between the first and second communication devices for the current session, and the first shared key is the master key shared by the first and second communication devices stored in the first communication device. Therefore, before the first and second communication devices initiate their first session, they can obtain the shared master key and the random identity information to be used in the first session. In this embodiment, the process of obtaining the shared master key and the random identity information to be used in the first session before the first session can be referred to as the initialization and pairing process of the first and second communication devices. Furthermore, the shared master key obtained during this initialization and pairing process can be called the initial shared key, and the obtained random identity information can be called the initial random identity information.

[0101] The initialization and pairing process of the first and second communication devices will be described below. The first communication device can be a terminal in the aforementioned wireless communication system, and the second communication device can be a core network device in the same system; alternatively, the first communication device can be a terminal in a data communication system, and the second communication device can be a server in that system; or the first communication device can be a terminal in a cloud computing environment, and the second communication device can be a cloud server. In the various embodiments described below, the first communication device will be a terminal in the wireless communication system, and the second communication device will be a core network device. For example, referring to Figure 2, the initialization and pairing process may include the following steps:

[0102] S20: The terminal obtains the initial shared key.

[0103] In this embodiment, the terminal manufacturer or operator can generate an initial shared key for the terminal and core network equipment, and send the initial shared key to the terminal. Accordingly, the terminal receives and stores the initial shared key.

[0104] In one possible implementation, at the time of terminal shipment or during the initialization phase, the manufacturer or operator can generate an initial shared key based on a first master key and the terminal's hardware identifier, and send this initial shared key to the terminal. The first master key can be the master key assigned by the manufacturer or operator to the core network equipment.

[0105] For example, a manufacturer or operator can generate an initial shared key using the following formula 1: K(0)=PRF(MK,HWID) (1)

[0106] Where K(0) is the initial shared key, MK is the first master key, HWID is the hardware identifier of the terminal, and PRF() is the pseudo random function.

[0107] It should be noted that the pseudo-random function can be based on the AES-CMAC algorithm, for example, AES-CMAC-PRF-128. Here, AES stands for Advanced Encryption Standard, a symmetric encryption algorithm. CMAC is short for Cipher-Based Message Authentication Code. 128 indicates that the PRF generates a 128-bit sequence. Alternatively, the pseudo-random function can also use a hash-based message authentication code (HMAC) function.

[0108] In addition, the terminal's hardware identifier can be used to uniquely identify the terminal. For example, the terminal's hardware identifier can be its hardware sequence number or device identification code, such as the International Mobile Equipment Identity (IMEI).

[0109] In another possible implementation, the manufacturer or operator may also randomly generate a sequence as the initial shared key between the terminal and the core network equipment, and send the initial shared key to the terminal.

[0110] After receiving the initial shared key, the terminal can either directly store it, or store its own user identifier corresponding to the initial shared key. The terminal's user identifier can refer to its identity information within the current communication system. For example, the terminal's user identifier could be its International Mobile Subscriber Identity (IMSI) or Subscription Permanent Identifier (SUPI).

[0111] S21: Core network devices obtain the initial shared key.

[0112] In some embodiments, after generating an initial shared key, the manufacturer or operator can send the initial shared key and the terminal's hardware identifier to the core network equipment. Upon receiving the initial shared key and the terminal's hardware identifier, the core network equipment can store the corresponding hardware identifier and initial shared key in a first mapping table. This first mapping table stores the mapping relationship between hardware identifiers and shared keys.

[0113] Optionally, if the core network device also stores the user identifier of the terminal, the core network device can store the hardware identifier of the terminal, the user identifier of the terminal, and the initial shared key in a first mapping table. In this case, the first mapping table stores the mapping relationship between the hardware identifier, the user identifier, and the shared key.

[0114] Optionally, when sending the initial shared key and the hardware identifier of the terminal to the core network equipment, the manufacturer or operator may also send the first master key assigned to the core network equipment. The core network equipment may store the first master key.

[0115] In other embodiments, after generating the initial shared key, the manufacturer or operator may also send a first master key used to generate the initial shared key and the hardware identifier of the terminal to the core network equipment. Correspondingly, upon receiving the first master key and the terminal's hardware identifier, the core network equipment may use the same algorithm as the manufacturer or operator to generate the initial shared key based on the first master key and the terminal's hardware identifier. Then, the hardware identifier of the terminal and the initial shared key are stored correspondingly in a first mapping table.

[0116] Optionally, if the core network device also stores the user identifier of the terminal, the core network device can store the hardware identifier of the terminal, the user identifier of the terminal, and the initial shared key in the first mapping table.

[0117] S22: The terminal negotiates initial random identity information with the core network equipment based on the initial shared key, the terminal's fixed identity information, and the core network equipment's identity information.

[0118] After obtaining the initial shared key with the core network device, the terminal can proactively initiate pairing with the core network device to negotiate initial random identity information. For example, referring to Figure 3, the process of the terminal negotiating random identity information with the core network device may include the following steps:

[0119] 221: The terminal generates a sixth MAC based on the initial shared key, its own fixed identity information, the identity information of the core network equipment, and a third random number.

[0120] In some embodiments, the terminal may generate a third random number. Then, based on the initial shared key, its own fixed identity information, the identity information of the core network device, and the third random number, an end-side session key is generated, and then based on the end-side session key and the third random number, a sixth MAC is generated.

[0121] The fixed identity information of the terminal may include the terminal's hardware identifier and the terminal's user identifier. The terminal may generate a terminal-side session key based on the initial shared key, its own hardware identifier, the identity information of the core network device, and a third random number.

[0122] For example, the terminal can generate the terminal-side session key using the following formula 2: k0=PRF(K(0),IDc ||IDs||R3||string0) (2)

[0123] Where k0 is the terminal-side session key, K(0) is the initial shared key, IDc is the user identifier of the terminal, and IDs is the identity information of the core network device, such as the device identifier of the core network device. R3 is the third random number generated by the terminal, and string0 is a preset string, such as the string "initial", to indicate that k0 is the terminal-side session key generated during initialization and pairing. "||" indicates concatenating the strings before and after.

[0124] After generating the end-side session key, the terminal can generate the sixth MAC using the following formula 3: mac6=MAC(k0,R3) (3)

[0125] Here, mac6 is the sixth MAC, and MAC() refers to the function used to generate the MAC. For example, MAC() can be a function based on the AES-CMAC algorithm.

[0126] In other embodiments, the terminal may generate a third random number and then directly generate a sixth MAC based on the initial shared key, its own fixed identity information, the identity information of the core network device, and the third random number.

[0127] For example, the terminal can generate the sixth MAC using the following formula 4.

[0128] mac6=MAC(K(0),IDc||IDs||R3||string0) (4)

[0129] 222: The terminal sends a fifth message to the core network equipment, which includes the terminal's fixed identity information, a third random number, and a sixth MAC address.

[0130] In this embodiment, the terminal can communicate with the core network equipment via a third communication device. In a wireless communication system, this third communication device can be a RAN (Radio Access Network) device. Taking a base station as an example, the terminal can send a fifth message to the base station, which then forwards the fifth message to the core network equipment.

[0131] It should be noted that a secure transmission channel can be established between the base station and the core network equipment. For example, the base station and the core network equipment can establish a Transport Layer Security (TLS) connection. In this case, the base station can forward the fifth message to the core network equipment through this secure transmission channel. In the embodiments described below, all messages transmitted between the base station and the core network equipment can be transmitted through this secure transmission channel.

[0132] Furthermore, as described above, the fixed identity information of a terminal may include the terminal's hardware identifier and the terminal's user identifier, and the core network equipment stores the mapping relationship between the terminal's hardware identifier and the corresponding initial shared key. Therefore, the fixed identity information of the terminal included in the fifth message can refer to the terminal's hardware identifier.

[0133] Optionally, if the core network equipment also stores the mapping relationship between the terminal's user identifier and the initial shared key, then the fixed identity information of the terminal included in the fifth message may refer to the terminal's user identifier.

[0134] Optionally, the fixed identity information of the terminal in the fifth message may also include the terminal's hardware identifier and user identifier.

[0135] 223: Core network equipment obtains the initial shared key based on the fixed identity information of the terminal.

[0136] After receiving the fifth message, the core network equipment can obtain the initial shared key between itself and the terminal based on the fixed identity information of the terminal carried in the fifth message.

[0137] For example, if the fifth message carries the hardware identifier of the terminal, the core network device can obtain the initial shared key corresponding to the hardware identifier of the terminal from the first mapping table stored in its own storage.

[0138] If the fifth message carries the user identifier of the terminal, the core network device can also obtain the initial shared key corresponding to the user identifier of the terminal from the first mapping table stored in its own storage.

[0139] 224: The core network equipment verifies the sixth MAC based on the initial shared key, the terminal's fixed identity information, its own identity information, and a third random number.

[0140] After obtaining the initial shared key, the core network device can use the same calculation method as the terminal when calculating the sixth MAC. Based on the initial shared key, its own identity information, the fixed identity information of the terminal carried in the fifth message, and the third random number, it can generate the verification MAC corresponding to the sixth MAC.

[0141] For example, if the terminal uses the sixth MAC calculated by the aforementioned formulas 2 and 3, the core network device can first use the aforementioned formula 2 to calculate the core network side session key based on the initial shared key, its own identity information, the terminal's fixed identity information in the fifth message, the third random number, and the preset string. Then, it can use formula 3 to calculate the verification MAC corresponding to the sixth MAC based on the core network side session key and the third random number.

[0142] If the terminal uses the sixth MAC calculated using Formula 4, the core network device can also use Formula 4 to calculate the verification MAC corresponding to the sixth MAC based on the initial shared key, its own identity information, the terminal's fixed identity information in the fifth message, the third random number, and the preset string.

[0143] After obtaining the verification MAC corresponding to the sixth MAC, the core network device can compare whether the sixth MAC and the corresponding verification MAC are the same in order to verify the sixth MAC.

[0144] If the verification MAC corresponding to the sixth MAC is the same as the sixth MAC, then the verification of the sixth MAC is successful. At this point, it can be determined that the fixed identity information of the terminal and the third random number carried in the fifth message have not been tampered with, and that the initial shared keys stored in the core network device and the terminal are the same. In this case, the core network device can perform the following step 225.

[0145] If the verification MAC corresponding to the sixth MAC is different from the sixth MAC, the verification of the sixth MAC fails. In this case, it can be determined that the fixed identity information of the terminal or the third random number carried in the fifth message has been tampered with, or that the initial shared keys stored in the core network device and the terminal are different. In this situation, the core network device can terminate the operation or return a pairing failure notification to the terminal.

[0146] 225: If the core network device passes the verification of the sixth MAC, it generates initial random identity information based on the initial shared key, the third random number, and the fourth random number, and stores the initial shared key and the initial random identity information accordingly.

[0147] After the sixth MAC verification is successful, the core network device can generate a fourth random number. Then, based on the initial shared key, the third random number, and the fourth random number, the core network device can generate the initial random identity information of the terminal using the following formula 5: RID(0)=PRF(K(0),R3||R4) (5)

[0148] Where RID(0) is the initial random identity information of the terminal, and R4 is the fourth random number generated by the core network device.

[0149] After generating the initial random identity information for the terminal, the core network device can store the initial random identity information of the terminal in correspondence with the user identifier of the terminal. For example, the core network device can store the mapping relationship between the user identifier of the terminal and the initial random identity information in a first mapping relationship table. At this time, the first mapping relationship table stores the mapping relationship between the terminal's hardware identifier, user identifier, initial shared key and initial random identity information.

[0150] 226: The core network equipment generates the seventh MAC based on the initial shared key, the terminal's fixed identity information, its own identity information, the third random number, and the fourth random number.

[0151] If the core network device generates a core network-side session key during the sixth MAC verification process, then after the sixth MAC verification is successful, the core network device can generate the seventh MAC based on the core network-side session key, the third random number, and the fourth random number using the following formula 6: mac7=MAC(k'0,R3||R4) (6)

[0152] Among them, mac7 is the seventh MAC, and k'0 is the core network side session key.

[0153] Optionally, if the core network device calculates the verification MAC corresponding to the sixth MAC based on Formula 4, then after the sixth MAC is verified, the core network device can generate the seventh MAC using the following Formula 7: mac7=MAC(K(0),IDc||IDs||R3||R4||string0) (7)

[0154] 227: The core network equipment sends a sixth message to the terminal, which includes a fourth random number and a seventh MAC address.

[0155] Among them, core network equipment can send a sixth message to the terminal through the base station.

[0156] 228: The terminal verifies the seventh MAC based on the initial shared key, its own fixed identity information, the identity information of the core network equipment, the third random number, and the fourth random number.

[0157] After receiving the sixth message, the terminal can use the same calculation method as the core network device when generating the seventh MAC. Based on the initial shared key, its own fixed identity information, the core network device's identity information, the third random number, and the fourth random number carried in the sixth message, it generates the verification MAC corresponding to the seventh MAC. Then, the seventh MAC is verified by comparing it with the corresponding verification MAC.

[0158] If the seventh MAC address is the same as the corresponding verification MAC address, then the verification of the seventh MAC address is successful. At this point, the terminal can determine that the fourth random number carried in the sixth message has not been tampered with, and that the initial shared key held by the core network device is the same as the initial shared key stored by itself. In this case, the terminal can execute step 229 below.

[0159] If the seventh MAC address and its corresponding verification MAC address are different, the verification of the seventh MAC address fails. In this case, the terminal can determine that the fourth random number carried in the sixth message has been tampered with, or that the initial shared key held by the core network device is different from the initial shared key it stores. In this situation, the terminal can either terminate the operation or return a pairing failure notification to the core network device. Correspondingly, after receiving the pairing failure notification, the core network device can delete the stored initial random identity information of the terminal.

[0160] 229: If the terminal verifies the seventh MAC, it generates initial random identity information based on the initial shared key, the third random number, and the fourth random number, and stores the initial random identity information.

[0161] After successful verification of the seventh MAC address, the terminal can use the same calculation method as the core network equipment to calculate its initial random identity information. Based on the initial shared key, the third random number, and the fourth random number carried in the sixth message, it generates its own initial random identity information. The terminal can then store this initial random identity information. For example, the terminal can store its own user identifier associated with this initial random identity information.

[0162] In this embodiment, before the terminal establishes its first session with the core network device, the terminal and the core network device can obtain an initial shared key and negotiate initial random identity information to be used in the first session based on the initial shared key. Subsequently, when establishing a session, the terminal and the core network device can use the initial random identity information to perform mutual authentication based on the initial shared key and negotiate a shared session key, thereby protecting the terminal's user identity information from being leaked.

[0163] It should be noted that the above is an example process illustrating how a terminal and core network equipment obtain an initial shared key and initial random identity information, as shown in an embodiment of this application. In some possible scenarios, the terminal and core network equipment may also obtain the initial random identity information through other means. For example, the initial random identity information may be pre-configured in the terminal and core network equipment by a third-party service. This embodiment of the application does not limit this approach.

[0164] The following describes the process by which the terminal and core network equipment perform mutual authentication and negotiate a shared session key using the negotiated random identity information and the pre-stored shared key. For example, referring to Figure 4, this process may include the following steps:

[0165] S40: The terminal obtains its own first random identity information and first shared key. The first random identity information is the identity information used by the terminal in the current session with the core network device, and the first shared key is the master key shared by the terminal and the core network device.

[0166] In this embodiment, the terminal can establish a session with the core network device to access the network. When the terminal accesses the network, it can proactively initiate an authentication process with the core network device. At this time, the terminal can obtain its first random identity information and first shared key.

[0167] Alternatively, when a terminal accesses the network, the authentication process can be initiated by the core network device. For example, the core network device can generate a second random number and send a broadcast message to the terminal via a base station to trigger the authentication process. This broadcast message includes the second random number. After receiving the broadcast message, the terminal can store the second random number from the broadcast message and obtain its own first random identity information and first shared key.

[0168] If the terminal is accessing the network for the first time, the terminal's first random identity information is the initial random identity information negotiated between the terminal and the core network equipment during the initialization and pairing process, and the corresponding first shared key is the initial shared key.

[0169] If the terminal is not accessing the network for the first time, its first random identity information can be the random identity information updated after the terminal completed authentication with the core network device and obtained a session key during its previous network access. The first shared key can be the initial shared key, or it can be an updated version of the shared key used in the previous authentication and session key negotiation process.

[0170] S41: The terminal and the core network equipment authenticate each other based on the first random identity information, the first shared key and the second shared key, wherein the second shared key is the master key shared with the terminal in the core network equipment.

[0171] For example, referring to Figure 5, the terminal and the core network device can perform mutual authentication through the following steps 511 to 521.

[0172] 511: The terminal generates a first MAC based on the first shared key, the first auxiliary information, the first random identity information, and the identity information of the core network device.

[0173] In the first implementation, the master key shared by the terminal and the core network device remains unchanged each time the terminal accesses the network. That is, the first shared key used by the terminal during each authentication and key negotiation process with the core network device is the initial shared key obtained during initialization and pairing between the terminal and the core network device. In this case, the terminal can generate a first random number, and the first auxiliary information may include this first random number. Then, the terminal generates a first end-side random key based on the first shared key, the first random number, the first random identity information, and the identity information of the core network device. Based on this first end-side random key, the first random number, the first random identity information, and the identity information of the core network device, a first MAC address is generated.

[0174] For example, the terminal can generate the first end-side random key using the following formula 8: Rk0=PRF(K(i),RID(i)||IDs||R1||string1) (8)

[0175] In this implementation, Rk0 is the first end-side random key, K(i) is the first shared key, RID(i) is the first random identity information, and i can be used to indicate the number of times the terminal has accessed the network. When the terminal is accessing the network for the first time, i can be equal to 0. In this implementation, K(i) remains unchanged regardless of the value of i. IDs is the identity information of the core network device, R1 is the first random number, and string1 is a preset string. For example, string1 can be "0", used to indicate that the first end-side random key is the first key generated by the terminal in this authentication process.

[0176] After generating the first end-side random key, the terminal can generate the first MAC using the following formula 9: mac1=MAC(Rk0,RID(i)||IDs||R1) (9)

[0177] Here, mac1 is the first MAC, and MAC() can be a function based on the AES-CMAC algorithm.

[0178] In the second implementation, each time the terminal accesses the network, the shared master key used by the terminal and the core network device in this network access is obtained by updating the shared master key from the previous network access. That is, the shared master key between the terminal and the core network device is updated with each session update. Based on this, the terminal can be equipped with a first counter. The count value of the first counter can be used to indicate the number of times the terminal updates the shared master key with the core network device. In other words, the count value of the first counter can be used to indicate how many times the terminal has cyclically updated the initial shared key to obtain the currently held shared key. In this case, the terminal can generate a first random number and obtain the current count value of the first counter. For example, the current count value of the first counter is a first count value C1, and the first auxiliary information includes the first random number and C1. Then, the terminal generates a first end-side random key based on the first shared key, the first random number, the first random identity information, and the identity information of the core network device, and generates a first MAC based on the first end-side random key, the first random number, the first random identity information, the identity information of the core network device, and C1.

[0179] The terminal can generate a first end-side random key using the aforementioned formula 8. Then, a first MAC can be generated using the following formula 10: mac1=MAC(Rk0,RID(i)||IDs||R1||C1) (10)

[0180] It should be noted that if the authentication process is initiated by the core network device, the terminal will also store a second random number broadcast by the core network device. In this case, the second random number can also be used as a parameter when generating the first end-side random key and the first MAC. For example, in Equation 8 above, the second random number R2 can be concatenated between R1 and string1. Similarly, in Equation 9 above, R2 is concatenated after R1, or in Equation 10 above, R2 is concatenated between R1 and C1.

[0181] 512: The terminal sends a first message to the core network equipment. The first message includes first auxiliary information, first random identity information, and first MAC address.

[0182] In this embodiment, the terminal can communicate with the core network equipment via a base station. Based on this, the terminal can send a first message to the base station, which then forwards the first message to the core network equipment. This first message can be an authentication request.

[0183] It should be noted that when the master key shared by the terminal and the core network equipment remains unchanged in each session, the terminal does not set a first counter. In this case, the first auxiliary information is the first random number. If the master key shared by the terminal and the core network equipment is updated with each session update, the terminal will set a first counter. Since the count value of the first counter used in calculating the first MAC is C1, the first auxiliary information includes the first random number and C1.

[0184] 513: The core network device obtains the second shared key based on the first random identity information in the first message.

[0185] After receiving the first message, the core network device can obtain the second shared key based on the first random identity information in the first message.

[0186] In this embodiment, the core network device may store a first mapping table, which stores the mapping relationships between hardware identifiers, user identifiers, random identity information, and shared keys. Based on this, the core network device can use the first random identity information to obtain the shared key corresponding to the first random identity information from the first mapping table. This shared key is the second shared key, which is the master key currently held by the core network device and shared between itself and the terminal.

[0187] 514: The core network equipment verifies the first MAC based on the second shared key, the first auxiliary information, the first random identity information, and its own identity information.

[0188] After obtaining the second shared key, the core network device can use the same calculation method as the terminal to calculate the first MAC. First, based on the second shared key it holds, its own identity information, and the first random number and first random identity information in the first auxiliary information carried in the first message, it generates a first core network side random key. Then, it uses the first core network side random key, its own identity information, and the first auxiliary information and first random identity information carried in the first message to generate a verification MAC corresponding to the first MAC, and uses the verification MAC corresponding to the first MAC to verify the first MAC.

[0189] If the first MAC address matches the corresponding verification MAC address, the verification of the first MAC address is successful. In this case, it can be determined that the first random identity information and the first auxiliary information carried in the first message have not been tampered with, and that the second shared key held by the core network device is the same as the first shared key held by the terminal. Under these circumstances, the core network device can perform subsequent steps to further authenticate the terminal.

[0190] Optionally, if the terminal calculates the first MAC address using the first implementation method in step 511, the core network device can determine that the terminal's authentication has been successful after obtaining the verification MAC address corresponding to the first MAC address using the same calculation method and verifying the first MAC address. In this case, the core network device can execute step 43 after executing steps 515 and 516. Alternatively, the core network device can execute step 43 after receiving the authentication success notification sent by the terminal in step 517.

[0191] If the first MAC address does not match the corresponding verification MAC address, the verification of the first MAC address fails. In this case, it can be determined that the first random identity information and / or the first auxiliary information carried in the first message has been tampered with, or that the second shared key held by the core network device is different from the first shared key held by the terminal. In this situation, the core network device can terminate the operation, or the core network device can return an authentication failure notification to the terminal.

[0192] 515: If the core network device verifies the first MAC, it generates the second MAC based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and its own identity information.

[0193] After the first MAC verification is successful, the core network device can obtain the second auxiliary information and generate the second MAC based on its own second shared key, the second auxiliary information, its own identity information, and the first auxiliary information and first random identity information carried in the first message.

[0194] In the first implementation, if the first auxiliary information includes a first random number but does not include the first count value C1, the core network device can obtain a second random number, and the second auxiliary information includes the second random number. Then, the core network device can generate a second core network-side random key based on the second shared key, the first random number, the second random number, the first random identity information, and its own identity information. Afterward, it generates a second MAC address based on the second core network-side random key, the first random identity information, the first random number, and the second random number.

[0195] It should be noted that if the authentication process is initiated by the core network device, the core network device can obtain the second random number previously broadcast to the terminal; if the authentication process is initiated by the terminal, the core network device generates the second random number.

[0196] After obtaining the second random number, the core network device can generate the second core network side random key using the following formula 11: Rk1=PRF(K(i)',RID(i)||IDs||R1||R2||string2) (11)

[0197] Where Rk1 is the second core network side random key; K(i)' is the second shared key held by the core network device; R2 is the second random number; and string2 is a preset string, for example, string2 can be "1", which is used to indicate that the second core network side random key is the second key generated by the core network device in this authentication process.

[0198] After generating the second core network side random key, the core network device can generate the second MAC using the following formula 12: mac2=MAC(Rk1,RID(i)||IDs||R1||R2||string2) (12)

[0199] Among them, mac2 is the second MAC.

[0200] In the second implementation, if the first auxiliary information includes a first random number and a first count value C1, the core network device will also have a corresponding second counter. The count value of the second counter is used to indicate the number of times the core network device updates the master key shared with the terminal. In other words, the count value of the second counter can be used to indicate how many times the core network device has cyclically updated the initial shared key to obtain the shared key currently held by the core network device. Based on this, the core network device can obtain the second random number and the current count value of the second counter. Then, the core network device can determine whether C1 is greater than the current count value of the second counter. If C1 is greater than the current count value of the second counter, the second shared key is updated D2 times based on the difference D2 between C1 and the current count value of the second counter, and the current count value of the second counter is updated to C1. Then, based on the updated second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the core network device, a second MAC is generated, wherein the second auxiliary information includes the second random number and the second count value C2, and C2 is equal to the current count value of the second counter.

[0201] It should be noted that, as described above, the count value of the first counter indicates the number of times the terminal updates its stored shared key, while the count value of the second counter indicates the number of times the core network device updates its stored shared key. Therefore, the first count value included in the first auxiliary information actually indicates the update status of the first shared key currently stored in the terminal, while the current count value of the second counter indicates the update status of the second shared key currently stored in the core network device. Based on this, if C1 is greater than the current count value of the second counter, it means that the number of times the terminal updates the shared key is greater than the number of times the core network device updates the shared key, that is, the update status of the first shared key is ahead of the update status of the second shared key. In this case, the core network device can update the second shared key D2 times based on the difference D2 between C1 and the current count value of the second counter, thereby ensuring that the update statuses of the first and second shared keys are consistent.

[0202] For example, the core network device can use the following formula 13 to cyclically update the second shared key D2 times. K(i)' m =KeyUpdate(K(i)' m-1 ,string3) (13)

[0203] Where K(i)' m It is the second shared key obtained in the m-th update, K(i)' m-1 Let K(i)' be the second shared key obtained in the (m-1)th update, where m takes values ​​from 1 to D2. When m is 1, K(i)'m-1 This indicates that the second shared key has not yet been updated. `string3` is a preset string, for example, `string3` could be "update". `KeyUpdate()` is the key update function; for example, `KeyUpdate()` could be a PRF based on the AES-CMAC algorithm, or an HMAC function.

[0204] Since the count value of the second counter is used to indicate the number of times the core network device updates the shared key it holds, after the second shared key is updated D2 times, the count value of the second counter will also increase by D2 times. For example, after increasing by D2 times, the current count value of the second counter becomes the second count value C2. At this time, C2 is equal to C1.

[0205] After updating the count values ​​of the second shared key and the second counter, the core network device can use the aforementioned formula 11 to generate a second core network side random key based on the updated second shared key, the first random number, the second random number, the first random identity information, and its own identity information. Then, based on the second core network side random key, the first random number, the second random number, the first count value C1, the second count value C2, the first random identity information, and its own identity information, it can generate a second MAC.

[0206] For example, the core network device can generate the second MAC using the following formula 14: mac2=MAC(Rk1,RID(i)||IDs||R1||R2||C1||C2||string2) (14)

[0207] Optionally, if the core network device determines that C1 is not greater than the current count value of the second counter by comparing the current count values ​​of C1 and the second counter, the core network device can generate a second MAC based on the second shared key, the first auxiliary information, the second random number, the current count value of the second counter, the first random identity information, and its own identity information.

[0208] It should be noted that if C1 equals the current count value of the second counter, it indicates that the update states of the first and second shared keys are consistent. If C1 is less than the current count value of the second counter, it indicates that the number of times the terminal updates the shared key is less than the number of times the core network device updates the shared key, meaning that the update state of the first shared key lags behind the update state of the second shared key. When the update states of the first and second shared keys are the same or lag behind, the core network device does not need to update its own second shared key or the current count value of the second counter. Based on this, the core network device can directly generate a second core network-side random key using the current second shared key, and generate a second MAC address using the aforementioned method.

[0209] 516: The core network equipment sends a second message to the terminal, which includes a second MAC address.

[0210] After generating the second MAC address, the core network equipment can send a second message to the terminal via the base station, which includes the second MAC address.

[0211] If the authentication process is initiated by the terminal and the core network device does not broadcast the second random number to the terminal in advance, the second message also includes second auxiliary information, which includes the second random number.

[0212] Optionally, if a second counter is also provided in the core network device, the second message may also include second auxiliary information, which includes the current count value of the second counter. For example, if the current count value of the second counter is C2, the second message may also include C2.

[0213] Optionally, in some embodiments, since the terminal and core network equipment communicate through a base station, in order to ensure communication security between the terminal and the base station in this embodiment, the core network equipment can also generate a second session key based on a second shared key and send the second session key to the base station. Based on this, the terminal can generate a third session key based on its own first shared key. The terminal and the base station can use their respective third session key and second session key to perform mutual authentication to determine whether the third session key and the second session key are the same, thereby enabling the terminal and the base station to decide whether to use the session key for communication.

[0214] Among them, after generating the second core network side random key, the core network equipment can generate the second session key based on the second shared key, the base station's identity information, its own identity information, the first random number and the second random number.

[0215] For example, the core network device can generate the second session key using the following formula 15: SK2=PRF(K(i)′,IDr||IDs||R1||R2||string4) (15)

[0216] Where SK2 is the second session key; K(i)′ is the second shared key. It should be noted that if the core network device does not update the second shared key based on the current count values ​​of C1 and the second counter, then K(i)′ is the unupdated second shared key; if the core network device updates the second shared key based on the current count values ​​of C1 and the second counter, then K(i)′ is the updated second shared key. string4 is a preset string, for example, string4 can be 2, used to indicate that this second session key is the third key generated by the core network device during this authentication process.

[0217] After generating the second session key, the core network device can send it to the base station in a second message. Upon receiving the second message containing the second session key, the base station can generate a fourth MAC address based on the second session key, its own identity information, and the terminal's fixed identity information. Then, the second session key is removed from the second message, and the fourth MAC address is added to the second message. Finally, the second message is forwarded to the terminal.

[0218] For example, the base station can use the following formula 16 to calculate the fourth MAC: mac4=MAC(PRF(SK2,R1||R2),IDc||IDr||R1||R2||string5) (16)

[0219] Here, mac4 is the fourth MAC address, IDc is the user identifier of the terminal, which is the fixed identity information of the terminal, and string5 is a preset string, for example, string5 can be "1".

[0220] It should be noted that the core network equipment can also send the second session key to the base station in other messages besides the second message. For example, the second session key can be sent in a separate message. In this case, after the base station generates the fourth MAC based on the second session key, it can also send the fourth MAC to the terminal in a separate message.

[0221] 517: The terminal authenticates the core network device based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the core network device, and the second MAC.

[0222] After receiving the second message sent by the core network device, the terminal can generate the verification MAC corresponding to the second MAC based on the information carried in the second message, using the same calculation method as the core network device in calculating the second MAC, and use the verification MAC corresponding to the second MAC to verify the second MAC.

[0223] In the first implementation, if the first auxiliary information does not include the first count value C1, then the second message will not include the second count value C2. In this case, the terminal can use the method for generating the second MAC described in the first implementation in step 515 to generate a second end-side random key based on the first shared key, the first random number, the second random number, the first random identity information, and the identity information of the core network device. Then, the terminal generates the verification MAC corresponding to the second MAC based on the second end-side random key, the first random identity information, the first random number, and the second random number.

[0224] After generating the verification MAC corresponding to the second MAC, the terminal can compare the second MAC in the second message with the corresponding verification MAC. If they are the same, the verification of the second MAC is successful. At this time, the terminal can determine that the authentication of the core network device is successful, and the terminal can execute S42.

[0225] Optionally, the terminal can also send a successful authentication notification to the core network equipment.

[0226] In the second implementation, if the first auxiliary information includes C1, then the second message will include C2. In this case, the terminal can compare C2 with the current count value of the first counter. If C2 is greater than the current count value of the first counter, it indicates that the update status of the first shared key lags behind the update status of the current second shared key in the core network device. In this case, the terminal can calculate the difference D1 between C2 and the current count value of the first counter. Then, referring to the method for updating the second shared key described in step 515 above, the first shared key is updated cyclically D1 times, and the current count value of the first counter is updated to C2. Afterward, the terminal can use the same calculation method as in step 515 above to calculate the second MAC based on the updated second shared key. First, a second end-side random key is generated based on the updated first shared key, the first random number, the second random number, the first random identity information, and the identity information of the core network device. Then, based on the second end-side random key, the first random number and C1, the second auxiliary information, the first random identity information, and the identity information of the core network device, the verification MAC corresponding to the second MAC is generated. The second auxiliary information includes the second random number and C2.

[0227] Optionally, if C2 is not greater than the current count value of the first counter, it indicates that the update status of the first shared key is the same as or ahead of the update status of the current second shared key in the core network device. In this case, the terminal can directly generate the verification MAC corresponding to the second MAC based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and its own identity information.

[0228] After generating the verification MAC corresponding to the second MAC, the terminal can compare the second MAC in the second message with the corresponding verification MAC. If they are the same, the verification of the second MAC is successful. At this point, the terminal can determine that the authentication of the core network device is successful. Afterward, the terminal can continue to execute steps 518 to 521 below so that the core network device can authenticate the terminal.

[0229] Optionally, if the second MAC address is different from the corresponding verification MAC address, the verification of the second MAC address fails. In this case, it can be determined that the authentication of the core network device has failed, and the terminal can end the operation or return an authentication failure notification to the core network device.

[0230] 518: After the core network device's identity is successfully authenticated, the terminal generates a third MAC based on the first shared key, the first random number, the second random number, the third count values ​​C3 and C2, the first random identity information, and the core network device's identity information.

[0231] After the terminal successfully authenticates the identity of the core network device through the second implementation method in step 517 above, it can also generate a third MAC based on the first shared key, the first random number, the second random number, the third count values ​​C3 and C2, the first random identity information, and the identity information of the core network device, so that the core network device can authenticate the terminal based on the third MAC.

[0232] It should be noted that C3 is equal to the current count value of the first counter. If the terminal updates the first shared key in step 517, the count value of the first counter is also updated, in which case C3 will be equal to C2. If the terminal does not update the first shared key, the count value of the first counter is not updated, and C3 may be equal to or greater than C2.

[0233] For example, the terminal can use the second end-side random key generated in step 517 to generate a third MAC using the following formula 17: mac3=MAC(Rk′1,RID(i)||IDs||R1||R2||C3||C2||string7) (17)

[0234] Here, mac3 is the third MAC, Rk′1 is the second end-side random key, and string7 is a preset string, which is different from string2. For example, string7 can be "2".

[0235] 519: The terminal sends a third message to the core network equipment. The third message includes the third MAC address and C3.

[0236] After generating the third MAC address, the terminal can send a third message to the core network equipment through the base station. This third message includes the third MAC address and C3.

[0237] Optionally, in some embodiments, the terminal and the base station can also perform mutual authentication. For example, the terminal also receives a fourth MAC sent by the base station, such as the fourth MAC being included in the second message. In this case, the terminal can also authenticate itself with the base station based on its third session key generated using the first shared key, the base station's identity information, its own fixed identity information, and the fourth MAC. If the authentication with the base station is successful, the terminal generates a fifth MAC based on the third session key, the base station's identity information, and its own fixed identity information; and sends the fifth MAC to the base station so that the base station can authenticate the terminal based on the fifth MAC. Subsequently, if the terminal receives a fourth message sent by the base station, it can determine that the authentication with the third communication device is successful, and that the third session key held by the terminal is the same as the second session key held by the third communication device. In this case, the terminal can determine the third session key as the shared session key with the base station, wherein the fourth message is used to indicate to the base station that the terminal's authentication is successful.

[0238] For example, the terminal can use the same calculation method as the core network equipment to calculate the second session key, calculating the third session key based on the first shared key, the base station's identity information, and the core network equipment's identity information. It should be noted that the third session key can be calculated by the terminal based on its own first shared key after successful authentication with the core network equipment. Then, the terminal can use the same calculation method as the base station to calculate the fourth MAC, generating a verification MAC corresponding to the fourth MAC based on the third session key, its own fixed identity information, the base station's identity information, a first random number, and a second random number. The received fourth MAC is compared with the verification MAC corresponding to the generated fourth MAC; if they are the same, the terminal's authentication with the base station is successful.

[0239] After successful authentication with the base station, the terminal can generate the fifth MAC address using the following formula 18: mac5=MAC(PRF(SK3,R1||R2),IDc||IDr||R1||R2||string6) (18)

[0240] Here, mac5 is the fifth MAC address, SK3 is the third session key, and string6 is a preset string. String6 and string5 can be different; for example, string6 can be "2".

[0241] After generating the fifth MAC address, the terminal can send it to the base station in the third message. Upon receiving the third message containing the fifth MAC address, the base station can extract it. Then, based on the previously generated second session key, the base station uses the same calculation method as when the terminal generated the fifth MAC address: the second session key, the terminal's fixed identity information, the base station's identity information, a first random number, and a second random number, to generate the corresponding verification MAC address. If the fifth MAC address matches the corresponding verification MAC address, the base station successfully authenticates the terminal. In this case, the base station can determine that the second session key is a shared session key between itself and the terminal, and return a fourth message to the terminal. This fourth message is identical to the third session key generated by the terminal, and it indicates that the base station has successfully authenticated the terminal; for example, it may be a notification of successful authentication. If the fifth MAC address does not match the corresponding verification MAC address, the base station fails to authenticate the terminal. In this case, the base station can refuse the terminal's access and terminate the operation.

[0242] After receiving the fourth message, the terminal determines that the base station has also successfully authenticated it. In this case, the terminal can identify the third session key as the session key shared between itself and the base station. This third session key is the same as the second session key in the base station.

[0243] It should be noted that the base station can forward the third message to the core network equipment after extracting the fifth MAC address from the third message. Alternatively, the base station can forward the third message containing the third MAC address and C3 to the core network equipment only after the terminal's identity has been successfully authenticated based on the fifth MAC address.

[0244] Alternatively, in some possible implementations, the terminal can also carry the fifth MAC address in a separate message. That is, the third message does not contain the fifth MAC address. In this case, the base station can directly forward the third message to the core network equipment after receiving it.

[0245] 520: The core network device verifies the third MAC based on the second shared key, the first random number, the second random number, C2, C3, the first random identity information and its own identity information, and determines whether the current count value of the second counter is equal to C3.

[0246] After receiving the third message, the core network device can generate a verification MAC corresponding to the third MAC using the same calculation method as the terminal in calculating the third MAC, based on its currently stored second shared key, first random number, second random number, C2, C3 carried in the third message, first random identity information, and its own identity information. Then, it compares whether the third MAC and the corresponding verification MAC are the same, and whether C3 is equal to the current count value of the second counter.

[0247] 521: If the verification of the third MAC passes and the current count value of the second counter is equal to C3, then the core network device has successfully authenticated the terminal's identity.

[0248] If the third MAC address is the same as the corresponding verification MAC address, and C3 equals the current count value of the second counter, then C3 has not been tampered with, the first shared key currently held in the terminal is the same as the second shared key currently held in the core network device, the update status of the first and second shared keys is also the same, and the terminal's identity information is legitimate. Therefore, the core network device can determine that the terminal's identity authentication has passed. In this case, the core network device can execute the following S43.

[0249] Optionally, if the third MAC address and the corresponding verification MAC address are different, or if C3 is not equal to the current count value of the second counter, it indicates that at least one of the following situations may exist: C3 has been tampered with; the first shared key currently held in the terminal is different from the second shared key currently held in the core network device; the update status of the first shared key and the second shared key is different; or the terminal's identity information is invalid. Therefore, the core network device can determine that the terminal's authentication has failed. In this case, the core network device can terminate the operation or return an authentication failure notification to the terminal.

[0250] S42: After the terminal successfully authenticates with the core network device, the terminal generates a first session key based on the first shared key, and updates the first random identity information to the second random identity information based on the first session key.

[0251] Once the terminal successfully authenticates with the core network device, it indicates that the first shared key currently held by the terminal is the same as the second shared key currently held by the core network device. Based on this, the terminal can use the first shared key to generate a first session key. This first session key is the session key shared between the terminal and the core network device in this session.

[0252] For example, the terminal can generate the first session key using the following formula 19: SK1=PRF(K(i),IDc||IDs||R1||R2||string8) (19)

[0253] Here, SK1 is the first session key, and string8 is a preset string, which is different from all the aforementioned preset strings. For example, string8 is "session". It should be noted that when the master key shared by the terminal and the core network equipment does not update with the session, K(i) is the initial shared key. When the master key shared by the terminal and the core network equipment updates with the session, K(i) is the latest shared key obtained by the terminal.

[0254] After obtaining the first session key, the terminal updates the first random identity information to the second random identity information so that when establishing a session with the core network device next time, it can use the second random identity information to perform identity authentication and session key negotiation with the core network device based on the method described in the embodiments of this application.

[0255] For example, the terminal can generate second random identity information using the following formula 20, and replace the first random identity information stored in its own memory with the second random identity information. RID(i+1)=PRF(PRF(SK1,R1||R2),R1||R2) (20)

[0256] Wherein, RID(i+1) is the second random identity information.

[0257] Optionally, if the master key shared by the terminal and the core network device is updated with each session update, the terminal can update the first shared key N times to obtain a third shared key. This third shared key is then used to authenticate the terminal and negotiate the session key with the core network device using the second random identity information and the third shared key, based on the method described in this application, when establishing a session with the core network device next time. Here, N can be an integer greater than 0.

[0258] For example, the terminal can update the first shared key once using the following formula 21 to obtain the third shared key. K(i+1)=KeyUpdate(K(i),string3) (21)

[0259] Where K(i+1) is the third shared key. Since the count value of the first counter is used to count the number of times the shared key in the terminal is updated, the count value of the first counter is incremented by 1 after the first shared key is updated once.

[0260] S43: After the core network device successfully authenticates with the terminal, it generates a first session key based on the second shared key, and updates the first random identity information to the second random identity information based on the first session key.

[0261] Once the core network device successfully authenticates the terminal, it indicates that the second shared key currently held by the core network device is the same as the first shared key currently held by the terminal. Based on this, the core network device can use the second shared key to generate the first session key in the same way that the terminal calculates the first session key.

[0262] After obtaining the first session key, the core network device can update the terminal's first random identity information to the second random identity information in the same way that the terminal updates the first random identity information to the second random identity information stored in itself.

[0263] Optionally, if the master key shared by the core network device and the terminal is updated with the session update, the core network device can also adopt the same implementation method as the terminal to update the first shared key to the third shared key, update the second shared key stored in itself to the third shared key, and update the count value of the second counter.

[0264] After the terminal and core network equipment negotiate and obtain the first session key, they can use the first session key to authenticate or encrypt or decrypt the transmitted data or instructions.

[0265] For example, the terminal and core network equipment can use a portion of the first session key as an encryption key for data encryption and decryption, and a portion as a message authentication key for message authentication. For instance, if the first session key is 128 bits long, the high 64 bits can be used as the encryption key and the low 64 bits as the message authentication key.

[0266] For example, when the terminal is an IoT terminal, the core network device can send a deactivation command to the terminal to instruct it to perform a deactivation operation. In this case, to ensure that the deactivation command is genuine and valid from the core network device, the core network device can process the deactivation command using a message authentication key to obtain the corresponding MAC address. Then, it sends the MAC address and the deactivation command together to the terminal. After receiving the deactivation command and the MAC address, the terminal can verify the MAC address using its stored message authentication key. If the verification passes, the deactivation command is considered genuine and valid, and the terminal performs the deactivation operation based on the command. If the verification fails, the deactivation command has been tampered with or forged, and the terminal does not perform the deactivation operation.

[0267] In addition, once a session key is negotiated between the terminal and the base station, the terminal and the base station can use the session key to encrypt and decrypt the data transmitted between them, thereby ensuring the security of data transmission between the terminal and the base station.

[0268] In this embodiment, the terminal can authenticate with the core network device based on a first random identity information and a first shared key. After successful authentication, it generates a session key shared with the core network device based on the first shared key. The first random identity information is the identity information negotiated between the terminal and the core network device for the current session. After generating the shared session key for the current session, both the terminal and the core network device update the first random identity information to a second random identity information for authentication in the next session. Therefore, in this embodiment, the terminal can use a negotiated random identity information to interact with the core network device each time it establishes a session, thereby achieving mutual authentication and session key acquisition. Compared to 5G-AKA, because the terminal uses different random identity information for authentication and key negotiation with the core network device in each session, even if the random identity information in a session is leaked, the terminal's real identity information will not be leaked, thus protecting the terminal's true user identity information. Furthermore, even if an attacker intercepts a message carrying random identity information in a session and replays the message in a subsequent session, the core network device cannot respond correctly to the replayed message because the random identity information used in each session is different. Thus, the attacker cannot obtain the correlation between sessions based on the core network device's response, thereby protecting user privacy and security. Moreover, as can be seen from the above embodiments, the communication method provided in this application is well compatible with 5G-AKA.

[0269] In this embodiment, the master key shared by the terminal and the core network device can be updated with each session update. In other words, the shared master key used by the terminal and the core network device will be different each time a session is established. In this case, even if the shared key in a certain session is leaked, the session key for each session cannot be deduced based on the leaked shared key. Therefore, it is impossible to obtain the data transmitted in each session by decrypting the session key. It can be seen that the authentication and session key negotiation method provided in this embodiment can achieve forward security.

[0270] Furthermore, in this embodiment, the terminal can also perform authentication and key negotiation with the base station based on a shared key with the core network equipment, with the assistance of the core network equipment. This not only prevents the terminal from accessing fake base stations but also ensures the security of subsequent data transmission between the terminal and the base station. Of course, the terminal can also choose not to perform authentication and key negotiation with the base station, which better complies with the current authentication and key negotiation architecture between the terminal and core network equipment in wireless communication systems.

[0271] The communication method provided in this application does not rely on third-party services for authentication and key acquisition. Therefore, while achieving secure communication, it can reduce the risk of leakage of user identity information. Furthermore, the communicating parties in this application embodiment can calculate the shared session key in the current session using a stored shared master key. That is, the communicating parties use a symmetric algorithm to generate the key, resulting in low communication and computational complexity. Therefore, it is more suitable for low-capability communication devices such as IoT terminals.

[0272] Since the communication method provided in this application does not rely on a PKI system, it has lower communication costs compared to digital certificate-based communication methods. Furthermore, because the communication method provided in this application involves the two communicating parties interacting to obtain and store the shared session key for each session, it does not involve key escrow issues compared to user identity-based communication methods; and compared to PSK-based communication methods, it avoids the problem of one device leaking a session key while simultaneously threatening the communication security of multiple devices, thus offering higher security.

[0273] Finally, in this embodiment, the terminal and the core network equipment can use the MAC authentication mechanism to interact during identity authentication and key negotiation, as well as during subsequent data transmission. This can protect the integrity and authenticability of the interactive information and achieve secure authentication.

[0274] It is worth noting that the above embodiments mainly illustrate the application of the communication method in the field of wireless communication, with the first communication device being a terminal in the wireless communication system, the second communication device being a core network device, and the third communication device being a base station. The communication method provided in this application can also be applied to other communication systems. Correspondingly, the terminal, core network device, and base station can be client devices, service providers, and access devices in other communication systems, respectively. For example, when the communication method is applied to the field of data communication, the terminal in the above embodiments can be replaced by a client device in the data communication field, the core network device can be replaced by a server, and the base station can be replaced by network devices such as routers and switches used to forward data between client devices and servers. When the communication method is applied to the field of cloud computing, the terminal in the above embodiments can be replaced by a client device in the cloud computing field, the core network device can be replaced by a cloud server, and the base station can be replaced by network devices such as routers and switches used to access the cloud server.

[0275] Based on the communication methods described in the above embodiments, this application provides a flowchart of identity authentication and key negotiation between a terminal, a base station, and a core network device, as shown in Figure 6. The process includes the following steps:

[0276] S60: The terminal obtains the first random identity information RID(i) and the first shared key K(i).

[0277] S61: The terminal obtains the first random number R1 and the first count value C1; based on K(i), RID(i), the identity information IDs of the core network device, R1 and the string "0", it generates the first terminal random key Rk0; based on Rk0, R1, RID(i), IDs and C1, it generates mac1.

[0278] S62: The terminal sends RID(i), R1, C1 and mac1 to the core network equipment through the base station.

[0279] S63: Core network devices obtain the second shared key K(i)' based on RID(i).

[0280] S64: Core network equipment verifies mac1 based on K(i)'.

[0281] S65: After mac1 verification is successful, the core network device obtains the second random number R2 and the second counter value C2. If C1 is greater than C2, K(i)' is updated D1 times in a loop, where D1 equals the difference between C1 and C2, and the count value of the second counter is updated to C1. Rk1 is generated based on the updated K(i)', R1, R2, RID(i), IDs, and the string "1". If C1 is not greater than C2, the second core network side random key Rk1 is generated based on K(i)', R1, R2, RID(i), IDs, and the string "1". mac2 is generated based on Rk1, R1, R2, RID(i), IDs, C1, C2, and the string "1".

[0282] S66: The core network equipment generates a second session key SK2 based on K(i)', the base station's identity information IDr, IDs, R1 and R2.

[0283] S67: Core network equipment sends mac2, R2, C2 and SK2 to the base station.

[0284] S68: The base station generates mac4 based on SK2, R1, R2, the terminal's user identifiers IDc and IDr, and the string "1".

[0285] S69: The base station sends mac2, R2, C2 and mac4 to the terminal.

[0286] S610: If C2 is greater than C1, the terminal updates K(i) D1 times in a loop and updates the count value of the first counter to C2; a second terminal-side random key Rk1' is generated based on the updated K(i), R1, R2, RID(i), IDs, and the string "1"; if C1 is not greater than C2, Rk1' is generated based on K(i), R1, R2, RID(i), IDs, and the string "1". mac2 is verified based on Rk1'.

[0287] S611: After mac2 is verified, the terminal generates mac3 based on K(i), R1, R2, RID(i), IDs, the current count value of the first counter C3, C2 and the string "2"; and generates the third session key SK3 based on K(i), IDr, IDs, R1 and R2.

[0288] S612: The terminal verifies mac4 based on SK3. After successful verification, SK3 is used as the shared session key with the base station, and mac5 is generated based on SK3, R1, R2, IDc, IDr and the string "2".

[0289] S613: The terminal sends mac3, C3 and mac5 to the base station.

[0290] S614: The terminal generates the first session key SK1 based on K(i), and updates RID(i) to RID(i+1) based on SK1.

[0291] S615: The base station verifies MAC5 based on SK2. After successful verification, SK2 is used as the shared session key with the terminal.

[0292] S616: The base station sends MAC3 and C3 to the core network equipment.

[0293] S617: Core network equipment verifies mac3 based on Rk1 and compares the current count values ​​of C3 and the second counter.

[0294] S618: If mac3 is verified and C3 is equal to the current count value of the second counter, the core network device generates SK1 based on K(i)' and updates RID(i) to RID(i+1) based on SK1.

[0295] The specific implementation methods of S60 to S618 can be referred to the relevant descriptions in the foregoing embodiments, and will not be repeated here.

[0296] The authentication process shown in Figure 6 above is initiated by the terminal. In some possible scenarios, such as when the terminal is an IoT terminal, the core network device can trigger the terminal to access the network and initiate the authentication process. For example, referring to Figure 7, this process may include the following steps:

[0297] S70: The core network equipment broadcasts the second random number R2 to the terminal through the base station.

[0298] S71: The terminal obtains the first random identity information RID(i) and the first shared key K(i).

[0299] S72: The terminal obtains the first random number R1 and the first count value C1; based on K(i), RID(i), the identity information IDs of the core network device, R1, R2 and the string "0", it generates the first terminal random key Rk0; based on Rk0, R1, R2, RID(i), IDs and C1, it generates mac1.

[0300] S73: The terminal sends RID(i), R1, C1 and mac1 to the core network equipment through the base station.

[0301] S74: The core network device obtains the second shared key K(i)' based on RID(i).

[0302] S75: Core network equipment verifies mac1 based on K(i)'.

[0303] S76: After mac1 verification is successful, the core network device obtains the second counter value C2; ​​if C1 is greater than C2, K(i)' is updated D1 times in a loop, where D1 equals the difference between C1 and C2, and the count value of the second counter is updated to C1; Rk1 is generated based on the updated K(i)', R1, R2, RID(i), IDs, and the string "1". If C1 is not greater than C2, Rk1 is generated based on K(i)', R1, R2, RID(i), IDs, and the string "1". mac2 is generated based on Rk1, R1, R2, RID(i), IDs, C1, C2, and the string "1".

[0304] S77: The core network equipment generates a second session key SK2 based on K(i)', the base station's identity information IDr, IDs, R1 and R2.

[0305] S78: Core network equipment sends mac2, C2 and SK2 to the base station.

[0306] S79: The base station generates mac4 based on SK2, R1, R2, the terminal's user identifiers IDc and IDr, and the string "1".

[0307] S710: The base station sends mac2, C2 and mac4 to the terminal.

[0308] S711: If C2 is greater than C1, the terminal updates K(i) D1 times in a loop and updates the count value of the first counter to C2; a second terminal-side random key Rk1' is generated based on the updated K(i), R1, R2, RID(i), IDs, and the string "1"; if C1 is not greater than C2, Rk1' is generated based on K(i), R1, R2, RID(i), IDs, and the string "1". mac2 is verified based on Rk1'.

[0309] S712: After mac2 is verified, the terminal generates mac3 based on K(i), R1, R2, RID(i), IDs, the current count value of the first counter C3, C2 and the string "2"; and generates the third session key SK3 based on K(i), IDr, IDs, R1 and R2.

[0310] S713: The terminal verifies mac4 based on SK3. After successful verification, SK3 is used as a shared session key with the base station, and mac5 is generated based on SK3, R1, R2, IDc, IDr and the string "2".

[0311] S714: The terminal sends mac3, C3 and mac5 to the base station.

[0312] S715: The terminal generates the first session key SK1 based on K(i), and updates RID(i) to RID(i+1) based on SK1.

[0313] S716: The base station verifies MAC5 based on SK2. After successful verification, SK2 is used as the shared session key with the terminal.

[0314] S717: The base station sends MAC3 and C3 to the core network equipment.

[0315] S718: The core network equipment verifies mac3 based on Rk1 and compares the current count values ​​of C3 and the second counter.

[0316] S719: If mac3 is verified and C3 is equal to the current count value of the second counter, the core network device generates SK1 based on K(i)' and updates RID(i) to RID(i+1) based on SK1.

[0317] The specific implementation methods of S70 to S719 can be referred to the relevant descriptions in the foregoing embodiments, and will not be repeated here.

[0318] The communication device provided in the embodiments of this application will be described next.

[0319] Figure 8 is a schematic diagram of a communication device provided in an embodiment of this application. This communication device can be deployed in a first communication device, for example, in the terminal of the aforementioned embodiment. As shown in Figure 8, the communication device 800 includes: a parameter acquisition module 801, an authentication module 802, and a key generation module 803.

[0320] The parameter acquisition module 801 is used to execute S40 in the aforementioned embodiment; the authentication module 802 is used to execute the terminal-side operation in S41 in the aforementioned embodiment; and the key generation module 803 is used to execute S42 in the aforementioned embodiment.

[0321] Optionally, the authentication module 802 is specifically configured to: generate a first message verification code (MAC) based on a first shared key, first auxiliary information, first random identity information, and the identity information of the second communication device; send a first message to the second communication device, the first message including the first auxiliary information, the first random identity information, and the first MAC; receive a second message, the second message including a second MAC, the second MAC being generated by the second communication device based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, provided that the first MAC has been verified; the second shared key being the master key shared by the second communication device and the first communication device; and authenticate the identity of the second communication device based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the second communication device, and the second MAC.

[0322] Optionally, the second message may also include a second random number.

[0323] Optionally, the first auxiliary information includes a first random number and a first count value C1, where C1 is the current count value of the first counter in the first communication device, and the first shared key is obtained by updating the initial shared key C1 times by the first communication device; the second auxiliary information includes a second random number and a second count value C2, where C2 is the current count value of the second counter in the second communication device, and the second shared key is obtained by updating the initial shared key C2 times by the second communication device; the second message also includes C2, and the initial shared key is the initial master key shared by the first communication device and the second communication device.

[0324] Optionally, the authentication module 802 is specifically used to: if the current count value of the first counter is not less than C2, generate a verification MAC corresponding to the second MAC based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device; if the second MAC is equal to the corresponding verification MAC, then the identity authentication of the second communication device is successful.

[0325] Optionally, the authentication module 802 is specifically configured to: if the current count value of the first counter is less than C2, update the first shared key D1 times based on the difference D1 between C2 and the current count value of the first counter, and update the current count value of the first counter to C2; generate a verification MAC corresponding to the second MAC based on the updated first shared key, first auxiliary information, second auxiliary information, first random identity information, and identity information of the second communication device; if the second MAC is equal to the corresponding verification MAC, the identity authentication of the second communication device is successful.

[0326] Optionally, the authentication module 802 is specifically used to: generate a third MAC based on a first shared key, a first random number, a second random number, third count values ​​C3 and C2, first random identity information, and the identity information of the second communication device, where C3 is equal to the current count value of the first counter; and send a third message to the second communication device, the third message including the third MAC and C3, the third message being used to authenticate the identity of the first communication device.

[0327] Optionally, the first shared key is the master key shared by the first communication device and the second communication device in the current session. The key generation module 803 is further configured to: update the first shared key N times to obtain a third shared key, the third shared key being the master key shared by the first communication device and the second communication device in the next session, where N is a preset value; and update the current count value of the first counter based on N.

[0328] Optionally, the parameter acquisition module 801 is further configured to: receive a broadcast message from the second communication device, the broadcast message including a second random number.

[0329] Optionally, the key generation module 803 is further configured to: generate second random identity information based on the first session key, the first random number, and the second random number; and replace the first random identity information with the second random identity information.

[0330] Optionally, the first communication device communicates with the second communication device through a third communication device. The communication device 800 is further configured to: generate a third session key based on a first shared key; perform identity authentication with the third communication device based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device; and, after successful identity authentication with the third communication device, determine the third session key as the shared session key with the third communication device.

[0331] Optionally, the communication device 800 is further configured to: receive a fourth MAC sent by a third communication device, wherein the fourth MAC is generated by the third communication device based on a second session key, the identity information of the third communication device, and the fixed identity information of the first communication device, and the second session key is generated by the second communication device based on a second shared key; generate a third session key based on the first shared key, and authenticate the third communication device based on the third session key, the identity information of the third communication device, the fixed identity information of the first communication device, and the fourth MAC; if the authentication of the third communication device is successful, generate a fifth MAC based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device; send the fifth MAC to the third communication device, wherein the fifth MAC is used to authenticate the first communication device; and if a fourth message is received from the third communication device, determine that the authentication with the third communication device is successful, wherein the fourth message is used to indicate that the authentication of the first communication device by the third communication device is successful.

[0332] Optionally, the first random identity information is the initial random identity information of the first communication device. The communication device further includes an initialization module 804, which is used to negotiate the initial random identity information with the second communication device based on the initial shared key, the fixed identity information of the first communication device, and the identity information of the second communication device. The initial shared key is the initial master key shared by the first communication device and the second communication device.

[0333] Optionally, the initialization module 804 is specifically configured to: generate a sixth MAC based on an initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and a third random number; send a fifth message to the second communication device, the fifth message including the fixed identity information of the first communication device, the third random number, and the sixth MAC; receive a sixth message from the second communication device, the sixth message including a fourth random number and a seventh MAC, the seventh MAC being generated by the second communication device based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number, provided that the sixth MAC has been verified; verify the seventh MAC based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number; if the verification of the seventh MAC is successful, generate initial random identity information based on the initial shared key, the third random number, and the fourth random number, and store the initial random identity information.

[0334] In this embodiment, the first communication device can authenticate with the second communication device based on first random identity information and a first shared key. After successful authentication, it generates a session key shared with the second communication device based on the first shared key. The first random identity information is the agreed-upon identity information for the current session between the first and second communication devices. After generating the shared session key, both the first and second communication devices update the first random identity information to the second random identity information for authentication in the next session. Therefore, in this embodiment, the first communication device can use a negotiated random identity information to interact with the second communication device each time a session is established, thereby achieving mutual authentication and session key acquisition. Since the authentication process uses the device's random identity information, even if the random identity information in a session is leaked, the first communication device's true identity information will not be leaked, thus protecting the user's identity information. Furthermore, even if an attacker intercepts a message containing random identity information in a session and replays the message in a subsequent session, the second communication device cannot respond correctly to the replayed message because the random identity information used in each session is different. Thus, the attacker cannot obtain the correlation between sessions based on the response of the second communication device, thereby protecting user privacy and security.

[0335] Figure 9 is a schematic diagram of another communication device provided in an embodiment of this application. This communication device can be deployed in a second communication device, for example, in the core network device of the aforementioned embodiment. As shown in Figure 9, the communication device 900 includes: an authentication module 901 and a key generation module 902.

[0336] The authentication module 901 is used to perform the core network device side operation in S41 of the aforementioned embodiment, and the key generation module 902 is used to perform S43 of the aforementioned embodiment.

[0337] Optionally, the authentication module 901 is specifically configured to: receive a first message sent by a first communication device, the first message including first auxiliary information, first random identity information, and a first MAC, the first MAC being generated based on a first shared key, the first auxiliary information, the first random identity information, and the identity information of a second communication device, the first shared key being a master key shared by the first communication device and the second communication device; obtain a second shared key based on the first random identity information; verify the first MAC based on the second shared key, the first auxiliary information, the first random identity information, and the identity information of the second communication device; if the first MAC is verified, generate a second MAC based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device; and send a second message to the first communication device, the second message including the second MAC, the second message being used to authenticate the identity of the second communication device.

[0338] Optionally, the first auxiliary information includes a first random number and a first count value C1, where C1 is the current count value of the first counter in the first communication device, and the first shared key is obtained by updating the initial shared key by the first communication device C1 times. The initial shared key is a shared key between the first communication device and the second communication device. The authentication module 901 is specifically used to: if the first MAC verification is successful, determine whether C1 is greater than the current count value of the second counter in the second communication device; if C1 is not greater than the current count value of the second counter, generate a second MAC based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device. The second auxiliary information includes a second random number and a second count value C2, where C2 is equal to the current count value of the second counter, and the second message also includes C2. If C1 is greater than the current count value of the second counter, then based on the difference D2 between C1 and the current count value of the second counter, the second shared key is updated D2 times, and the current count value of the second counter is updated to C1; based on the updated second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, a second MAC is generated. The second auxiliary information includes a second random number and a second count value C2, where C2 is equal to the current count value of the second counter, and the second message also includes C2.

[0339] Optionally, the authentication module 901 is specifically configured to: receive a third message sent by the first communication device, the third message including a third MAC and a third count value C3, the third MAC being generated by the first communication device after successfully authenticating the identity of the second communication device, based on a first shared key, a first random number, a second random number, C2, C3, first random identity information, and the identity information of the second communication device, and C3 being equal to the current count value of the first counter; verify the third MAC based on the second shared key, the first random number, the second random number, C2, C3, the first random identity information, and the identity information of the second communication device, and determine whether the current count value of the second counter is equal to C3; if the verification of the third MAC is successful, and the current count value of the second counter is equal to C3, then the identity authentication of the first communication device is successful.

[0340] Optionally, the second shared key is the master key shared by the second communication device and the first communication device in the current session. The key generation module 902 is further configured to: update the second shared key N times to obtain a third shared key, the third shared key being the master key shared by the second communication device and the first communication device in the next session, where N is a preset value; and update the current count value of the second counter based on N.

[0341] Optionally, the second message may also include a second random number.

[0342] Optionally, the authentication module 901 is also used to: send a broadcast message, the broadcast message including a second random number.

[0343] Optionally, the key generation module 902 is further configured to: generate second random identity information based on the first session key, the first random number, and the second random number; and replace the first random identity information with the second random identity information.

[0344] Optionally, the second communication device communicates with the first communication device through a third communication device. The communication device 900 is further configured to: send a second session key to the third communication device so that the third communication device can authenticate with the first communication device based on the second session key, and after the authentication with the first communication device is successful, determine the second session key as a shared session key with the first communication device. The second session key is generated by the second communication device based on the second shared key.

[0345] Optionally, the first random identity information is the initial random identity information of the first communication device. The communication device further includes an initialization module 903, which is used to negotiate the initial random identity information with the first communication device based on the fixed identity information of the first communication device, the identity information of the second communication device, and the initial shared key. The initial shared key is the initial master key shared by the first communication device and the second communication device.

[0346] Optionally, the initialization module 903 is specifically configured to: receive a fifth message from the first communication device, the fifth message including the fixed identity information of the first communication device, a third random number, and a sixth MAC, the sixth MAC being generated based on an initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and the third random number; obtain an initial shared key based on the fixed identity information of the first communication device; verify the sixth MAC based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and the third random number; if the verification of the sixth MAC is successful, generate initial random identity information based on the initial shared key, the third random number, and the fourth random number, and store the initial shared key and the initial random identity information accordingly; generate a seventh MAC based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number, and send a sixth message to the first communication device, the sixth message including the fourth random number and the seventh MAC, so that the first communication device generates initial random identity information based on the initial shared key, the third random number, and the fourth random number if the verification of the seventh MAC is successful.

[0347] In this embodiment, the second communication device can authenticate itself with the first communication device based on the first random identity information of the first communication device and its own stored second shared key. After successful authentication, it generates a session key shared with the first communication device based on the second shared key. The first random identity information is the identity information of the first communication device in the current session, negotiated between the second and first communication devices. After generating the shared session key for the current session, both the second and first communication devices update the first random identity information to the second random identity information for authentication in the next session. Therefore, in this embodiment, each time the second communication device establishes a session with the first communication device, it can use a pre-negotiated random identity information of the first communication device to interact with it, thereby achieving mutual authentication and obtaining the session key. Since the authentication process uses the device's random identity information, even if the random identity information in a session is leaked, the first communication device's real identity information will not be leaked, thus protecting the user's identity information. Furthermore, even if an attacker intercepts a message containing random identity information in a session and replays the message in a subsequent session, the second communication device cannot respond correctly to the replayed message because the random identity information used in each session is different. Thus, the attacker cannot obtain the correlation between sessions based on the response of the second communication device, thereby protecting user privacy and security.

[0348] Figure 10 is a schematic diagram of another communication device provided in an embodiment of this application. This communication device can be deployed in a third communication device, for example, in the base station of the aforementioned embodiment. As shown in Figure 10, the communication device 1000 includes: a key acquisition module 1001 and an authentication module 1002.

[0349] The key acquisition module 1001 is used to receive a second session key sent by the second communication device. The second session key is generated based on a second shared key, which is a master key shared by the second communication device and the first communication device. The authentication module 1002 is used to authenticate with the first communication device based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device. The key acquisition module 1001 is also used to determine the second session key as the shared session key with the first communication device after successful authentication with the first communication device.

[0350] Optionally, the authentication module 1002 is specifically used to: generate a fourth MAC based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device; send the fourth MAC to the first communication device, the fourth MAC being used to authenticate the third communication device; receive a fifth MAC sent by the first communication device, the fifth MAC being generated by the first communication device based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device after the first communication device has successfully authenticated the third communication device, the third session key being generated based on the first shared key, the first shared key being the master key shared by the first communication device and the second communication device in the first communication device; and authenticate the first communication device based on the second session key and the fifth MAC.

[0351] In this embodiment, the first communication device can communicate with the second communication device via a third communication device. Furthermore, with the assistance of the second communication device, the third communication device can perform authentication and key negotiation with the first communication device. This not only prevents the first communication device from accessing a third communication device with security risks but also ensures the security of subsequent data transmission between the first and third communication devices.

[0352] It should be noted that the module division in the communication device provided in the above embodiments is illustrative and only represents one logical functional division. In actual implementation, other division methods may also be used. Furthermore, the functional modules in the various embodiments of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0353] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a router, switch, or other network device) or processor to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0354] Furthermore, the communication device and communication method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0355] Figure 11 is a schematic diagram of a communication device provided in an embodiment of this application. As shown in Figure 11, the communication device may include at least one processor 1101, a communication bus 1102, a memory 1103, and a transceiver 1104. It should be noted that the device structure shown in Figure 11 does not constitute a limitation on the communication device. The communication device may include more or fewer components than shown, or combine certain components, or have different component arrangements. This application embodiment does not limit this. The various components of the communication device will be described in detail below with reference to Figure 11:

[0356] Processor 1101 is the control center of the communication device and can be a single processor or a collective term for multiple processing elements. For example, processor 1101 can be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of programs according to this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs). Processor 1101 can perform various functions of the communication device by running or executing software programs stored in memory 1103 and by calling data stored in memory 1103. For example, in the various embodiments described below, the actions of the communication device can be executed by the processor of the corresponding device calling data in memory.

[0357] As one embodiment, processor 1101 may include one or more CPUs.

[0358] As one embodiment, the communication device may include multiple processors. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0359] The communication bus 1102 may include a path for transmitting information between the aforementioned components. The communication bus 1102 may be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used in Figure 11, but this does not indicate that there is only one bus or one type of bus.

[0360] The memory 1103 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or it may be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 1103 may exist independently and be connected to the processor 1101 via the communication bus 1102. The memory 1103 may also be integrated with the processor 1101. The memory 1103 is used to store software programs that execute the schemes provided in the embodiments of this application, and its execution is controlled by the processor 1101.

[0361] Transceiver 1104 is used to communicate with other devices or communication networks. For example, transceiver 1104 can be used to send and receive messages or data information.

[0362] It should be noted that the aforementioned devices can be disposed on separate chips, or at least partially or entirely on the same chip. Whether the devices are disposed independently on different chips or integrated on one or more chips often depends on the needs of the product design. This application does not limit the specific implementation of the aforementioned devices.

[0363] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital versatile discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0364] In the various embodiments of this application, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments are consistent and can be referenced mutually. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone, where A and B can be singular or plural. In the textual description of the embodiments of this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship. In this application, "first," "second," and various numerical designations are only for ease of description and are not used to limit the scope of the embodiments of this application. For example, they are used to distinguish different messages, rather than to describe a specific order or sequence.

[0365] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. The order of the process numbers does not imply the order of execution; the execution order of each process should be determined by its function and internal logic.

[0366] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A communication method, characterized in that, Applied to a first communication device, the method includes: Obtain the first random identity information and the first shared key of the first communication device. The first random identity information is the identity information used by the first communication device in the current session with the second communication device. The first shared key is the master key shared by the first communication device and the second communication device. Based on the first random identity information and the first shared key, perform identity authentication with the second communication device; After successful authentication with the second communication device, a first session key is generated based on the first shared key, and the first random identity information is updated to a second random identity information based on the first session key. The second random identity information is the identity information used by the first communication device in the next session with the second communication device, and the first session key is the shared session key between the first communication device and the second communication device in the current session.

2. The method according to claim 1, characterized in that, The step of authenticating the identity with the second communication device based on the first random identity information and the first shared key includes: Based on the first shared key, the first auxiliary information, the first random identity information, and the identity information of the second communication device, a first message verification code (MAC) is generated. Send a first message to the second communication device, the first message including the first auxiliary information, the first random identity information and the first MAC; Receive a second message, the second message including a second MAC, the second MAC being generated by the second communication device based on a second shared key, the first auxiliary information, the second auxiliary information, the first random identity information and the identity information of the second communication device when the first MAC is verified. The second shared key is the master key shared by the second communication device and the first communication device in the second communication device. The second communication device is authenticated based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the second communication device, and the second MAC address.

3. The method according to claim 2, characterized in that, The first auxiliary information includes a first random number and a first count value C1, where C1 is the current count value of the first counter in the first communication device, and the first shared key is obtained by updating the initial shared key C1 times by the first communication device; the second auxiliary information includes a second random number and a second count value C2, where C2 is the current count value of the second counter in the second communication device, and the second shared key is obtained by updating the initial shared key C2 times by the second communication device; the second message also includes C2, and the initial shared key is the initial master key shared by the first communication device and the second communication device.

4. The method according to claim 3, characterized in that, The authentication of the second communication device based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the second communication device, and the second MAC address includes: If the current count value of the first counter is not less than C2, then based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, a verification MAC corresponding to the second MAC is generated; If the second MAC is equal to the corresponding verification MAC, then the authentication of the second communication device is successful.

5. The method according to claim 3, characterized in that, The authentication of the second communication device based on the first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, the identity information of the second communication device, and the second MAC address includes: If the current count value of the first counter is less than C2, then based on the difference D1 between C2 and the current count value of the first counter, the first shared key is updated D1 times, and the current count value of the first counter is updated to C2. Based on the updated first shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, a verification MAC corresponding to the second MAC is generated; If the second MAC is equal to the corresponding verification MAC, then the authentication of the second communication device is successful.

6. The method according to claim 4 or 5, characterized in that, After the identity authentication of the second communication device is successful, the method further includes: Based on the first shared key, the first random number, the second random number, the third counter value C3, the C2, the first random identity information, and the identity information of the second communication device, a third MAC is generated, where C3 is equal to the current counter value. A third message is sent to the second communication device. The third message includes the third MAC and the C3. The third message is used to authenticate the first communication device.

7. The method according to any one of claims 3 to 6, characterized in that, The first shared key is the master key shared by the first communication device and the second communication device in the current session. After generating the first session key based on the first shared key, the method further includes: The first shared key is updated N times to obtain a third shared key. The third shared key is the master key that the first communication device shares with the second communication device in the next session with the second communication device. N is a preset value. The current count value of the first counter is updated based on N.

8. The method according to any one of claims 3 to 7, characterized in that, The second message also includes the second random number.

9. The method according to any one of claims 3 to 7, characterized in that, Before obtaining the first random identity information and the first shared key of the first communication device, the method further includes: Receive a broadcast message from the second communication device, the broadcast message including the second random number.

10. The method according to any one of claims 3 to 9, characterized in that, The step of updating the first random identity information to the second random identity information based on the first session key includes: The second random identity information is generated based on the first session key, the first random number, and the second random number; Replace the first random identity information with the second random identity information.

11. The method according to any one of claims 1 to 10, characterized in that, The first communication device communicates with the second communication device through a third communication device. During the authentication process with the second communication device based on the first random identity information and the first shared key, the method further includes: Generate a third session key based on the first shared key; Based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device, identity authentication is performed with the third communication device. After successful authentication with the third communication device, the third session key is determined as the shared session key with the third communication device.

12. The method according to claim 11, characterized in that, The authentication process based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device, and the authentication with the third communication device, includes: The third communication device receives a fourth MAC sent by the third communication device. The fourth MAC is generated by the third communication device based on the second session key, the identity information of the third communication device and the fixed identity information of the first communication device. The second session key is generated by the second communication device based on the second shared key. Based on the third session key, the identity information of the third communication device, the fixed identity information of the first communication device, and the fourth MAC, the third communication device is authenticated. If the identity authentication of the third communication device is successful, a fifth MAC is generated based on the third session key, the identity information of the third communication device, and the fixed identity information of the first communication device; The fifth MAC is sent to the third communication device, and the fifth MAC is used to authenticate the first communication device. If a fourth message is received from the third communication device, it is determined that the authentication with the third communication device has been successful. The fourth message is used to indicate that the third communication device has successfully authenticated the first communication device.

13. The method according to any one of claims 1 to 12, characterized in that, The first random identity information is the initial random identity information of the first communication device, and the method further includes: Based on the initial shared key, the fixed identity information of the first communication device, and the identity information of the second communication device, the initial random identity information is negotiated with the second communication device. The initial shared key is the initial master key shared by the first communication device and the second communication device.

14. The method according to claim 13, characterized in that, The process of negotiating the initial random identity information with the second communication device based on the initial shared key, the fixed identity information of the first communication device, and the identity information of the second communication device includes: Based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and the third random number, a sixth MAC is generated; Send a fifth message to the second communication device, the fifth message including the fixed identity information of the first communication device, the third random number and the sixth MAC; The second communication device receives a sixth message, the sixth message including a fourth random number and a seventh MAC, the seventh MAC being generated by the second communication device based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number after the sixth MAC is verified. The seventh MAC is verified based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number. If the verification of the seventh MAC passes, the initial random identity information is generated based on the initial shared key, the third random number, and the fourth random number, and the initial random identity information is stored.

15. A communication method, characterized in that, Applied to a second communication device, the method includes: Based on the first random identity information and the second shared key, the first communication device is authenticated. The first random identity information is the identity information used by the first communication device in the current session with the second communication device. The second shared key is the master key shared by the second communication device and the first communication device. After successful authentication with the first communication device, a first session key is generated based on the second shared key, and the first random identity information is updated to a second random identity information based on the first session key. The second random identity information is the random identity information used by the first communication device in the next session with the second communication device, and the first session key is the shared session key between the second communication device and the first communication device in the current session.

16. The method according to claim 15, characterized in that, The authentication process with the first communication device based on the first random identity information and the second shared key includes: The system receives a first message sent by the first communication device. The first message includes first auxiliary information, first random identity information, and a first MAC. The first MAC is generated based on a first shared key, the first auxiliary information, the first random identity information, and the identity information of the second communication device. The first shared key is a master key shared by the first communication device and the second communication device in the first communication device. The second shared key is obtained based on the first random identity information; The first MAC is verified based on the second shared key, the first auxiliary information, the first random identity information, and the identity information of the second communication device; If the first MAC verification passes, a second MAC is generated based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device. A second message is sent to the first communication device. The second message includes the second MAC address and is used to authenticate the second communication device.

17. The method according to claim 16, characterized in that, The first auxiliary information includes a first random number and a first count value C1, where C1 is the current count value of the first counter in the first communication device, and the first shared key is obtained by updating the initial shared key C1 times by the first communication device. The initial shared key is the initial master key shared by the first communication device and the second communication device. If the first MAC verification passes, a second MAC is generated based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, including: If the first MAC verification passes, then determine whether C1 is greater than the current count value of the second counter in the second communication device; If C1 is not greater than the current count value of the second counter, then the second MAC is generated based on the second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device. The second auxiliary information includes a second random number and a second count value C2, where C2 is equal to the current count value of the second counter. The second shared key is obtained by the second communication device updating the initial shared key C2 times. The second message also includes C2.

18. The method according to claim 17, characterized in that, The method further includes: If C1 is greater than the current count value of the second counter, then based on the difference D2 between C1 and the current count value of the second counter, the second shared key is updated D2 times, and the current count value of the second counter is updated to C1. Based on the updated second shared key, the first auxiliary information, the second auxiliary information, the first random identity information, and the identity information of the second communication device, the second MAC is generated. The second auxiliary information includes the second random number and the second count value C2, where C2 is equal to the current count value of the second counter. The second message also includes the C2.

19. The method according to claim 17 or 18, characterized in that, After sending the second message to the first communication device, the method further includes: The system receives a third message sent by the first communication device. The third message includes a third MAC and a third count value C3. The third MAC is generated by the first communication device after the second communication device has been successfully authenticated, based on the first shared key, the first random number, the second random number, C2, C3, the first random identity information, and the identity information of the second communication device. The C3 is equal to the current count value of the first counter. Based on the second shared key, the first random number, the second random number, C2, C3, the first random identity information, and the identity information of the second communication device, the third MAC is verified, and it is determined whether the current count value of the second counter is equal to C3. If the verification of the third MAC passes and the current count value of the second counter is equal to C3, then the authentication of the first communication device passes.

20. The method according to any one of claims 17 to 19, characterized in that, The second shared key is the master key shared by the second communication device and the first communication device in the current session. After generating the first session key based on the second shared key, the process further includes: The second shared key is updated N times to obtain a third shared key, which is the master key shared by the second communication device and the first communication device in the next session with the first communication device, and N is a preset value; The current count value of the second counter is updated based on N.

21. The method according to any one of claims 17 to 20, characterized in that, The second message also includes the second random number.

22. The method according to any one of claims 17 to 20, characterized in that, Before authenticating with the first communication device based on the first random identity information and the second shared key, the process further includes: Send a broadcast message, the broadcast message including the second random number.

23. The method according to any one of claims 17 to 22, characterized in that, The step of updating the first random identity information to the second random identity information based on the first session key includes: The second random identity information is generated based on the first session key, the first random number, and the second random number; Replace the first random identity information with the second random identity information.

24. The method according to any one of claims 15 to 23, characterized in that, The second communication device communicates with the first communication device through a third communication device. During the authentication process with the first communication device based on the first random identity information and the second shared key, the method further includes: A second session key is sent to the third communication device so that the third communication device can authenticate with the first communication device based on the second session key. After the authentication with the first communication device is successful, the second session key is determined as a shared session key with the first communication device. The second session key is generated by the second communication device based on the second shared key.

25. The method according to any one of claims 15 to 24, characterized in that, The first random identity information is the initial random identity information of the first communication device, and the method further includes: Based on the fixed identity information of the first communication device, the identity information of the second communication device, and the initial shared key, the initial random identity information is negotiated with the first communication device, and the initial shared key is the initial master key shared by the first communication device and the second communication device.

26. The method according to claim 25, characterized in that, The step of negotiating the initial random identity information with the first communication device based on the fixed identity information of the first communication device, the identity information of the second communication device, and the initial shared key includes: The system receives a fifth message from the first communication device, the fifth message including the fixed identity information of the first communication device, a third random number, and a sixth MAC, the sixth MAC being generated based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and the third random number; Based on the fixed identity information of the first communication device, the initial shared key is obtained; The sixth MAC is verified based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, and the third random number. If the verification of the sixth MAC passes, the initial random identity information is generated based on the initial shared key, the third random number, and the fourth random number, and the initial shared key and the initial random identity information are stored accordingly. Based on the initial shared key, the fixed identity information of the first communication device, the identity information of the second communication device, the third random number, and the fourth random number, a seventh MAC is generated, and a sixth message is sent to the first communication device. The sixth message includes the fourth random number and the seventh MAC, so that if the first communication device verifies the seventh MAC, it generates the initial random identity information based on the initial shared key, the third random number, and the fourth random number.

27. A communication method, characterized in that, Applied to a third communication device, the method includes: The second communication device receives a second session key sent by the second communication device. The second session key is generated based on a second shared key, which is a master key shared by the second communication device and the first communication device. The second communication device communicates with the first communication device through the third communication device. Based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device, identity authentication is performed with the first communication device; After successful authentication with the first communication device, the second session key is determined as the shared session key with the first communication device.

28. The method according to claim 27, characterized in that, The authentication process based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device, and the authentication with the first communication device, includes: A fourth MAC is generated based on the second session key, the identity information of the third communication device, and the fixed identity information of the first communication device; The fourth MAC is sent to the first communication device, and the fourth MAC is used to authenticate the third communication device. The first communication device receives a fifth MAC sent by the first communication device. The fifth MAC is generated by the first communication device based on a third session key, the identity information of the third communication device, and the fixed identity information of the first communication device when the identity authentication of the third communication device is successful. The third session key is generated based on a first shared key, which is the master key shared by the first communication device and the second communication device in the first communication device. The first communication device is authenticated based on the second session key and the fifth MAC.

29. A communication method, characterized in that, The method includes: The first communication device obtains the first random identity information and the first shared key of the first communication device. The first random identity information is the identity information used by the first communication device in the current session with the second communication device. The first shared key is the master key shared by the first communication device and the second communication device. The first communication device and the second communication device authenticate each other based on their respective first shared key, second shared key and first random identity information. The second shared key is the master key shared by the second communication device and the first communication device. After the first communication device successfully authenticates with the second communication device, it generates a first session key based on the first shared key, and updates the first random identity information to the second random identity information based on the first session key. After the second communication device successfully authenticates with the first communication device, it generates the first session key based on the second shared key, and updates the first random identity information to the second random identity information based on the first session key.

30. The method according to claim 29, characterized in that, The first communication device communicates with the second communication device through a third communication device, and the method further includes: The second communication device sends a second session key to the third communication device, the second session key being generated by the second communication device based on the second shared key; The third communication device and the first communication device authenticate each other based on their respective second session key, third session key, identity information of the third communication device and fixed identity information of the first communication device. The third session key is generated by the first communication device based on the first shared key. After the third communication device successfully authenticates with the first communication device, it determines the second session key as the shared session key with the first communication device. After the first communication device successfully authenticates with the third communication device, it determines the third session key as the shared session key with the first communication device.

31. A communication device, characterized in that, The communication device includes at least one module, which is used to perform the communication method according to any one of claims 1 to 30.

32. A communication device, characterized in that, The communication device includes a processor for executing a computer program stored in a memory to implement the communication method according to any one of claims 1 to 28.

33. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a communication device, cause the communication device to perform the communication method according to any one of claims 1 to 28.

34. A computer program product containing instructions, characterized in that, When the instruction is executed by the communication device, the communication device performs the communication method as described in any one of claims 1 to 28.

Images