Authentication method, communication device, communication system, and storage medium

Abstract

The present disclosure provides an authentication method, a communication device, a communication system, and a storage medium. The method comprises: receiving a first message sent by a second device, wherein the first message is used by a first device to authenticate the second device, and the second device comprises an Internet of things (IoT) device; and authenticating the second device on the basis of the first message. The method of the present disclosure can ensure secure communication between the first device and the second device, prevent communication fraud, and guarantee communication stability.

Description

Authentication methods, communication equipment, communication systems, storage media Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to authentication methods, communication devices, communication systems, and storage media. Background Technology

[0002] Internet of Things (IoT) devices have been introduced into communication systems. Summary of the Invention

[0003] This disclosure proposes authentication methods, communication equipment, communication systems, and storage media.

[0004] According to a first aspect of the present disclosure, an authentication method is proposed, performed by a first device, the method comprising: receiving a first message sent by a second device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; and authenticating the second device based on the first message.

[0005] According to a second aspect of the present disclosure, an authentication method is provided, performed by a second device, the method comprising: sending a first message to a first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device.

[0006] According to a third aspect of the present disclosure, an authentication method is provided for a communication system, the communication system including a second device and a first device, the method comprising: the second device sending a first message to the first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; and the first device authenticating the second device based on the first message.

[0007] According to a fourth aspect of the present disclosure, a first device is provided, comprising: a transceiver module, configured to receive a first message sent by a second device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; and a processing module, further configured to authenticate the second device based on the first message.

[0008] According to a fifth aspect of the present disclosure, a second device is provided, comprising: a transceiver module for sending a first message to a first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device.

[0009] According to a sixth aspect of the present disclosure, a communication device is provided, comprising:

[0010] One or more processors;

[0011] The processor is configured to invoke instructions to cause the communication device to execute any of the authentication methods described in the first or second aspect.

[0012] According to a seventh aspect of the present disclosure, a communication system is provided, including a first device and a second device, wherein the first device is configured to implement the authentication method described in the first aspect, and the second device is configured to implement the authentication method described in the second aspect.

[0013] According to an eighth aspect of the present disclosure, a storage medium is provided that stores instructions that, when executed on a communication device, cause the communication device to perform an authentication method as described in any of the first to second aspects.

[0014] In a ninth aspect, embodiments of this disclosure provide a program product, including a computer program that, when executed by a communication device, implements the authentication methods described in the first and second aspects.

[0015] In a tenth aspect, embodiments of this disclosure provide a computer program that, when run on a computer, causes the computer to perform the authentication methods described in the first and second aspects.

[0016] It is understood that the aforementioned network devices, terminals, communication devices, communication systems, storage media, program products, and computer programs are all used to execute the methods proposed in the embodiments of this disclosure. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here. Attached Figure Description

[0017] The above and / or additional aspects and advantages of this disclosure will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, in which:

[0018] Figure 1A is a schematic diagram of the architecture of some communication systems provided in the embodiments of this disclosure;

[0019] Figures 1B-1C are schematic diagrams illustrating the architecture of a second device communicating according to embodiments of the present disclosure;

[0020] Figure 2A is an interactive schematic diagram of an authentication method provided in an embodiment of this disclosure;

[0021] Figure 2B is an interactive schematic diagram of an authentication method provided in an embodiment of this disclosure;

[0022] Figure 2C is an interactive schematic diagram of an authentication method provided in an embodiment of this disclosure;

[0023] Figures 3A-3H are schematic flowcharts of an authentication method provided in another embodiment of this disclosure;

[0024] Figure 4A is an interactive schematic diagram of the authentication method provided in another embodiment of this disclosure;

[0025] Figure 4B is an interactive schematic diagram of the authentication method provided in another embodiment of this disclosure;

[0026] Figure 4C is an interactive schematic diagram of the authentication method provided in another embodiment of this disclosure;

[0027] Figure 5A is a schematic diagram of the structure of a first device provided in an embodiment of this disclosure;

[0028] Figure 5B is a schematic diagram of the structure of a second device provided in an embodiment of this disclosure;

[0029] Figure 6A is a schematic diagram of the structure of a communication device provided in an embodiment of this disclosure;

[0030] Figure 6B is a schematic diagram of the structure of a chip provided in an embodiment of this disclosure. Detailed Implementation

[0031] This disclosure provides an authentication method, communication device, communication system, and storage medium.

[0032] In a first aspect, embodiments of this disclosure propose an authentication method executed by a first device, the method comprising: receiving a first message sent by a second device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; and authenticating the second device based on the first message.

[0033] In the above embodiments, the second device can send a first message to the first device, and the first device can authenticate the second device based on the first message. Thus, communication authentication is performed between the second device and the first device, which can ensure the security of communication between the first device and the second device, avoid communication fraud, and ensure communication stability.

[0034] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: receiving a first request sent by the second device, the first request being used to request triggering authentication between the first device and the second device; and sending a second request to the second device, the second request being used to request the second device to send the first message.

[0035] In conjunction with some embodiments of the first aspect, in some embodiments, the first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

[0036] In conjunction with some embodiments of the first aspect, in some embodiments, the second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm; wherein the second security algorithm is a security algorithm determined by the first device for confidentiality and / or integrity protection of at least one of data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

[0037] In conjunction with some embodiments of the first aspect, in some embodiments, sending the second request to the second device includes: the first request satisfying a first condition, and sending the second request to the second device; wherein the first condition includes at least one of the following: the first request is not protected; the security verification of the first request fails.

[0038] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: sending a paging message to the second device, the paging message including a first random number generated by the first device.

[0039] In conjunction with some embodiments of the first aspect, in some embodiments, the first message includes at least one of the following: a device identifier of the second device, a second random number generated by the second device, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm; wherein the third security algorithm is a security algorithm determined by the second device for confidentiality and / or integrity protection of at least one of the data, information, and signaling between the second device and the first device, and the third security algorithm is selected by the second device from one or more first security algorithms; wherein the first data is data that the second device needs to send to the first device, the first data is protected by a first key, the first key is used to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device; the first verification value is used by the first device to authenticate the second device, the first verification value is generated based on a second key, and the second key is used to protect the integrity of at least one of the data, information, and signaling between the second device and the first device.

[0040] In conjunction with some embodiments of the first aspect, in some embodiments, the first response is used by the first device to authenticate the second device, and the first response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key.

[0041] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: sending a third request to a third device, the third request including a device identifier of the second device, the third request being used to request at least one of a third key and a third security algorithm; receiving at least one of the third key and a third identifier indicating the third security algorithm sent by the third device; generating a second response based on at least one of the device identifier of the second device, a first random number, a second random number, and the third key; and generating at least one of a first key and a second key.

[0042] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: sending a fourth request to a third device, the fourth request including at least one of the following: a device identifier of the second device, a first random number, a second random number, a third identifier for indicating a third security algorithm, or a second identifier for indicating a second security algorithm; wherein the fourth request is used to request at least one of a second response, a first key, and a second key; receiving at least one of the second response, the first key, and the second key sent by the third device, the second response being generated based on at least one of the device identifier of the second device, the first random number, the second random number, and the third key.

[0043] In conjunction with some embodiments of the first aspect, in some embodiments, authenticating the second device based on the first message includes: performing a first operation, the first operation including at least one of the following: verifying a first response based on a second response, and verifying a first verification value based on a second key; the authentication of the second device based on the first message further includes at least one of the following: satisfying a second condition to determine that the second device has been authenticated, the second condition including at least one of the following: the first response has been verified and the first verification value has been verified; satisfying a third condition to determine that the second device has not been authenticated, the third condition including at least one of the following: the first response has not been verified and the first verification value has not been verified.

[0044] In the above embodiments, it is explained how the first device authenticates the second device so that the first device can accurately authenticate the second device, thereby ensuring the communication security between the first device and the second device, avoiding communication fraud, and ensuring communication stability.

[0045] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: sending a second message to the second device based on the authentication result of the second device.

[0046] In conjunction with some embodiments of the first aspect, in some embodiments, the second device is successfully authenticated, and the second message includes at least one of an authentication success indication and first information, wherein the first information includes information that the first device needs to send to the second device, and the second message is protected by a first key and / or a second key; or, the second device is not successfully authenticated, and the second message includes an authentication failure indication, and / or the second message is not protected by a key.

[0047] In the above embodiments, the first device may also send a second message to the second device so that the second device can determine the authentication result of the first device based on the second message. The second device can then perform corresponding operations based on the authentication result. For example, when the authentication result indicates that the second device has passed authentication, the second device can communicate with the first device. When the authentication result indicates that the second device has failed authentication, the second device can choose not to communicate with the first device, thereby ensuring communication stability.

[0048] In some embodiments of the first aspect, the method further includes: the second device being authenticated, storing at least one of the device identifier of the second device, a first key, and a second key; and communicating with the second device based on at least one of the first key and the second key.

[0049] In the above embodiments, when the second device is successfully authenticated, the second device can communicate with the first device based on the key, thereby further ensuring the security of the communication data between the second device and the first device, preventing the leakage of the communication data between the second device and the first device, and ensuring communication stability.

[0050] Secondly, this disclosure provides an authentication method performed by a second device, the method comprising: sending a first message to a first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device.

[0051] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: sending a first request to the first device, the first request being used to request triggering authentication between the first device and the second device; receiving a second request sent by the first device, the second request being used to request the second device to send the first message.

[0052] In conjunction with some embodiments of the second aspect, in some embodiments, sending the first request to the first device includes: the second device not storing at least one of a first key and a second key, and sending the first request to the first device; wherein the first key is used to protect the confidentiality of at least one of data, information, and signaling between the second device and the first device, and the second key is used to protect the integrity of at least one of data, information, and signaling between the second device and the first device.

[0053] In conjunction with some embodiments of the second aspect, in some embodiments, the first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

[0054] In conjunction with some embodiments of the second aspect, in some embodiments, the second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm; wherein the second security algorithm is a security algorithm determined by the first device for confidentiality protection and / or integrity protection of at least one of data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

[0055] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: receiving a paging message sent by the first device, the paging message including a first random number generated by the first device.

[0056] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: generating a second random number; generating a first response based on at least one of a device identifier of the second device, a first random number, a second random number, and a third key, wherein the first response is used by the first device to authenticate the second device; generating at least one of a first key and a second key; protecting first data based on the first key, wherein the first data is data that the second device needs to send to the first device; and generating a first verification value based on the second key, wherein the first verification value is used by the first device to authenticate the second device.

[0057] In conjunction with some embodiments of the second aspect, in some embodiments, the first message includes at least one of the following: a device identifier of the second device, a second random number, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm; wherein the third security algorithm is a security algorithm determined by the second device for confidentiality protection and / or integrity protection of at least one of data, information, and signaling between the second device and the first device, and the third security algorithm is selected by the second device from one or more first security algorithms.

[0058] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: receiving a second message sent by the first device based on the authentication result of the second device.

[0059] In some embodiments, in conjunction with the second aspect, the method further includes: performing security verification on the second message based on a second key, wherein the second message passes the security verification, and it is determined that the first device has been authenticated by the second device.

[0060] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: the second message including an authentication success indication, determining that the second device has been authenticated by the first device; the second message is not protected by a key, and / or, the second message includes an authentication failure indication, determining that the second device has not been authenticated by the first device.

[0061] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: the second device authenticating with the first device, and / or the first device authenticating with the second device, storing at least one of a first key and a second key; and communicating with the first device based on at least one of the first key and the second key.

[0062] Thirdly, this disclosure provides an authentication method for a communication system, the communication system including a second device and a first device, the method including: the second device sending a first message to the first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; and the first device authenticating the second device based on the first message.

[0063] Fourthly, this disclosure provides a first device, comprising: a transceiver module for receiving a first message sent by a second device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; and a processing module for further authenticating the second device based on the first message.

[0064] Fifthly, embodiments of this disclosure propose a second device, including: a transceiver module, configured to send a first message to a first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device.

[0065] In a sixth aspect, embodiments of this disclosure provide a communication device comprising: one or more processors; one or more memories for storing instructions; wherein the processors are configured to invoke the instructions to cause the communication device to perform the methods described in the first aspect, the optional implementation of the first aspect, the second aspect, and the optional implementation of the second aspect.

[0066] In a seventh aspect, embodiments of this disclosure provide a communication system comprising: a second device and a first device; wherein the first device is configured to perform the method described in the first aspect and optional implementations thereof, and the second device is configured to perform the method described in the second aspect and optional implementations thereof.

[0067] Eighthly, embodiments of this disclosure provide a storage medium storing instructions that, when executed on a communication device, cause the communication device to perform the method described in the first aspect, an optional implementation of the first aspect, the second aspect, and an optional implementation of the second aspect.

[0068] In a ninth aspect, embodiments of this disclosure provide a program product including a computer program that, when executed by a processor, implements the methods described in the first aspect, optional implementations of the first aspect, the second aspect, and optional implementations of the second aspect.

[0069] In a tenth aspect, embodiments of this disclosure provide a computer program that, when run on a computer, causes the computer to perform the methods described in the first aspect, an optional implementation of the first aspect, the second aspect, and an optional implementation of the second aspect.

[0070] It is understood that the aforementioned network devices, terminals, communication devices, communication systems, storage media, program products, and computer programs are all used to execute the methods proposed in the embodiments of this disclosure. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0071] This disclosure provides embodiments of authentication methods, communication devices, communication systems, and storage media. In some embodiments, terms such as authentication method and information processing method may be used interchangeably.

[0072] This disclosure is not exhaustive, but merely illustrative of some embodiments, and is not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined, for example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments. In all embodiments of this disclosure, unless otherwise specified or logically conflicting, the terminology and / or descriptions between the embodiments are consistent and can be mutually referenced. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0073] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure.

[0074] In this embodiment of the disclosure, unless otherwise stated, elements expressed in the singular form, such as "a," "an," "the," "the," "the," "the," "the," "the," "this," etc., can mean "one and only one," or "one or more," "at least one," etc. For example, when using articles such as "a," "an," "the," etc. in translation, the noun following the article can be understood as either a singular expression or a plural expression.

[0075] In the embodiments disclosed herein, "multiple" refers to two or more.

[0076] In some embodiments, the terms "at least one of A or B, at least one of A and B", "one or more", "a plurality of", "multiple" and the like can be used interchangeably.

[0077] In some embodiments, the notation "at least one of A and B", "A and / or B", "A in one case, B in another", "in response to one case A, in response to another case B", etc., may include the following technical solutions depending on the situation: in some embodiments, A (execute A regardless of whether there is a branch B); in some embodiments, B (execute B regardless of whether there is a branch A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, both A and B are executed. The same applies when there are more branches such as A, B, C, etc.

[0078] In some embodiments, the notation "A or B" may include the following technical solutions, depending on the situation: in some embodiments, A (execute A regardless of whether a branch B exists); in some embodiments, B (execute B regardless of whether a branch A exists); in some embodiments, execution is selected from A and B (A and B are selectively executed). The same applies when there are more branches such as A, B, and C.

[0079] The prefixes "first," "second," etc., used in the embodiments of this disclosure are merely for distinguishing different descriptive objects and do not impose restrictions on the position, order, priority, quantity, or content of the descriptive objects. The description of the descriptive objects is found in the claims or the context of the embodiments, and the use of prefixes should not constitute unnecessary restrictions. For example, if the descriptive object is a "field," the ordinal numbers preceding "field" in "first field" and "second field" do not restrict the position or order of the "fields." "First" and "second" do not restrict whether the "fields" they modify are in the same message, nor do they restrict the order of "first field" and "second field." Similarly, if the descriptive object is a "level," the ordinal numbers preceding "level" in "first level" and "second level" do not restrict the priority between "levels." Furthermore, the number of descriptive objects is not limited by ordinal numbers and can be one or more. For example, in "first device," the number of "devices" can be one or more. Furthermore, the objects modified by different prefixes can be the same or different. For example, if the object being described is "device", then "first device" and "second device" can be the same device or different devices, and their types can be the same or different. Similarly, if the object being described is "information", then "first information" and "second information" can be the same information or different information, and their content can be the same or different.

[0080] In some embodiments, “including A,” “containing A,” “for indicating A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0081] In some embodiments, terms such as "time / frequency" and "time-frequency domain" refer to the time domain and / or frequency domain.

[0082] In some embodiments, terms such as “in response to…”, “in response to determining…”, “in the case of…”, “when…”, “when…”, “if…”, etc. can be used interchangeably. These descriptions all refer to the device making a corresponding action under certain objective circumstances. They do not necessarily limit the time, nor do they require the device to make a judgment action when implementing it, nor do they mean that there must be other limitations.

[0083] In some embodiments, the terms “greater than,” “greater than or equal to,” “not less than,” “more than,” “more than or equal to,” “not less than,” “higher than,” “higher than or equal to,” “not lower than,” and “above” can be used interchangeably, as can the terms “less than,” “less than or equal to,” “not greater than,” “less than,” “less than or equal to,” “not more than,” “lower than,” “lower than or equal to,” “not higher than,” and “below”.

[0084] In some embodiments, devices, etc., may be interpreted as physical or virtual, and their names are not limited to those described in the embodiments. Terms such as “device,” “equipment,” “circuit,” “network element,” “network function,” “network device,” “function,” “node,” “unit,” “section,” “system,” “network,” “chip,” “chip system,” “entity,” and “subject” are interchangeable.

[0085] In some embodiments, "network" can be interpreted as devices included in a network (e.g., access network devices, core network devices, etc.).

[0086] In some embodiments, the terms "access network device (AN device)," "radio access network device (RAN device)," "base station (BS)," "radio base station," "fixed station," "node," "access point," "transmission point (TP)," "reception point (RP)," "transmission / reception point (TRP)," "panel," "antenna panel," "antenna array," "cell," "macro cell," "small cell," "femto cell," "pico cell," "sector," "cell group," "serving cell," "carrier," "component carrier," and "bandwidth part (BWP)" can be used interchangeably.

[0087] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", "subscriber station", "mobile unit", "subscriber unit", "wireless unit", "remote unit", "mobile device", "wireless device", "wireless communication device", "remote device", "mobile subscriber station", "access terminal", "mobile terminal", "wireless terminal", "remote terminal", "handset", "user agent", "mobile client", and "client" can be used interchangeably.

[0088] In some embodiments, access network devices, core network devices, or network devices can be replaced by terminals. For example, embodiments of this disclosure can also be applied to structures where communication between access network devices, core network devices, or network devices and terminals is replaced by communication between multiple terminals (e.g., device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, the structure can also be configured such that the terminal has all or part of the functions of the access network device. Furthermore, terms such as "uplink" and "downlink" can be replaced with terms corresponding to communication between terminals (e.g., "sidelink"). For example, uplink channel, downlink channel, etc., can be replaced with sidelink channel, and uplink link, downlink, etc., can be replaced with sidelink link.

[0089] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, core network device, or network device may also be configured to have all or some of the functions of the terminal.

[0090] In some embodiments, the acquisition of data, information, etc., may comply with the laws and regulations of the country where the location is situated.

[0091] In some embodiments, data, information, etc., may be obtained with the user's consent.

[0092] Furthermore, each element, each row, or each column in the table of this disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0093] Figure 1A is a schematic diagram of the architecture of a communication system according to an embodiment of the present disclosure. As shown in Figure 1A, the communication system 100 may include a core network device and a second device; wherein, the second device and the core network device can communicate through a reader, and optionally, the reader may include at least one of an access network device and a terminal.

[0094] In some embodiments, the second device does not require a battery; it can collect ambient energy and / or artificial energy to power normal uplink and downlink transmission. Optionally, the ambient energy may include natural energy sources such as solar, wind, and nuclear energy, and the artificial energy may include energy such as electromagnetic waves emitted by artificial devices. In some embodiments, the second device may also be referred to as: Ambient Internet of Things (A-IoT) device, Internet of Things (IoT) device, low-power device, low-power ambient IoT device, A-IoT Device, A-IoT UE, A-IoT terminal, A-IoT Tag, tag, IoT terminal, etc.

[0095] In some embodiments, the terminal includes, but is not limited to, at least one of the following: mobile phone, wearable device, car with communication function, smart car, tablet computer, computer with wireless transceiver function, virtual reality (VR) terminal device, augmented reality (AR) terminal device, wireless terminal device in industrial control, wireless terminal device in self-driving, wireless terminal device in remote medical surgery, wireless terminal device in smart grid, wireless terminal device in transportation safety, wireless terminal device in smart city, and wireless terminal device in smart home.

[0096] In some embodiments, the access network device is, for example, a node or device that connects a terminal to a wireless network. The access network device may include at least one of the following in a 5G communication system: evolved Node B (eNB), next-generation eNB (ng-eNB), next-generation Node B (gNB), node B (NB), home node B (HNB), home evolved node B (HeNB), radio backhaul device, radio network controller (RNC), base station controller (BSC), base transceiver station (BTS), base band unit (BBU), mobile switching center, base station in a 6G communication system, open RAN, cloud RAN, base station in other communication systems, and access node in a Wi-Fi system, but is not limited thereto.

[0097] In some embodiments, the technical solutions of this disclosure can be applied to the Open RAN architecture. In this case, the interfaces between or within access network devices involved in the embodiments of this disclosure can be transformed into internal interfaces of Open RAN. The processes and information interactions between these internal interfaces can be implemented by software or programs.

[0098] In some embodiments, the access network device may be composed of a central unit (CU) and a distributed unit (DU). The CU may also be called a control unit. The CU-DU structure can separate the protocol layer of the access network device. Some of the protocol layer functions are centrally controlled by the CU, while the remaining part or all of the protocol layer functions are distributed in the DU and centrally controlled by the CU. However, this is not the only possibility.

[0099] In some embodiments, the core network equipment may be a single device comprising one or more network elements, or it may be multiple devices or a group of devices, including all or part of the first device and the third device, respectively. Network elements may be virtual or physical. The core network may include, for example, at least one of the following: Evolved Packet Core (EPC), 5G Core Network (5GCN), 6G Core Network (6GCN), and Next Generation Core (NGC).

[0100] Optionally, in some embodiments, the first device described above can be used to provide access and mobility management functions, such as an Access and Mobility Management Function (AMF) network element. Alternatively, the first device can be used to provide Internet of Things (IoT) functions, such as an Internet of Things Function (IoTF) network element or an Ambient Internet of Things Function (AIoTF) network element.

[0101] Optionally, in some embodiments, the third device can be used to provide unified data management functions, such as a Unified Data Management (UDM) network element; or, the third device can be used to provide unified data warehousing functions, such as a Unified Data Repository (UDR) network element. Alternatively, in some embodiments, the third device can be an application server.

[0102] It is understood that the communication system described in this disclosure is for the purpose of more clearly illustrating the technical solutions of this disclosure, and does not constitute a limitation on the technical solutions proposed in this disclosure. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions proposed in this disclosure are also applicable to similar technical problems.

[0103] The following embodiments of this disclosure can be applied to the communication system 100 shown in FIG1A, or to some of the main bodies, but are not limited thereto. The main bodies shown in FIG1A are illustrative. The communication system may include all or some of the main bodies in FIG1A, or it may include other main bodies outside of FIG1A. The number and form of each main body are arbitrary. Each main body may be physical or virtual. The connection relationship between the main bodies is illustrative. The main bodies may not be connected or may be connected. The connection can be in any way, it can be a direct connection or an indirect connection, it can be a wired connection or a wireless connection.

[0104] The embodiments disclosed herein can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 6th generation mobile communication system (6G), 5G New Radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New Radio Access (NX), Future Generation Radio Access (FX), Global System for Mobile Communications (GSM), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), and IEEE 802.20, Ultra-Wideband (UWB), Bluetooth (a registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X) systems, systems utilizing other authentication methods, and next-generation systems built upon them, etc. Furthermore, multiple systems can be combined (e.g., a combination of LTE or LTE-A with 5G).

[0105] Optionally, the aforementioned second device does not require a battery; it can collect ambient energy and / or artificial energy to supply normal uplink and downlink transmission. Optionally, the ambient energy may include natural energy sources such as solar, wind, and nuclear energy, and the artificial energy may include energy such as electromagnetic waves emitted by artificial devices. In some embodiments, the second device may also be referred to as: Ambient Internet of Things (A-IoT) device, Internet of Things (IoT) device, low-power device, low-power ambient IoT device, A-IoT Device, A-IoT UE, A-IoT terminal, A-IoT Tag, Tag, IoT terminal, etc.

[0106] In some embodiments, the second device can be applied to a variety of different communication architectures in the communication system. Optionally, Figures 1B-1C are schematic diagrams of the architecture of the second device communicating according to embodiments of the present disclosure.

[0107] Optionally, as shown in Figure 1B, the second device (i.e., the Ambient IoT device in Figure 1B) and the network device (i.e., the base station (BS) in Figure 1B) can directly receive and send data.

[0108] Optionally, as shown in Figure 1C, the second device (i.e., the Ambient IoT device in Figure 1C) and the network device (i.e., the base station (BS) in Figure 1C) can indirectly receive and send data through an intermediate node. Optionally, the intermediate node can also be called an auxiliary node. The intermediate node can be, for example, any of the following: relay, integrated access backhaul (IAB) device, terminal, or repeater.

[0109] Optionally, in some embodiments, the network devices (i.e., BS) and intermediate nodes (or auxiliary nodes) in Figures 1B and 1C can be collectively referred to as readers.

[0110] Optionally, the data transmitted between the Reader and the second device may include the following three service types: Device-terminated (DT), Device-originated–device-terminated triggered (DO-DTT), and Device-originated-autonomous (DO-A).

[0111] Optionally, both the aforementioned DT data and DO-DTT data require network triggering to be sent, while the aforementioned DO-A data can be actively triggered by the second device. The DO-A service type can provide more flexibility on both the second device side and the network side.

[0112] Optionally, DO-A service types pose a greater risk than DT or DO-DTT service types. For example, attackers can easily launch a Denial of Service (DoS) attack on the CN by creating a network of multiple unauthorized secondary devices to actively send false data. Therefore, how to implement one-way or two-way authentication for DO-A service types to ensure the confidentiality and integrity of information sent by secondary devices is a pressing issue that needs to be addressed.

[0113] Figure 2A is an interactive schematic diagram of an authentication method according to an embodiment of the present disclosure. As shown in Figure 2A, this embodiment of the disclosure relates to an authentication method for a communication system 100; the method includes:

[0114] Step 2101: The second device sends a first request to the first device.

[0115] In some embodiments, the first device may receive a first request sent by the second device, but is not limited thereto. The first device may also receive a first request sent by a subject other than the second device, in which case step 2101 may be omitted.

[0116] Alternatively, the second device may also be referred to as an A-IoT device, IoT device, low-power device, low-power environment IoT device, A-IoT UE, A-IoT terminal, A-IoT Tag, tag, IoT terminal, etc. For a detailed description of the second device, please refer to the description preceding the embodiment shown in Figure 2A.

[0117] Optionally, the first device can be used to provide access and mobility management functions, such as an Access and Mobility Management Function (AMF) network element. Alternatively, the first device can be used to provide Internet of Things (IoT) functions, such as an Internet of Things Function (IoTF) network element or an Ambient Internet of Things Function (AIoTF) network element.

[0118] Optionally, the second device can communicate with the first device through a Reader. For a detailed description of the Reader, please refer to the description preceding the embodiment shown in Figure 2A.

[0119] Optionally, the first request can be used to request triggering authentication between the first device and the second device. In some embodiments, the first request may include at least one of the following: the device identifier (ID) of the second device, a first indication, or one or more first identifiers. Optionally, the first indication can be used to indicate the function of the first request; for example, the first indication can indicate whether the first request is used to request triggering authentication between the first device and the second device. In some embodiments, the first indication may also be called an authentication indication or other names, which are not specifically limited in this disclosure. Optionally, the first identifier can be used to indicate a first security algorithm supported by the second device. In some embodiments, the first identifier may not be included in the first request; for example, when the second device supports a first security algorithm, the first identifier may not be included in the first request. Optionally, when the first identifier is not included in the first request, the first security algorithm supported by the second device may be stored in advance in a third device; for example, the third device may store the first security algorithm supported by the second device in the context information of the second device. Optionally, the third device here can be used to provide unified data management functions. For example, the third device can be a Unified Data Management (UDM) network element, or it can be used to provide unified data storage functions. For example, the third device can be a Unified Data Repository (UDR) network element. Alternatively, in some embodiments, the third device can be an application server.

[0120] Optionally, the first request described above may also be referred to as a command request or other names, which are not specifically limited in this disclosure.

[0121] Optionally, the second device may send a first request to the first device when at least one of the first key and the second key is not stored in the second device, for example, when the second device's memory (e.g., non-volatile memory (NVM)) does not store at least one of the first key and the second key. Alternatively, the second device may send a first request to the first device after at least one of the first key and the second key stored in a volatile register of the second device is lost. In some embodiments, the first key may be used to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device. For example, the first key may be used to encrypt at least one of the data, information, and signaling between the second device and the first device. Optionally, the first key may also be called a confidentiality key, confidentiality protection key, encryption key, or other names, and this disclosure does not specifically limit it in this regard. Optionally, the second key can be used to protect the integrity of at least one of the data, information, and signaling between the second device and the first device. The method of integrity protection using the second key is explained in subsequent steps 2108 and 2111. Optionally, the second key may also be called an integrity key, integrity protection key, or other names, and this disclosure does not specifically limit this. Optionally, the first key and the second key may be collectively referred to as a session key or other names, and this disclosure does not specifically limit this.

[0122] Optionally, when the second device does not store at least one of the first key and the second key, the first request sent by the second device will not be protected by the key; for example, the first request will not be protected by the first key and / or the second key.

[0123] Optionally, the method of this disclosure embodiment can be applied to DO-A services. For example, when the second device has a DO-A requirement, such as when the second device needs to actively send data to the first device (i.e., the second device actively triggers the sending of data), the second device sends a first request to the first device to request the triggering of authentication between the second device and the first device.

[0124] In some embodiments, the names of information, etc., are not limited to the names described in the embodiments. Terms such as "information", "message", "signal", "signaling", "report", "configuration", "indication", "instruction", "command", "channel", "parameter", "domain", "field", "symbol", "symbol", "codebook", "codeword", "codepoint", "bit", "data", "program", and "chip" can be used interchangeably.

[0125] In some embodiments, terms such as “send,” “transmit,” “report,” “distribute,” “transfer,” “bidirectional transmission,” “send and / or receive” can be used interchangeably.

[0126] Step 2102: The first device sends a second request to the second device.

[0127] Optionally, the second request can be used to request the first message, and the first message can be used by the first device to authenticate the second device.

[0128] In some embodiments, the second request may include at least one of the following: a first random number (Nonce 1) generated by the first device, and a second identifier indicating the second security algorithm. Optionally, the second security algorithm may be a security algorithm determined by the first device for confidentiality and / or integrity protection of at least one of the data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms. Optionally, the second request may or may not include the second identifier. For example, when the first request in step 2101 includes the first identifier, the first device may select (e.g., randomly select, or determine according to configuration) the second security algorithm from one or more first security algorithms indicated by the first identifier, and include the second identifier corresponding to the second security algorithm in the second request; when the first request in step 2101 does not include the first identifier, it indicates that the second device supports a first security algorithm, and the second security algorithm should be the first security algorithm supported by the second device. In this case, the first device can obtain the first security algorithm supported by the second device from the third device, therefore, the first device does not need to include the second identifier in the second request.

[0129] Optionally, in some embodiments, before sending the second request, the first device may first determine whether the first request in step 2101 meets the second condition. If the second condition is met, the first device sends the second request to the second device; if the second condition is not met, the first device does not send the second request to the second device. Optionally, the first condition may include at least one of the following: the first request is not protected, or the security verification of the first request fails. Optionally, when the first request is not protected, it indicates that the second device does not store the first key and / or the second key; when the security verification of the first request fails, it indicates that the first key and / or the second key stored on the second device is different from the first key and / or the second key stored on the first device. Optionally, in a communication system, when a second device is authenticated, the second device stores the same key as the first device. Therefore, when the first request meets the first condition, it means that the second device that sent the first request has not been authenticated by the first device. At this time, the second device may be a malicious device. The first device then determines that it needs to authenticate the second device. The first device can send a second request to the second device to request the first message so that the first device can subsequently authenticate the second device based on the first message.

[0130] Alternatively, the second request may also be referred to as an authentication command request or other names, which are not specifically limited in this disclosure.

[0131] Step 2103: The second device determines at least one of the first key, the second key, the first verification value, and the first response (User Response, RES).

[0132] Optionally, the second device can generate a second random number (Nonce 2) and generate a first response based on at least one of the device identifier of the second device, the first random number, the second random number, and the third key. Optionally, the third key may include, for example, at least one of the root key and the intermediate key of the second device. Optionally, different second devices may correspond to different root keys and / or different intermediate keys, wherein the intermediate key of the second device may be generated based on the root key and the device identifier of the second device. In some embodiments, the root key and / or intermediate key of the second device may be stored in the NVM of the second device. In other embodiments, the root key and / or intermediate key of the second device may also be associated with the device identifier of the second device and stored in the third device. For example, the third device may associate the root key and / or intermediate key of the second device with the device identifier of the second device and store it in the context information of the second device. Optionally, when generating the first response, the second device may generate the first response based on the first random number, the second random number, and the root key of the second device; or, it may generate the first response based on the first random number, the second random number, and the intermediate key of the second device; or, it may generate the first response based on the device identifier of the second device, the first random number, the second random number, and the intermediate key of the second device. This disclosure does not specifically limit the specific generation method of the first response, and any possible generation method is within the protection scope of this disclosure.

[0133] Optionally, the second device may also generate at least one of the first key and the second key based on at least one of the third security algorithm and the third key. Optionally, the third security algorithm may be a security algorithm determined by the second device for confidentiality protection and / or integrity protection of at least one of the data, information, and signaling between the second device and the first device. The third security algorithm may be selected by the second device from one or more first security algorithms. In some embodiments, when the second request includes a second identifier, it indicates that the first device has selected a second security algorithm. In this case, the third security algorithm may be the second security algorithm described above. In other embodiments, when the second request does not include a second identifier and the second device supports multiple first security algorithms, it indicates that the first device has not selected a second security algorithm. In this case, the second device may select a third security algorithm from one or more first security algorithms it supports and generate at least one of the first key and the second key based on at least one of the third security algorithm and the third key. In some embodiments, when the second request does not include a second identifier and the second device only supports one first security algorithm, it indicates that the first security algorithm is a third security algorithm. In this case, the second device can generate at least one of the first key and the second key based on at least one of the third security algorithm and the third key. For example, the second device can generate at least one of the first key and the second key based on the third security algorithm and the root key of the second device, or the second device can generate at least one of the first key and the second key based on the third security algorithm and the intermediate key of the second device. Optionally, in some embodiments, the second device can also generate at least one of the first key and the second key based on at least one of the first random number, the second random number, and the third key. For example, the second device can generate at least one of the first key and the second key based on the first random number, the second random number, and the root key of the second device, or the second device can generate at least one of the first key and the second key based on the first random number, the second random number, and the intermediate key of the second device. This disclosure does not specifically limit the specific generation method of the first key and the second key; any possible generation method is within the protection scope of this disclosure.

[0134] Optionally, after the second device determines the second key, the second device can generate a first verification value based on the second key. For example, the second device can include at least one of "the device identifier of the second device, a second random number, a first response, first data, and a third identifier for indicating a third security algorithm" in the first message. Optionally, the first data can be data that the second device needs to send to the first device. The first data can be data actively sent by the second device (i.e., data actively triggered by the second device to be sent). The first data can be protected by the first key. Furthermore, after the second device determines the first message, the second device can calculate the first verification value based on the second key and the third security algorithm. Optionally, the first verification value can be included in the first message. This first verification value can be used by the first device to authenticate the second device. For example, the first verification value can be used by the first device to perform integrity verification on the first message sent by the second device. The first verification value can be, for example, a message authentication code (MAC).

[0135] Step 2104: The second device sends a first message to the first device.

[0136] Optionally, the first message may include at least one of the following: a device identifier of the second device, a second random number generated by the second device, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm.

[0137] For a detailed introduction to "first response, first verification value, and third security algorithm", please refer to the description in step 2103 above.

[0138] Optionally, the first data can be data that the second device needs to send to the first device. For example, the first data can be data that the second device actively sends (i.e., data that the second device actively triggers to send). The first data can be protected by the first key.

[0139] Optionally, including the third identifier in the first message is primarily to inform the first device which specific security algorithm is used to protect the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device. Optionally, the first message may or may not include the third identifier. In some embodiments, when the third security algorithm is the second security algorithm, it indicates that the third security algorithm was selected by the first device, and the first device necessarily knows which security algorithm is the third security algorithm; therefore, the first message may not include the third identifier. In other embodiments, when the first device does not select the second security algorithm, if the second device supports multiple first security algorithms, it indicates that the third security algorithm was selected by the second device from multiple first security algorithms. In this case, the first message may include the third identifier, which is used to inform the first device which security algorithm the second device specifically selected as the third security algorithm. In some other embodiments, if the second device supports a first security algorithm, then the first security algorithm supported by the second device is the aforementioned third security algorithm. In this case, the first message may not include the third identifier, and since the first message does not include the third identifier, the first device cannot know which algorithm the third security algorithm is. However, since the third device stores the first security algorithm supported by the second device, when the first device needs to use the third security algorithm, it can request the third device to obtain the first security algorithm supported by the second device.

[0140] Optionally, the first message mentioned above may also be called an authentication command response or other names, which are not specifically limited in this disclosure.

[0141] Step 2105: The first device sends a third request and / or a fourth request to the third device.

[0142] Optionally, in some embodiments, the third request may include the device identifier of the second device, and the third request may be used to request at least one of a third key and a third security algorithm. For a detailed description of the third key, please refer to the steps described above.

[0143] Optionally, when the first message in step 2104 does not include a third identifier and the first device does not select a second security algorithm, it indicates that the second device supports a first security algorithm, and the third security algorithm is this first security algorithm supported by the second device. The first device is unaware of which security algorithm it supports. Therefore, since the third device stores this first security algorithm supported by the second device, the third request can be used to request the third security algorithm from the third device. Alternatively, when the first message in step 2104 includes a third identifier, or the first device selects a second security algorithm, it indicates that the first device knows which specific security algorithm is used to protect the confidentiality and / or integrity of at least one of the data, information, and signaling between the second and first devices. Thus, the third request does not need to request the third security algorithm.

[0144] Optionally, in some embodiments, the fourth request described above can be used to request at least one of the second response, the first key, and the second key. Optionally, the second response may include, for example, an expected user response (XRES). Optionally, the second response, the first key, and the second key may be used, for example, for the first device to authenticate the second device. Specific authentication methods described here can be found in subsequent step 2108.

[0145] Optionally, the fourth request may include at least one of the following: a device identifier of the second device, a first random number, a second random number generated by the second device, a third identifier for indicating a third security algorithm, or a second identifier for indicating a second security algorithm. In some embodiments, when the first device selects a second security algorithm from one or more first security algorithms supported by the second device, the third request may include a second identifier corresponding to the second security algorithm selected by the first device. This second identifier is used to inform the third device which security algorithm is specifically used to generate at least one of the second response, the first key, and the second key. In other embodiments, when the first device does not select a second security algorithm from one or more first security algorithms supported by the second device, but the first message in step 2104 includes "a third identifier for indicating a third security algorithm," the fourth request may include a third identifier, which is also used to inform the first device which security algorithm is specifically used to generate at least one of the second response, the first key, and the second key. In some other embodiments, when the first device does not select a second security algorithm from one or more first security algorithms supported by the second device, and the first message in step 2104 does not include "a third identifier for indicating a third security algorithm", it indicates that the second device supports a first security algorithm. The first security algorithm supported by the second device is used to generate at least one of the second response, the first key, and the second key. Optionally, since the third device stores the first security algorithm supported by the second device, the fourth request may not include the second identifier and the third identifier. When the third device determines that the fourth request does not include the second identifier or the third identifier, the third device can know that the security algorithm used to generate at least one of the second response, the first key, and the second key is the first security algorithm supported by the second device that it stores. Then, the third device can subsequently generate at least one of the second response, the first key, and the second key based on the security algorithm.

[0146] Step 2106: The third device sends the second information to the first device.

[0147] Optionally, in some embodiments, when the first device sends a third request to the third device in step 2105, the second information may include at least one of a third key and a third identifier. Optionally, in some embodiments, when the third request in step 2105 is not used to request a third security algorithm, the second information may not include the third identifier. In some embodiments, when the third request in step 2105 is used to request a third security algorithm, indicating that the second device currently supports a first security algorithm, the third device may identify the first security algorithm currently supported by the second device (which it stores) as the third security algorithm and include a third identifier indicating the third security algorithm in the second information.

[0148] Optionally, in some embodiments, when the first device sends a fourth request to the third device in step 2105 above, the second information may include at least one of the second response, the first key, and the second key.

[0149] Optionally, the second response may be generated by the third device based on at least one of the device identifier of the second device, the first random number, the second random number, and the third key. For example, the third device may generate the second response based on the first random number, the second random number, and the root key of the second device; or, the third device may generate the second response based on the first random number, the second random number, and the intermediate key of the second device; or, the third device may generate the second response based on the device identifier of the second device, the first random number, the second random number, and the intermediate key of the second device. This disclosure does not specifically limit the specific generation method of the second response, and any possible generation method is within the protection scope of this disclosure.

[0150] Optionally, at least one of the first key and the second key may be generated by the third device based on at least one of the third security algorithm and the third key; or, at least one of the first key and the second key may be generated by the third device based on at least one of the first random number, the second random number, and the third key. Optionally, the method by which the third device generates at least one of the first key and the second key is the same as the method by which the second device generates at least one of the first key and the second key in step 2103 above, and will not be repeated here.

[0151] Optionally, the third security algorithm used by the third device when generating the first key and / or the second key may be the security algorithm indicated by the second identifier or the third identifier in the fourth request of step 2105 above. Alternatively, when the fourth request of step 2105 above does not include the second identifier and the third identifier, it indicates that the second device currently supports a first security algorithm. In this case, the third device may determine the first security algorithm currently supported by the second device stored in its memory as the third security algorithm, and generate the first key and / or the second key based on at least one of the third security algorithm and the third key.

[0152] Step 2107: The first device determines at least one of the first key, the second key, and the second response based on the second information.

[0153] Optionally, when the second information includes at least one of a third key and a third identifier, the first device may generate a second response based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key, and generate at least one of the first key and the second key based on at least one of a third security algorithm and a third key. In some embodiments, at least one of the first key and the second key may also be generated based on at least one of the first random number, a second random number, and a third key. Optionally, when the second information includes a third identifier, the third security algorithm used to generate the first key and / or the second key may be the security algorithm indicated by the third identifier in the second information; or, when the second information does not include a third identifier, the third security algorithm used to generate the first key and / or the second key may be a second security algorithm selected by the first device from one or more first security algorithms, or it may be the security algorithm indicated by the third identifier in the first message of step 2104 above. For a detailed description of this part, please refer to steps 2102-2107 above, and for the generation method of "second response, first key, second key", please refer to step 2106 above.

[0154] Optionally, when the second information includes at least one of the second response, the first key, and the second key, the first device can directly determine at least one of the second response, the first key, and the second key based on the second information.

[0155] Step 2108: First device authenticates second device.

[0156] Optionally, the first device can authenticate the second device by performing a first operation. Optionally, the first operation may include at least one of the following: verifying a first response based on a second response, or verifying a first verification value based on a second key. Optionally, the above-mentioned "verifying a first response based on a second response" may include, for example, determining whether the second response is consistent with the first response; when the second response is consistent with the first response, confirming that the first response verification is successful; when the second response is inconsistent with the first response, confirming that the first response verification is unsuccessful. Optionally, the above-mentioned "verifying a first verification value based on a second key" may include, for example, generating a second verification value based on a second key determined by the first device and a third security algorithm; optionally, the method for generating the second verification value is the same as the method for generating the first verification value; the second device determines whether the second verification value is consistent with the first verification value; when the second verification value is consistent with the first verification value, confirming that the first verification value verification is successful; when the second verification value is inconsistent with the first verification value, confirming that the first verification value verification is unsuccessful.

[0157] Optionally, when the first response verification passes and / or the first verification value verification passes, the first device determines that the second device authentication has passed; when the first response verification fails and / or the first verification value verification fails, the first device determines that the second device authentication has failed.

[0158] Step 2109: The first device sends a second message to the second device.

[0159] Optionally, the first device may send a second message to the second device based on its authentication result of the second device.

[0160] Optionally, in some embodiments, when the second device is successfully authenticated, the second message may include at least one of the authentication success indication and the first information. Optionally, the first information may include information that the first device needs to send to the second device. For example, the first information may include command information or instruction information that the first device needs to send to the second device. The first information may be protected by a first key. Optionally, the second message may be protected by a first key and / or a second key. For example, in some embodiments, the second message may be encrypted using the first key. In other embodiments, a third verification value may be generated using the second key and a third security algorithm, and the third verification value may be included in the second message and the second message may be encrypted using the first key. Alternatively, in yet another embodiment, a third verification value may be generated using the second key and a third security algorithm, and the second message may be encrypted using the first key. After that, both the third verification value and the encrypted second message may be sent to the second device.

[0161] Optionally, when the second device is successfully authenticated, the first device may also associate and store at least one of the device identifier, the first key, and the second key of the second device in the context information of the second device.

[0162] Alternatively, in other embodiments, when the second device authentication fails, the second message may include an authentication failure indication, and / or the second message may not be protected by a key.

[0163] Alternatively, the second message may also be referred to as a command response or other names, which are not specifically limited in this disclosure.

[0164] Step 2110: The second device determines the authentication result of the first device for the second device based on the second message.

[0165] Optionally, the second device may first decrypt the second message based on the first key. If the second message is successfully decrypted and includes an authentication success indication, the second device can determine that it has been authenticated by the first device. If the second message is not protected by a key, and / or includes an authentication failure indication, the second device can determine that it has not been authenticated by the first device.

[0166] Step 2111: The second device performs security verification on the second message.

[0167] Optionally, the second device can perform integrity verification on the second message to achieve security verification of the second message. In some embodiments, the second device can perform integrity verification on the second message based on a second key. Optionally, the second device can first decrypt the second message based on a first key and determine the third verification value included in the second message. Then, the second device can generate a fourth verification value based on the second key and a third security algorithm, and determine whether the fourth verification value is consistent with the third verification value. When the fourth verification value is consistent with the third verification value, the integrity verification of the second message is determined to be successful, that is, the second message passes the security verification. When the fourth verification value is inconsistent with the third verification value, the integrity verification of the second message is determined to be unsuccessful, that is, the second message fails the security verification.

[0168] Optionally, in some embodiments, the second device may first generate a fourth verification value based on the second key and the third security algorithm, and determine whether the fourth verification value is consistent with the third verification value sent by the first device. Then, the second device can use the first key to decrypt the second message. Optionally, when the fourth verification value is consistent with the third verification value and the second message is successfully decrypted, the second device can determine that both the integrity verification and confidentiality verification of the second message are successful, and thus determine that the second message has passed security verification. When the fourth verification value is inconsistent with the third verification value, and / or the second message decryption fails, the second device can determine that the integrity verification and / or confidentiality verification of the second message are unsuccessful, and thus determine that the second message has failed security verification.

[0169] Step 2112: The second device is authenticated by the first device, and / or the first device is authenticated by the second device, and the second device stores at least one of the device identifier, the first key, and the second key of the second device.

[0170] Optionally, the second device may associate and store at least one of the device identifier, the first key, and the second key in the memory (e.g., NVM) of the second device.

[0171] Optionally, the second device may store at least one of the generated first key and second key in the temporary memory (e.g., a register) of the second device.

[0172] Step 2113: The first device and the second device communicate using at least one of the first key and the second key.

[0173] In some embodiments, at least one of the data, information, and signaling between the second device and the first device can be encrypted using a first key to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device. In some embodiments, an integrity verification value can be generated using a second key and a third security algorithm, and this integrity verification value can be included in at least one of the data, information, and signaling between the second device and the first device to protect the integrity of at least one of the data, information, and signaling between the second device and the first device.

[0174] The authentication method involved in the embodiments of this disclosure may include at least one of steps 2101 to 2113. For example, step 2108 may be implemented as an independent embodiment, steps 2101+2102+2103+2104+2108 may be implemented as an independent embodiment, and steps 2110+2111 may be implemented as an independent embodiment, but are not limited thereto.

[0175] In some embodiments, steps 2110 and 2111 can be performed in an interchangeable order or simultaneously.

[0176] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0177] Figure 2B is an interactive schematic diagram of an authentication method according to an embodiment of the present disclosure. As shown in Figure 2B, this embodiment of the disclosure relates to an authentication method for a communication system 100; the method includes:

[0178] Step 2201: The second device determines at least one of the first key, the second key, the first verification value, and the first response.

[0179] Optionally, the second device can generate a second random number (Nonce 2) and generate a first response based on at least one of the device identifier of the second device, the second random number, and the third key. Optionally, a detailed description of the third key can be found in the embodiment described in Figure 2A above. Optionally, when generating the first response, the second device can generate the first response based on the second random number and the root key of the second device, or it can generate the first response based on the second random number and the intermediate key of the second device, or it can generate the first response based on the device identifier of the second device, the second random number, and the intermediate key of the second device. This disclosure does not specifically limit the specific generation method of the first response, and any possible generation method is within the protection scope of this disclosure.

[0180] Optionally, the second device may also generate at least one of the first key and the second key based on at least one of the third security algorithm and the third key. Optionally, the third security algorithm may be a security algorithm determined by the second device for confidentiality protection and / or integrity protection of at least one of the data, information, and signaling between the second device and the first device, and the third security algorithm may be selected by the second device from one or more first security algorithms. Optionally, the second device may generate at least one of the first key and the second key based on the third security algorithm and the root key of the second device, or the second device may generate at least one of the first key and the second key based on the third security algorithm and the intermediate key of the second device. Optionally, in some embodiments, the second device may also generate at least one of the first key and the second key based on at least one of the second random number and the third key. For example, the second device may generate at least one of the first key and the second key based on the second random number and the root key of the second device, or the second device may generate at least one of the first key and the second key based on the second random number and the intermediate key of the second device. This disclosure does not specifically limit the specific generation method of the first key and the second key, and any possible generation method is within the protection scope of this disclosure.

[0181] Optionally, after the second device determines the second key, the second device can generate a first verification value based on the second key. For example, the second device can include at least one of "the device identifier of the second device, a second random number, a first response, first data, and a third identifier for indicating a third security algorithm" in the first message. Optionally, the first data can be data that the second device needs to send to the first device. The first data can be data actively sent by the second device (i.e., data actively triggered by the second device). The first data can be protected by the first key. Furthermore, after the second device determines the first message, the second device can calculate the first verification value based on the second key and the third security algorithm. Optionally, the first verification value can be included in the first message. This first verification value can be used by the first device to authenticate the second device. For example, the first verification value can be used by the first device to perform integrity verification on the first message sent by the second device. The first verification value can be, for example, a MAC value.

[0182] Step 2202: The second device sends a first message to the first device.

[0183] Optionally, the first message may include at least one of the following: a device identifier of the second device, a second random number generated by the second device, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm.

[0184] Optionally, the first message may include a third identifier, or it may not include a third identifier. In some embodiments, when the second device supports multiple first security algorithms, the first message may include a third identifier, which indicates the third security algorithm selected by the second device from the multiple first security algorithms it supports. If the second device supports only one first security algorithm, the first message may not include a third identifier. In this case, the first device cannot know which algorithm is the third security algorithm based on the first message. However, the third device stores the first security algorithm supported by the second device. Therefore, when the first device needs to use the third security algorithm, it can request the first security algorithm supported by the second device from the third device.

[0185] Optionally, the first message described above may also be referred to as a command request or other names, which are not specifically limited in this disclosure.

[0186] Step 2203: The first device sends a third request and / or a fourth request to the third device.

[0187] Optionally, in some embodiments, the third request may include the device identifier of the second device, and the third request may be used to request at least one of a third key and a third security algorithm. For a detailed description of the third key, please refer to the steps described above.

[0188] Optionally, when the first message in step 2202 does not include a third identifier, it indicates that the second device supports a first security algorithm, and the third security algorithm is the same first security algorithm supported by the second device. The first device is unaware of this first security algorithm supported by the second device. Optionally, since the third device stores the first security algorithm supported by the second device, the third request can be used to request the third security algorithm from the third device. Optionally, when the first message in step 2202 includes a third identifier, it indicates that the first device, based on the first message, knows which specific security algorithm is used to protect the confidentiality and / or integrity of at least one of the data, information, and signaling between the second and first devices. Therefore, the third request does not need to request the third security algorithm.

[0189] Optionally, in some embodiments, the fourth request described above can be used to request at least one of the second response, the first key, and the second key. Optionally, the second response, the first key, and the second key can be used, for example, for the first device to authenticate the second device. For details on the specific authentication method described here, please refer to step 2206.

[0190] Optionally, the fourth request may include at least one of the following: a device identifier of the second device, a second random number generated by the second device, and a third identifier for indicating a third security algorithm. In some embodiments, when the first message in step 2202 includes a "third identifier for indicating a third security algorithm," the fourth request may include a third identifier to inform the third device which specific security algorithm is used to generate at least one of the second response, the first key, and the second key. In some other embodiments, when the first message in step 2202 does not include "a third identifier for indicating a third security algorithm", it indicates that the second device supports a first security algorithm. The first security algorithm supported by the second device is at least one of the second response, the first key, and the second key. Optionally, since the third device stores the first security algorithm supported by the second device, the fourth request may not include the third identifier. When the third device determines that the fourth request does not include the third identifier, the third device can know that the security algorithm used to generate at least one of the second response, the first key, and the second key is the first security algorithm supported by the second device that it stores. Then, the third device can subsequently generate at least one of the second response, the first key, and the second key based on the security algorithm.

[0191] Step 2204: The third device sends the second information to the first device.

[0192] Optionally, in some embodiments, when the first device sends a third request to the third device in step 2203, the second information may include at least one of a third key and a third identifier. Optionally, in some embodiments, when the third request in step 2203 is not used to request a third security algorithm, the second information may not include the third identifier. In some embodiments, when the third request in step 2203 is used to request a third security algorithm, it indicates that the second device currently supports a first security algorithm, and the first device is unaware of this first security algorithm. In this case, the third device can identify the first security algorithm currently supported by the second device as the third security algorithm and include a third identifier indicating the third security algorithm in the second information, so that the first device can subsequently generate at least one of a first key and a second key based on the third security algorithm indicated by the second information.

[0193] Optionally, in some embodiments, when the first device sends a fourth request to the third device in step 2203 above, the second information may include at least one of the second response, the first key, and the second key.

[0194] Optionally, the second response may be generated by the third device based on at least one of the device identifier of the second device, the second random number, and the third key. For example, the third device may generate the second response based on the second random number and the root key of the second device, or the third device may generate the second response based on the second random number and the intermediate key of the second device, or the third device may generate the second response based on the device identifier of the second device, the second random number, and the intermediate key of the second device. This disclosure does not specifically limit the specific generation method of the second response, and any possible generation method is within the protection scope of this disclosure.

[0195] Optionally, at least one of the first key and the second key may be generated by the third device based on at least one of the third security algorithm and the third key; or, at least one of the first key and the second key may be generated by the third device based on at least one of the second random number and the third key. Optionally, the method by which the third device generates at least one of the first key and the second key is the same as the method by which the second device generates at least one of the first key and the second key in step 2201 above, and will not be repeated here.

[0196] Optionally, the third security algorithm used by the third device to generate the first key and / or the second key may be the security algorithm indicated by the third identifier in the fourth request of step 2204 above. Alternatively, when the fourth request of step 2204 above does not include the third identifier, it indicates that the second device currently supports a first security algorithm. In this case, the third device may determine the first security algorithm currently supported by the second device stored in its memory as the third security algorithm, and generate the first key and / or the second key based on at least one of the third security algorithm and the third key.

[0197] Step 2205: The first device determines at least one of the first key, the second key, and the second response based on the second information.

[0198] Optionally, when the second information includes at least one of a third key and a third identifier, the first device may generate a second response based on at least one of the device identifier of the second device, a second random number, and a third key, and generate at least one of a first key and a second key based on at least one of a third security algorithm and a third key. In some embodiments, at least one of the first key and the second key may also be generated based on at least one of a second random number and a third key. Optionally, when the second information includes a third identifier, the third security algorithm used to generate the first key and / or the second key may be the security algorithm indicated by the third identifier in the second information; or, when the second information does not include a third identifier, the third security algorithm used to generate the first key and / or the second key may be a second security algorithm selected by the first device from one or more first security algorithms, or it may be the security algorithm indicated by the third identifier in the first message of step 2202 above. For a detailed description of this part, please refer to the steps described above.

[0199] Optionally, when the second information includes at least one of the second response, the first key, and the second key, the first device can directly determine at least one of the second response, the first key, and the second key based on the second information.

[0200] Step 2206: First device authenticates second device.

[0201] Step 2207: The first device sends a second message to the second device.

[0202] Step 2208: The second device determines the authentication result of the first device for the second device based on the second message.

[0203] Step 2209: The second device performs security verification on the second message.

[0204] Step 2210: The second device is authenticated by the first device, and / or the first device is authenticated by the second device, and the second device stores at least one of the device identifier, the first key, and the second key of the second device.

[0205] Step 2211: The first device and the second device communicate using at least one of the first key and the second key.

[0206] For a detailed description of steps 2206-2211, please refer to the embodiment described in Figure 2A above.

[0207] The authentication method involved in the embodiments of this disclosure may include at least one of steps 2201 to 2211. For example, step 2206 may be implemented as a standalone embodiment, steps 2202+2206 may be implemented as a standalone embodiment, and steps 2208+2209 may be implemented as standalone embodiments, but are not limited thereto.

[0208] In some embodiments, steps 2208 and 2209 may be performed in an interchangeable order or simultaneously.

[0209] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0210] Figure 2C is an interactive schematic diagram of an authentication method according to an embodiment of the present disclosure. As shown in Figure 2C, this embodiment of the disclosure relates to an authentication method for a communication system 100; the method includes:

[0211] Step 2301: The first device sends a paging message to the second device.

[0212] Optionally, the paging message may include a first random number generated by the first device. Optionally, the paging message may be determined to be sent by the first device, or the paging message may be triggered by an application function (AF) network element to be sent by the first device. For detailed information about the first device and the second device, please refer to the description of the embodiment in Figure 2A.

[0213] Alternatively, the paging message described above may also be called a paging request or other names, which are not specifically limited in this disclosure.

[0214] Step 2302: The second device determines at least one of the first key, the second key, the first verification value, and the first response (User Response, RES).

[0215] Step 2303: The second device sends a first message to the first device.

[0216] Alternatively, the first message described above may also be referred to as a paging response or other names, which are not specifically limited in this disclosure.

[0217] Step 2304: The first device sends a third request and / or a fourth request to the third device.

[0218] Step 2305: The third device sends the second information to the first device.

[0219] Step 2306: The first device determines at least one of the first key, the second key, and the second response based on the second information.

[0220] Step 2307: First device authenticates second device.

[0221] Step 2308: The first device sends a second message to the second device.

[0222] Alternatively, the second message described above may also be referred to as a command request or other names, which are not specifically limited in this disclosure.

[0223] Step 2309: The second device determines the authentication result of the first device for the second device based on the second message.

[0224] Step 2310: The second device performs security verification on the second message.

[0225] Step 2311: The second device is authenticated by the first device, and / or the first device is authenticated by the second device, and the second device stores at least one of the device identifier, the first key, and the second key of the second device.

[0226] Step 2312: The first device and the second device communicate using at least one of the first key and the second key.

[0227] For a detailed description of steps 2302-2312, please refer to the embodiment described in Figure 2A above.

[0228] The authentication method involved in the embodiments of this disclosure may include at least one of steps 2301 to 2312. For example, step 2307 may be implemented as a standalone embodiment, steps 2301+2303+2307 may be implemented as a standalone embodiment, and steps 2309+2310 may be implemented as a standalone embodiment, but are not limited thereto.

[0229] In some embodiments, steps 2309 and 2310 may be performed in an alternate order or simultaneously.

[0230] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0231] Figure 3A is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3A, this disclosure relates to an authentication method for a first device, the method comprising:

[0232] Step 3101: Receive the first message sent by the second device.

[0233] Step 3102: Authenticate the second device based on the first message.

[0234] Optionally, the first message is used by the first device to authenticate the second device, whereby the second device includes an Internet of Things (IoT) device.

[0235] Optionally, the method further includes:

[0236] Receive a first request sent by the second device, the first request being used to request the triggering of authentication between the first device and the second device;

[0237] Send a second request to the second device, the second request being used to request the second device to send the first message.

[0238] Optionally, the first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

[0239] Optionally, the second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm;

[0240] The second security algorithm is a security algorithm determined by the first device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

[0241] Optionally, sending the second request to the second device includes:

[0242] If the first request meets the first condition, the second request is sent to the second device;

[0243] The first condition includes at least one of the following:

[0244] The first request is not protected;

[0245] The security verification for the first request failed.

[0246] Optionally, the method further includes:

[0247] A paging message is sent to the second device, the paging message including a first random number generated by the first device.

[0248] Optionally, the first message includes at least one of the following: the device identifier of the second device, a second random number generated by the second device, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm;

[0249] The third security algorithm is a security algorithm determined by the second device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device. The third security algorithm is selected by the second device from one or more first security algorithms.

[0250] Wherein, the first data is the data that the second device needs to send to the first device, and the first data is protected by a first key. The first key is used to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device; the first verification value is used by the first device to authenticate the second device, and the first verification value is generated based on a second key. The second key is used to protect the integrity of at least one of the data, information, and signaling between the second device and the first device.

[0251] Optionally, the first response is used by the first device to authenticate the second device, and the first response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key.

[0252] Optionally, the method further includes:

[0253] Send a third request to a third device, the third request including the device identifier of the second device, the third request being used to request at least one of a third key and a third security algorithm;

[0254] Receive at least one of the third key and the third identifier indicating the third security algorithm sent by the third device;

[0255] A second response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and the third key;

[0256] Generate at least one of the first key and the second key.

[0257] Optionally, the method further includes:

[0258] A fourth request is sent to a third device, the fourth request including at least one of the following: the device identifier of the second device, a first random number, a second random number, a third identifier for indicating a third security algorithm, or a second identifier for indicating a second security algorithm; wherein, the fourth request is used to request at least one of a second response, a first key, and a second key;

[0259] The device receives at least one of the second response, the first key, and the second key sent by the third device, wherein the second response is generated based on at least one of the device identifier of the second device, the first random number, the second random number, and the third key.

[0260] Optionally, authenticating the second device based on the first message includes:

[0261] Perform a first operation, the first operation including at least one of the following: verifying a first response based on a second response, verifying a first verification value based on a second key;

[0262] The authentication of the second device based on the first message further includes at least one of the following:

[0263] If the second condition is met, the second device is determined to be authenticated. The second condition includes at least one of the following: the first response verification is passed, or the first verification value verification is passed.

[0264] If the third condition is met, it is determined that the second device authentication has failed. The third condition includes at least one of the following: the first response verification fails, or the first verification value verification fails.

[0265] Optionally, the method further includes:

[0266] A second message is sent to the second device based on the authentication result of the second device.

[0267] Optionally, if the second device is successfully authenticated, the second message includes at least one of an authentication success indication and first information, wherein the first information includes information that the first device needs to send to the second device, and the second message is protected by a first key and / or a second key; or...

[0268] The second device authentication failed, the second message includes an authentication failure indication, and / or the second message is not protected by a key.

[0269] Optionally, the method further includes:

[0270] Upon successful authentication of the second device, at least one of the device identifier, the first key, and the second key of the second device is stored.

[0271] The second device communicates based on at least one of the first key and the second key.

[0272] For a detailed description of steps 3101-3102, please refer to the above embodiment description.

[0273] The authentication method involved in the embodiments of this disclosure may include at least one of steps 3101 to 3102. For example, step 3101 may be implemented as a separate embodiment, and step 3102 may be implemented as a separate embodiment, but are not limited thereto.

[0274] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0275] Figure 3B is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3B, this embodiment of the present disclosure relates to an authentication method for a first device, the method comprising:

[0276] Step 3201: Receive the first request sent by the second device.

[0277] Step 3202: Send a second request to the second device.

[0278] Step 3203: Receive the first message sent by the second device.

[0279] Step 3204: Send a third request and / or a fourth request to the third device.

[0280] Step 3205: Receive the second information sent by the third device.

[0281] Step 3206: Determine at least one of the first key, the second key, and the second response based on the second information.

[0282] Step 3207: Authenticate the second device.

[0283] Step 3208: Send a second message to the second device.

[0284] Step 3209: Communicate with the second device using at least one of the first key and the second key.

[0285] For a detailed description of steps 3201-3209, please refer to the above embodiment description.

[0286] The authentication method involved in the embodiments of this disclosure may include at least one of steps 3201 to 3209. For example, step 3207 may be implemented as a standalone embodiment, and steps 3201+3202+3203+3207 may be implemented as standalone embodiments, but are not limited thereto.

[0287] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0288] Figure 3C is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3C, this disclosure relates to an authentication method for a first device, the method comprising:

[0289] Step 3301: Receive the first message sent by the second device.

[0290] Step 3302: Send a third request and / or a fourth request to the third device.

[0291] Step 3303: Receive the second information sent by the third device.

[0292] Step 3304: Determine at least one of the first key, the second key, and the second response based on the second information.

[0293] Step 3305: Authenticate the second device.

[0294] Step 3306: Send a second message to the second device.

[0295] Step 3307: Communicate with the second device using at least one of the first key and the second key.

[0296] For a detailed description of steps 3301-3307, please refer to the above embodiment description.

[0297] The authentication method involved in the embodiments of this disclosure may include at least one of steps 3301 to 3307. For example, step 3305 may be implemented as a standalone embodiment, and steps 3301+3305 may be implemented as standalone embodiments, but are not limited thereto.

[0298] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0299] Figure 3D is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3D, the present disclosure relates to an authentication method for a first device, the method comprising:

[0300] Step 3401: Send a paging message to the second device.

[0301] Step 3402: Receive the first message sent by the second device.

[0302] Step 3403: Send a third request and / or a fourth request to the third device.

[0303] Step 3404: Receive the second information sent by the third device.

[0304] Step 3405: ​​Determine at least one of the first key, the second key, and the second response based on the second information.

[0305] Step 3406: Authenticate the second device.

[0306] Step 3407: Send a second message to the second device.

[0307] Step 3408: Communicate with the second device using at least one of the first key and the second key.

[0308] For a detailed description of steps 3401-3408, please refer to the above embodiment description.

[0309] The authentication method involved in the embodiments of this disclosure may include at least one of steps 3401 to 3408. For example, step 3406 may be implemented as a standalone embodiment, and steps 3401+3402+3406 may be implemented as standalone embodiments, but are not limited thereto.

[0310] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0311] Figure 3E is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3E, this disclosure relates to an authentication method for a first device, the method comprising:

[0312] Step 3501: Send the first message to the first device.

[0313] Optionally, the first message is used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device.

[0314] Optionally, the method further includes:

[0315] Send a first request to the first device, the first request being used to request the triggering of authentication between the first device and the second device;

[0316] Receive a second request sent by the first device, the second request being used to request the second device to send the first message.

[0317] Optionally, sending the first request to the first device includes:

[0318] The second device, which does not store at least one of the first key and the second key, sends the first request to the first device; wherein the first key is used to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device, and the second key is used to protect the integrity of at least one of the data, information, and signaling between the second device and the first device.

[0319] Optionally, the first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

[0320] Optionally, the second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm; wherein the second security algorithm is a security algorithm determined by the first device for confidentiality protection and / or integrity protection of at least one of data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

[0321] Optionally, the method further includes:

[0322] The device receives a paging message sent by the first device, the paging message including a first random number generated by the first device.

[0323] Optionally, the method further includes:

[0324] Generate a second random number;

[0325] A first response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key, and the first response is used by the first device to authenticate the second device;

[0326] Generate at least one of the first key and the second key;

[0327] The first data is protected by the first key, and the first data is the data that the second device needs to send to the first device.

[0328] A first verification value is generated based on the second key, and the first verification value is used by the first device to authenticate the second device.

[0329] Optionally, the first message includes at least one of the following: the device identifier of the second device, a second random number, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm;

[0330] The third security algorithm is a security algorithm determined by the second device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device, and the third security algorithm is selected by the second device from one or more first security algorithms.

[0331] Optionally, the method further includes:

[0332] Receive a second message sent by the first device based on the authentication result of the second device.

[0333] Optionally, the method further includes:

[0334] The second message is securely verified based on the second key. If the second message passes the security verification, it is determined that the first device has been authenticated by the second device.

[0335] Optionally, the method further includes:

[0336] The second message includes an authentication success indication, confirming that the second device has been authenticated by the first device;

[0337] The second message is not protected by a key, and / or the second message includes an authentication failure indication, determining that the second device has failed authentication by the first device.

[0338] Optionally, the method further includes:

[0339] The second device is authenticated by the first device, and / or the first device is authenticated by the second device, and stores at least one of the first key and the second key;

[0340] Communicate with the first device based on at least one of the first key and the second key.

[0341] For a detailed description of step 3501, please refer to the above embodiment.

[0342] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0343] Figure 3F is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3F, this disclosure relates to an authentication method for a second device, the method comprising:

[0344] Step 3601: Send the first request to the first device.

[0345] Step 3602: Receive the second request sent by the first device.

[0346] Step 3603: Determine at least one of the first key, the second key, the first verification value, and the first response.

[0347] Step 3604: Send the first message to the first device.

[0348] Step 3605: Receive the second message sent by the first device.

[0349] Step 3606: Determine the authentication result of the first device for the second device based on the second message.

[0350] Step 3607: Perform security verification on the second message.

[0351] Step 3608: Store at least one of the device identifier of the second device, the first key, and the second key.

[0352] Step 3609: Communicate with the first device using at least one of the first key and the second key.

[0353] For a detailed description of steps 3601-3609, please refer to the above embodiment description.

[0354] The authentication method involved in the embodiments of this disclosure may include at least one of steps 3601 to 3609. For example, steps 3601+3602+3603+3604 may be implemented as independent embodiments, and steps 3606+3607 may be implemented as independent embodiments, but are not limited thereto.

[0355] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0356] Figure 3G is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3G, this embodiment of the disclosure relates to an authentication method for a second device, the method comprising:

[0357] Step 3701: Determine at least one of the first key, the second key, the first verification value, and the first response.

[0358] Step 3702: Send the first message to the first device.

[0359] Step 3703: Receive the second message sent by the first device.

[0360] Step 3704: Determine the authentication result of the first device for the second device based on the second message.

[0361] Step 3705: Perform security verification on the second message.

[0362] Step 3706: Store at least one of the device identifier of the second device, the first key, and the second key.

[0363] Step 3707: Communicate with the first device using at least one of the first key and the second key.

[0364] For a detailed description of steps 3701-3707, please refer to the above embodiment description.

[0365] The authentication method disclosed in this embodiment may include at least one of steps 3701 to 3707. For example, step 3702 may be implemented as a separate embodiment, and steps 3704 and 3705 may be implemented as separate embodiments, but are not limited thereto.

[0366] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0367] Figure 3H is a flowchart illustrating an authentication method according to an embodiment of the present disclosure. As shown in Figure 3H, this embodiment of the present disclosure relates to an authentication method for a second device, the method comprising:

[0368] Step 3801: Receive the paging message sent by the first device.

[0369] Step 3802: Determine at least one of the first key, the second key, the first verification value, and the first response.

[0370] Step 3803: Send the first message to the first device.

[0371] Step 3804: Receive the second message sent by the first device.

[0372] Step 3805: Determine the authentication result of the first device for the second device based on the second message.

[0373] Step 3806: Perform security verification on the second message.

[0374] Step 3807: Store at least one of the device identifier of the second device, the first key, and the second key.

[0375] Step 3808: Communicate with the first device using at least one of the first key and the second key.

[0376] For a detailed description of steps 3801-3808, please refer to the above embodiment description.

[0377] The authentication method involved in the embodiments of this disclosure may include at least one of steps 3801 to 3808. For example, steps 3801+3803 may be implemented as independent embodiments, and steps 3805+3806 may be implemented as independent embodiments, but are not limited thereto.

[0378] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0379] The following is an exemplary description of the above method:

[0380] Environmental IoT devices can be: IoT devices that support environmental power, requiring no batteries and using capacitors to provide storage capacity, with limited energy storage capabilities. In some embodiments, environmental IoT devices can be powered by collecting radio waves, light, motion, heat, or any other suitable power source. Environmental IoT can make supply chains more efficient and sustainable, and can provide the data needed for advanced transportation and smart city initiatives.

[0381] Optionally, the connection topology between environmental IoT devices and other devices can be divided into two categories: Topology 1 and Topology 2.

[0382] Optionally, Topology 1 can refer to Figure 1B above, where the BS (i.e., the base station) communicates directly with the environmental IoT device. In Topology 1, the environmental IoT device directly communicates bidirectionally with the base station. The communication information between the BS and the environmental IoT device can include environmental IoT data and / or signaling. In this Topology 1, the process of the BS sending data to the environmental IoT device can differ from the process of the BS receiving data from the environmental IoT device.

[0383] Optionally, Topology 2 can refer to Figure 1C above. The BS can communicate with the environmental IoT devices through intermediate nodes. In Topology 2, the environmental IoT devices and intermediate nodes communicate bidirectionally. In this Topology 2, the intermediate nodes can be relays, IAB nodes, UEs, repeaters, etc., and the intermediate nodes can transmit information between the BS and the environmental IoT devices.

[0384] Based on Topology 1 and Topology 2 above, the following different business types can be considered for environmental IoT services.

[0385] -DT: Device terminated.

[0386] -DO-DTT: Device Initiated-Device Termination Trigger. Environmental IoT devices can only send data to the CN after being triggered by the CN.

[0387] -DO-A: Device Initiated-Autonomous, environmental IoT devices can send data to the CN at any time via a card reader.

[0388] In Rel-19, only DT and DO-DTT are supported, meaning that environmental IoT devices need to be triggered by the network before they can provide collected data or execute requested commands. However, the DO-A service type offers more flexibility on both the device and network sides and will be supported and explored in Rel-20.

[0389] From a security perspective, DO-A service types may pose greater risks than DT or DO-DTT service types. For example, attackers can easily launch a DoS attack against a CN by creating a network of multiple IoT devices in an unauthorized environment and actively sending false data.

[0390] Therefore, it is necessary to study how to perform one-way or two-way authentication for DO-A service types and ensure the confidentiality / integrity of information sent by environmental IoT devices.

[0391] Alternatively, the main objective of the method disclosed herein is as follows:

[0392] Provide an authentication method for DO-A service types (network authentication performed by environmental IoT devices).

[0393] Protect information during AIoT service communication.

[0394] Figure 4A is an interactive schematic diagram of an authentication method according to an embodiment of the present disclosure. It is assumed that the environmental IoT device ID and root key are stored in the NVM of the environmental IoT device. The UDM or application server can maintain the environmental IoT device ID and the corresponding root key. The session key generated from the root key can be temporarily stored in the memory of the environmental IoT device. Referring to Figure 4A, the method of the present disclosure may include the following steps:

[0395] 1. The environmental IoT device (i.e., the IoT device in Figure 4A) sends a command request to the IoTF / AMF via a reader, including the device ID, authentication indication (optional), and security algorithm (optional).

[0396] Optionally, due to the lack of a session key, the environmental IoT device may send a command request. Once the IoTF / AMF receives an unprotected command request from the IoT device, or once the security verification of the command request fails, the IoTF / AMF can initiate an authentication process.

[0397] 2. IoTF / AMF generates a random number 1 and can select a security algorithm to protect subsequent communications based on the received security algorithm. IoTF / AMF includes the random number 1 and the selected security algorithm in the authentication command request.

[0398] 3. The environmental IoT device generates a random number 2, which is used to calculate the session key and RES.

[0399] Optionally, the environmental IoT device generates a session key based on the root key / intermediate key and the identifier of the selected security algorithm.

[0400] Optionally, the environmental IoT device generates a response RES based on random number 1, random number 2, and the root key / intermediate key.

[0401] The environmental IoT device sends an authentication command response, including a random number 2, RES (optional), data protected by a confidential key (optional), and a MAC for integrity protection.

[0402] Optionally, the session key may include an integrity protection key and a confidentiality protection key.

[0403] Optionally, the environmental IoT device can use the environmental IoT device ID and the root key to generate an intermediate key, and use the intermediate key to calculate the session key.

[0404] Optionally, environmental IoT devices may only support one security algorithm. In this case, the supported security algorithms are stored in the UDM or application server associated with the device ID. No security algorithm was provided in step 1, and no selected algorithm was provided in step 2.

[0405] 4. Once the IoTF / AMF receives a response message, it can interact with the application server / UDM to obtain the corresponding root key / intermediate key.

[0406] Optionally, UDM can provide IoTF / AMF with an intermediate key for the environmental IoT device, which is generated using the root key and the environmental IoT device ID.

[0407] 5. IoTF / AMF generates session keys and XRES in the same way as environmental IoT devices.

[0408] Optionally, IoTF / AMF checks the integrity of the authentication command response by verifying the MAC.

[0409] Optionally, IoTF / AMF checks the authenticity of environmental IoT devices by comparing RES and XRES.

[0410] If the MAC is successfully verified and / or RES equals XRES, the IoTF / AMF can store the session key locally along with the device ID and begin processing protected data sent from the ambient IoT device.

[0411] Optionally, in other embodiments, the IoTF / AMF provides the application server / UDM with random number 1, random number 2, and a selected security algorithm (optional). The application server / UDM calculates the session key and / or XRES in the same manner as the IoT devices in the environment and returns the session key and / or XRES to the IoTF / AMF. The IoTF / AMF returns a command response, including the authentication result and subsequent commands (optional). If the authentication result fails, this message is unprotected. Otherwise, this message is protected by the session key.

[0412] 7. By verifying command response messages, environmental IoT devices can check the authenticity of the network.

[0413] 8. If the verification is successful, the environmental IoT device can send the protected data to CN.

[0414] Optionally, FIG4B is an interactive schematic diagram of an authentication method according to an embodiment of the present disclosure. Referring to FIG4B, the method of the present disclosure may include the following steps:

[0415] 1. The environmental IoT device generates a random number 1, which is used to calculate the session key and RES.

[0416] Optionally, the environmental IoT device generates a session key based on the root key / intermediate key and the identifier of the selected security algorithm.

[0417] Optionally, the environmental IoT device generates a response RES for authentication based on a random number 1 and a root key / intermediate key.

[0418] Optionally, environmental IoT devices send command requests to the IoTF / AMF via a reader, including device ID, Nonce 1, selected security algorithm (optional), RES for authentication, and MAC for integrity protection.

[0419] Alternatively, due to the lack of a session key, the environmental IoT device may initiate an authentication process.

[0420] Optionally, the session key may include an integrity protection key and a confidentiality protection key.

[0421] Optionally, environmental IoT devices may only support one security algorithm. In this case, the supported security algorithm is stored in the UDM or application server associated with the device ID. No security algorithm was provided in step 1.

[0422] 2. Once the IoTF / AMF receives a command request from the environmental IoT device, it can interact with the application server / UDM to obtain the root key / intermediate key.

[0423] 3. IoTF / AMF generates session keys and XRES in the same way as environmental IoT devices.

[0424] Optionally, IoTF / AMF checks the integrity of the authentication command response by verifying the MAC.

[0425] Optionally, IoTF / AMF checks the authenticity of environmental IoT devices by comparing RES and XRES.

[0426] If the MAC is successfully verified and / or RES equals XRES, the IoTF / AMF can store the session key locally along with the device ID.

[0427] Optionally, in other embodiments, the IoTF / AMF provides the application server / UDM with a random number 1 and a selected security algorithm (optional). The application server / UDM calculates the session key and / or XRES in the same manner as the IoT devices in the environment, and returns the session key and / or XRES to the IoTF / AMF.

[0428] Steps 4-6 in Figure 4B are the same as steps 6-8 in Figure 4A.

[0429] Optionally, FIG4C is an interactive schematic diagram of an authentication method according to an embodiment of the present disclosure. Referring to FIG4C, the method of the present disclosure may include the following steps:

[0430] 1. The IoTF / AMF sends a paging request, including Nonce 1, to the IoT device. The paging request can be triggered by the AF.

[0431] 2. The environmental IoT device generates a random number 2, which is used to calculate the session key and RES.

[0432] Optionally, the environmental IoT device generates a session key based on the root key / intermediate key and the identifier of the selected security algorithm.

[0433] Optionally, the environmental IoT device generates a response RES based on random number 1, random number 2, and the root key / intermediate key.

[0434] Optionally, the environmental IoT device sends a paging response message, including Nonce 2, RES (optional), a selected security algorithm (optional), and a MAC for integrity protection.

[0435] Optionally, the session key may include an integrity protection key and a confidentiality protection key.

[0436] Optionally, environmental IoT devices may only support one security algorithm. In this case, the supported security algorithms are stored in the UDM or application server associated with the device ID. No algorithm selection is provided in step 2.

[0437] Steps 3-7 in Figure 4C are the same as steps 4-8 in Figure 4A.

[0438] Optionally, in embodiments of this disclosure, the environmental IoT device can implement the following:

[0439] Environmental IoT devices can send messages to trigger authentication between the environmental IoT device and the network.

[0440] Environmental IoT devices can send messages containing random numbers, RES, and MAC.

[0441] Environmental IoT devices can generate session keys to protect messages used for authentication.

[0442] Optionally, in embodiments of this disclosure, the IoTF / AMF can achieve the following:

[0443] IoTF / AMF can receive messages to trigger authentication between environmental IoT devices and the network.

[0444] IoTF / AMF can verify messages using session keys.

[0445] In some embodiments, if the arrows in the interaction diagram representing the sending of information, signaling, etc., from one subject to another pass through other subjects, it can be interpreted as the message being forwarded from one subject to another via other subjects, or it can be interpreted as the message being sent from one subject to another without passing through other subjects. For example, step 1 in Figure 4A can be interpreted as: forwarding a command request from the IoT device to the IoTF / AMF via the reader / writer.

[0446] This disclosure also proposes an apparatus (also referred to as a communication device, etc.) for implementing any of the above methods. For example, an apparatus is proposed that includes units or modules for implementing the steps performed by the terminal in any of the above methods. Furthermore, another apparatus is proposed that includes units or modules for implementing the steps performed by a network device (e.g., an access network device, a core network functional node, a core network device, etc.) in any of the above methods.

[0447] It should be understood that the division of units or modules in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units or modules in the device can be implemented by a processor calling software: for example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of the units or modules in the above device. The processor can be, for example, a general-purpose processor, such as a Central Processing Unit (CPU) or a microprocessor, and the memory can be internal or external to the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits. The functionality of some or all of the units or modules can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC). The functionality of some or all of the units or modules is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD). Taking a field-programmable gate array (FPGA) as an example, it can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby achieving the functionality of some or all of the units or modules. All units or modules of the above device can be implemented entirely through processor-called software, entirely through hardware circuits, or partially through processor-called software with the remaining parts implemented through hardware circuits.

[0448] In this embodiment, the processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a Central Processing Unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. The logical relationships of the aforementioned hardware circuits are fixed or reconfigurable. For example, the processor is a hardware circuit implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a Neural Network Processing Unit (NPU), a Tensor Processing Unit (TPU), or a Deep Learning Processing Unit (DPU).

[0449] Figure 5A is a schematic diagram of the structure of a first device according to an embodiment of this disclosure. The first device is used to perform any of the above methods. In some embodiments, as shown in Figure 5A, the first device may include at least one of a processing module, a transceiver module, etc. In some embodiments, the transceiver module is used to receive a first message sent by a second device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; the processing module is further used to authenticate the second device based on the first message.

[0450] Optionally, the transceiver module is used to perform at least one of the communication steps (e.g., steps 2101, 2102, 2104, 2109, 2113, 2202, 2207, 2211, 2301, 2303, 2308, 2312, 3101, 3102, but not limited thereto) performed by the first device in any of the above methods, which will not be elaborated here. Optionally, the processing module is used to perform at least one of the other steps (e.g., steps 2107, 2108, 2205, 2206, 2306, 2307, but not limited thereto) performed by the first device in any of the above methods, which will not be elaborated here.

[0451] Optionally, the transceiver module is further configured to receive a first request sent by the second device, the first request being used to request the triggering of authentication between the first device and the second device;

[0452] The transceiver module is further configured to send a second request to the second device, the second request being used to request the second device to send the first message.

[0453] Optionally, the first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

[0454] Optionally, the second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm;

[0455] The second security algorithm is a security algorithm determined by the first device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

[0456] Optionally, the transceiver module is further configured to:

[0457] If the first request meets the first condition, the second request is sent to the second device;

[0458] The first condition includes at least one of the following:

[0459] The first request is not protected;

[0460] The security verification for the first request failed.

[0461] Optionally, the method further includes:

[0462] A paging message is sent to the second device, the paging message including a first random number generated by the first device.

[0463] Optionally, the first message includes at least one of the following: the device identifier of the second device, a second random number generated by the second device, a first response RES, first data, a first verification value, and a third identifier for indicating a third security algorithm;

[0464] The third security algorithm is a security algorithm determined by the second device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device. The third security algorithm is selected by the second device from one or more first security algorithms.

[0465] Wherein, the first data is the data that the second device needs to send to the first device, and the first data is protected by a first key. The first key is used to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device; the first verification value is used by the first device to authenticate the second device, and the first verification value is generated based on a second key. The second key is used to protect the integrity of at least one of the data, information, and signaling between the second device and the first device.

[0466] Optionally, the first response is used by the first device to authenticate the second device, and the first response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key.

[0467] Optionally, the transceiver module is further configured to send a third request to a third device, the third request including the device identifier of the second device, and the third request being used to request at least one of a third key and a third security algorithm;

[0468] The transceiver module is further configured to receive at least one of the third key and the third identifier indicating the third security algorithm sent by the third device;

[0469] The processing module is further configured to generate a second response based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key;

[0470] The processing module is also used to generate at least one of the first key and the second key.

[0471] Optionally, the transceiver module is further configured to send a fourth request to the third device, the fourth request including at least one of the following: the device identifier of the second device, a first random number, a second random number, a third identifier for indicating a third security algorithm, or a second identifier for indicating a second security algorithm; wherein, the fourth request is used to request at least one of a second response, a first key, and a second key;

[0472] The transceiver module is further configured to receive at least one of the second response, the first key, and the second key sent by the third device, wherein the second response is generated based on at least one of the device identifier of the second device, the first random number, the second random number, and the third key.

[0473] Optionally, the processing module is further configured to:

[0474] Perform a first operation, the first operation including at least one of the following: verifying a first response based on a second response, verifying a first verification value based on a second key;

[0475] The authentication of the second device based on the first message further includes at least one of the following:

[0476] If the second condition is met, the second device is determined to be authenticated. The second condition includes at least one of the following: the first response verification is passed, or the first verification value verification is passed.

[0477] If the third condition is met, it is determined that the second device authentication has failed. The third condition includes at least one of the following: the first response verification fails, or the first verification value verification fails.

[0478] Optionally, the transceiver module is further configured to send a second message to the second device based on the authentication result of the second device.

[0479] Optionally, if the second device is successfully authenticated, the second message includes at least one of an authentication success indication and first information, wherein the first information includes information that the first device needs to send to the second device, and the second message is protected by a first key and / or a second key; or...

[0480] The second device authentication failed, the second message includes an authentication failure indication, and / or the second message is not protected by a key.

[0481] Optionally, the processing module is further configured to, when the second device is successfully authenticated, store at least one of the device identifier, the first key, and the second key of the second device;

[0482] The transceiver module is also used to communicate with the second device based on at least one of the first key and the second key.

[0483] Figure 5B is a schematic diagram of the structure of the second device proposed in an embodiment of this disclosure. The second device is used to perform any of the above methods. In some embodiments, as shown in Figure 5B, the second device may include at least one of a processing module, a transceiver module, etc. In some embodiments, the transceiver module is used to send a first message to a first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device.

[0484] Optionally, the transceiver module is used to execute at least one of the communication steps (e.g., steps 2101, 2102, 2104, 2109, 2113, 2202, 2207, 2211, 2301, 2303, 2308, 2312, 3201, but not limited thereto) performed by the second device in any of the above methods, which will not be elaborated here. Optionally, the processing module is used to execute at least one of the other steps (e.g., steps 2103, 2110, 2111, 2112, 2201, 2208, 2209, 2210, 2302, 2309, 2310, 2311, but not limited thereto) performed by the second device in any of the above methods, which will not be elaborated here.

[0485] Optionally, the transceiver module is further configured to send a first request to the first device, the first request being used to request the triggering of authentication between the first device and the second device;

[0486] The transceiver module is also used to receive a second request sent by the first device, the second request being used to request the second device to send the first message.

[0487] Optionally, the transceiver module is further configured to send the first request to the first device when the second device does not store at least one of the first key and the second key; wherein the first key is used to protect the confidentiality of at least one of the data, information and signaling between the second device and the first device, and the second key is used to protect the integrity of at least one of the data, information and signaling between the second device and the first device.

[0488] Optionally, the first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

[0489] Optionally, the second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm; wherein the second security algorithm is a security algorithm determined by the first device for confidentiality protection and / or integrity protection of at least one of data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

[0490] Optionally, the transceiver module is further configured to receive a paging message sent by the first device, the paging message including a first random number generated by the first device.

[0491] Optionally, the processing module is further configured to:

[0492] Generate a second random number;

[0493] A first response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key, and the first response is used by the first device to authenticate the second device;

[0494] Generate at least one of the first key and the second key;

[0495] The first data is protected by the first key, and the first data is the data that the second device needs to send to the first device.

[0496] A first verification value is generated based on the second key, and the first verification value is used by the first device to authenticate the second device.

[0497] Optionally, the first message includes at least one of the following: the device identifier of the second device, a second random number, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm;

[0498] The third security algorithm is a security algorithm determined by the second device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device, and the third security algorithm is selected by the second device from one or more first security algorithms.

[0499] Optionally, the transceiver module is further configured to receive a second message sent by the first device based on the authentication result of the second device.

[0500] Optionally, the processing module is further configured to perform security verification on the second message based on the second key, and the second message passes the security verification to determine that the first device has been authenticated by the second device.

[0501] Optionally, the processing module is further configured to:

[0502] The second message includes an authentication success indication, confirming that the second device has been authenticated by the first device;

[0503] The second message is not protected by a key, and / or the second message includes an authentication failure indication, determining that the second device has failed authentication by the first device.

[0504] Optionally, the processing module is further configured to:

[0505] The second device is authenticated by the first device, and / or the first device is authenticated by the second device, and stores at least one of the first key and the second key;

[0506] Communicate with the first device based on at least one of the first key and the second key.

[0507] In some embodiments, the transceiver module may include a transmitting module and / or a receiving module, which may be separate or integrated. Optionally, the transceiver module may be interchangeable with a transceiver.

[0508] In some embodiments, the processing module may be a single module or may include multiple sub-modules. Optionally, the multiple sub-modules may each perform all or part of the steps required by the processing module.

[0509] In some embodiments, the processing module can be replaced by the processor, and the transceiver module can be replaced by the transceiver.

[0510] Figure 6A is a schematic diagram of the structure of the communication device 6100 proposed in an embodiment of this disclosure. The communication device 6100 can be a network device (e.g., access network device, core network device, etc.), a terminal (e.g., user equipment, etc.), a chip, chip system, or processor that supports the network device in implementing any of the above methods, or a chip, chip system, or processor that supports the terminal in implementing any of the above methods. The communication device 6100 can be used to implement the methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0511] As shown in Figure 6A, the communication device 6100 is used to execute any of the above methods. In some embodiments, the communication device 6100 includes one or more processors 6101. The processor 6101 may be a general-purpose processor or a special-purpose processor, such as a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control communication devices (e.g., base stations, baseband chips, terminal devices, terminal device chips, DUs or CUs, etc.), execute programs, and process program data. Optionally, the communication device 6100 is used to execute any of the above methods. Optionally, one or more processors 6101 are used to invoke instructions to cause the communication device 6100 to execute any of the above methods.

[0512] In some embodiments, the communication device 6100 further includes one or more transceivers 6102. When the communication device 6100 includes one or more transceivers 6102, the transceivers 6102 perform communication steps such as sending and / or receiving in the above method (e.g., steps 2101, 2102, 2104, 2109, 2113, 2202, 2207, 2211, 2301, 2303, 2308, 2312, 3101, 3102, 3202, but not limited to these steps). The processor 6101 performs at least one of the following steps: (e.g., steps 2107, 2108, 2205, 2206, 2306, 2307, 2103, 2110, 2111, 2112, 2201, 2208, 2209, 2210, 2302, 2309, 2310, 2311, but not limited thereto). In optional embodiments, the transceiver may include a receiver and / or a transmitter, which may be separate or integrated. Optionally, the terms transceiver, transceiver unit, transceiver, transceiver circuit, interface circuit, interface, etc., can be used interchangeably; the terms transmitter, transmitting unit, transmitter, transmitting circuit, etc., can be used interchangeably; the terms receiver, receiving unit, receiver, receiving circuit, etc., can be used interchangeably.

[0513] In some embodiments, the communication device 6100 further includes one or more memories 6103 for storing data and / or instructions. Optionally, one or more processors 6101 are used to invoke instructions stored in the memory 6103 to cause the communication device 6100 to perform any of the above methods. Optionally, all or part of the memory 6103 may also be located outside the communication device 6100. In an optional embodiment, the communication device 6100 may include one or more interface circuits 6104. Optionally, the interface circuit 6104 is connected to the memory 6102 and can be used to receive data and / or instructions from the memory 6102 or other devices, and can be used to send data and / or instructions to the memory 6102 or other devices. For example, the interface circuit 6104 can read data and / or instructions stored in the memory 6102 and send the data and / or instructions to the processor 6101.

[0514] The communication device 6100 described in the above embodiments may be a network device or a terminal, but the scope of the communication device 6100 described in this disclosure is not limited thereto, and the structure of the communication device 6100 may not be limited by FIG. 6A. The communication device may be a standalone device or a part of a larger device. For example, the communication device may be: (1) a standalone integrated circuit IC, or chip, or chip system or subsystem; (2) a collection of one or more ICs, optionally, the IC collection may also include storage components for storing data, programs and / or instructions; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, terminal device, smart terminal device, cellular phone, wireless device, handheld device, mobile unit, vehicle device, network device, cloud device, artificial intelligence device, etc.; (6) others, etc.

[0515] Figure 6B is a schematic diagram of the structure of chip 6200 according to an embodiment of this disclosure. For cases where the communication device 6100 can be a chip or a chip system, please refer to the schematic diagram of chip 6200 shown in Figure 6B, but it is not limited thereto.

[0516] Chip 6200 includes one or more processors 6201. Chip 6200 is used to perform any of the methods described above.

[0517] In some embodiments, chip 6200 further includes one or more interface circuits 6202. Optionally, terms such as interface circuit, interface, and transceiver pin can be used interchangeably. In some embodiments, chip 6200 further includes one or more memories 6203 for storing data and / or instructions. Optionally, all or part of the memories 6203 may be located outside of chip 6200. Optionally, interface circuit 6202 is connected to memory 6203, and interface circuit 6202 can be used to receive data and / or instructions from memory 6203 or other devices, and interface circuit 6202 can be used to send data and / or instructions to memory 6203 or other devices. For example, interface circuit 6202 can read data and / or instructions stored in memory 6203 and send the data and / or instructions to processor 6201.

[0518] In some embodiments, the interface circuit 6202 performs at least one of the communication steps such as sending and / or receiving in the above-described method (e.g., steps 2101, 2103, 2105, 3102, and 4102, but not limited thereto). The interface circuit 6202 performing the communication steps such as sending and / or receiving in the above-described method refers, for example, to the interface circuit 6202 performing data and / or instruction interaction between the processor 6201, the chip 6200, the memory 6203, or the transceiver device. In some embodiments, the processor 6201 performs at least one of other steps (e.g., steps 2102, 2104, 2106, 3101, and 4101, but not limited thereto).

[0519] The modules and / or devices described in the various embodiments, such as virtual devices, physical devices, and chips, can be combined or separated arbitrarily as needed. Optionally, some or all steps can also be performed collaboratively by multiple modules and / or devices, which is not limited here.

[0520] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device, cause the communication device to perform any of the above methods. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0521] This disclosure also proposes a program product, including a program and / or instructions, which, when executed by a communication device, cause the communication device to perform any of the above methods. Optionally, the program product is a computer program product. Optionally, the program product is stored on the storage medium.

[0522] This disclosure also proposes a computer program that, when run on a computer, causes the computer to perform any of the above methods.

[0523] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program can be transferred from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0524] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0525] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0526] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. An authentication method, characterized in that, Performed by a first device, the method includes: Receive a first message sent by a second device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; The second device is authenticated based on the first message.

2. The method as described in claim 1, characterized in that, The method further includes: Receive a first request sent by the second device, the first request being used to request the triggering of authentication between the first device and the second device; Send a second request to the second device, the second request being used to request the second device to send the first message.

3. The method as described in claim 2, characterized in that, The first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

4. The method as described in claim 2 or 3, characterized in that, The second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm; The second security algorithm is a security algorithm determined by the first device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

5. The method according to any one of claims 2-4, characterized in that, Sending the second request to the second device includes: If the first request meets the first condition, the second request is sent to the second device; The first condition includes at least one of the following: The first request is not protected; The security verification for the first request failed.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: A paging message is sent to the second device, the paging message including a first random number generated by the first device.

7. The method according to any one of claims 1-6, characterized in that, The first message includes at least one of the following: the device identifier of the second device, a second random number generated by the second device, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm; The third security algorithm is a security algorithm determined by the second device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device. The third security algorithm is selected by the second device from one or more first security algorithms. Wherein, the first data is the data that the second device needs to send to the first device, and the first data is protected by a first key, which is used to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device; the first verification value is used by the first device to authenticate the second device, and the first verification value is generated based on a second key, which is used to protect the integrity of at least one of the data, information, and signaling between the second device and the first device; the first response is used by the first device to authenticate the second device, and the first response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key.

8. The method according to any one of claims 1-7, characterized in that, The method further includes: Send a third request to a third device, the third request including the device identifier of the second device, the third request being used to request at least one of a third key and a third security algorithm; Receive at least one of the third key and the third identifier indicating the third security algorithm sent by the third device; A second response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and the third key; Generate at least one of the first key and the second key.

9. The method according to any one of claims 1-8, characterized in that, The method further includes: A fourth request is sent to a third device, the fourth request including at least one of the following: the device identifier of the second device, a first random number, a second random number, a third identifier for indicating a third security algorithm, or a second identifier for indicating a second security algorithm; wherein, the fourth request is used to request at least one of a second response, a first key, and a second key; The device receives at least one of the second response, the first key, and the second key sent by the third device, wherein the second response is generated based on at least one of the device identifier of the second device, the first random number, the second random number, and the third key.

10. The method according to any one of claims 1-9, characterized in that, The authentication of the second device based on the first message includes: Perform a first operation, the first operation including at least one of the following: verifying a first response based on a second response, verifying a first verification value based on a second key; The authentication of the second device based on the first message further includes at least one of the following: If the second condition is met, the second device is determined to be authenticated. The second condition includes at least one of the following: the first response verification is passed, or the first verification value verification is passed. If the third condition is met, it is determined that the second device authentication has failed. The third condition includes at least one of the following: the first response verification fails, or the first verification value verification fails.

11. The method according to any one of claims 1-10, characterized in that, The method further includes: A second message is sent to the second device based on the authentication result of the second device.

12. The method as described in claim 11, characterized in that, The second device is successfully authenticated, and the second message includes at least one of an authentication success indication and first information, wherein the first information includes information that the first device needs to send to the second device, and the second message is protected by a first key and / or a second key; or The second device authentication failed, the second message includes an authentication failure indication, and / or the second message is not protected by a key.

13. The method according to any one of claims 1-12, characterized in that, The method further includes: Upon successful authentication of the second device, at least one of the device identifier, the first key, and the second key of the second device is stored. The second device communicates based on at least one of the first key and the second key.

14. An authentication method, characterized in that, Performed by a second device, the method includes: A first message is sent to a first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device.

15. The method as described in claim 14, characterized in that, The method further includes: Send a first request to the first device, the first request being used to request the triggering of authentication between the first device and the second device; Receive a second request sent by the first device, the second request being used to request the second device to send the first message.

16. The method as described in claim 15, characterized in that, Sending the first request to the first device includes: The second device, which does not store at least one of the first key and the second key, sends the first request to the first device; wherein the first key is used to protect the confidentiality of at least one of the data, information, and signaling between the second device and the first device, and the second key is used to protect the integrity of at least one of the data, information, and signaling between the second device and the first device.

17. The method as described in claim 15 or 16, characterized in that, The first request includes at least one of the following: a device identifier of the second device, a first indication, and one or more first identifiers; wherein the first indication is used to indicate the function of the first request, and the one or more first identifiers are used to indicate one or more first security algorithms supported by the second device.

18. The method as described in any one of claims 15-19, characterized in that, The second request includes at least one of the following: a first random number generated by the first device, and a second identifier for indicating a second security algorithm; wherein the second security algorithm is a security algorithm determined by the first device for confidentiality and / or integrity protection of at least one of data, information, and signaling between the second device and the first device, and the second security algorithm is selected by the first device from one or more first security algorithms.

19. The method according to any one of claims 14-18, characterized in that, The method further includes: The device receives a paging message sent by the first device, the paging message including a first random number generated by the first device.

20. The method according to any one of claims 14-19, characterized in that, The method further includes: Generate a second random number; A first response is generated based on at least one of the device identifier of the second device, a first random number, a second random number, and a third key, and the first response is used by the first device to authenticate the second device; Generate at least one of the first key and the second key; The first data is protected by the first key, and the first data is the data that the second device needs to send to the first device. A first verification value is generated based on the second key, and the first verification value is used by the first device to authenticate the second device.

21. The method according to any one of claims 14-20, characterized in that, The first message includes at least one of the following: the device identifier of the second device, a second random number, a first response, first data, a first verification value, and a third identifier for indicating a third security algorithm; The third security algorithm is a security algorithm determined by the second device for protecting the confidentiality and / or integrity of at least one of the data, information, and signaling between the second device and the first device, and the third security algorithm is selected by the second device from one or more first security algorithms.

22. The method according to any one of claims 14-21, characterized in that, The method further includes: Receive a second message sent by the first device based on the authentication result of the second device.

23. The method as described in claim 22, characterized in that, The method further includes: The second message is securely verified based on the second key. If the second message passes the security verification, it is determined that the first device has been authenticated by the second device.

24. The method according to any one of claims 14-23, characterized in that, The method further includes: The second message includes an authentication success indication, confirming that the second device has been authenticated by the first device; The second message is not protected by a key, and / or the second message includes an authentication failure indication, determining that the second device has failed authentication by the first device.

25. The method according to any one of claims 14-24, characterized in that, The method further includes: The second device is authenticated by the first device, and / or the first device is authenticated by the second device, and stores at least one of the first key and the second key; Communicate with the first device based on at least one of the first key and the second key.

26. An authentication method for a communication system, the communication system comprising a second device and a first device, the method comprising: The second device sends a first message to the first device, the first message being used by the first device to authenticate the second device, the second device including an Internet of Things (IoT) device; The first device authenticates the second device based on the first message.

27. A communication device, characterized in that, The communication device is used to perform the method according to any one of claims 1 to 13, 14 to 25.

28. A communication system, characterized in that, The device includes a second device and a first device, wherein the first device is configured to implement the method of any one of claims 1 to 13, and the second device is configured to implement the method of any one of claims 14 to 25.

29. A storage medium storing instructions, characterized in that, When the instructions are executed on a communication device, the communication device performs the method as described in any one of claims 1 to 13, 14 to 25.

30. A program product comprising at least one of a program and instructions, characterized in that, When at least one of the programs or instructions is executed by a communication device, it implements the method of any one of claims 1 to 13, 14 to 25.

Images