WO2020221324A1 - 一种注册方法及通信装置 - Google Patents

一种注册方法及通信装置 Download PDF

Info

Publication number
WO2020221324A1
WO2020221324A1 PCT/CN2020/087914 CN2020087914W WO2020221324A1 WO 2020221324 A1 WO2020221324 A1 WO 2020221324A1 CN 2020087914 W CN2020087914 W CN 2020087914W WO 2020221324 A1 WO2020221324 A1 WO 2020221324A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
access device
identity
core network
network element
Prior art date
Application number
PCT/CN2020/087914
Other languages
English (en)
French (fr)
Inventor
李�赫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020221324A1 publication Critical patent/WO2020221324A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a registration method and a communication device.
  • NAS non-access stratum
  • the embodiments of the present application provide a registration method and communication device, and provide a way for an access device without NAS capability to register to a core network.
  • an embodiment of the present application provides a registration method, including: a secure access gateway receives a first request message sent by an access device, and after receiving the first request message, the secure access gateway sends a request message to the core
  • the network initiates a registration process for the access device, the first request message carries the original identity information of the access device, the access device does not have non-access layer NAS capabilities, and the secure access gateway has NAS capability;
  • the secure access gateway generates a hidden identity for the access device according to the identity information of the access device, the identity information of the access device includes only the original identity information, or the access
  • the identity information of the device includes the original identity information and device-related information, and the device-related information includes one of the operator information of the access device, the access time information of the access device, and the location information of the access device, or Multiple;
  • the secure access gateway sends a second request message to the first core network element of the core network, the second request message is used to request that the access device be registered to the core network, the second request The
  • the secure access gateway replaces the access device without NAS capability to trigger the registration process, replaces the access device to generate a hidden identity for the access device, and then initiates the registration process for the access device to the core network based on the hidden identity .
  • the hidden identity includes at least a first part of information and a second part of information used to determine the permanent identity of the access device; the first part of information and the second part of information are determined by The identity information of the access device is determined.
  • the first part of information may be home network identifier, and the second part of information may be scheme out.
  • the original identity information of the access device or original identity information plus device-related information constitutes the identity information of the access device.
  • the identity information is divided into at least two parts. The first part and the second part are used to form the home network identifier and scheme out .
  • the first part of information and the second part of information are determined by the identity information of the access device, including:
  • the first part of information is the first part of the identity information of the access device
  • the second part of information is the second part of the identity information of the access device
  • the first part and the second part are in the The identity information of the access device does not overlap, or,
  • the first part of information is the information after the first part of the format conversion in the identity information of the access device
  • the second part of the information includes the second part of the format conversion in the identity information of the access device Information after, or,
  • the first part of information includes the first part of the identity information of the access device, and the second part of information is obtained by encryption according to the second part of the identity information of the access device, or ,
  • the first part of the information is the information after the first part of the format of the identity information of the access device is converted, and the second part of the information is the format of the second part of the identity information of the access device
  • the converted information is encrypted again.
  • the first part of the identity information of the access device is: the device-related information or a part of the device-related information in the identity information of the access device.
  • the device-related information or part of the device-related information is used as the home network identifier, and it is sent directly to UDM without encryption.
  • the calculation is relatively simple, which saves resources and improves efficiency.
  • the hidden identity also includes type information of the permanent identity, and the type information of the permanent identity indicates that the permanent identity is the identity of the access device.
  • the SUPI type mentioned in the embodiments of this application can be distinguished from the SUPI type in the UE registration process.
  • the registration of the access device can be realized on the premise that the SUCI structure in the existing standard can be changed.
  • the hidden identity identifier includes at least a first part of information and a second part of information used to determine the permanent identity of the access device;
  • the first part of information is the type of the permanent identity, and the second part of information is determined based on the identity information of the access device.
  • the hidden identity identifier further includes a routing indicator, and the routing indicator is used to determine the core network element that decrypts the hidden identity identifier.
  • Reusing the routing indicator in the SUCI structure in the UE process does not need to change the existing SUCI structure, which is relatively simple and effective.
  • the routing indicator is obtained from the configuration information of the secure access gateway according to the information of the operator registered by the access device.
  • the routing indicator is configured in the secure access gateway to provide convenience for determining the core network element used for decrypting the hidden identity, which is simple and effective.
  • the hidden identity identifier further includes a public key identifier, and the public key identified by the public key identifier is used to encrypt part or all of the identity information of the access device
  • the public key identifier is obtained from the configuration information of the secure access gateway according to the information of the operator registered by the access device.
  • the second request message also carries a first authentication success indication, and the first authentication success indication is used to instruct the secure access gateway to determine that the access device is legal Access equipment.
  • the first authentication success indication indicating that the secure access gateway has successfully authenticated the access device is sent to the core network, so that the core network can further instruct the core network after determining that the access device is a secure device
  • the network element reduces the authentication process to prepare.
  • an embodiment of the present application provides a registration method, including: a second core network element receives a service request message sent by a third core network element, the service request message including a hidden identity from a secure access gateway , The hidden identity identifier indicates the identity information of the access device, the access device does not have NAS capability, and the secure access gateway has NAS capability; the second core network element generates all information based on the hidden identity identifier The permanent identity of the access device; when the second core network element determines that the access device is a legitimate access device according to the permanent identity, it sends a service response to the third core network element Message, the service response message includes instruction information for instructing the third core network element to skip the authentication process for the access device.
  • the second core network element determines that the access device is successfully authenticated, it instructs other core network elements to skip the authentication process, which can save resources and improve efficiency.
  • the hidden identity includes at least a first part of information and a second part of information used to generate a permanent identity of the access device, and the first part of information and the second part of information are Is determined by the identity information of the access device;
  • the second core network element generating the permanent identity of the access device according to the hidden identity includes: the second core network element according to the Hide the first part of the information and the second part of the identity to generate a permanent identity of the access device.
  • the permanent identity includes information obtained by combining the first part of information and the second part of information; or,
  • the permanent identification includes information obtained after format conversion and combination of the first part of information and the second part of information; or,
  • the permanent identification includes information obtained by decoding the second part of information and combining the decrypted second part of information with the first part of information; or,
  • the permanent identification includes information obtained by performing format conversion on the second part of information after decoding, and performing format conversion on the first part of information, and combining the first part of information after format conversion and the second part of information.
  • the hidden identity also includes the type of the permanent identity
  • the permanent identity also includes the type of the permanent identity
  • the first part of information is used to indicate the information of the operator registered by the access device
  • the second part of information is used to indicate the identity of the access device
  • the hidden identity includes at least a first part of information and a second part of information used to generate a permanent identity of the access device, and the first part of information is a type of the permanent identity , The second part of information is determined by the identity information of the access device;
  • the generation of the permanent identity of the access device by the second core network element according to the identity information of the access device indicated by the hidden identity includes:
  • the second core network element combines the first part of information and the information obtained by parsing the second part of information to obtain the permanent identity of the access device.
  • the service request message further includes a first authentication success indication, and the first authentication success indication is used to instruct the secure access gateway to determine that the access device is a legitimate access device ;
  • the method Before sending a service response message to the third core network element, the method further includes:
  • the network element of the second core network determines, according to the first authentication success indication, that the secure access gateway has determined that the access device is a legitimate access device.
  • the first authentication success indication is used to determine that the access device is legal in the fixed network, and then the other network elements of the core network are instructed to skip the authentication process, thereby improving network security.
  • the service response message includes the permanent identity of the access device, the permanent identity includes the indication information, and the indication information is the type of the permanent identity.
  • SUPI type The type of permanent identity in the above design (for example, SUPI type) is different from the SUPI type in the existing protocol.
  • SUPI is received, the security of the access device is determined, that is, the authentication process of the access device is skipped, and there is no need to add Other information, save resources.
  • the indication information is a second authentication success indication
  • the second authentication success indication is used to indicate that the access device is a legal access device in the core network.
  • the above design indicates that the access device is successfully authenticated in the core network by generating a second authentication success indication, thereby further skipping the authentication process of the access device and is directly effective.
  • the service response further includes an authentication vector, and the authentication vector is a set value.
  • the UE registration process can be reused. No need to change the framework, saving resources.
  • the authentication vector of the set value is used as the indication information to instruct the third core network element to skip the authentication process for the access device.
  • the authentication vector of the set value is used to instruct to skip the authentication process of the access device, which is simple and effective, and does not need to add other information, which further saves resources.
  • the method further includes:
  • the second core network element determines that the access device is a legal access device according to the permanent identity, it generates an authentication vector, where the authentication vector includes a first expected response XRES* and a first authentication
  • the token AUTN, the authentication service key Kausf and the random number RAND, the first expected response XRES* and the first authentication token AUTN are all set values;
  • the Kausf is determined according to part or all of the identity information of the access device.
  • the Kausf is determined according to the long-term identity; or,
  • the Kausf is determined based on the first encryption key CK and the first integrity key IK, and both the first encryption key CK and the first integrity key IK are based on the identity of the access device Part or all of the information is determined, or the first encryption key CK and the first integrity key IK are both determined according to the long-term identity of the access device.
  • the above design provides an effective way to generate an authentication vector to reuse the existing registration process.
  • it also includes:
  • the second core network element determines that the access device is a legal access device according to the permanent identity
  • the second core network element generates an authentication vector according to the long-term key K, and the long-term The key K is determined based on the long-term identity of the access device, or the long-term key K is determined based on part or all of the identity information of the access device.
  • the above design provides an effective way to generate an authentication vector to reuse the existing registration process.
  • the authentication vector includes a second expected response XRES, a second authentication token AUTN, a second encryption key CK', a second integrity key IK', and a random number RAND;
  • the second encryption key CK' and the second integrity key IK' are determined according to the first encryption key CK and the first integrity key IK;
  • the first encryption key CK and the first integrity key IK are both determined according to part or all of the identity information of the access device, or the first encryption key CK and the first An integrity key IK is determined according to the long-term identity of the access device, and the second expected response XRES and the second authentication token AUTN are both set values.
  • the above design provides an effective way to generate an authentication vector to reuse the existing registration process.
  • an embodiment of the application provides a registration method, including:
  • the first core network element When the secure access device triggers the registration process for the access device to the core network, the first core network element sends a service request message to the third core network element, the service request message carrying the hidden identity of the access device Identifies that the access device does not have NAS capability, and the secure access gateway has NAS capability; the first core network element receives a service response message sent by the third core network element, the service response message Carrying the permanent identity corresponding to the hidden identity of the access device, and the service response message includes indication information for instructing the first core network element to skip the authentication process for the access device; The network element of the first core network allocates a globally unique temporary identifier GUTI to the access device according to the permanent identity identifier.
  • the permanent identification carried in the service response message includes the indication information, and the indication information is a type of permanent identification used to instruct the third core network element to skip the registration
  • the authentication process of the access device is described.
  • the message type of the service response message instructs the third core network element to skip the authentication process for the access device.
  • the service request message also carries a first authentication success indication, and the first authentication success indication is used to instruct the secure access device to determine that the access device is a legitimate access device;
  • the first authentication success indication and the type of the permanent identity together indicate that the third core network element skips the authentication process for the access device.
  • the service response message also carries a second authentication success indication, and the second authentication indication is used to indicate that the access device is a legal access device in the core network.
  • an embodiment of the present application provides a registration method, including:
  • the third core network element When the secure access device triggers the registration process for the access device to the core network, the third core network element sends a service request message to the second core network element, where the service request message carries the hidden identity of the access device Identifies that the access device does not have NAS capability, and the secure access gateway has NAS capability; the third core network element receives a service response message sent by the second core network element, the service response message Carrying the permanent identity corresponding to the hidden identity of the access device, the service response message includes indication information for instructing the third core network element to skip the authentication process for the access device.
  • the network element of the third core network determines to skip the authentication process for the access device according to the instruction information, thereby directly skipping the authentication process, saving resources and improving efficiency.
  • the permanent identification carried in the service response message includes the indication information, and the indication information is a type of permanent identification used to instruct the third core network element to skip the registration
  • the authentication process of the access device is described.
  • the message type of the service response message instructs the third core network element to skip the authentication process for the access device.
  • the service request message also carries a first authentication success indication, and the first authentication success indication is used to instruct the secure access device to determine that the access device is a legitimate access device;
  • the first authentication success indication and the type of the permanent identity together indicate that the third core network element skips the authentication process for the access device.
  • the service response message also carries a second authentication success indication, and the second authentication indication is used to indicate that the access device is a legitimate access device authentication in the core network. success.
  • an embodiment of the present application also provides a communication device, which is applied to a secure access gateway, and the beneficial effects can be referred to the description of the first aspect and will not be repeated here.
  • the device has the function of realizing the secure access gateway in the method example of the first aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the structure of the device includes a receiving unit, a processing unit, and a sending unit. These units can perform the corresponding functions in the method examples of the first aspect. For details, please refer to the detailed description in the method examples. Do repeat.
  • the embodiments of the present application also provide a communication device, which is applied to a second core network element, and the beneficial effects can be referred to the description of the second aspect and will not be repeated here.
  • the device has the function of realizing the behavior in the method example of the second aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the structure of the device includes a receiving unit, a processing unit, and a sending unit. These units can perform the corresponding functions in the method example of the second aspect. For details, please refer to the detailed description in the method example. Do repeat.
  • an embodiment of the present application also provides a communication device, which is applied to a network element of a first core network, and the beneficial effects can be referred to the description of the third aspect and will not be repeated here.
  • the device has the function of realizing the network element of the first core network in the method example of the third aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the structure of the device includes a receiving unit, a processing unit, and a sending unit. These units can perform the corresponding functions in the method examples of the third aspect. For details, please refer to the detailed description in the method examples. Do repeat.
  • an embodiment of the present application also provides a communication device, which is applied to a third core network element, and the beneficial effects can be referred to the description of the fourth aspect and will not be repeated here.
  • the device has the function of realizing the behavior in the method example of the fourth aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the structure of the device includes a receiving unit, a processing unit, and a sending unit. These units can perform the corresponding functions in the method example of the fourth aspect. For details, please refer to the detailed description in the method example. Do repeat.
  • an embodiment of the present application also provides a communication device, which is applied to a secure access gateway, and the beneficial effects can be referred to the description of the first aspect and will not be repeated here.
  • the structure of the communication device includes a processor and a memory, and the processor is configured to support the secure access gateway to perform the corresponding function in the above-mentioned first aspect method.
  • the memory is coupled with the processor, and it stores program instructions and data necessary for the communication device.
  • the structure of the communication device also includes a communication interface for communicating with other devices.
  • an embodiment of the present application also provides a communication device, which is applied to a second core network element, and the beneficial effects can be referred to the description of the second aspect and will not be repeated here.
  • the structure of the communication device includes a processor and a memory, and the processor is configured to support the second core network element to perform the corresponding functions in the above-mentioned second aspect method.
  • the memory is coupled with the processor, and it stores program instructions and data necessary for the communication device.
  • the structure of the communication device also includes a transceiver for communicating with other devices.
  • an embodiment of the present application also provides a communication device, which is applied to a network element of a first core network, and the beneficial effects can be referred to the description of the third aspect and will not be repeated here.
  • the structure of the communication device includes a processor and a memory, and the processor is configured to support the network element of the first core network to perform corresponding functions in the method of the third aspect.
  • the memory is coupled with the processor, and it stores program instructions and data necessary for the communication device.
  • the structure of the communication device also includes a communication interface for communicating with other devices.
  • the embodiments of the present application also provide a communication device, the communication device is applied to a third core network element, and the beneficial effects can be referred to the description of the fourth aspect and will not be repeated here.
  • the structure of the communication device includes a processor and a memory, and the processor is configured to support the network element of the first core network to perform the corresponding function in the method of the fourth aspect.
  • the memory is coupled with the processor, and it stores program instructions and data necessary for the communication device.
  • the structure of the communication device also includes a transceiver for communicating with other devices.
  • the embodiments of the present application provide a communication system.
  • the secure access gateway the first Core network network elements, second core network network elements, and third core network network elements;
  • the secure access gateway is configured to receive the first request message sent by the access device, and after receiving the first request message, initiate a registration process for the access device to the core network, and according to the access device’s
  • the identity information generates a hidden identity for the access device, and sends a second request message to the first core network element of the core network;
  • the first request message carries the original identity information of the access device, the access device does not have non-access stratum NAS capability, and the secure access gateway has NAS capability; the identity of the access device The information includes only the original identity information, or the identity information of the access device includes the original identity information and device-related information, and the device-related information includes the operator information of the access device and the access device’s access information.
  • One or more of access time information and location information of the access device; the second request message carries the hidden identity;
  • the first core network element is configured to send a first service request message to the third core network element after receiving the second request message, where the first service request message carries the hidden identity logo
  • the third core network element is configured to send a second service request message to the second core network element after receiving the first service request message, where the second service request message carries the Hide identity;
  • the second core network element is configured to, after receiving the second service request message, generate the permanent identity of the access device according to the identity information of the access device indicated by the hidden identity, When it is determined that the access device is a legitimate access device according to the permanent identity, a second service response message is sent to a third core network element, where the second service response message includes instructions to the third core network The instruction information that the network element skips the authentication process for the access device;
  • the third core network element is further configured to send a first service response message to the first core network element after receiving the second service response message, where the first service response message includes the indication information;
  • the first core network element is further configured to, after receiving the first service response message, allocate a globally unique temporary identifier GUTI to the access device according to the permanent identity identifier.
  • the hidden identity includes at least a first part of information and a second part of information used to generate a permanent identity of the access device, and the first part of information and the second part of information are Determined by the identity information of the access device; when the second core network element generates the permanent identity of the access device according to the hidden identity, it is specifically configured to use the hidden identity
  • the first part of information and the second part of information generate a permanent identity identifier of the access device.
  • the permanent identification includes information obtained by combining the first part of information and the second part of information; or,
  • the permanent identification includes information obtained after format conversion and combination of the first part of information and the second part of information; or,
  • the permanent identification includes information obtained by decoding the second part of information and combining the decrypted second part of information with the first part of information; or,
  • the permanent identification includes information obtained by performing format conversion on the second part of information after decoding, and performing format conversion on the first part of information, and combining the first part of information after format conversion and the second part of information.
  • the hidden identity includes at least a first part of information and a second part of information used to generate a permanent identity of the access device, and the first part of information is a type of the permanent identity , The second part of information is determined by the identity information of the access device;
  • the second core network element When the second core network element generates the permanent identity of the access device according to the hidden identity, it is specifically configured to: combine the first part of information and the information parsed from the second part of information Obtain the permanent identity of the access device.
  • the first service request message and the second service request message further include a first authentication success indication, and the first authentication success indication is used to instruct the secure access gateway to determine the access The incoming device is a legal one;
  • the second core network element Before sending a second service response message to the third core network element, the second core network element is further configured to determine according to the first authentication success indication that the secure access gateway has determined the access The incoming device is a legal one.
  • the first service response message and the second service response message include the permanent identity of the access device, the permanent identity includes the indication information, and the indication information is State the type of permanent identity.
  • the indication information is a second authentication success indication
  • the second authentication success indication is used to indicate that the access device is a legal access device in the core network.
  • the second service response message further includes an authentication vector, and the authentication vector is a set value.
  • the authentication vector of the set value is used as the indication information to instruct the third core network element to skip the authentication process for the access device.
  • the second core network element determines that the access device is a legal access device according to the permanent identity, it is also used to generate an authentication vector, the authentication vector It includes a first expected response XRES*, a first authentication token AUTN, an authentication service key Kausf, and a random number RAND.
  • the first expected response XRES* and the first authentication token AUTN are both set values; wherein, the Kausf is determined according to part or all of the identity information of the access device; or, the Kausf is determined according to the long-term identity; or, the Kausf is determined according to the first encryption key CK, the first Is determined by the integrity key IK, the first encryption key CK and the first integrity key IK are both determined based on part or all of the identity information of the access device, or the first Both the encryption key CK and the first integrity key IK are determined according to the long-term identity of the access device.
  • the second core network element determines that the access device is a legitimate access device according to the permanent identity
  • the second core network element uses the long-term key K
  • An authentication vector is generated, the long-term key K is determined according to the long-term identity of the access device, or the long-term key K is determined according to part or all of the identity information of the access device.
  • the authentication vector includes a second expected response XRES, a second authentication token AUTN, a second encryption key CK', a second integrity key IK', and a random number RAND;
  • the second encryption key CK' and the second integrity key IK' are determined according to the first encryption key CK and the first integrity key IK; the first encryption key CK and the first integrity key
  • the secret key IK is determined based on part or all of the identity information of the access device, or the first encryption key CK and the first integrity key IK are both determined based on the access device’s If the long-term identity is determined, the second expected response XRES and the second authentication token AUTN are both set values.
  • the present application also provides a computer-readable storage medium having instructions stored in the computer-readable storage medium, which when run on a computer, cause the computer to execute the methods described in the above aspects.
  • this application also provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the methods described in the above aspects.
  • the present application also provides a computer chip connected to a memory, and the chip is configured to read and execute a software program stored in the memory, and execute the methods described in the foregoing aspects.
  • FIG. 1 is a schematic diagram of a 5G network system architecture in an embodiment of the application
  • Figure 2A is a schematic diagram of a UE registration process in an embodiment of the application
  • FIG. 2B is a schematic diagram of a SUCI structure in an embodiment of the application.
  • Figure 2C is a schematic diagram of another SUCI in an embodiment of the application.
  • FIG. 3 is a schematic flowchart of an authentication method in an embodiment of this application.
  • Figure 4 is a schematic diagram of an AV generation method in an embodiment of the application.
  • FIG. 5 is a schematic flowchart of another authentication method in an embodiment of this application.
  • Figure 6 is a schematic diagram of the NAS SMC process in an embodiment of the application.
  • Fig. 7 is a schematic structural diagram of a communication system in an embodiment of the application.
  • FIG. 8 is a schematic structural diagram of another communication system in an embodiment of this application.
  • Figure 9 is a schematic flowchart of a registration method in an embodiment of the application.
  • FIG. 10 is a schematic flowchart of another registration method in an embodiment of this application.
  • FIGS 11-15 are schematic diagrams of communication devices in an embodiment of this application.
  • system and “network” in this article are often used interchangeably in this article.
  • the term “and/or” in this article is only an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone B these three situations.
  • the character “/” in this text generally indicates that the associated objects before and after are in an "or” relationship.
  • the term “at least one” referred to in this application refers to one, or more than one, that includes one, two, three and more; “multiple” refers to two, or more than two, that includes two, Three and more.
  • At least one item (a) or similar expressions refers to any combination of these items, including any combination of a single item (a) or plural items (a).
  • at least one item (a) of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B according to A does not mean that B is determined only according to A, and B can also be determined according to A and/or other information.
  • the ordinal numbers such as “first” and “second” mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the order, timing, priority, or order of multiple objects. Importance.
  • the terms “including” and “having” in the embodiments of the present application, claims and drawings are not exclusive. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, and may also include unlisted steps or modules.
  • the process of registering a device with the ability to generate NAS signaling, such as a user equipment (UE) to the core network is described.
  • the UE is registered to the fifth generation (5G).
  • 5G fifth generation
  • the UE which may also be called a terminal, may be a mobile device, such as a mobile phone, a tablet computer (pad), a computer with wireless transceiver function, and so on.
  • a mobile device such as a mobile phone, a tablet computer (pad), a computer with wireless transceiver function, and so on.
  • the network architecture also includes radio access network (RAN), access and mobility control functions (access and mobility function, AMF), unified data management (unified data management, UDM), authentication server function (authentication server function) , AUSF), security anchor function (SEAF), etc.
  • RAN radio access network
  • AMF access and mobility control functions
  • UDM unified data management
  • authentication server function authentication server function
  • AUSF security anchor function
  • the main function of the RAN is to control users to wirelessly access the mobile communication network.
  • RAN is a part of mobile communication system. It implements a wireless access technology. Conceptually, it resides between a certain device (such as a mobile phone, a computer, or any remote control machine) and provides a connection to its core network.
  • the AMF network element is responsible for UE access management and mobility management, such as registration management, connection management, mobility management, reachability management, etc.; in practical applications, it includes mobility management entities in the network framework of LTE.
  • the mobility management function in the management entity (MME) has been added to the access management function.
  • the SEAF network element is used to complete the authentication of the UE.
  • the function of the SEAF can be incorporated into the AMF.
  • the AUSF network element has an authentication service function for terminating the authentication function requested by the SEAF network element.
  • the authentication vector sent by the UDM is received and the authentication vector is processed, and the processed authentication The vector is sent to SEAF.
  • the UDM network element can store the user's subscription information, generate authentication parameters, and so on.
  • the ARPF network element has authentication credential storage and processing functions, which are used to store the user's long-term authentication credential, such as a permanent key K.
  • the functions of the ARPF network element can be incorporated into the UDM network element.
  • Fig. 2A is a schematic diagram of a method for UE to perform secure network access registration based on the network architecture shown in Fig. 1.
  • the UE sends an N1 message to SEAF.
  • the N1 message carries concealed identity information (subscriber concealed identifier, SUCI) or 5G-globally unique temporary UE identity (GUTI).
  • concealed identity information subscriber concealed identifier, SUCI
  • GUI 5G-globally unique temporary UE identity
  • the N1 message may be a registration request message (Registration Request) or a service request message (Service Request) message.
  • the UE If the UE has accessed the network before and has a security context, then the UE carries 5G-GUTI in the N1 message. If the UE is entering the network for the first time and there is no security context, then the UE carries the SUCI in the N1 message. SUCI is generated by the UE.
  • FIGS. 2B and 2C are schematic diagrams of the format of the SUCI generated by the UE.
  • the SUCI includes the following information 1)-7).
  • SUPI Type can have 7 values, which are used to identify 7 types of SUPI encrypted in SUCI.
  • SUPI type has two values. When the value of SUPI type is 0, it means that SUPI is the international mobile subscriber identification number (IMSI). When the value of SUPI type is 1, it means that SUPI is a network specific indication. Character (network specific identifier). When the value of SUPI type is 2 to 7, there is no clear regulation at present, and it will be used in the future.
  • IMSI international mobile subscriber identification number
  • Character network specific identifier
  • Home network Identifier can be composed of two parts, namely MCC (Mobile Country Code) and MNC (Mobile Network Code, mobile network code).
  • MCC Mobile Country Code
  • MNC Mobile Network Code, mobile network code
  • MCC Mobile Country Code
  • MNC Mobile Network Code, mobile network code
  • MCC Mobile Country Code
  • MNC Mobile Network Code, mobile network code
  • MCC Mobile Country Code
  • MNC Mobile Network Code, mobile network code
  • the MCC is used to identify which operator the UE belongs to.
  • the combination of MCC and MNC is used to uniquely indicate the network operator of the UE.
  • SUPI type indicates that when SUPI is IMSI, the format of SUCI is shown in FIG. 2B.
  • IMSI is a sign that distinguishes mobile users, and it can be configured in the universal subscriber identity module (USIM) card of the UE.
  • IMSI consists of three parts, namely MCC, MNC, and mobile subscriber identification number (mobile subscriber identification number, MSIN). MSIN is used to identify mobile users in a mobile communication network.
  • NSI Network Specific Identifier
  • Home Network Identifier can be a specific character string.
  • NSI can use the format of Network Access Identifier (NAI).
  • NAI Network Access Identifier
  • the NAI format may be user name@domain name (username@realm), and the realm may be determined as Home Network Identifier, or the status part includes Home Network Identifier.
  • a SUPI in NSI format is [email protected].
  • SUPI type indicates that when SUPI is NSI, the format of SUCI is shown in FIG. 2C.
  • Routing Indicator (Routing Indicator) consists of 1 to 4 decimal arrays.
  • the Routing Indicator and Home Network Identifier work together to indicate the AUSF and UDM serving this UE.
  • the Routing Indicator can be configured in the global subscriber identity module (Universal Subscriber Identity Module, USIM) card of the UE. If this value is not configured in the USIM card, the Routing Indicator is the default value of 0.
  • USIM Universal Subscriber Identity Module
  • the protection scheme identifier (Protection Scheme Identifier) is used to indicate the adopted security protection mechanism, and its value can have the following 3 types: 0x0, 0x1 and 0x2.
  • the Protection Scheme Identifier value is 0x0, it means NULL-SCHEME.
  • the output result of the NULL-SCHEME operation is the same as the value of the operation input, that is, no encryption operation is performed. For example, if the value of the operation input is SUPI, then the NULL-SCHEME output is also SUPI.
  • the Protection Scheme Identifier value is 0x1, it means that the Profile ⁇ A> security protection mechanism is used.
  • the Protection Scheme Identifier value is 0x2, it means that the Profile ⁇ B> security protection mechanism is used.
  • the UE can choose one of these methods to convert SUPI encryption to SUCI. If Profile ⁇ A> and Profile ⁇ B> are not configured in the UE, the UE can select NULL-SCHEME, which means that SUPI is not encrypted.
  • Home Network Public Key Identifier which represents the public key used by the UE.
  • the UE shall use the public key and Profile ⁇ A> or Profile ⁇ B> to encrypt and convert SUPI into SUCI.
  • Scheme Output used to represent the output result of the safety protection mechanism, which can be represented by a string.
  • Scheme Output can be obtained by encrypting the input of the security protection mechanism (Protection Scheme input) through the public key determined by the Home Network Public Key Identifier and the security protection mechanism determined by the Protection Scheme Identifier.
  • Protection Scheme input when SUPI is IMSI, it may be a mobile subscriber identification number (mobile subscriber identification number, MSIN). MSIN identifies users under the operator.
  • the generated SUCI is used to hide the MSIN of the UE, only revealing which country and operator the user belongs to, and not revealing the final user individual. Because the MSIN representing the individual end user is encrypted and protected by the public key and protection mechanism.
  • the SUCI structure can follow the NAI format. That is, referring to Fig. 2C, SUCI can be composed of SUPI type, routing indicator, protection scheme ID, homenetwork public key ID, scheme output, and releam. Among them, the username can be used as the input of the scheme output, and the Releam part can be regarded as the Home Network Identifier. Therefore, the NSI format of SUCI is SUPI type, routing indicator, protection scheme ID, homenetwork public key ID, scheme output@releam.
  • the SUCI in NAI format is: type1.rid678.schid1.hnkey27.ecckey ⁇ ECC ephemeral public key>.cip ⁇ encryption of user17>.mac ⁇ MAC tag value>@example.com. If NULL-Scheme is selected, SUCI is: [email protected].
  • the service request message 1 may be Nausf_UEAuthentication_Authenticate Request, and the service request message 1 carries SUCI or SUPI.
  • the service request message 1 carries SUCI. If the N1 message carries 5G-GUTI, the service request message 1 carries SUPI.
  • S203 AUSF sends a service request message 2 to UDM, and the service request message 2 may be Nudm_UEAuthentication_Get Request.
  • the service request message 2 carries SUCI and a service network name (serving network name, SN-name), or carries SUPI.
  • the service request message 2 carries SUCI. If the service request message 1 carries 5G-GUTI, the service request message 2 carries SUPI.
  • the specific process for UDM to obtain SUPI can include A1-A4:
  • UDM will determine which security protection mechanism the UE uses according to the Protection Scheme Identifier in the SUCI.
  • UDM will determine which pair of public and private keys the UE uses according to Home Network Public Key Identifier in SUCI.
  • UDM decrypts Scheme Output and verifies integrity protection according to the determined security protection mechanism and private key. If the integrity protection verification is successful, the result after decryption is to recover the UE's identity information.
  • the identity information of the UE in the case that SUPI is IMSI, the result of the analysis from Scheme Output is MSIN.
  • UDM then obtains the final SUPI according to the SUPI type. For example, UDM determines the type of SUPI obtained according to the SUPI type. If the SUPI type is IMSI, it can be determined that the output result of the decryption Scheme Output represents MSIN. Then UDM forms an IMSI together with MSIN according to the MCC and MMC in the Home network Identifier.
  • UDM searches for the user's subscription data according to the recovered SUPI, and then selects an authentication method to authenticate SUPI according to the data in the contract data.
  • the authentication method can be 5G authentication and key agreement (5G-authentication and key agreement, 5G AKA) or extended authentication protocol authentication and key agreement (extensible authentication protocol-authentication and key agreement, EAP-AKA') the way.
  • FIG. 3 is a schematic diagram of the authentication process in EAP-AKA' mode.
  • the UDM After receiving the service request message 2, the UDM generates an authentication vector (authentication vector, AV).
  • the input parameters that need to be used for authentication vector generation are K, sequence number (SQN), random number (RAND) and authentication management field (AMF).
  • K represents a long-term key, which corresponds to the UE one-to-one.
  • K can be pre-configured in the UE's USIM and UDM.
  • the SQN is maintained by the UDM, and the SQN is incremented by 1 every time the UE initiates authentication.
  • RAND is a random number generated by UDM.
  • UDM can set the separation bit in the authentication management domain to 1.
  • a message authentication code (message authentication code, MAC), RAND, an expected response (eXpected RESponse, XRES), and an encryption key (Cipher Key, CK), integrity key (Integrity protection key, IK), anonymous key (anonymity key, AK).
  • the AK and SQN are further XORed.
  • the effect of the XOR operation is to encrypt the SQN. Avoid exposing SQN in the air.
  • CK and IK will further become CK’ and IK’.
  • AUTN stands for authentication token (authentication token), where The symbol
  • UDM sends a service response message 2 to AUSF.
  • the service response message 2 carries EAP-AKA’AV and SUPI.
  • the service response message 2 may be Nudm_UEAuthentication_GetResponse.
  • Nausf_UEAuthentication_Authenticate Response includes EAP request (EAP-Request)/AKA'-Challenge (AKA'-Challenge).
  • EAP request (EAP-Request)/AKA'-Challenge (AKA'-Challenge) includes RAND and AUTN.
  • the SEAF sends an authentication request message (such as Authentication Request) to the UE.
  • the authentication request message can carry a transparently transmitted EAP-Request/AKA'-Challenge message.
  • the authentication request message may also include 5G key set identifier (Key Set Identifier in 5G, ngKSI) and inter-architecture downgrading prevention (Anti-Bidding down Between Architectures, ABBA) parameters.
  • SEAF needs to generate a 5G key set identifier (Key Set Identifier in 5G, ngKSI).
  • SEAF needs to determine ABBA parameters according to its own deployment method.
  • the ngKSI parameter is used to identify the key used between the UE and the SEAF.
  • ABBA is the key generation parameter of Kamf.
  • SEAF's own deployment method includes the deployment method of SEAF and AMF jointly, that is, the functions of SEAF and AMF are realized by one network element, or they are deployed separately, that is, SEAF and AMF are two independent network elements.
  • the UE performs an authentication operation. Specifically, the UE generates XMAC according to the key K stored in the USIM of the UE and the RAND received from the SEAF network element.
  • the operation method used by the UE to generate the XMAC is the same as that used by the UDM network element to generate the MAC.
  • the calculation method used is the same.
  • the UE's comparison of the XMAC and the MAC carried in the AUTN realizes the authentication of the UE to the home network. If the MAC in XMAC and AUTN are the same, the authentication is successful, otherwise the authentication fails.
  • the UE After the authentication is successful, the UE generates RES according to RAND and K.
  • the operation mode used by the UE to generate RES is the same as the operation mode used by the UDM network element to generate XRES.
  • the UE includes the RES in an authentication response message (such as Authentication Response) and sends it to the SEAF.
  • the authentication response message may include an EAP-Response/AKA'-Challenge message.
  • the SEAF transparently transmits the EAP-Response/AKA'-Challenge message.
  • the SEAF may put the EAP-Response/AKA'-Challenge message in the service request message 3 (such as Nausf_UEAuthentication_Authenticate Request) and send it to AUSF.
  • AUSF performs an authentication operation. AUSF compares the RES received from the UE with the XRES saved by itself. If the RES is the same as the XRES saved by itself, the authentication is successful, that is, the AUSF considers the UE to be authentic, otherwise the authentication fails.
  • the AUSF and the UE may further exchange EAP-Request/AKA'-Notification and EAP-Response/AKA'-Notification messages.
  • AUSF sends a service response message 3 (such as Nausf_UEAuthentication_Authenticate Response) to SEAF.
  • the service response message 3 may carry Kseaf and SUPI.
  • the service response message 3 may also carry indication information of successful authentication, for example, an EAP Success message may be used as indication information of successful authentication.
  • the SEAF transparently transmits the EAP Success message to the UE.
  • SEAF needs to send the ngKSI and ABBA parameters to the UE again.
  • the ngKSI and ABBA parameters here are the same as those sent in S304.
  • the purpose of the SEAF sending the ngKSI and ABBA parameters again is to ensure that the message format used for the transparent transmission of the EAP Success message is the same as the message format of the S304.
  • FIG. 5 is a schematic diagram of the authentication process in the 5G AKA mode.
  • UDM generates 5G AV.
  • IK. Kausf is a derived key synchronized between the UE and the AUSF network element, and is used to derive the anchor key Kseaf. 5G AV RAND
  • AUTN RAND
  • UDM sends a service response message 2 to AUSF, and the service response message 2 carries 5G AV and SUPI.
  • the AUSF performs further processing on the authentication vector, for example, performs a hash operation on XRES* to generate HXRES*, deduces K AUSF to generate K SEAF , and the processed authentication vector includes RAND, MAC, HXRES* , Wherein the MAC can be carried in AUTN, that is, the processed authentication vector includes RAND and AUTN carrying MAC.
  • the AUSF sends a service response message 1 to the SEAF.
  • the service response message 1 may be Nausf_UEAuthentication_Authenticate Response.
  • Nausf_UEAuthentication_Authenticate Response includes Kseaf and processed 5G AV.
  • the SEAF sends an authentication request message to the UE, where the authentication request message carries part of the parameters in the processed authentication vector, and the part of the parameters includes RAND and MAC, where MAC can be carried in AUTN .
  • the authentication request message may also include ngKSI and ABBA parameters. SEAF saves the HXRES* and Kseaf in the processed 5G AV.
  • the UE generates an XMAC according to the key K stored in the USIM of the UE and the RAND received from the SEAF network element.
  • the calculation method used by the UE to generate the XMAC is the same as that of the UDM network element to generate the MAC.
  • the calculation method used is the same.
  • the UE's comparison of the XMAC and the MAC carried in the AUTN realizes the authentication of the UE to the home network. If the MAC in XMAC and AUTN are the same, the authentication is successful, otherwise the authentication fails.
  • the UE After the authentication is successful, the UE generates RES* according to RAND and K.
  • the operation mode used by the UE to generate RES* is the same as the operation mode used by the UDM network element to generate XRES*.
  • the UE includes the RES* in an authentication response message and sends it to the SEAF network element.
  • the SEAF network element performs a hash operation on the RES* included in the authentication response message to generate HRES*, and compares the HRES* with the HXRES* in the authentication vector sent by the AUSF network element, and passes The comparison of HRES* and HXRES* completes the authentication of the UE by the service network. If the HRES* is consistent with the HXRES*, the service network authenticates the UE successfully, otherwise the authentication fails.
  • SEAF After the service network successfully authenticates the UE, the SEAF forwards the RES* returned by the UE to the AUSF network element, and the AUSF network element performs the next step of authentication.
  • SEAF can send RES* to AUSF through service request message 3 (such as Nausf_UEAuthentication_Authenticate Request).
  • the AUSF network element After receiving the RES*, the AUSF network element compares the RES* with the XRES* in the authentication vector, and if the results are consistent, the authentication of the UE by the home network is completed.
  • SUPI and K seaf can be sent to SEAF through service response message 3 (such as Nausf_UEAuthentication_Authenticate Response).
  • service response message 3 may also carry indication information that the authentication is successful.
  • SEAF After receiving the service response message 3, SEAF then executes the NAS security activation process.
  • FIG. 6 For a schematic diagram of the NAS security activation process.
  • AMF After SEAF receives the service response message, AMF will generate Kamf according to the Ksea f received by SEAF, and pass the Kamf to AMF. AMF will further use Kamf to generate NAS encryption key Knasenc and NAS integrity protection key Knasint.
  • AMF enables NAS integrity protection.
  • the AMF sends a NAS security mode signaling (NAS Security Mode Command, NAS SMC) message to the UE.
  • AMF uses the NAS integrity protection key Knasint to protect the integrity of NAS SMC messages.
  • S603 After sending the NAS SMC message, the AMF starts uplink decryption. In order to decrypt the NAS security mode complete (SMP) message. After receiving the NAS SMP, enable downstream encryption.
  • SMP NAS security mode complete
  • the UE also generates Kamf and NAS encryption key Knasenc and NAS integrity protection key Knasint.
  • the UE uses the NAS integrity protection key to perform integrity protection verification on the NSA SMC message. If the verification is successful, it will enable uplink encryption, downlink decryption and integrity protection.
  • NAS SMP messages are encrypted and integrity protected.
  • the UE is a device capable of generating NAS signaling, and there is an N1 interface with the AMF, and a device that cannot generate NAS signaling cannot register with the core network in the above-mentioned manner.
  • the embodiment of the present application provides a registration method for a device that cannot generate NAS signaling to register with the core network.
  • a device that cannot generate NAS signaling may be referred to as an access device that does not have NAS capability in the embodiment of the present application.
  • a device with NAS signaling can replace the signaling used for registration between an access device without NAS capability and the core network.
  • a device with NAS signaling and a device that can exchange signaling with the core network instead of an access device without NAS capability may be referred to as a secure access gateway in the embodiment of the present application.
  • the communication system architecture includes access devices without NAS capabilities, secure access gateways, first core network network elements, second core network network elements, and third core network network elements.
  • the secure access gateway can communicate with the network element of the first core network through a unique interface, such as an N1 interface and an N2 interface.
  • the network element of the first core network can complete the authentication of the network access device.
  • the network element of the second core network can store the user's subscription information and generate authentication parameters.
  • the third core network element has an authentication service function.
  • the secure access gateway is a network element with NAS capability, and can be used as a gateway to process related messages from access devices that do not have NAS capability.
  • the secure access gateway can be part of the access network or part of the core network.
  • the first core network network element, the second core network network element, and the third core network network element may be network elements used to handle the access of access devices without NAS capabilities, and they may be traditional AMF, AUSF, UDM networks Meta, it can also be a special function entity that handles the access of access devices without NAS capability. There can be one or more of these functional entities, and they can be unified into AMF, AUSF, UDM, or distributed and stored in AMF, AUSF, UDM.
  • the network element of the first core network may be an access and mobility control function (AMF) or a SEAF.
  • the network element of the second core network may be UDM, or ARPF, or a decryption subscription identifier de-concealing function (SIDF).
  • the third core network element may be AUSF.
  • an access device that does not have NAS capabilities may be a fixed network residential gateway (FN-RG).
  • the network element capable of generating NAS signaling may be a wired access gateway (wireline access gateway function, W-AGF).
  • W-AGF provides FN-FG with the ability to access the fifth-generation (5G) core network.
  • 5G fifth-generation
  • FN-RG establishes a connection with the core network through W-AGF.
  • FN-RG the registration of an access device without NAS capability to the core network is described in detail. It should be understood that when other access devices without NAS capability are applied, this
  • the related information of FN-RG mentioned in the application embodiment can be replaced with related information of an access device without NAS capability.
  • the identity information of FN-RG can be replaced with an access device without NAS capability.
  • the device-related information of the FN-RG can be replaced with the device-related information of the access device that does not have NAS capabilities, etc., which will not be listed one by one.
  • FIG. 8 shows a schematic diagram of the fixed network mobile convergence system architecture provided by an embodiment of this application.
  • the system architecture may include FN-RG, W-AGF, AMF, UPF, UDM, AUSF, SEAF, ARPF, etc.
  • W-AGF and AMF are interconnected through N1 interface and N2 interface
  • W-AGF and UPF are interconnected through N3 interface
  • UPF and SMF are interconnected through N4 interface
  • between UPF and DN They are interconnected through the N6 interface
  • AMF and UDM are interconnected through the N8 interface
  • UDM and SMF are interconnected through the N10 interface
  • SMF and AMF are interconnected through the N11 interface
  • AMF and AUSF are interconnected through the N12 interface.
  • AUSF and UDM are interconnected through the N13 interface.
  • the W-AGF and AMF can be connected through the N1 interface and the N2 interface.
  • the N1 interface can be used when FN-RG is connected to the 5G core network. Since the FN-RG is not capable of accessing the 5G core network, that is, the FN-RG does not have an interface connected to the AMF, and therefore is not capable of sending N1 interface messages, W-AGF can replace FN-RG to send N1 interface messages to AMF.
  • the FN-RG is an access device of a fixed network, and is used to provide access management for terminal devices connected to the FN-RG.
  • the W-AGF is responsible for connecting the FN-RG to the 5G core network. When FN-RG is connected, W-AGF will replace FN-RG to generate NAS messages.
  • the AMF network element is responsible for UE access management and mobility management, such as registration management, connection management, mobility management, reachability management, etc.; in practical applications, it includes mobility management entities in the network framework of LTE.
  • the mobility management function in the management entity (MME) has been added to the access management function.
  • the SMF is used to allocate session resources for the user plane.
  • UPF is used to provide user plane data export and connect to external networks.
  • the SEAF network element is used to complete the authentication of the network access device (such as FN-RG).
  • the function of the SEAF can be incorporated into the AMF.
  • the AUSF network element has an authentication service function for terminating the authentication function requested by the SEAF network element.
  • the authentication vector sent by the UDM is received and the authentication vector is processed, and the processed authentication The vector is sent to SEAF.
  • the UDM network element can store the user's subscription information, generate authentication parameters, and so on.
  • the ARPF network element has authentication credential storage and processing functions, which are used to store the user's long-term authentication credential, such as a permanent key K.
  • the functions of the ARPF network element can be incorporated into the UDM network element.
  • the SIDF network element is responsible for decrypting SUCI to obtain SUPI.
  • the functions of the SIDF network element can be incorporated into the UDM network element.
  • the first core network element is SEAF
  • the second core network element is UDM
  • the third core network element is AUSF as an example.
  • FIG. 9 is a schematic flowchart of a registration method provided by an embodiment of this application.
  • the FN-RG sends a first request message to the W-AGF.
  • the first request message includes the original identity information of the FN-RG.
  • the W-AGF initiates a registration procedure for the access device to the core network.
  • the first request message may be a message that is exchanged between the FN-RG and the W-AGF in the registration process of the fixed network.
  • FN-RG accesses W-AGF through Layer 2 connection, so that W-AGF and FN-RG complete the fixed network authentication process.
  • Layer 2 connection refers to the connection of the fixed network.
  • the message sent by the FN-RG through the layer 2 (Layer 2) connection W-AGF is used as the first request message.
  • the first request message includes an indication field, which is used to trigger the W-AGF A registration procedure is initiated to the core network of the mobile network, so that after the W-AGF completes the authentication of the FN-RG, S902 is executed.
  • W-AGF determines whether S902 needs to be executed according to other information. For example, W-AGF can determine whether to perform S902 based on pre-configured information, network traffic status information and other information. For example, when the W-AGF is connected to the fixed network and the 5G core network at the same time, the W-AGF can automatically connect to the 5G core network after receiving the FN-RG network access request according to the pre-configuration information, and then establish a connection with the 5G core network. Data transmission link.
  • W-AGF judges that the fixed network line is congested and busy based on other information (such as the status information of the fixed network), and the next time FN-RG uses the fixed network link, it actively connects to the 5G core network for the fixed network.
  • the network link is shunted to reduce the degree of congestion (in this case, the FN-RG initiated to the W-AGF may not be the registration process, it may be a part of the data transmission process, or other fixed network signaling processes).
  • W-AGF can decide whether to access the 5G core network for all FN-RGs or some FN-RGs according to the network management configuration instructions.
  • the network management configuration has a list that specifies which FN-RGs are.
  • This list may include the correspondence between the identity information of the FN-RG and the indication used to indicate whether the 5G core network can be accessed. Whether FN-RG can access the 5G core network is related to whether FN-RG users purchase this service.
  • the original identity information of the FN-RG may be Line ID (Line ID), or may be a Hybrid Fiber Coaxialz Identifier (HFC identifier).
  • Line ID Line ID
  • HFC identifier Hybrid Fiber Coaxialz Identifier
  • the format used by different operators of the Line ID may be different or the same.
  • the format that the line ID can use may be dynamic host configuration protocol (dynamic host configuration protocol, DHCP) v4 option 82 interactive use (exchange), or Ethernet
  • DHCP dynamic host configuration protocol
  • DHCP DHCP
  • v4 option 82 interactive use (exchange) Ethernet
  • Ethernet Ethernet
  • PPPoE point-to-point protocol over ethernet
  • the HFC identifier may be a decimal string containing a media access control address (MAC) address or an HFC account identifier.
  • MAC media access control address
  • HFC account identifier For details, please refer to 3GPP TS23.316 version 020.
  • the W-AGF generates concealed identity information (subscriber concealed identifier, SUCI) according to the identity information of the FN-RG.
  • the identity information of the FN-RG may only include the original identity information of the RN-RG, and may also include other information in addition to the original identity information of the FN-RG.
  • W-AGF can directly use the original identity information of FN-RG to generate hidden identity information.
  • W-AGF can only use the original identity information of FN-RG to generate hidden identity information.
  • the identity information of FN-RG only includes the original identity information of FN-RG; in another case, Some other information used to further indicate the identity of FN-RG can also be obtained.
  • other information used to further indicate the identity of FN-RG is called FN-RG equipment related information. -The title of other information of RG's identity is not specifically limited in this application.
  • W-AGF uses the acquired device-related information together with FN-RG's original identity information to generate hidden identity information.
  • Device-related information can include one or more of FN-RG location information, access time information, FN-RG operator information, etc., so that FN-RG identity information can be unique within the operator Or be unique in the global network.
  • the identity information of the RN-RG includes not only the original identity information of the FN-RG, but also device-related information.
  • Device-related information may include one or more of FN-RG location information, access time information, FN-RG operator information, etc. It can be understood that: device-related information may include only one item, such as only Including FN-RG operator information, or only FN-RG location information, or only FN-RG access time information; or device-related information can include two of them, such as FN-RG operator information And FN-RG location information; or device-related information includes three items, such as FN-RG operator information and FN-RG location information and access time information.
  • the information of the operator of the FN-RG may be the information of the operator to which the FN-RG belongs, or the information of the cooperative operator of the FN-RG.
  • the information of the operator to which the FN-RG belongs or the information of the cooperative operator of the FN-RG is determined by the W-AGF.
  • the information of the operator to which the FN-RG belongs is obtained from the configuration information of the W-AGF according to the identity information of the FN-RG.
  • the information of the operator of the FN-RG cannot be directly obtained from the original identity information of the FN-RG.
  • the W-AGF can directly obtain or infer the information of the registered operator of the FN-RG according to the fixed network layer 2 message of the FN-RG.
  • FN-RG cooperative operator information refers to the fact that the current service provider described by FN-RG has not deployed 5G networks, but its service provider has contracted and cooperated with operators that have deployed 5G networks, so that the service provider’s FN-
  • the RG can access the network of an operator that has deployed a 5G network. It can even access the networks of other operators that have contracted with this operator.
  • the W-AGF is configured with the correspondence between the identity information of FN-RG and the information of the operator to which FN-RG belongs, or the correspondence between the identity information of FN-RG and the information of the operator cooperating with FN-RG, thereby
  • the W-AGF can determine the information of the operator to which the FN-RN corresponding to the identity information of the FN-RG belongs or the information of the cooperative operator according to the corresponding relationship.
  • the original identity information of FN-RG may directly carry the operator information to which FN-RG belongs, so W-AGF can be used directly.
  • the identity information of FN-RG may only include The original identity information or FN-RG identity information includes the original identity information and device-related information, but the device-related information no longer includes FN-RG operator information.
  • the original identity information of FN-RG may be unique within the operator or unique in the global network, of course, it may also be locally unique. In the case of local uniqueness, it may be because FN-RG is a fixed network device and its location in the existing network is relatively fixed. Therefore, the identity information of a device in Beijing may be the same as that of a device in Shanghai. However, because it is not mobile, it is impossible for the equipment in Shanghai to go to Beijing to use the network, so it may cause duplication in the distribution of fixed network identity information.
  • the identity information of FN-RG does not uniquely identify a device, but can be reused by different devices.
  • the method of combining the original identity information of FN-RG with the device-related information can be that the original identity information of FN-RG comes first and other information comes after; it can also be other information comes first and the original identity information of FN-RG comes after; It can be specified that the original identity information of the FN-RG is filled in the fixed bits at the front, and other information is filled in the fixed bits at the back. The bits that are not filled are filled with 0; the original identity information of FN-RG and other information can also be connected in series using special connections, such as colon ":", double vertical bar "
  • W-AGF can first generate SUPI based on the original identity information of FN-RG, and then generate a hidden identity (SUCI) based on SUPI.
  • W-AGF may first combine the original identity information of FN-RG with device-related information to generate SUPI, and then generate a hidden identity based on SUPI; the content of device-related information can refer to the description in the previous paragraph.
  • SUPI type please refer to the following description.
  • the SUCI includes at least two parts of information used to determine the SUPI of the FN-RG, the first part of information and the second part of information, respectively. Both the first part of the information and the second part of the information can be determined by the identity information of the FN-RG.
  • the identity information of the FN-RG mentioned here may only include original identity information, or may include original identity information and device-related information.
  • the first part of information and the second part of information are determined by the identity information of the FN-RG, multiple methods may be included. Several methods are exemplarily described as follows.
  • the first part of information is the first part of the identity information of the FN-RG
  • the second part of information is the second part of the identity information of the FN-RG.
  • the first part and the second part may not overlap in the FN-RG identity information.
  • the FN-RG identity information includes 15 bits
  • the first part includes 5 bits of 15 bits
  • the second part includes 6bit information in 10bit other than 5bit information.
  • the information included in the first part and the second part constitutes the identity information of the FN-RG, for example, the first part includes a part of the FN-RG identity information
  • the second part of the information includes Another part of the identity information of the FN-RG.
  • the identity information of FN-RG includes original identity information and device-related information.
  • the device-related information can be used as the first part of information, and the original identity information can be used as the second part of information; or the device-related information can be used Part of is combined with the original identity information as the second part of information, and the other part of the device-related information is used as the first part of information.
  • the first part of the information is the information carried by the home Network Identifier or the Releam part
  • the second part of the information may be the information carried by the Scheme Out.
  • the original identity information may be used as the input of the Scheme Out
  • the device-related information is determined as the home Network Identifier.
  • the first part of the identity information of FN-RG can be directly used as a part of SUPI, such as device-related information or part of device-related information, and the second part can be used as another part of SUPI, and the other part can be used directly.
  • the scheme input is used to obtain the scheme output in the SUCI.
  • the second part is the original identity information or part of the original identity information of the FN-RG.
  • the SUPI is formed by the two parts, the two parts can be directly combined and the SUPI type is added to obtain the SUPI.
  • the two parts of information can be formatted and then the SUPI type is added to obtain the SUPI.
  • Format conversion means converting to a format that can be recognized by the 5G core network. You can refer to the related description in the second method, which will not be repeated here.
  • SUPI type may be the third part of information in SUCI.
  • the SUPI can be formed directly based on the first part and the second part, and there is no need to add SUPI type.
  • the first part of the information is the information of the first part of the FN-RG identity information after format conversion
  • the second part of the information includes the second part of the format of the FN-RG identity information The converted information.
  • the first part of the FN-RG identity information and the second part of the FN-RG identity information described in the embodiment of this application refer to the two parts of the FN-RG identity information.
  • the combination can be all of the FN-RG identity information or part of the FN-RG identity information.
  • the second part may be part of the information formed by combining the original identity information of FN-RG with a part of the device-related information, and the first part of information may be Part of the extended identity information.
  • the second part may also be part of the original identity information of the FN-RG, or the original identity information of the FN-RG; the first part may be part of the device-related information, or device-related information.
  • the format conversion in the embodiment of this application means that the W-AGF converts the identity information of the FN-RG into a format that can be recognized by the 5G core network.
  • the original identity information of FN-RG mentioned above or the combination of original identity information and device-related information may not be in a format that can be recognized by the 5G core network. Therefore, W-AGF can further format the FN-RG identity information to make it into a format that can be recognized by the 5G core network. Including the method of directly multiplexing the FN-RG identity bits directly, or the result of calculation by using set rules.
  • the first 5 bits of the identity information of FN-RG are the first part of the information, but in the SUPI configuration, the first part of the information requires 6 bits, so a conversion rule needs to be defined, which can directly convert the 5 bit information into the first part of the SUPI configuration information.
  • the conversion rule can be a list of correspondences or a reversible conversion method. Reversible means that UDM can perform reverse operations to obtain the first 5 bits of the original FN-RG identity information.
  • W-AGF can convert the format of the first part of the identity information of FN-RG as the Home network Identifier or Releam part, and convert the format of the second part to obtain information similar to MSIN or username as the input of Scheme Output, and finally Obtaining Scheme Output, that is to say, the method of obtaining SUCI mentioned in the second way can be considered as: After format conversion of FN-RG identity information, it is obtained by using NULL Scheme.
  • the first part of information and the second part of information can be combined and the SUPI type is added to obtain SUPI.
  • the SUPI can be formed directly based on the first part and the second part. , No need to add SUPI type.
  • the first part of the information includes the first part of the FN-RG's identity information
  • the second part of the information is obtained by encrypting the second part of the FN-RG's identity information.
  • the first part of the identity information of FN-RG can be directly used as a part of SUPI, such as device-related information or part of device-related information, and the second part can be used as another part of SUPI, and the other part can be used directly.
  • the scheme input is used to obtain the scheme output in the SUCI.
  • the second part is the original identity information or part of the original identity information of the FN-RG.
  • one way is to combine the first part of information with the decrypted second part of information (such as scheme input) and then add SUPI type to obtain SUPI .
  • Another way is to perform format conversion on the first part of the information in the SUCI and the decrypted second part of the information separately, and then combine and add the SUPI type to obtain the SUPI.
  • the first method can be compared to that SUCI is generated by NULL Scheme
  • the third method can be equivalent to selecting a security protection mechanism (profile) and passing the identity information or part of the identity information of FN-RG Get encrypted.
  • W-AGF converts part of the FN-RG identity information format as Home network Identifier or Releam, and encrypts the other part as scheme input, and finally obtains scheme output.
  • the fourth way the first part of the information is the first part of the FN-RG identity information after format conversion, and the second part of the information is the second part of the FN-RG identity information
  • the information after format conversion is encrypted again.
  • This method corresponds to the second method, which means that the identity information of FN-RG cannot be directly used by the 5G core network, and all the corresponding format conversions are required.
  • the description of format conversion can refer to the second way.
  • the descriptions of the first part and the second part can refer to the second way, which will not be repeated here.
  • W-AGF converts the format of the first part of the identity information of FN-RG and determines it as Home network Identifier or Releam, and converts the format of the second part to information similar to MSIN or username, and determines it as Scheme Input.
  • the first part of the FN-RG identity information can be directly used as part of the SUPI after format conversion, such as device-related information or part of the device-related information, and the second part can be converted into another part of SUPI.
  • the other part can be directly used as the scheme input to obtain the scheme output in the SUCI, and the second part can be the original identity information of the FN-RG or a part of the original identity information.
  • UDM when UDM generates SUPI based on SUCI, it can combine the first part of information and the decrypted second part of information (for example, scheme input) and then add SUPI type to obtain SUPI.
  • the device-related information includes the operator information of the FN-RG (for example, the information of the operator to which the FN-RG belongs, or the information of the cooperative operator of the FN-RG) as an example.
  • the method is explained in detail.
  • the first part of information may be determined based on the device-related information or part of the device-related information in the FN-RG identity information, for example, all or part of the operator information of the FN-RG is directly used as the first part. information.
  • Part information or convert all or part of the operator information of FN-RG as the first part of the information.
  • the second part of the information may be determined based on the original identity information of the FN-RG. For example, take part or all of the original identity information of the FN-RG as the second part of the information, or take the information obtained by encrypting part or all of the original identity information of the FN-RG as the SUCI
  • the second part of information used to determine the SUPI, or the information obtained after format conversion of part or all of the original identity information of the FN-RG is used as the second part of information used to determine the SUPI.
  • the first part of information can be used as the Home network Identifier or releam part
  • the second part of information can be used as the Scheme Output.
  • the information of the operator of the FN-RG obtained from the configuration information of the W-AGF can be the same as the MCC+MNC format in the IMSI or the same as the releam part of the NSI format, and the obtained operator’s information of the FN-RG can be The information is added in the Home network IDentification or releam part of SUCI.
  • Obtaining the information of the operator registered by FN-RG from the configuration information of the W-AGF may also be different from the format of MCC+MNC in IMSI, and the obtained information of the operator registered by FN-RG can be converted into MCC +MNC format, or the releam part of the NSI format, and then add the information of the operator registered with the FN-RG after the format conversion to the Home network Identifier or releam part of SUCI.
  • W-AGF supports only one operator for access.
  • W-AGF supports only one operator for access.
  • the information of the operator to which the RG belongs can be directly determined according to the operator supported by W-AGF to access the information of the operator to which the FN-RG belongs, and the information of the determined operator of the FN-RG or the information of the FN-RG
  • the information of the operator after format conversion is added to the Home network Identifier or releam part of SUCI.
  • W-AGF is the security gateway of China Mobile.
  • W-AGF directly determines the MCC+MNC corresponding to China Mobile. The value is used as the Home network Identifier or releam part.
  • SUCI may include, in addition to the above-mentioned first part information and second part information, the SUPI type information used to form the SUPI, and the SUPI type information Indicate that the permanent identity is the identity of FN-RG.
  • the value of SUPI type is different from the value of SUPI type corresponding to IMSI and Network Specific Identifier.
  • the value of SUPI type can be 2, which is used to indicate that SUPI is the identity of FN-RG.
  • the first part of the information may be a certain type of SUPI, such as a SUPI type.
  • the SUPI type may be determined according to the identity information of the FN-RG, or the FN-RG access is determined according to the layer 2 message type, and the W-AGF determines that it is the FN-RG access, thereby determining the SUPI type.
  • the determined SUPI Type can reuse the type corresponding to the existing NSI, or define a new type.
  • the newly defined type represents the access of access devices that do not have NAS capabilities, such as the access of fixed network devices (such as FN-RG).
  • the second part of the information can be all or part of the identity information of FN-RG, or all or part of the identity information of FN-RG after format conversion, or all of the identity information of FN-RG
  • the information after part of the information is encrypted may also be the information after all or part of the information format conversion of the FN-RG identity information.
  • the format conversion and encryption are as mentioned above, so I won’t repeat them here.
  • the SUPI type may be included in the SUCI, and the SUPI type may be a part other than the first part of the information and the second part of the information, such as the first way-the fifth way above, or as the first part of the information, such as the sixth part.
  • the SUPI type may be included in the SUCI, and the SUPI type may be a part other than the first part of the information and the second part of the information, such as the first way-the fifth way above, or as the first part of the information, such as the sixth part.
  • the SUPI type may be included in the SUCI, and the SUPI type may be a part other than the first part of the information and the second part of the information, such as the first way-the fifth way above, or as the first part of the information, such as the sixth part.
  • the SUPI type may be included in the SUCI, and the SUPI type may be a part other than the first part of the information and the second part of the information, such as the first way-the fifth way above, or as the
  • the SUCI may also include a routing indicator.
  • the routing indicator is used by the AMF to find and determine the AUSF that can serve the FN-RG and the AUSF to find and determine the UDM that can serve the FN-RG.
  • the routing indicator may be obtained from the configuration information of the W-AGF.
  • the operator can specify that only one or a few AUSF, UDM/ARPF/SIDF are used to handle FN-RG access, and different operators can handle FN-RG
  • the AUSF, UDM/ARPF/SIDF of the access may be the same or different.
  • the second case is that the operator does not make any regulations, which means that all AUSF, UDM/ARPF/SIDF can handle FN-RG access.
  • the method of determining the Routing Indicator is different.
  • the configuration information in the W-AGF may include AUSF used to process the access of the FN-RG, and the Routing Indicator corresponding to UDM/ARPF/SIDF. Therefore, in this case, there may be one or more Routing indicators configured in the W-AGF. If there are more than one, the W-AGF can randomly select one of the multiple Routing indicators included in the configuration information, or select the appropriate one according to the operator's division rule according to the identity information of the FN-RG. At this time, the Routing Indicator is used to indicate the AUSF, UDM/ARPF/SIDF that can serve the fixed network. Optionally, in this case, the Routing Indicator can also be set to a fixed value, for example, to a maximum value of 9999.
  • the configuration information of the W-AGF also includes Routing Indicators corresponding to the information of different operators. That is, the configuration information includes the correspondence between different operator information and Routing Indicator, so that in the process of generating SUCI for the FN-RG, the information of the operator to which the FN-RG belongs or the information of the cooperative operator can be obtained from the fixed From the configuration information of the network security gateway.
  • the configuration information can also be more fine-grained.
  • the corresponding relationship in the configuration is also added to part of the FN-RG identity information.
  • the configuration information includes operator information or cooperative operator information, Routing Indicator and Correspondence of the routing field part in the identity information.
  • the Routing indicator can be a default value, such as 0.
  • the SUCI may also include a public key identifier, and the public key identified by the public key identifier is used to encrypt the second part of the information in the permanent identity identifier.
  • the public key identifier is obtained from the configuration information of the W-AGF.
  • the configuration information of the W-AGF includes the correspondence between the public key identifier and the public key.
  • the public key used is not limited, that is, different FN-RGs can use the same or different public keys. Then, when W-AGF determines the public key identifier, it can select one of the configured one or more public key identifiers.
  • the public keys used by different operators may be different, and the configuration information of the W-AGF may also include the information of the operator and The corresponding relationship of the public key identifier (or public key), so that the W-AGF can obtain the public key from the configuration information of the W-AGF according to the information of the operator to which the FN-RG belongs or the cooperative operator information Identifier.
  • the public key identifier may be the Home Network Public Key Id in the SUCI structure shown in FIG. 2B or FIG. 2C, which is a key used to encrypt the input of the Scheme output.
  • the W-AGF selects the NULL Scheme mode.
  • the SUCI may also include a security protection mechanism identifier.
  • the security protection mechanism identifier can be used to indicate the security protection mechanism adopted for the input of the Scheme output.
  • the security protection mechanism identifier may be the Protection scheme Id in the SUCI structure shown in FIG. 2B or FIG. 2C.
  • the specific determination method of Home Network Public Key Id refer to the determination method of Protection scheme Id shown in FIG. 2B or FIG. 2C.
  • the W-AGF can be configured with only one security protection mechanism, and the SUCI may not include the security protection mechanism identifier, that is, the configured security protection mechanism is used to encrypt the input of the Scheme output.
  • the W-AGF can only select NULL Scheme.
  • the operator can also configure the W-AGF to select NULL Scheme.
  • W-AGF cannot find the identification information of FN-RG or the public key corresponding to the information of the operator determined by W-AGF, W-AGF also selects NULL Scheme.
  • NULL Scheme Home Network Public Key Id can add 0.
  • the W-AGF sends a second request message to the AMF of the mobile network, where the second request message is used to request registration of the FN-RG to the core network, and the second request message may carry the SUCI .
  • the second request message may also carry a first authentication success indication, and the first authentication success indication is used to instruct the W-AGF to determine that the FN-RG is a legal access device.
  • W-AGF can be configured with one or Multiple AMF identification information, so that the W-AGF can select one AMF identification information from the configuration information, and send the second request message to the AMF corresponding to the selected AMF identification information.
  • W-AGF can be configured with a selection strategy for selecting an AMF capable of handling FN-RG access, so W-AGF selects an AMF capable of handling FN-RG access according to the selection strategy, and The second request message is sent to the selected AMF.
  • AMF sends a first service request message to AUSF.
  • the first service request message includes SUCI. If the second request message carries the first authentication success indication, the first service request message carries the first authentication success indication.
  • the first service request message may be Nausf_UEAuthentication_Authenticate Request or other types of service request messages.
  • the first service request message may be a service request message specifically for FN-RG, such as Nausf_FN- RGAuthentication_Authenticate Request.
  • the SUCI includes the Routing Indicator, and the AMF can determine the AUSF according to the Routing Indicator and/or Homenetwork identifier (or the Releam part) in the SUCI, and send the first service request message to the selected AUSF.
  • the AMF can determine that the second request message belongs to the FN-RG registration process according to the first authentication success indication, and select the one that can serve this FN-RG according to the pre-configured information AUSF.
  • the pre-configured information may be the pre-configured identification information of the AUSF that can handle the access of the FN-RG, or the selection strategy for selecting the AUSF that can handle the access of the FN-RG. That is to say, when the Routing Indicator in SUCI is 0, the AMF and UDM/ARPF/SIDF are determined to be AMF, not based on the Routing Indicator carried in SUCI. Exemplarily, AMF can further replace Routing Indicator in SUCI with corresponding values that can find AUSF and UDM/ARPF/SIDF. Another understanding is that if Routing Indicator is 0, then AMF can choose AUSF arbitrarily.
  • AUSF sends a second service request message to UDM.
  • the second service request message includes SUCI. If the first service request message carries the first authentication success indication, the second service request message carries the first authentication success indication.
  • the second service request message may be Nudm_UEAuthentication_Get Request, or other types of service request messages.
  • the first service request message may be a service request message dedicated to FN-RG, such as Nudm_FN- RGAuthentication_Get Request.
  • the SUCI includes the Routing Indicator
  • the AUSF may determine the UDM according to the Routing Indicator and/or Home network identifier (or the Releam part) in the SUCI, and send the second service request message to the selected UDM.
  • the AUSF can send the second service request message to any UDM.
  • the AUSF may determine that the first service request message belongs to the FN-RG registration process according to the first authentication success indication, and select the UDM that can serve this FN-RG according to pre-configured information or information fed back by other network elements.
  • the pre-configured information may be pre-configured DUM identification information capable of handling FN-RG access, or a selection strategy used to select UDM capable of handling FN-RG access.
  • Routing Indicator in SUCI when the Routing Indicator in SUCI is 0, it is AUSF that determines UDM/ARPF/SIDF, and it is no longer based on the Routing Indicator carried in SUCI.
  • AMF can further replace Routing Indicator in SUCI with the corresponding value of UDM/ARPF/SIDF that can be found. For example, UDM information fed back through network storage function (NRF) network elements.
  • NRF network storage function
  • the UDM obtains the SUPI of the FN-RG according to the SUCI in the second service request message.
  • UDM obtains SUPI directly from SUCI.
  • UDM obtains FN-RG identity information or part of FN-RG identity information from SUCI, and then obtains SUPI based on the obtained FN-RG identity information or part of FN-RG identity information.
  • FN-RG wants to use FN-RG identity information or part of FN-RG identity information to generate SUPI
  • UDM needs to obtain FN-RG identity information or part of FN-RG identity information through SUCI , And then generate SUPI according to the identity information of FN-RG or part of the identity information of FN-RG.
  • SUCI when W-AGF generates SUCI, SUCI includes two parts of information used to determine SUPI, namely the first part of information and the second part of information, then UDM can obtain FN-RG from the two parts of information in SUCI FN-RG identity information or part of FN-RG identity information, or directly obtain FN-RG SUPI or part of FN-RG SUPI through these two parts of information.
  • the formats adopted by SUCI and SUPI can be the same or different.
  • both adopt the NAI format For example, both adopt the format for access that does not have NAS capabilities.
  • the format adopted by the device for example, is called a non-NAS access identifier (Non-NAS access identifier, NNAI).
  • NNAI non-NAS access identifier
  • other names are adopted, which is not specifically limited in the embodiment of the present application.
  • NNAI when applied to a fixed network, both can adopt a format defined for fixed network equipment, for example, it can be called a fixed access identifier (fix access identifier, FAI) or called, of course, it can also be other This application does not specifically limit the title.
  • FAI fixed access identifier
  • FAI fixed access identifier
  • the formats used by the two are different, one uses NAI, and the other uses NNAI.
  • the NNAI format can be composed of two parts: SUPI Type and identity information indicating fixed network access.
  • the identity information adopts NAI format.
  • the identity information part of the NAI format can directly use the fixed network identity information in the 5G core network, that is, the 5G core network can recognize and process the original fixed network identity information.
  • the fixed network identity information is directly Line ID or HFC Identifier; it can also be Line ID or HFC Identifier and other types of fixed network identity information combined with other information to have unique identity information in the 5G core network.
  • the domain name part of the NAI format can be the SUPI domain name in the NSI format, or a domain name combined with other information tools.
  • NNAI can be bound with SUPI Type. For example, if SUPI Type adopts a newly defined value, then the format of the fixed network identity information corresponding to this value is the NNAI format.
  • NNAI can be of fixed length in 5G core network, such as 32bit. If the identity information of FN-RG is greater than 32 bits, you can choose to directly use part of the identity information of FN-RG to write into NNAI. The writing method will be specified in advance. If the identity information of FN-RG is less than or equal to 32 bits, then the identity information of FN-RG can be directly written into NNAI. You can write from high to low, and you can write from low to high. The parts that are not filled up are automatically filled with special values, such as 0.
  • UDM can combine the two parts of information used to determine SUPI in SUCI to obtain FN-RG identity information or part of FN-RG identity information, and FN-RG identity information or part of FN-RG identity information can be directly As part of SUPI or SUPI.
  • Method 1 can be applied to the situation where the formats adopted by SUCI and SUPI are the same.
  • both SUCI and SUPI can use the NAI format.
  • the SUCI in the NAI format can be [email protected].
  • the first part of information can be user17 and the second part of information is @example.com. Therefore, you can combine user17 and @example.com and add the SUPI type (type 2) included in SUCI to obtain SUPI.
  • the first part of information is type2
  • the second part of information is [email protected], so you can combine type2 and [email protected] to get SUPI.
  • the user17 is the original identity information of FN-RG LineID or the identity information of FN-RG.
  • both SUCI and SUPI can use the newly defined format NNAI for fixed network equipment.
  • the two parts of information used to determine SUPI are intercepted from 32 bits to obtain SUPI.
  • the first part of information is SUPI type
  • the second part of information may be FN-RG identity information (or part of identity information) or identity information (or part of identity information) after format conversion.
  • the identity information of FN-RG can adopt the same format as SUCI
  • the second part of the information can be the identity information of FN-RG (or a part of identity information)
  • the identity information of FN-RG can also adopt a different format from SUCI.
  • the second part of the information may be the information after the format conversion of the identity information (or a part of the identity information).
  • the first part of information and the second part of information used to determine the SUPI in the SUCI may be obtained by using the first way or the second way or the fifth way in S902.
  • Method 2 Decrypt the second part of information used to determine SUPI in SUCI, and combine the decrypted second part of information with the first part of information to obtain FN-RG identity information or part of FN-RG identity information, or obtain FN -SUPI corresponding to RG identity information or part of SUPI corresponding to FN-RG identity information.
  • the first part of information and the second part of information used to determine the SUPI in the SUCI may be obtained by adopting the third way or the fourth way or the fifth way in S902.
  • the second method is similar to the first method, and it can be applied to the situation where the formats adopted by SUCI and SUPI are the same.
  • Method 1 is analogous to that SUCI is generated using NULL Scheme, and no decryption operation is required to obtain SUPI.
  • Method 3 when analyzing SUPI, it can be equivalent to selecting a security protection mechanism (profile) and decrypting it by using the security protection mechanism.
  • Manner 3 Convert the first part information and the second part information of SUCI used to determine SUPI and combine them to obtain FN-RG identity information or part of FN-RG identity information, or to obtain SUPI or SUPI of FN-RG Part.
  • Method 3 can be applied when the formats adopted by SUCI and SUPI are different.
  • the format of SUCI may be the same or different from the format of FN-RG identity information. If the format of the SUCI is the same as the format of the FN-RG identity information, the identity information or part of the identity information of the FN-RG can be directly obtained from the first part of the information and the second part of the information. Then format the identity information or part of the identity information of the FN-RG to obtain the SUPI or part of the SUPI of the FN-RG. Exemplarily, for a case where a part of SUPI is obtained by format conversion, other part of information may be included in SUCI to form SUPI, so that another part of SUPI is obtained from other part of SUCI to form SUPI.
  • the format of SUPI can be the same as the format of FN-RG, then the first part of the information and the second part of the information are formatted to obtain the FN-RG identity information or identity information a part of.
  • the identity information or part of the identity information of FN-RG is regarded as SUPI.
  • the identity information or part of the identity information of FN-RG can be part of SUPI, or the part of identity information of FN-RG. Part of identity information or part of identity information is intercepted as SUPI.
  • the first part of the information and the second part of the information of SUCI can be obtained by using the first way, the second way, or the fifth way in S902, that is, the identity information of the FN-RG can be used directly ( Or a part of the identity information as the first part and the second part of the SUCI, or the identity information (or a part of the identity information) of the FN-RG, which is formatted as the first part and the second part of the SUCI.
  • Method 4 Decrypt the second part of the SUCI information and perform format conversion, and combine the second part of the information after the format conversion and the first part of the information after the format conversion to obtain the FN-RG identity information or part of the FN-RG identity information , Or obtain the SUPI corresponding to the FN-RG identity information or a part of the SUPI corresponding to the FN-RG identity information.
  • Method 1 can be applied to situations where the formats adopted by SUCI and SUPI are different.
  • the format of SUCI may be the same or different from the format of FN-RG identity information.
  • Mode 4 is similar to Mode 3, and can be applied to situations where the formats adopted by SUCI and SUPI are different.
  • the third method is analogous to that SUCI is generated using NULL Scheme, and no decryption operation is required when obtaining SUPI.
  • method four when analyzing SUPI, it can be equivalent to selecting a security protection mechanism (profile) and decrypting it by using the security protection mechanism.
  • UDM After UDM obtains SUPI, it can query the SUPI of FN-RG from the subscription database to determine whether FN-RG is a legal fixed network equipment. For example, if the SUPI of this FN-RG is determined to exist in the subscription database through query, it is determined that the FN-RG is a legal fixed network equipment. Exemplarily, when UDM determines that it is currently serving a fixed network device, it may determine whether to generate AV in a specific way or not.
  • the UDM may determine whether the second service request message belongs to the FN-RG registration process according to the second service request message (or determine whether the UDM currently serves fixed network equipment, such as FN-RG, according to the second service request message). For example, the second service request message is determined to belong to the FN-RG registration process according to the SUPI type in the SUCI, or the second service request message is determined to belong to the FN-RG registration process according to the fixed network authentication result indication, or according to the second service request message The type determines that the second service request message belongs to the FN-RG registration process.
  • the UE's registration to the core network can be used, that is, UDM can generate an authentication vector AV, which can be a set value, and can also be based on FN-RG SUPI or FN-RG identity information Or a part of the identity information generates an authentication vector.
  • UDM can generate an authentication vector AV, which can be a set value, and can also be based on FN-RG SUPI or FN-RG identity information Or a part of the identity information generates an authentication vector.
  • UDM does not need to generate an authentication vector.
  • this method is used as an example to describe the subsequent registration process.
  • S907 UDM sends a second service response message to AUSF.
  • the specific form of the second service response message corresponds to the second service request message of S905.
  • the second service request message in S905 is a Nudm_UEAuthentication_Get Request message
  • the second service response message in S907 is a Nudm_UEAuthentication_Get Response message.
  • the second service request message of S907 is a fixed network-related servicing request message
  • the second service response message of S907 is a corresponding servicing response message.
  • the second service request message is Nudm_FN-RGAuthentication_Get Request
  • the second service response The message can be Nudm_FN-RGAuthentication_GetResponse.
  • the second service response message includes the SUPI generated in S906.
  • the second service response message also carries a second authentication success indication.
  • the second authentication success indication is used to indicate that the UDM further determines that the FN-RG authentication is successful (or further confirms that the FN-RG is a legal access device), which can be understood as the UDM agrees the FN-RG to access the 5G core network.
  • the second authentication success indication may be the same as the first authentication success indication uploaded by the W-AGF, or may be regenerated by UDM. Therefore, the UDM determination method can directly trust the instruction information uploaded by the W-AGF, or further search the subscription database to determine whether the FN-RG is legal.
  • the subscription information of the FN-RG that can access the 5G core network is stored in the UDM database, so that the UDM can search the database according to SUPI and determine that the current FN-RG can access the 5G core network.
  • UDM is combined with the indication of successful fixed network authentication (first authentication success indication), so UDM determines to allow the FN-RG to access the 5G core network. In other words, the FN-RG is successfully authenticated in the 5G core network (or It is said that FN-RG is a legal access device in the 5G core network).
  • the access device is connected to the 5G core network as an example for description, of course, it can also be applied to a future core network system, such as a 6G core network.
  • the AUSF After receiving the second service response message, the AUSF determines according to the second service response message that the authentication process is no longer initiated, and directly executes S908. Specifically, the AUSF determines not to initiate the authentication process according to the SUPI type (that is, skips the authentication process for FN-RG), in other words, the SUPI type in the second service response message indicates that the AUSF skips the authentication process .
  • the SUPI type that is, skips the authentication process for FN-RG
  • the AUSF determines not to initiate the authentication process according to the second authentication success indication (in other words, the second authentication success indication in the second service response message is used to instruct the AUSF to skip the authentication process, or to indicate FN -RG is a legal access device in the 5G core network, so the AUSF considers that there is no need to perform authentication operations), or the AUSF determines not to initiate the authentication process according to the SUPI type and the first authentication success indication, in other words, The SUPI type in the second service response message and the first authentication success indication together instruct the AUSF to skip the authentication process.
  • the second service response message is a service response message related to the fixed network
  • AUSF may determine not to initiate the authentication process according to the message type of the second service response message. In other words, the message type indication of the second service response message The AUSF skips the authentication process.
  • S908 AUSF sends a first service response message to AMF.
  • the specific form of the first service response message corresponds to the first service request message of S904.
  • the first service request message in S904 is the Nausf_UEAuthentication_Authenticate Request message
  • the first service response message in S908 is the Nausf_UEAuthentication_Authenticate Response message.
  • the first service request message of S904 is a fixed network-related servicing request message
  • the first service response message of S908 is a corresponding servicing response message.
  • the first service request message is Nausf_FN-RGAuthentication_Authenticate Request
  • the first service response The message can be Nausf_FN-RGAuthentication_Authenticate Response.
  • the first service response message carries SUPI and may also carry a second authentication success indication.
  • AMF stores SUPI.
  • AMF judges whether the authentication process is not to be performed and/or whether a security activation process is required.
  • the security activation process is the NAS SMC process.
  • AMF judges that the authentication process is not required, and the corresponding AMF judges that the authentication process is not required and/or whether the security activation process is required.
  • the AMF performs the rest of the registration process, which is similar to the existing one, and will not be repeated here.
  • AMF allocates 5G-GUTI to W-AGF. And send a second completion message to W-AGF.
  • the second completion message contains 5G-GUTI.
  • W-AGF When W-AGF generates SUCI in S902, it directly generates SUCI according to the identity information of FN-RG. If this method is adopted, after receiving the second completion message, the W-AGF needs to generate SUPI in the same way as UDM generates SUPI. In S902, W-AGF can generate SUCI according to the identity information of FN-RG first, and then generate SUCI according to SUPI. If this method is adopted, after receiving the second completion message, the W-AGF does not need to generate SUPI again, and directly executes S912.
  • the W-AGF saves the 5G-GUTI, and sends a first completion message to the FN-RG.
  • SUPI is generated in this step.
  • the W-AGF may not need to generate SUPI. However, if it is compatible with the registration mode of the UE, SUPI can be generated.
  • the first completion message includes 5G-GUTI.
  • FIG. 10 is a schematic flowchart of another registration method provided by an embodiment of this application.
  • the UDM generates an authentication vector.
  • the authentication vector is a set value, for example, the authentication vector may be an authentication vector AV of all 0s or all 1s.
  • the UDM determines that the FN-RG is successfully authenticated on the fixed network, it generates an authentication vector AV of the set value.
  • the first method Perform evolution processing on all information of FN-RG identity information or partial information of identity information or SUPI of FN-RG, the value after the evolution processing is used as the long-term key K, and the authentication vector is generated based on the long-term key K .
  • an authentication vector of EAP-AKA' or 5G AKA is used to generate an authentication vector.
  • the second method perform evolution processing on all information of FN-RG identity information or partial information of identity information or SUPI of FN-RG, the value after the evolution processing is taken as Kausf, and then an authentication vector is generated based on Kausf.
  • the authentication vector includes a first expected response XRES*, a first authentication token AUTN, an authentication service key Kausf, and a random number RAND.
  • the first expected response XRES * And the first authentication token AUTN are both preset values, such as 0.
  • the authentication vector includes a second expected response XRES, a second authentication token AUTN, an authentication service key Kausf, and a random number RAND.
  • the second expected response Both XRES and the second authentication token AUTN are preset values, such as 0.
  • the third method perform evolution processing on all information of the identity information of the FN-RG or partial information of the identity information or the SUPI of the FN-RG, the values after the evolution processing are used as CK and IK, and an authentication vector is generated based on CK and IK.
  • the authentication vector includes a first expected response XRES*, a first authentication token AUTN, CK, IK, and a random number RAND.
  • the first expected response XRES* and The first authentication token AUTN is a preset value, such as 0.
  • the authentication vector includes a second expected response XRES, a second authentication token AUTN, CK', IK', and a random number RAND.
  • the second expected response Both XRES and the second authentication token AUTN are preset values, such as 0. CK’ and IK’ are derived based on CK and IK.
  • UDM sends a second service response message to AUSF.
  • the specific form of the second service response message corresponds to the second service request message of S1005.
  • the second service response message includes the SUPI and the authentication vector generated in S1006.
  • the second service response message may also carry a second authentication success indication.
  • the second authentication success indication is used to indicate that the UDM has successfully authenticated the FN-RG (or it is determined that the FN-RG is a legal access device).
  • the second authentication success indication may be the same as the first authentication success indication uploaded by the W-AGF, or may be regenerated by UDM.
  • the AUSF After receiving the second service response message, the AUSF determines according to the second service response message that the authentication process is no longer initiated, and directly executes S1009 and S1010. Specifically, if AUSF determines that the second service response message belongs to the FN-RG registration process according to the SUPI type, it does not initiate the authentication process. Or the AUSF determines that the second service response message belongs to the FN-RG registration process according to the second authentication success indication, and does not initiate the authentication process. Alternatively, when the second service response message is a fixed network-related servicing response message, AUSF may determine that the second service response message belongs to the FN-RG registration process according to the message type of the second service response message, and the authentication process is not initiated. Or, when the authentication vector is the set value, the AUSF may determine that the second service response message belongs to the FN-RG registration process according to the authentication vector of the set value.
  • AUSF obtains Kausf from the authentication vector, and then derives Kseaf based on Kausf.
  • AUSF uses a fixed segment in the authentication vector as Kausf, such as using EAP-AKA' authentication method, and CK' and IK' in the authentication vector can be determined as Kausf; for example, 5G AKA authentication method , CK and IK in the authentication vector can be determined as Kausf.
  • the authentication vector is a set value, such as all 0s or all 1, then all the bits of Kausf are also all 0s or all 1s. At this time, all the bits of Kseaf are also all 0s or all 1s.
  • S1010 AUSF sends a first service response message to SEAF.
  • the first service response message includes Kseaf and SUPI.
  • the first service response message may also include a second authentication success indication.
  • the authentication vector is a set value, such as all 0 or all 1
  • all the bits of Kamf can be the same as Kseaf.
  • SEAF and AMF are different devices, SEAF passes Kamf to AMF.
  • the SEAF sends Kamf to the AMF after judging that the FN-RG authentication is successful.
  • SEAF can judge whether FN-RG is a legal access device according to the second authentication success indication, or judge whether FN-RG is a legal access device according to the Kseaf special value.
  • SEAF After SEAF receives the first authentication success indication in S1004, it saves the first authentication success indication, then SEAF generates Kamf according to Kseaf, and after judging that the authentication is successful according to the saved first authentication success indication, it passes Kamf to AMF.
  • the method for AMF to determine to skip the NAS SMC activation process can refer to step S909.
  • AMF can also be based on the set value of Kseaf (for example, all bits are 0 or all bits are 1) or set value
  • Kseaf for example, all bits are 0 or all bits are 1
  • the authentication vector judgment skips the NAS SMC activation process. Perform S1012-S1014.
  • the AMF when the authentication vector is generated based on the identity information of the FN-RG or the SUPI of the FN-RG, the AMF can be executed according to the authentication procedure of the UE, that is, the AMF does not skip the NAS SMC activation procedure .
  • AMF will further use Kamf to generate NAS encryption key Knasenc and NAS integrity protection key Knasint.
  • S601-S605 For the specific NAS SMC activation process, please refer to S601-S605, which will not be repeated here. Perform S1012-S1014 again.
  • an embodiment of the application also provides a communication device for executing the secure access gateway (such as W-AGF) described in the method embodiment shown in FIG. 9 to FIG. 10
  • the apparatus includes a receiving unit 1101, a processing unit 1102, and a sending unit 1103.
  • the receiving unit 1101 is configured to receive a first request message sent by an access device, where the first request message carries original identity information of the access device, and the access device does not have non-access stratum NAS capability,
  • the secure access gateway has NAS capabilities;
  • the processing unit 1102 is configured to, after receiving the first request cancellation, initiate a registration process for the access device to the core network, and generate hidden information for the access device according to the identity information of the access device Identity identification, the identity information of the access device includes only the original identity information, or the identity information of the access device includes the original identity information and device-related information, and the device-related information includes the access device One or more of the operator information, the access time information of the access device, and the location information of the access device;
  • the sending unit 1103 is configured to send a second request message to the first core network element of the core network, where the second request message is used to request registration of the access device to the core network, and the second request message Carry the hidden identity identifier.
  • the hidden identity includes at least a first part of information and a second part of information used to determine the permanent identity of the access device; the first part of information and the second part of information are determined by The identity information of the access device is determined.
  • the first part of information may be home network identifier, and the second part of information may be scheme out.
  • the first part of information and the second part of information are determined by the identity information of the access device, including:
  • the first part of information is the first part of the identity information of the access device
  • the second part of information is the second part of the identity information of the access device
  • the first part and the second part are in the
  • the identity information of the access device does not overlap, or, the first part of the information is information after the first part of the identity information of the access device is converted, and the second part of the information includes the access device
  • the second part of the identity information in the identity information after the format conversion, or the first part of the information includes the first part in the identity information of the access device, and the second part of the information is based on the access
  • the second part of the information in the identity information of the access device is obtained by encrypting, or the first part of the information is the information after the format conversion of the first part in the identity information of the access device, and the second part
  • the information is obtained by re-encrypting the information after format conversion of the second part of the identity information of the access device.
  • the first part of the identity information of the access device is: the device-related information or a part of the device-related information in the identity information of the access device.
  • the hidden identity also includes type information of the permanent identity, and the type information of the permanent identity indicates that the permanent identity is the identity of the access device.
  • the hidden identity identifier includes at least a first part of information and a second part of information used to determine the permanent identity of the access device;
  • the first part of information is the type of the permanent identity, and the second part of information is determined based on the identity information of the access device.
  • the hidden identity identifier further includes a routing indicator, and the routing indicator is used to determine the core network element that decrypts the hidden identity identifier.
  • the routing indicator is obtained from the configuration information of the secure access gateway according to the information of the operator registered by the access device.
  • the hidden identity identifier further includes a public key identifier, and the public key identified by the public key identifier is used to encrypt part or all of the identity information of the access device
  • the public key identifier is obtained from the configuration information of the secure access gateway according to the information of the operator registered by the access device.
  • the second request message also carries a first authentication success indication, and the first authentication success indication is used to instruct the secure access gateway to determine that the access device is legal Access equipment.
  • the embodiment of the present application also provides a communication device applied to the second core network element, and is used to perform the first method described in the method embodiment shown in FIG. 9 to FIG.
  • the device includes a receiving unit 1201, a processing unit 1202, and a sending unit 1203.
  • the receiving unit 1201 is configured to receive a service request message sent by a third core network element, where the service request message includes a hidden identity from the secure access gateway, the hidden identity indicating the identity information of the access device, and The access device does not have NAS capability, and the secure access gateway has NAS capability.
  • the processing unit 1202 is configured to generate a permanent identity of the access device according to the hidden identity; the second core network element determines that the access device is a legal access device according to the permanent identity At this time, a service response message is sent to the third core network element, where the service response message includes indication information for instructing the third core network element to skip the authentication process for the access device.
  • the hidden identity includes at least a first part of information and a second part of information used to generate a permanent identity of the access device, and the first part of information and the second part of information are Is determined by the identity information of the access device; the processing unit 1202, when generating the permanent identity of the access device according to the hidden identity, is specifically configured to perform according to the second of the hidden identity Part of the information and the second part of the information generate a permanent identity of the access device.
  • the permanent identity includes information obtained by combining the first part of information and the second part of information; or,
  • the permanent identification includes information obtained after format conversion and combination of the first part of information and the second part of information; or,
  • the permanent identification includes information obtained by decoding the second part of information and combining the decrypted second part of information with the first part of information; or,
  • the permanent identification includes information obtained by performing format conversion on the second part of information after decoding, and performing format conversion on the first part of information, and combining the first part of information after format conversion and the second part of information.
  • the hidden identity also includes the type of the permanent identity
  • the permanent identity also includes the type of the permanent identity
  • the first part of information is used to indicate the information of the operator registered by the access device
  • the second part of information is used to indicate the identity of the access device
  • the hidden identity includes at least a first part of information and a second part of information used to generate a permanent identity of the access device, and the first part of information is a type of the permanent identity , The second part of information is determined by the identity information of the access device;
  • the processing unit 1202 when generating the permanent identity of the access device according to the identity information of the access device indicated by the hidden identity, is specifically configured to:
  • the second core network element combines the first part of information and the information obtained by parsing the second part of information to obtain the permanent identity of the access device.
  • the service request message further includes a first authentication success indication, and the first authentication success indication is used to instruct the secure access gateway to determine that the access device is a legitimate access device ;
  • the processing unit 1202 is further configured to, before the sending unit 1203 sends a service response message to the third core network element, determine according to the first authentication success indication that the secure access gateway has determined the The access device is a legal access device.
  • the service response message includes the permanent identity of the access device, the permanent identity includes the indication information, and the indication information is the type of the permanent identity.
  • the indication information is a second authentication success indication
  • the second authentication success indication is used to indicate that the access device is a legal access device in the core network.
  • the service response further includes an authentication vector, and the authentication vector is a set value.
  • the authentication vector of the set value is used as the indication information to instruct the third core network element to skip the authentication process for the access device.
  • the processing unit 1202 when the processing unit 1202 determines that the access device is a legitimate access device according to the permanent identity, it generates an authentication vector, where the authentication vector includes the first expected response XRES *, the first authentication token AUTN, the authentication service key Kausf and the random number RAND, the first expected response XRES* and the first authentication token AUTN are all set values; wherein, the Kausf is based on the access Part or all of the identity information entered into the device is determined; or, the Kausf is determined according to the long-term identity; or, the Kausf is determined according to the first encryption key CK and the first integrity key IK , The first encryption key CK and the first integrity key IK are both determined based on part or all of the identity information of the access device, or the first encryption key CK and the The first integrity key IK is determined according to the long-term identity of the access device.
  • the processing unit 1202 determines that the access device is a legitimate access device according to the permanent identity, it is specifically configured to generate an authentication vector according to the long-term key K. K is determined according to the long-term identity of the access device, or the long-term key K is determined according to part or all of the identity information of the access device.
  • the authentication vector includes a second expected response XRES, a second authentication token AUTN, a second encryption key CK', a second integrity key IK', and a random number RAND;
  • the second encryption key CK' and the second integrity key IK' are determined according to the first encryption key CK and the first integrity key IK;
  • the first encryption key CK and the first integrity key IK are both determined according to part or all of the identity information of the access device, or the first encryption key CK and the first An integrity key IK is determined according to the long-term identity of the access device, and the second expected response XRES and the second authentication token AUTN are both set values.
  • the embodiment of the application also provides a communication device, which is applied to the network element of the first core network, and is used to perform the method described in the method embodiment shown in FIG. 9 to FIG. A method executed by a core network element (AMF/SEAF).
  • AMF/SEAF a core network element
  • the device includes a receiving unit 1301, a processing unit 1302, and a sending unit 1303.
  • the sending unit 1303 sends a service request message to the third core network element, where the service request message carries the hidden identity of the access device, so The access device does not have NAS capabilities, and the secure access gateway has NAS capabilities; the receiving unit 1301 receives a service response message sent by the third core network element, and the service response message carries the access device
  • the permanent identity corresponding to the hidden identity, the service response message includes indication information for instructing the first core network element to skip the authentication process for the access device; the processing unit 1302 is based on The permanent identity identifier allocates a globally unique temporary identifier GUTI to the access device.
  • the permanent identification carried in the service response message includes the indication information, and the indication information is a type of permanent identification used to instruct the third core network element to skip the registration
  • the authentication process of the access device is described.
  • the message type of the service response message instructs the third core network element to skip the authentication process for the access device.
  • the service request message also carries a first authentication success indication, and the first authentication success indication is used to instruct the secure access device to determine that the access device is a legitimate access device;
  • the first authentication success indication and the type of the permanent identity together indicate that the third core network element skips the authentication process for the access device.
  • the service response message also carries a second authentication success indication, and the second authentication indication is used to indicate that the access device is a legal access device in the core network.
  • the embodiments of the present application also provide a communication device, which is applied to a third core network element, and is used to perform the first method described in the method embodiments shown in FIGS. 9-10.
  • the device includes a receiving unit 1401, a processing unit 1402, and a sending unit 1403.
  • the sending unit 1403 sends a service request message to the second core network element, where the service request message carries the hidden identity of the access device, so The access device does not have NAS capability, and the secure access gateway has NAS capability; the receiving unit 1401 receives a service response message sent by the second core network element, and the service response message carries the access device
  • the permanent identity corresponding to the hidden identity of, the service response message includes indication information for instructing the third core network element to skip the authentication process for the access device.
  • the processing unit 1402 determines to skip the authentication process for the access device according to the instruction information, thereby directly skipping the authentication process, saving resources and improving efficiency.
  • the permanent identification carried in the service response message includes the indication information, and the indication information is a type of permanent identification used to instruct the third core network element to skip the registration
  • the authentication process of the access device is described.
  • the message type of the service response message instructs the third core network element to skip the authentication process for the access device.
  • the service request message also carries a first authentication success indication, and the first authentication success indication is used to instruct the secure access device to determine that the access device is a legitimate access device;
  • the first authentication success indication and the type of the permanent identity together indicate that the third core network element skips the authentication process for the access device.
  • the service response message also carries a second authentication success indication, and the second authentication indication is used to indicate that the access device is a legitimate access device authentication in the core network. success.
  • the division of units in the embodiments of this application is illustrative, and is only a logical function division. In actual implementation, there may be other division methods.
  • the functional units in the various embodiments of this application can be integrated into one process. In the device, it can also exist alone physically, or two or more units can be integrated into a module.
  • the above-mentioned integrated unit can be realized in the form of hardware or software function module.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including a number of instructions to enable a terminal device (which may be a personal computer, a mobile phone, or a network device, etc.) or a processor to execute all or part of the steps of the method in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .
  • the secure access network element, the first core network network element, the second core network network element, and the third core network network element may all be presented in the form of dividing various functional modules in an integrated manner.
  • the "module” here can refer to a specific ASIC, circuit, processor and memory that executes one or more software or firmware programs, integrated logic circuit, and/or other devices that can provide the above-mentioned functions.
  • the communication device 1500 as shown in FIG. 15 includes at least one processor 1501, memory 1502, and optionally, a communication interface 1503.
  • the memory 1502 may be a volatile memory, such as a random access memory; the memory may also be a nonvolatile memory, such as a read-only memory, flash memory, hard disk drive (HDD) or solid-state drive (solid-state drive, SSD) or the memory 1502 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the memory 1502 may be a combination of the above-mentioned memories.
  • connection medium between the processor 1501 and the memory 1502 described above is not limited in the embodiment of the present application.
  • the memory 1502 and the processor 1501 are connected by a bus 1504 in the figure, and the bus 1504 is represented by a thick line in the figure.
  • the connection mode between other components is only for schematic description and is not cited Is limited.
  • the bus 1504 can be divided into address bus, data bus, control bus and so on. For ease of presentation, only a thick line is used in FIG. 15, but it does not mean that there is only one bus or one type of bus.
  • the processor 1501 may have a function of data transceiving and can communicate with other devices.
  • an independent data transceiving module such as a communication interface 1503, can be set to send and receive data; the processor 1501 is communicating with other devices. During communication, data transmission can be performed through the communication interface 1503.
  • the processor 1501 in FIG. 15 can execute instructions by calling a computer stored in the memory 1502, so that the secure access gateway can execute the foregoing The method performed by the W-AGF in any method embodiment.
  • the functions/implementation processes of the sending unit, the receiving unit, and the processing unit in FIG. 11 may all be implemented by the processor 1501 in FIG. 15 calling a computer execution instruction stored in the memory 1502.
  • the function/implementation process of the processing unit in FIG. 11 may be implemented by the processor 1501 in FIG. 15 calling computer execution instructions stored in the memory 1502, and the function/implementation process of the sending unit and the receiving unit in FIG. 15 in the communication interface 1503 to achieve.
  • the processor 1501 in FIG. 15 may invoke the computer execution instruction stored in the memory 1502 to make the second core network
  • the network element may execute the method executed by the UDM or ARPF or SIDF in any of the foregoing method embodiments.
  • the functions/implementation processes of the sending unit, the receiving unit, and the processing unit in FIG. 12 may all be implemented by the processor 1501 in FIG. 15 calling a computer execution instruction stored in the memory 1502.
  • the function/implementation process of the processing unit in FIG. 12 may be implemented by the processor 1501 in FIG. 15 calling computer execution instructions stored in the memory 1502, and the function/implementation process of the sending unit and the receiving unit in FIG. 15 in the communication interface 1503 to achieve.
  • the processor 1501 in FIG. 15 may invoke the computer execution instruction stored in the memory 1502 to make the first core network
  • the network element may execute the method executed by the AMF or SEAF in any of the foregoing method embodiments.
  • the functions/implementation processes of the sending unit, the receiving unit, and the processing unit in FIG. 13 can all be implemented by the processor 1501 in FIG. 15 calling a computer execution instruction stored in the memory 1502.
  • the function/implementation process of the processing unit in FIG. 13 may be implemented by the processor 1501 in FIG. 15 calling computer execution instructions stored in the memory 1502, and the function/implementation process of the sending unit and the receiving unit in FIG. 15 in the communication interface 1503 to achieve.
  • the processor 1501 in FIG. 15 may invoke the computer execution instruction stored in the memory 1502 to make the third core network
  • the network element may execute the method executed by the AMF or SEAF in any of the foregoing method embodiments.
  • the functions/implementation processes of the sending unit, the receiving unit, and the processing unit in FIG. 14 may all be implemented by the processor 1501 in FIG. 15 calling a computer execution instruction stored in the memory 1502.
  • the function/implementation process of the processing unit in FIG. 14 may be implemented by the processor 1501 in FIG. 15 calling computer execution instructions stored in the memory 1502, and the function/implementation process of the sending unit and the receiving unit in FIG. 15 in the communication interface 1503 to achieve.
  • the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种注册方法及通信装置，提供一种不具备NAS能力的接入设备注册核心网的方式。方法包括：安全接入网关接收接入设备发送的接入设备的原始身份信息，接入设备不具备非接入层NAS能力，安全接入网关具备NAS能力；安全接入网关根据接入设备的身份信息为接入设备生成隐藏身份标识，接入设备的身份信息仅包括原始身份信息，或者接入设备的身份信息包括原始身份信息和设备相关信息，设备相关信息包括接入设备的运营商信息、接入设备的接入时间信息和接入设备的位置信息中一项或者多项；安全接入网关向核心网的第一核心网网元发送第二请求消息，第二请求消息用于请求将接入设备注册到核心网，第二请求消息携带隐藏身份标识。

Description

一种注册方法及通信装置
相关申请的交叉引用
本申请要求在2019年04月29日提交中国专利局、申请号为201910353248.9、申请名称为“一种注册方法及通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种注册方法及通信装置。
背景技术
对于不具备非接入层(non-access stratum，NAS)能力的接入设备来说，如何接入移动网的核心网侧，目前没有标准化的注册方式。
发明内容
本申请实施例提供一种注册方法及通信装置，提供一种不具备NAS能力的接入设备注册到核心网的方式。
本申请实施例提供的具体技术方案如下：
第一方面，本申请实施例提供一种注册方法，包括：安全接入网关接收接入设备发送的第一请求消息，所述安全接入网关在接收到所述第一请求消后，向核心网发起对所述接入设备的注册流程，所述第一请求消息携带所述接入设备的原始身份信息，所述接入设备不具备非接入层NAS能力，所述安全接入网关具备NAS能力；所述安全接入网关根据所述接入设备的身份信息为所述接入设备生成隐藏身份标识，所述接入设备的身份信息仅包括所述原始身份信息，或者所述接入设备的身份信息包括所述原始身份信息和设备相关信息，所述设备相关信息包括所述接入设备的运营商信息、接入设备的接入时间信息和接入设备的位置信息中一项或者多项；所述安全接入网关向核心网的第一核心网网元发送第二请求消息，所述第二请求消息用于请求将所述接入设备注册到核心网，所述第二请求消息携带所述隐藏身份标识。
该方法，由安全接入网关代替不具备NAS能力的接入设备触发注册流程，代替接入设备为接入设备生成隐藏身份标识，进而基于隐藏身份标识向核心网发起对接入设备的注册流程。
在一种可能的设计中，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定。
示例性地，第一部分信息可以是home network identifier，第二部分信息可以是scheme out。
由接入设备的原始身份信息，或者原始身份信息加上设备相关信息构成接入设备的身份信息，将身份信息拆成至少两部分，第一部分和第二部分用来构成home network identifier 和scheme out。
在一种可能的设计中，所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定，包括：
所述第一部分信息为所述接入设备的身份信息中的第一部分，所述第二部分信息为所述接入设备的身份信息中的第二部分，且第一部分和第二部分在所述接入设备的身份信息中不重叠，或者，
所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息包括所述接入设备的身份信息中的所述第二部分格式转换后的信息，或者，
所述第一部分信息包括所述接入设备的身份信息中的所述第一部分，所述第二部分信息为根据所述接入设备的身份信息中的所述第二部分信息加密得到的，或者，
所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息是对所述接入设备的身份信息中的所述第二部分格式转换后的信息再加密得到的。
在一种可能的设计中，所述接入设备的身份信息中的第一部分为：所述接入设备的身份信息中所述设备相关信息或者所述设备相关信息的一部分。
上述设计，由将设备相关信息或者设备相关信息的一部分作为home network identifier，不需要进行加密直接发到UDM。运算相对简单，节省资源，提高效率。
在一种可能的设计中，所述隐藏身份标识还包括所述永久身份标识的类型信息，所述永久身份标识的类型信息指示所述永久身份标识为接入设备的身份标识。
本申请实施例中提及的SUPI type，能够与UE注册流程中的SUPI type区分开，复用UE的SUCI，能够更改现有标准中SUCI结构的前提下，实现对接入设备的注册。
在一种可能的设计中，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；
所述第一部分信息为所述永久身份标识的类型，所述第二部分信息基于所述接入设备的身份信息确定。
在一种可能的设计中，所述隐藏身份标识中还包括路由指示符，所述路由指示符用于确定解密所述隐藏身份标识的核心网网元。
复用UE流程中SUCI结构中的路由指示符，无需更改现有SUCI的结构，相对简单有效。
在一种可能的设计中，所述路由指示符为根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
在安全接入网关配置路由指示符，为确定用于解密所述隐藏身份标识的核心网网元提供便利，简单有效。
在一种可能的设计中，所述隐藏身份标识还包括公钥标识符，所述公钥标识符所标识的公钥用于对所述接入设备的身份信息中的部分或者全部信息进行加密；所述公钥标识符是根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
在一种可能的设计中，所述第二请求消息中还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示所述安全接入网关确定所述接入设备为合法的接入设备。
将指示所述安全接入网关对所述接入设备进行鉴权成功的第一鉴权成功指示发到核 心网，以便于核心网确定该接入设备为一个安全设备后，为进一步指示核心网网元减少鉴权流程做准备。
第二方面，本申请实施例提供一种注册方法，包括：第二核心网网元接收第三核心网网元发送的服务请求消息，所述服务请求消息包括来自安全接入网关的隐藏身份标识，所述隐藏身份标识指示接入设备的身份信息，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；所述第二核心网网元根据所述隐藏身份标识生成所述接入设备的永久身份标识；所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，向所述第三核心网网元发送服务响应消息，所述服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。
上述方法，第二核心网网元在确定对接入设备鉴权成功时，指示其它核心网网元跳过鉴权流程，能够节省资源，提高效率。
在一种可能的设计中，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息和所述第二部分信息是由所述接入设备的身份信息确定的；所述第二核心网网元根据所述隐藏身份标识生成所述接入设备的永久身份标识，包括：所述第二核心网网元根据所述隐藏身份标识的所述第一部分信息和所述第二部分信息生成所述接入设备的永久身份标识。
在一种可能的设计中，所述永久身份标识包括所述第一部分信息和第二部分信息组合后的信息；或者，
所述永久身份标识包括对所述第一部分信息和所述第二部分信息进行格式转换并组合后的信息；或者，
所述永久身份标识包括对所述第二部分信息进行解码并将解密后的第二部分信息与所述第一部分信息组合后的信息；或者，
所述永久身份标识包括对所述第二部分信息进行解码后进行格式转换，以及对所述第一部分信息进行格式转换，将格式转换后的第一部分信息和第二部分信息组合后的信息。
上述设计提供几种简单有效的从SUCI中获取SUPI的方式。
在一种可能的设计中，所述隐藏身份标识还包括所述永久身份标识的类型，则所述永久身份标识还包括所述永久身份标识的类型。
在一种可能的设计中，所述第一部分信息用于指示所述接入设备所注册的运营商的信息，所述第二部分信息用于指示所述接入设备的身份。
在一种可能的设计中，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息为所述永久身份标识的类型，所述第二部分信息是由所述接入设备的身份信息确定的；
所述第二核心网网元根据所述隐藏身份标识指示的所述接入设备的身份信息生成所述接入设备的永久身份标识，包括：
所述第二核心网网元将所述第一部分信息以及从所述第二部分信息解析得到的信息组合得到所述接入设备的永久身份标识。
在一种可能的设计中，所述服务请求消息中还包括第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入网关确定所述接入设备为合法的接入设备；
在向所述第三核心网网元发送服务响应消息之前，还包括：
所述第二核心网网元根据所述第一鉴权成功指示确定所述安全接入网关已确定所述 接入设备为合法的接入设备。
上述设计，通过第一鉴权成功指示来确定接入设备在固网已经合法时，再向核心网其它网元指示跳过鉴权流程，提高网络安全性。
在一种可能的设计中，所述服务响应消息中包括所述接入设备的永久身份标识，所述永久身份标识包括所述指示信息，所述指示信息为所述永久身份标识的类型。
上述设计中永久身份标识的类型(比如，SUPI type)区别与现有协议中的SUPI type，当接收到SUPI后，则确定接入设备安全，即跳过接入设备的鉴权流程，无需增加其他信息，节省资源。
在一种可能的设计中，所述指示信息为第二鉴权成功指示，所述第二鉴权成功指示用于指示所述接入设备在核心网为合法的接入设备。
上述设计，通过生成一个第二鉴权成功指示来指示接入设备在核心网鉴权成功，从而进一步跳过接入设备的鉴权流程，直接有效。
在一种可能的设计中，所述服务响应中还包括鉴权向量，所述鉴权向量为设定值。
上述设计，通过设置特殊值的鉴权向量，从而能够复用UE的注册流程。无需更改框架，节省资源。
在一种可能的设计中，所述设定值的鉴权向量作为所述指示信息用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
通过设定值的鉴权向量来指示跳过接入设备的鉴权流程，简单有效，并且无需增加其他信息，进一步节省资源。
在一种可能的设计中，所述方法还包括：
所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，生成鉴权向量，所述鉴权向量包括第一期望响应XRES*、第一认证令牌AUTN、认证服务秘钥Kausf和随机数RAND，所述第一期望响应XRES*和第一认证令牌AUTN均为设定值；
其中，所述Kausf是根据所述接入设备的身份信息的部分或者全部信息确定的；或者，
所述Kausf是根据所述长久身份标识确定的；或者，
所述Kausf是根据第一加密秘钥CK、第一完整性秘钥IK确定的，所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的。
上述设计提供一种生成鉴权向量的有效方式来复用现有的注册流程。
在一种可能的设计中，还包括：
所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，所述第二核心网网元根据长期密钥K生成鉴权向量，所述长期密钥K是根据所述接入设备的长久身份标识确定的，或者所述长期密钥K是根据所述接入设备的身份信息的部分或者全部信息确定的。
上述设计提供一种生成鉴权向量的有效方式来复用现有的注册流程。
在一种可能的设计中，所述鉴权向量包括第二期望响应XRES、第二认证令牌AUTN、第二加密秘钥CK’、第二完整性秘钥IK’和随机数RAND；
所述第二加密秘钥CK’和第二完整性秘钥IK’是根据第一加密秘钥CK和第一完整性 秘钥IK确定的；
所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的，所述第二期望响应XRES和第二认证令牌AUTN均为设定值。
上述设计提供一种生成鉴权向量的有效方式来复用现有的注册流程。
第三方面，本申请实施例提供一种注册方法，包括：
在安全接入设备向核心网触发对接入设备的注册流程时，第一核心网网元向第三核心网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；所述第一核心网网元接收所述第三核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示所述第一核心网网元跳过对所述接入设备的鉴权流程的指示信息；所述第一核心网网元根据所述永久身份标识为所述接入设备分配全球唯一临时标识GUTI。
在一种可能的设计中，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指示用于指示所述接入设备在所述核心网为合法的接入设备。
第四方面，本申请实施例提供一种注册方法，包括：
在安全接入设备向核心网触发对接入设备的注册流程时，第三核心网网元向第二核心网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；所述第三核心网网元接收所述第二核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。所述第三核心网网网元根据所述指示信息确定跳过对所述接入设备的鉴权流程，从而直接跳过鉴权流程，节省资源，提高效率。
在一种可能的设计中，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指示用于指示所述接入设备在所述核心网为合法的接入设备鉴权成功。
第五方面，本申请实施例还提供了一种通信装置，所述通信装置应用于安全接入网关，有益效果可以参见第一方面的描述此处不再赘述。该装置具有实现上述第一方面的方法实例中安全接入网关的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。在一个可能的设计中，所述装置的结构中包括接收单元、处理单元和发送单元，这些单元可以执行上述第一方面方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第六方面，本申请实施例还提供了一种通信装置，所述通信装置应用于第二核心网网元，有益效果可以参见第二方面的描述此处不再赘述。该装置具有实现上述第二方面的方法实例中行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。在一个可能的设计中，所述装置的结构中包括接收单元、处理单元和发送单元，这些单元可以执行上述第二方面方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第七方面，本申请实施例还提供了一种通信装置，所述通信装置应用于第一核心网网元，有益效果可以参见第三方面的描述此处不再赘述。该装置具有实现上述第三方面的方法实例中第一核心网网元的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。在一个可能的设计中，所述装置的结构中包括接收单元、处理单元和发送单元，这些单元可以执行上述第三方面方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第八方面，本申请实施例还提供了一种通信装置，所述通信装置应用于第三核心网网元，有益效果可以参见第四方面的描述此处不再赘述。该装置具有实现上述第四方面的方法实例中行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。在一个可能的设计中，所述装置的结构中包括接收单元、处理单元和发送单元，这些单元可以执行上述第四方面方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第九方面，本申请实施例还提供了一种通信装置，所述通信装置应用于安全接入网关，有益效果可以参见第一方面的描述此处不再赘述。所述通信装置的结构中包括处理器和存储器，所述处理器被配置为支持所述安全接入网关执行上述第一方面方法中相应的功能。所述存储器与所述处理器耦合，其保存所述通信装置必要的程序指令和数据。所述通信装置的结构中还包括通信接口，用于与其他设备进行通信。
第十方面，本申请实施例还提供了一种通信装置，所述通信装置应用于第二核心网网元，有益效果可以参见第二方面的描述此处不再赘述。所述通信装置的结构中包括处理器和存储器，所述处理器被配置为支持所述第二核心网网元执行上述第二方面方法中相应的功能。所述存储器与所述处理器耦合，其保存所述通信装置必要的程序指令和数据。所述通信装置的结构中还包括收发机，用于与其他设备进行通信。
第十一方面，本申请实施例还提供了一种通信装置，所述通信装置应用于第一核心网网元，有益效果可以参见第三方面的描述此处不再赘述。所述通信装置的结构中包括处理 器和存储器，所述处理器被配置为支持所述第一核心网网元执行上述第三方面方法中相应的功能。所述存储器与所述处理器耦合，其保存所述通信装置必要的程序指令和数据。所述通信装置的结构中还包括通信接口，用于与其他设备进行通信。
第十二方面，本申请实施例还提供了一种通信装置，所述通信装置应用于第三核心网网元，有益效果可以参见第四方面的描述此处不再赘述。所述通信装置的结构中包括处理器和存储器，所述处理器被配置为支持所述第一核心网网元执行上述第四方面方法中相应的功能。所述存储器与所述处理器耦合，其保存所述通信装置必要的程序指令和数据。所述通信装置的结构中还包括收发机，用于与其他设备进行通信。
第十三方面，本申请实施例提供一种通信***，有益效果可以参见第一方面和第二方面、第三方面和第四方面的描述此处不再赘述，包括安全接入网关、第一核心网网元、第二核心网网元以及第三核心网网元；
安全接入网关，用于接收接入设备发送的第一请求消息，在接收到所述第一请求消息后，向核心网发起对所述接入设备的注册流程，根据所述接入设备的身份信息为所述接入设备生成隐藏身份标识，并向核心网的第一核心网网元发送第二请求消息；
其中，所述第一请求消息携带所述接入设备的原始身份信息，所述接入设备不具备非接入层NAS能力，所述安全接入网关具备NAS能力；所述接入设备的身份信息仅包括所述原始身份信息，或者所述接入设备的身份信息包括所述原始身份信息和设备相关信息，所述设备相关信息包括所述接入设备的运营商信息、接入设备的接入时间信息和接入设备的位置信息中一项或者多项；所述第二请求消息携带所述隐藏身份标识；
所述第一核心网网元，用于在接收到所述第二请求消息后，向所述第三核心网网元发送第一服务请求消息，所述第一服务请求消息携带所述隐藏身份标识；
所述第三核心网网元，用于在接收到所述第一服务请求消息后，向所述第二核心网网元发送第二服务请求消息，所述第二服务请求消息中携带所述隐藏身份标识；
所述第二核心网网元，用于在接收到所述第二服务请求消息后，根据所述隐藏身份标识指示的所述接入设备的身份信息生成所述接入设备的永久身份标识，在根据所述永久身份标识确定所述接入设备为合法的接入设备时，向第三核心网网元发送第二服务响应消息，所述第二服务响应消息包括指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息；
所述第三核心网网元，还用于在接收所述第二服务响应消息后，向所述第一核心网网元发送第一服务响应消息，所述第一服务响应消息包括所述指示信息；
所述第一核心网网元，还用于在接收到所述第一服务响应消息后，根据所述永久身份标识为所述接入设备分配全球唯一临时标识GUTI。
在一种可能的设计中，关于隐藏身份标识的相关描述参见第一方面中描述，此处不再赘述。
在一种可能的设计中，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息和所述第二部分信息是由所述接入设备的身份信息确定的；所述第二核心网网元在根据所述隐藏身份标识生成所述接入设备的永久身份标识时，具体用于根据所述隐藏身份标识的所述第一部分信息和所述第二部分信息生成所述接入设备的永久身份标识。
在一种可能的设计中，所述永久身份标识包括所述第一部分信息和第二部分信息组合 后的信息；或者，
所述永久身份标识包括对所述第一部分信息和所述第二部分信息进行格式转换并组合后的信息；或者，
所述永久身份标识包括对所述第二部分信息进行解码并将解密后的第二部分信息与所述第一部分信息组合后的信息；或者，
所述永久身份标识包括对所述第二部分信息进行解码后进行格式转换，以及对所述第一部分信息进行格式转换，将格式转换后的第一部分信息和第二部分信息组合后的信息。
在一种可能的设计中，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息为所述永久身份标识的类型，所述第二部分信息是由所述接入设备的身份信息确定的；
所述第二核心网网元在根据所述隐藏身份标识生成所述接入设备的永久身份标识时，具体用于：将所述第一部分信息以及从所述第二部分信息解析得到的信息组合得到所述接入设备的永久身份标识。
在一种可能的设计中，所述第一服务请求消息和第二服务请求消息中还包括第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入网关确定所述接入设备为合法的接入设备；
所述第二核心网网元在向所述第三核心网网元发送第二服务响应消息之前，还用于根据所述第一鉴权成功指示确定所述安全接入网关已确定所述接入设备为合法的接入设备。
在一种可能的设计中，所述第一服务响应消息和第二服务响应消息中包括所述接入设备的永久身份标识，所述永久身份标识包括所述指示信息，所述指示信息为所述永久身份标识的类型。
在一种可能的设计中，所述指示信息为第二鉴权成功指示，所述第二鉴权成功指示用于指示所述接入设备在核心网为合法的接入设备。
在一种可能的设计中，所述第二服务响应消息中还包括鉴权向量，所述鉴权向量为设定值。
在一种可能的设计中，所述设定值的鉴权向量作为所述指示信息用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，还用于生成鉴权向量，所述鉴权向量包括第一期望响应XRES*、第一认证令牌AUTN、认证服务秘钥Kausf和随机数RAND，所述第一期望响应XRES*和第一认证令牌AUTN均为设定值；其中，所述Kausf是根据所述接入设备的身份信息的部分或者全部信息确定的；或者，所述Kausf是根据所述长久身份标识确定的；或者，所述Kausf是根据第一加密秘钥CK、第一完整性秘钥IK确定的，所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的。
在一种可能的设计中，所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，所述第二核心网网元根据长期密钥K生成鉴权向量，所述长期密钥K是根据所述接入设备的长久身份标识确定的，或者所述长期密钥K是根据所述接入设备的身份信息的部分或者全部信息确定的。
在一种可能的设计中，所述鉴权向量包括第二期望响应XRES、第二认证令牌AUTN、第二加密秘钥CK’、第二完整性秘钥IK’和随机数RAND；所述第二加密秘钥CK’和第二完整性秘钥IK’是根据第一加密秘钥CK和第一完整性秘钥IK确定的；所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的，所述第二期望响应XRES和第二认证令牌AUTN均为设定值。
第十四方面，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第十五方面，本申请还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第十六方面，本申请还提供一种计算机芯片，所述芯片与存储器相连，所述芯片用于读取并执行所述存储器中存储的软件程序，执行上述各方面所述的方法。
附图说明
图1为本申请实施例中5G网络***架构示意图；
图2A为本申请实施例中UE注册流程示意图；
图2B为本申请实施例中一种SUCI结构示意图；
图2C为本申请实施例中另一种SUCI示意图；
图3为本申请实施例中一种鉴权方法流程示意图；
图4为本申请实施例中一种AV生成方法示意图；
图5为本申请实施例中另一种鉴权方法流程示意图；
图6为本申请实施例中NAS SMC流程示意图；
图7为本申请实施例中一种通信***结构示意图；
图8为本申请实施例中另一种通信***结构示意图；
图9为本申请实施例中一种注册方法流程示意图；
图10为本申请实施例中另一种注册方法流程示意图；
图11-图15为本申请实施例中通信装置示意图。
具体实施方式
应理解，说明书通篇中提到的“一个实施例”、“一个实现方式”、“一个实施方式”或“一示例”意味着与实施例有关的特定特征、结构或特性包括在本申请的至少一个实施例中。因此，在整个说明书各处出现的“在一个实施例中”、“一个实现方式”、“一个实施方式”或“在一示例中”未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中。应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
另外，本文中术语“***”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示 前后关联对象是一种“或”的关系。本申请涉及的术语“至少一个”，是指一个，或一个以上，即包括一个、两个、三个及以上；“多个”，是指两个，或两个以上，即包括两个、三个及以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。应理解，在本申请实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。以及，除非有相反的说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。此外，本申请实施例和权利要求书及附图中的术语“包括”和“具有”不是排他的。例如，包括了一系列步骤或模块的过程、方法、***、产品或设备没有限定于已列出的步骤或模块，还可以包括没有列出的步骤或模块。
在介绍本申请实施例提供的注册方案之前，先对具有生成NAS信令能力的设备，比如用户设备(user equipment，UE)注册到核心网的流程进行说明，以UE注册到第五代(5G)核心网为例。
参见图1所示，为目前的第五代(5G)的网络架构示意图。UE，也可以称为终端，可以是移动设备，比如手机，平板电脑(pad)、带无线收发功能的电脑等。
网络架构还包括无线接入网(radio access network，RAN)、接入和移动性控制功能(access and mobility function，AMF)、统一数据管理(unified data management，UDM)、认证服务功能(authentication server function，AUSF)、安全锚功能(security anchor function，SEAF)等。
所述RAN的主要功能是控制用户通过无线接入到移动通信网络。RAN是移动通信***的一部分。它实现了一种无线接入技术。从概念上讲，它驻留某个设备之间(如移动电话、一台计算机，或任何远程控制机)，并提供与其核心网的连接。
所述AMF网元负责UE的接入管理和移动性管理，如注册管理，连接管理，移动管理，可达性管理等；在实际应用中，其包括了LTE中网络框架中移动性管理实体(mobility management entity，MME)里的移动性管理功能，并加入了接入管理功能。
所述SEAF网元用于完成对UE的认证，在5G中，SEAF的功能可以合并到AMF中。
所述AUSF网元具有鉴权服务功能，用于终结所述SEAF网元请求的认证功能，在认证过程中，接收UDM发送的鉴权向量并对鉴权向量进行处理，将处理后的鉴权向量发送给SEAF。
所述UDM网元可存储用户的签约信息，生成认证参数等。
所述ARPF网元具有认证凭证存储和处理功能，用于存储用户的长期认证凭证，如永久密钥K等。在5G中，所述ARPF网元的功能可以合并到UDM网元中。
如图2A所示为基于如图1所示的网络架构中，UE进行安全入网注册的方法示意图。
S201，UE向SEAF发送N1消息。N1消息里携带有隐藏身份信息(subscriber concealed identifier，SUCI)或5G-全球唯一临时UE标识(globally unique temporary UE Identity，GUTI)。
其中，N1消息可以是注册请求消息(Registration Request)，也可以是服务请求消息 (Service Request)消息。
若UE曾经入网过，有安全上下文，那么UE在N1消息中携带5G-GUTI。如果UE是首次入网，没有安全上下文，那么UE在N1消息中携带的是SUCI。SUCI是由UE生成的。
示例性地，参见图2B和2C所示，为UE生成的SUCI的格式示意图。SUCI中包括如下1)-7)的信息。
1)SUPI Type可以有7个值，用于标识SUCI中加密的SUPI的7种类型。目前，SUPI type有2个值，当SUPI type的值为0时表示SUPI为国际移动用户识别码(international mobile subscriber identification number，IMSI)，当SUPI type的值为1时，表示SUPI为网络特定指示符(network specific identifier)。当SUPI type的值为2到7，目前未做明确规定，留在将来使用。
2)家乡网络指示符(Home network Identifier)。
当SUPI type表示SUPI为IMSI时，Home network Identifier可以由2部分组成，分别是MCC(Mobile Country Code，移动国家代码)和MNC(Mobile Network Code，移动网络代码)。MCC用于唯一地标识移动客户属于的国家，可以由三位十进制数组成(000-999)，例如我国的MCC为460。MNC用于标识UE属于哪个运营商。MCC和MNC相结合用于唯一地表示UE的网络运营商。后续再描述时，以SUPI为IMSI为例进行说明。示例性地，SUPI type表示SUPI为IMSI时，SUCI的格式参见图2B所示。
IMSI是区别移动用户的标志，可以在UE的全球用户身份模块(universal subscriber identity module，USIM)卡中配置。IMSI由三部分构成，分别是MCC、MNC和移动用户识别号码(mobile subscriber identification number，MSIN)。MSIN用于识别某一移动通信网中的移动用户。
当SUPI type表示SUPI为网络特殊标识符(Network Specific Identifier，NSI)时，Home Network Identifier可以是一个特定字符串。NSI可以使用网络接入指示符(Network Access Identifier，NAI)的格式。示例性地，NAI格式可以为用户名称@域名(username@realm)，则realm可以确定为Home Network Identifier，或者releam部分包含Home Network Identifier。比如，一个NSI格式的SUPI为[email protected]。示例性地，SUPI type表示SUPI为NSI时，SUCI的格式参见图2C所示。
3)路由指示符(Routing Indicator)由1到4个十进制数组组成。Routing Indicator与Home Network Identifier一起作用来指示为这个UE服务的AUSF和UDM。Routing Indicator可以配置在UE的全球用户身份模块(universal subscriber identity module，USIM)卡中配置。如果USIM卡中未配置该值，则Routing Indicator为默认值0。
4)保护方式指示符(Protection Scheme Identifier)用于指示采用的安全保护机制，其值可以有如下3种：0x0、0x1和0x2。Protection Scheme Identifier值为0x0时，表示NULL-SCHEME。NULL-SCHEME的运算输出结果与运算输入的值相同，也就是不进行任何加密运算，比如，如果运算输入的值为SUPI，那么NULL-SCHEME输出也为SUPI。Protection Scheme Identifier值为0x1时，表示使用Profile<A>安全保护机制。Protection Scheme Identifier值为0x2时，表示使用Profile<B>安全保护机制。如果UE中配置有Profile<A>和Profile<B>，UE可以选择其中一种方式，将SUPI加密转换为SUCI。如果UE中未配置Profile<A>和Profile<B>，UE可以选择NULL-SCHEME，也就是不对SUPI进行 加密运算。
5)家乡网络公钥指示符(Home Network Public Key Identifier)，其表示UE使用的公钥。UE要使用公钥和Profile<A>或Profile<B>对SUPI进行加密转换为SUCI。UE中可能预配置有多个公钥，则UE可以在配置的多个公钥中选择一个公钥，然后将该公钥的标识(比如ID)作为Home Network Public Key Identifier的值。如果使用了NULL-SCHEME，则Home Network Public Key Identifier的值为0。
6)Scheme Output，用于表示安全保护机制的输出结果，其可以由一个字符串表示。Scheme Output可以是通过由Home Network Public Key Identifier确定的公钥和Protection Scheme Identifier确定的安全保护机制，对安全保护机制的输入(Protection Scheme的输入)进行加密得到输出结果。对于Protection Scheme的输入(Scheme Input)，在SUPI为IMSI的情况下，可以是移动用户识别号码(mobile subscriber identification number，MSIN)。MSIN标识运营商下的用户。
从上可以看出，在SUPI为IMSI时，生成的SUCI用于隐藏UE的MSIN，仅暴漏用户属于哪个国家以及哪个运营商，并没有暴漏最终的用户个体。由于表示最终用户个体的MSIN被公钥和保护机制进行了加密保护。
对于SUPI为NSI时，SUCI构成方式可以遵照NAI格式。即参见图2C所示，SUCI可以由SUPI type、routing indicator、protection scheme ID、homenetwork public key ID、scheme output和releam构成。其中，username可以作为scheme output的输入，Releam部分可以认为是Home Network Identifier。因此SUCI的NSI格式为SUPI type,routing indicator,protection scheme ID,homenetwork public key ID,scheme output@releam。例如，如果NSI为[email protected],the Routing Indicator为678,and a Home Network Public Key Identifier为27，并且使用profileA，则NAI格式的SUCI为：type1.rid678.schid1.hnkey27.ecckey<ECC ephemeral public key>.cip<encryption of user17>.mac<MAC tag value>@example.com。如果选择了NULL-Scheme，则SUCI为：[email protected]。
S202，SEAF在接收到N1消息后，SEAF向AUSF发送服务请求消息1。服务请求消息1可以是Nausf_UEAuthentication_Authenticate Request，服务请求消息1携带有SUCI或者携带SUPI。
示例性地，若S201中N1消息中携带SUCI，则服务请求消息1携带SUCI。若N1消息携带的是5G-GUTI，则服务请求消息1携带SUPI。
S203，AUSF向UDM发送服务请求消息2，服务请求消息2可以是Nudm_UEAuthentication_Get Request。服务请求消息2中携带有SUCI和服务网络名称(serving network name，SN-name)，或者携带SUPI。
示例性地，若S202中服务请求消息1中携带SUCI，则服务请求消息2携带SUCI。若服务请求消息1携带的是5G-GUTI，则服务请求消息2携带SUPI。
S204a，若服务请求消息2携带的是SUCI，UDM要从SUCI获得SUPI。
UDM获得SUPI的具体流程可以包括A1-A4：
A1，UDM会根据SUCI中的Protection Scheme Identifier确定UE使用的是哪种安全保护机制。
A2，UDM会根据SUCI中的Home Network Public Key Identifier确定UE使用的是哪一对公私钥。
A3，UDM根据确定的安全保护机制和私钥对Scheme Output进行解密和完整性保护验证。如果完整性保护验证成功，则解密后的结果就是恢复出UE的身份信息。UE的身份信息，在SUPI为IMSI的情况下，从Scheme Output解析的结果为MSIN。
A4，UDM再根据SUPI type，获取最终的SUPI。比如，UDM根据SUPI type确定获得的SUPI的类型。如果SUPI type是IMSI，则可以确定解密Scheme Output的输出结果代表MSIN。然后UDM再根据Home network Identifier中的MCC和MMC，与MSIN一起组成IMSI。
S204b，UDM根据恢复出的SUPI查找用户的签约数据，再根据签约数据中的数据选择一个鉴权方法对SUPI进行鉴权。鉴权方法可以是5G认证和秘钥协商(5G-authentication and key agreement，5G AKA)的方式或者是扩展认证协议认证和秘钥协商(extensible authentication protocol-authentication and key agreement，EAP-AKA’)的方式。
参见图3所示，为EAP-AKA’的方式的鉴权流程示意图。
S301，UDM接收到服务请求消息2后，生成鉴权向量(authentication vector，AV)。
示例性地，UDM生成的过程如图4所示。
鉴权向量生成需要使用的输入参数是K，序列号(sequence number，SQN)，随机数(random number，RAND)和鉴权管理域(authentication management field，AMF)。其中，f 1,f2,f3,f4,f5表示5种加密算法，K表示长期密钥，是与UE一一对应的。K可以预先配置在UE的USIM中和UDM中。SQN由UDM维护，每UE发起鉴权一次SQN加1。RAND是UDM生成的随机数。UDM可以将鉴权管理域中的分离比特位(separation bit)设置为1。
根据图4所示，在输入参数和5种加密算法的作用下，分别得到消息认证码(message authentication code，MAC)，RAND，期望的回复(eXpected RESponse，XRES)，加密密钥(Cipher Key，CK)，完整性密钥(Integrity protection key，IK)，匿名秘钥(anonymity key，AK)。
生成AK后，AK与SQN进一步做异或操作，异或操作效果是将SQN加密。避免SQN在空口暴漏。在EAP-AKA’鉴权方法中，CK和IK会进一步变成CK’和IK’。
最终得到EAP-AKA’的AV为RAND||XRES||CK’||IK’||AUTN。AUTN表示认证令牌(authentication token)，其中
Figure PCTCN2020087914-appb-000001
符号||表示串接，
Figure PCTCN2020087914-appb-000002
表示异或运算。
S302，UDM发送服务响应消息2给AUSF。服务响应消息2中携带有EAP-AKA’AV和SUPI。服务响应消息2可以是Nudm_UEAuthentication_Get Response。
S303，AUSF从AV中获得CK’，IK’和XRES并保存下来，将RAND，AUTN通过服务响应消息1发送给SEAF。服务响应消息1可以是Nausf_UEAuthentication_Authenticate Response。示例性地，Nausf_UEAuthentication_Authenticate Response包括EAP请求(EAP-Request)/AKA'挑战(AKA'-Challenge)。EAP请求(EAP-Request)/AKA'挑战(AKA'-Challenge)中包括RAND，AUTN。
S304，SEAF发送认证请求消息(比如Authentication Request)给UE。其中，认证请求消息中可以携带透传的EAP-Request/AKA'-Challenge消息。认证请求消息中还可以包括5G密钥集标识符(Key Set Identifier in 5G，ngKSI)和架构间防降级(Anti-Bidding down Between Architectures，ABBA)参数。SEAF需要生成5G密钥集标识符(Key Set Identifier in 5G，ngKSI)。SEAF需要根据自己的部署方式确定ABBA参数。ngKSI参数用于标识UE 和SEAF之间使用的密钥。ABBA是密钥Kamf的生成参数。SEAF自己的部署方式包括SEAF与AMF合设的部署方式，即SEAF与AMF的功能由一个网元实现，或者分开部署方式，即SEAF和AMF为两个独立的网元。
S305，UE执行认证操作。具体的，UE根据所述UE中的USIM中存储的密钥K与从所述SEAF网元接收的RAND生成XMAC，这里所述UE生成XMAC所采用的运算方式与所述UDM网元生成MAC所采用的运算方式相同。
所述UE对XMAC和AUTN中携带的MAC的比对实现所述UE对所述家乡网络的认证。若XMAC和AUTN中的MAC一致，则认证成功，否则认证失败。
在认证成功后，所述UE根据RAND和K生成RES，这里所述UE生成RES所采用的运算方式与所述UDM网元生成XRES所采用的运算方式相同。
S306，所述UE将RES包含在认证响应消息(比如Authentication Response)中，发送给所述SEAF。认证响应消息可以包括EAP-Response/AKA'-Challenge消息。
S307，SEAF透传EAP-Response/AKA'-Challenge消息。示例性地，SEAF可以将EAP-Response/AKA'-Challenge消息放到服务请求消息3(比如Nausf_UEAuthentication_Authenticate Request)中发送给AUSF。
S308，AUSF执行认证操作。AUSF用从UE收到的RES与自己保存的XRES进行对比。如果RES与自己保存的XRES相同，则认证成功，即AUSF认为UE是真实的，否则认证失败。
示例性地，AUSF和UE可以进一步交互EAP-Request/AKA'-Notification and EAP-Response/AKA'-Notification消息。
S309，AUSF使用保存的CK’和IK’生成Kausf。Kausf＝CK’||IK’。Kausf是所述UE和所述AUSF网元之间同步的派生密钥，用于派生锚点密钥Kseaf，即AUSF进一步基于Kausf派生出Kseaf。之后，AUSF发送服务响应消息3(比如Nausf_UEAuthentication_Authenticate Response)给SEAF。服务响应消息3中可以携带有Kseaf和SUPI。服务响应消息3中还可以携带鉴权成功的指示信息，比如可以通过EAP Success消息作为鉴权成功的指示信息。
S310，SEAF将EAP Success消息透传给UE。SEAF需要再次发送ngKSI和ABBA参数给UE。这里的ngKSI和ABBA参数与S304发送的相同。其中，SEAF再次发送ngKSI和ABBA参数的目的用于保证透传EAP Success消息采用的消息格式与S304的消息格式相同。
参见图5所示，为5G AKA的方式的鉴权流程示意图。
S501，UDM生成5G AV。5G AV的生成过程，可以参考图3中EAP-AKA’AV的生成描述，但是与其区别在于：UDM采用CK和IK生成Kausf。UDM将XRES进一步生成XRES*。因此5G AV的构成为RAND,AUTN,XRES*,和Kausf。Kausf＝CK||IK。Kausf是所述UE和所述AUSF网元之间同步的派生密钥，用于派生锚点密钥Kseaf。5G AV＝RAND||XRES*||CK||IK||AUTN＝RAND||XRES*||Kausf||AUTN。
S502，UDM发送服务响应消息2给AUSF，服务响应消息2中携带有5G AV和SUPI。
S503，AUSF从5G AV中获得Kausf和XRES*并保存下来。
S504，所述AUSF对所述鉴权向量进行进一步处理，例如对XRES*进行哈希运算，生成HXRES*，根据K AUSF进行推演生成K SEAF，处理后的鉴权向量包括RAND、MAC、HXRES*，其中，MAC可以携带在AUTN，也就是说，所述处理后的鉴权向量包括RAND、携带有MAC的AUTN。
S505，所述AUSF向所述SEAF发送服务响应消息1。服务响应消息1可以是Nausf_UEAuthentication_Authenticate Response。示例性地，Nausf_UEAuthentication_Authenticate Response包括Kseaf和处理后的5G AV。
S506，所述SEAF向所述UE发送认证请求消息，其中，所述认证请求消息中携带处理后的鉴权向量中的部分参数，该部分参数包括RAND、MAC，其中，MAC可以携带在AUTN中。认证请求消息中还可以包括ngKSI和ABBA参数。SEAF将处理后的5G AV中的HXRES*和Kseaf保存。
S507，所述UE根据所述UE中的USIM中存储的密钥K与从所述SEAF网元接收的RAND生成XMAC，这里所述UE生成XMAC所采用的运算方式与所述UDM网元生成MAC所采用的运算方式相同。
所述UE对XMAC和AUTN中携带的MAC的比对实现所述UE对所述家乡网络的认证。若XMAC和AUTN中的MAC一致，则认证成功，否则认证失败。
在认证成功后，所述UE根据RAND和K生成RES*，这里所述UE生成RES*所采用的运算方式与所述UDM网元生成XRES*所采用的运算方式相同。
S508，所述UE将RES*包含在认证响应消息中，发送给所述SEAF网元。
S509，所述SEAF网元对所述认证响应消息中包括的RES*进行哈希运算，生成HRES*，将HRES*与所述AUSF网元发送的鉴权向量中的HXRES*进行比对，通过HRES*与的HXRES*的比对完成所述服务网络对所述UE的认证，若HRES*与的HXRES*一致，则所述服务网络对所述UE认证成功，否则认证失败。
S510，在所述服务网络对所述UE认证成功之后，所述SEAF将所述UE返回的RES*转发给所述AUSF网元，由所述AUSF网元进行下一步的认证。示例性地，SEAF可以通过服务请求消息3(比如Nausf_UEAuthentication_Authenticate Request)将RES*发送给AUSF。
S511，所述AUSF网元接收到RES*后，将RES*与所述鉴权向量中的XRES*进行比对，结果若一致，则完成所述家乡网络对所述UE的认证。
S512，所述AUSF网元在认证成功之后，会将SUPI和K seaf发送给所述SEAF。示例性地，可以通过服务响应消息3(比如Nausf_UEAuthentication_Authenticate Response)将SUPI和Kseaf发送给SEAF。服务响应消息3还可以携带鉴权成功的指示信息。
SEAF在接收到服务响应消息3后，接下来执行NAS安全激活流程，参见图6所示为NAS安全激活流程示意图。
SEAF在接收到服务响应消息后，AMF会根据SEAF接收到的Ksea f生成Kamf，将Kamf传递给AMF。AMF会进一步使用Kamf生成NAS加密密钥Knasenc和NAS完整性保护密钥Knasint。
S601，AMF开启NAS完整性保护。
S602，AMF向UE发送NAS安全模式信令(NAS Security Mode Command，NAS SMC)消息。AMF使用NAS完整性保护密钥Knasint对NAS SMC消息进行完整性保护。
S603，AMF在发送NAS SMC消息之后，开启上行解密。以便于对NAS安全模式完成(security mode complete，SMP)消息做解密。在收到NAS SMP后，开启下行加密。
S604，UE同样生成Kamf和NAS加密密钥Knasenc和NAS完整性保护密钥 Knasint。UE使用NAS完整性保护密钥对NSA SMC消息进行完整性保护验证，如果验证成功，则开启上行加密，下行解密和完整性保护。
S605，UE回复NAS SMP消息给AMF。NAS SMP消息被加密保护和完整性保护。
UE是具备生成NAS信令的设备，并且与AMF之间存在N1接口，而对于无法生成NAS信令的设备无法通过上述提供的方式注册到核心网。基于此，本申请实施例提供无法生成NAS信令的设备注册到核心网的注册方式。无法生成NAS信令的设备在本申请实施例中可以称为不具备NAS能力的接入设备。无法生成NAS信令的设备，可以通过具有NAS信令的设备代替不具备NAS能力的接入设备与核心网之间交互用于注册的信令。具有NAS信令的设备且能够代替不具备NAS能力的接入设备与核心网交互信令的设备，在本申请实施例中可以称为安全接入网关。
参见图7所示为本申请实施例提供的通信***架构示意图。通信***架构中包括不具备NAS能力的接入设备、安全接入网关、第一核心网网元、第二核心网网元以及第三核心网网元。安全接入网关与第一核心网网元可以通过特有接口通信，如N1接口和N2接口。第一核心网网元可以完成对入网设备的认证。第二核心网网元可存储用户的签约信息，生成认证参数等。第三核心网网元具有鉴权服务功能。
安全接入网关，是一种具备NAS能力的网元，可以用于处理不具有NAS能力的接入设备的相关消息的网关。该安全接入网关可以属于接入网的一部分，或者属于核心网的一部分。
第一核心网网元、第二核心网网元和第三核心网网元可以是用于处理不具备NAS能力的接入设备接入的网元，它们可以是传统的AMF、AUSF、UDM网元，也可以是专门处理用于处理不具备NAS能力的接入设备接入的一些特殊功能实体。这些功能实体可以有一个或者多个，并且可以统一合并到AMF、AUSF、UDM中，或者分布存储在AMF、AUSF、UDM中。
示例性地，第一核心网网元可以是接入和移动性控制功能(access and mobility function，AMF)或者是SEAF。第二核心网网元可以是UDM、或者ARPF、或者解密签约标识功能实体(subscription identifier de-concealing function，SIDF)。第三核心网网元可以是AUSF。
示例性地，本申请实施例可以但不仅限于固网移动融合场景。在固网移动融合场景中，不具备NAS能力的接入设备，比如可以是固网接入网关(fixed network residential gateway，FN-RG)。具备生成NAS信令的网元可以是有线接入网关(wireline access gateway function，W-AGF)。W-AGF为FN-FG提供接入第五代(5G)核心网的能力，换句话说，FN-RG通过W-AGF与核心网建立连接。
本申请实施例中，以FN-RG为例，对不具有NAS能力的接入设备注册到核心网进行详说明，应理解的是，在应用的其它不具有NAS能力的接入设备时，本申请实施例提及的FN-RG的相关信息，可以替换成不具备NAS能力的接入设备的相关信息，比如FN-RG的身份信息可以替换为不具备NAS能力的接入设备，再比如，FN-RG的设备相关信息可以替换为不具备NAS能力的接入设备的设备相关信息，等等，不再一一例举。
示例性地，参见图8所示为本申请实施例提供的固网移动融合***架构示意图。***架构中可以包括FN-RG、W-AGF、AMF、UPF、UDM、AUSF、SEAF、ARPF等。参见图8所示，W-AGF与AMF之间通过N1接口和N2接口实现互联，W-AGF与UPF之间通过N3接口实现互联，UPF与SMF之间通过N4接口实现互联，UPF与DN之间通过N6 接口实现互联，AMF与UDM之间通过N8接口实现互联，UDM与SMF之间通过N10接口实现互联，SMF与AMF之间通过N11接口实现互联，AMF与AUSF之间通过N12接口实现互联，AUSF与UDM之间通过N13接口实现互联。
图8中，W-AGF与AMF之间可以通过N1接口和N2接口相连。N1接口可以在FN-RG接入5G核心网的时候使用。由于FN-RG没有能力接入5G核心网，也就是FN-RG上不具有与AMF相连的接口，从而没有能力发N1接口消息，W-AGF可以代替FN-RG向AMF发送N1接口消息。
所述FN-RG是固网的接入设备，用于对连接到FN-RG的终端设备提供接入管理。
所述W-AGF负责将FN-RG接入到5G核心网。在FN-RG接入的时候，W-AGF会替代FN-RG生成NAS消息。
所述AMF网元负责UE的接入管理和移动性管理，如注册管理，连接管理，移动管理，可达性管理等；在实际应用中，其包括了LTE中网络框架中移动性管理实体(mobility management entity，MME)里的移动性管理功能，并加入了接入管理功能。
所述SMF用于为用户面分配会话资源。UPF用于提供用户面数据出口，连接外部网络。
所述SEAF网元用于完成对入网设备(比如FN-RG)的认证，在5G中，SEAF的功能可以合并到AMF中。
所述AUSF网元具有鉴权服务功能，用于终结所述SEAF网元请求的认证功能，在认证过程中，接收UDM发送的鉴权向量并对鉴权向量进行处理，将处理后的鉴权向量发送给SEAF。
所述UDM网元可存储用户的签约信息，生成认证参数等。
所述ARPF网元具有认证凭证存储和处理功能，用于存储用户的长期认证凭证，如永久密钥K等。在5G中，所述ARPF网元的功能可以合并到UDM网元中。
所述SIDF网元负责解密SUCI中获得SUPI。所述SIDF网元的功能可以合并到UDM网元中。
后续描述时，以第一核心网网元为SEAF、第二核心网网元为UDM、第三核心网网元为AUSF为例进行说明。
请参阅图9，为本申请实施例提供的一种注册方法的流程示意图。
S901，FN-RG向W-AGF发送第一请求消息。该第一请求消息中包括FN-RG的原始身份信息。所述W-AGF在接收到所述第一请求消后，向核心网发起对所述接入设备的注册流程。
作为一种示例，该第一请求消息可以是FN-RG与W-AGF之间完成在固网的注册流程中交互的一个消息。例如，FN-RG通过层2(Layer 2)连接接入W-AGF，从而W-AGF与FN-RG完成固网鉴权流程。Layer 2连接是指固网的连接。比如，FN-RG通过层2(Layer 2)连接W-AGF发送的消息作为该第一请求消息，一种可能的方式，第一请求消息中包括指示字段，该指示字段用于触发W-AGF向移动网的核心网发起注册流程，从而W-AGF对所述FN-RG完成鉴权后，执行S902。
另一种可能的方式为，W-AGF根据其它信息判断是否需要执行S902。比如，W-AGF可以根据预配置的信息、网络流量状态信息等信息来判断是否需要执行S902。比如，W-AGF同时接入固网和5G核心网时，W-AGF可以根据预配置信息，在收到FN-RG入网请求后， 自动为其接入5G核心网，进而建立与5G核心网的数据传输链路。再比如，W-AGF根据其他信息(比如固网的状态信息)判断固网线路拥挤繁忙，则在下一次FN-RG使用固网链路的时候，主动为其接入5G核心网，进而为固网链路分流，减少其拥挤程度(此时FN-RG向W-AGF发起的可以不是注册流程，可以是数据传输流程中的一部分，或者其他固网信令流程)。再比如，W-AGF可以根据网管配置指示信息，决定是要对所有FN-RG还是部分FN-RG进行接入5G核心网的操作，例如：网管配置有一个列表，列表明确了哪些FN-RG可以接入5G核心网，哪些不可以接入核心网。这个列表可以包括FN-RG的身份信息和用于指示是否可以接入5G核心网的指示的对应关系。而FN-RG是否可以接入5G核心网与FN-RG的使用者是否购买这项服务有关。
示例性地，FN-RG的原始身份信息可以是Line ID(线路ID)，或者可以是综合数字服务宽带接入网技术标识符(Hybrid Fiber Coaxialz identifier，HFC identifier)。
其中，Line ID不同运营商的采用的格式可能不同也可能相同，比如，line ID可以采用的格式可以是动态主机设置协议(dynamic host configuration protocol，DHCP)v4option 82交互使用(exchange)，或者是以太网上的点对点协议(point-to-point protocol over ethernet，PPPoE)电路和远程ID，具体内容可以参考3GPP TS23.316版本020。其中，HFC identifier可以是一个十进制字符串，其包含媒体访问控制地址(media access control address，MAC)地址或者HFC账户标识符，具体内容可以参考3GPP TS23.316版本020。
S902，W-AGF根据所述FN-RG的身份信息生成隐藏身份信息(subscriber concealed identifier，SUCI)。
其中，所述FN-RG的身份信息可以仅包括RN-RG的原始身份信息，还可以在包括FN-RG的原始身份信息的基础上还包括其他信息。
一种可能的方式，W-AGF可以直接使用FN-RG的原始身份信息生成隐藏身份信息。一种情况下，W-AGF可以只用FN-RG的原始身份信息生成隐藏身份信息，在该情况下，FN-RG的身份信息仅包括FN-RG的原始身份信息；另一种情况下，也可以获取一些用于进一步表明FN-RG的身份的其他信息，为了描述方便，将用于进一步表明FN-RG的身份的其他信息称为FN-RG的设备相关信息，对用于进一步表明FN-RG的身份的其他信息的称呼本申请不作具体限定。W-AGF将获取的设备相关信息与FN-RG原始身份信息一起使用，生成隐藏身份信息。设备相关信息可以包括FN-RG的位置信息、接入的时间信息、FN-RG的运营商信息等中的一项或者多项，从而可以使FN-RG的身份信息在运营商内部是唯一的或者在全球网络中是唯一的。在该情况下，RN-RG的身份信息中不仅仅包括FN-RG的原始身份信息，还包括设备相关信息。
设备相关信息可以包括FN-RG的位置信息、接入的时间信息、FN-RG的运营商信息等中的一项或者多项，可以理解为：设备相关信息可以仅包括其中一项，比如仅包括FN-RG的运营商信息、或者仅包括FN-RG的位置信息、或者仅包括FN-RG接入的时间信息；或者设备相关信息可以包括其中两项，比如包括FN-RG的运营商信息和FN-RG的位置信息；或者设备相关信息包括三项，比如包括FN-RG的运营商信息和FN-RG的位置信息和接入的时间信息。
FN-RG的运营商的信息可以是FN-RG所归属的运营商信息，或者FN-RG的合作运营商信息。其中，所述FN-RG所属的运营商的信息或者FN-RG的合作运营商信息由W-AGF确定的。比如，所述FN-RG所属的运营商的信息是根据所述FN-RG的身份信息从所述 W-AGF的配置信息中获得的。此时，FN-RG的运营商的信息无法直接从FN-RG的原始身份信息中全部获得。再比如，W-AGF可以根据FN-RG的固网层二消息中直接获取到或者推断得到FN-RG的所注册的运营商的信息。FN-RG的合作运营商信息是指当前FN-RG所述的服务提供商没有部署5G网络，但是其服务提供商与部署了5G网络的运营商有签约合作，使这个服务提供商的FN-RG可以接入部署了5G网络的运营商的网络。甚至还可以接入与该运营商有签约的其他运营商的网络。例如，W-AGF中配置有FN-RG的身份信息与FN-RG所属的运营商的信息的对应关系，或者FN-RG的身份信息与FN-RG合作的运营商的信息的对应关系，从而W-AGF可以根据对应关系来确定FN-RG的身份信息所对应的FN-RN所属的运营商的信息或者合作的运营商信息。
作为一种示例，FN-RG的原始身份信息中可能直接携带有FN-RG所属的运营商信息，那么W-AGF直接使用即可，在该请况下，FN-RG的身份信息可以仅包括原始身份信息，或者FN-RG的身份信息包括原始身份信息和设备相关信息，但设备相关信息中不再包括FN-RG的运营商信息。
可以理解的是，FN-RG的原始身份信息可以是运营商内部是唯一的或者在全球网络中是唯一的，当然也可能只是局部唯一。对局部唯一的情况，可能因为FN-RG是固网设备，在现有网络中位置相对固定，因此可能造成北京的一个设备的身份信息与上海的一个设备的身份信息相同。但因为其不具备移动性，因此上海的设备不可能去北京入网使用，因此在固网身份信息分配上就可能造成重复。再比如，当FN-RG的原始身份信息采用Line ID时，当Line ID采用DHCP标识的时候，因为DHCP分配的IP地址是有有效期的，并且这个IP地址可以被不同设备重复使用。此时就造成FN-RG的身份信息并没有唯一的标识一个设备，而是可以被不同的设备重复使用。
但是5G网络的用户身份信息是不可以重复的，因此需要一种手段将可能重复的固网身份信息扩展成为在5G网络中不会重复的。因此，原始身份信息结合设备相关信息是可行的一种方法。FN-RG的原始身份信息与设备相关信息结合的方法可以是FN-RG的原始身份信息在前，其他信息在后；也可以是其他信息在前，FN-RG的原始身份信息在后；还可以规定FN-RG的原始身份信息填充到前面固定的比特位，其他信息填到后面固定比特位。对于没有填充上的比特位则填充为0；还可以将FN-RG的原始身份信息与其他信息之间使用特殊的连接符合进行串联，比如冒号“：”，双竖线“||”等。
另一种可能的方式，W-AGF可以仅先根据FN-RG的原始身份信息生成SUPI，再根据SUPI生成隐藏身份标识(SUCI)。或者，W-AGF可以先将FN-RG的原始身份信息与设备相关信息相结合生成SUPI，再根据SUPI生成隐藏身份标识；设备相关信息的内容可以参考前一段的描述。SUPI type的内容请参考后面的描述。
一种示例中，SUCI包括用于确定FN-RG的SUPI的至少两部分信息，分别为第一部分信息和第二部分信息。第一部分信息和第二部分信息均可以由FN-RG的身份信息来确定。
这里所说的FN-RG的身份信息可以仅包括原始身份信息，也可以包括原始身份信息和设备相关信息。
在所述第一部分信息和所述第二部分信息由所述FN-RG的身份信息确定时，可以包括多种方式，如下示例性的描述几种方式。
第一种方式：所述第一部分信息为所述FN-RG的身份信息中的第一部分，所述第二 部分信息为所述FN-RG的身份信息中的第二部分。其中，第一部分和第二部分在所述FN-RG的身份信息中可以不重叠，比如FN-RG的身份信息包括15比特(bit)，第一部分包括15bit中的5bit信息，第二部分包括除5bit信息以外的其它10bit中的6bit信息。示例性地，第一部分和第二部分包括的信息构成了所述FN-RG的身份信息，比如所述第一部分包括所述FN-RG的身份信息中的一部分信息，所述第二部分信息包括所述FN-RG的身份信息中的另一部分信息。
作为第一种方式的一个示例，FN-RG的身份信息包括原始身份信息和设备相关信息，可以将设备相关信息作为第一部分信息，而原始身份信息作为第二部分信息；或者可以将设备相关信息的一部分与原始身份信息相结合作为第二部分信息，将设备相关信息的另一部分作为第一部分信息。
比如，第一部分信息为home Network Identifier或者Releam部分承载的信息，第二部分信息可以为Scheme Out承载的信息，可以将原始身份信息作为Scheme Out的输入，将设备相关信息确定为home Network Identifier。
示例性地，FN-RG的身份信息中第一部分可以直接被用作构成SUPI的一部分，比如设备相关信息或者设备相关信息的一部分，第二部分可以作为SUPI的另一部分，该另一部分可以直接用作scheme input用于获得SUCI中的scheme output，第二部分为FN-RG的原始身份信息或者原始身份信息的一部分。比如，通过该两部分构成SUPI时，可以直接将该两部分组合在添加SUPI type得到SUPI，另外，还可以将这两部分信息进行格式转换再添加SUPI type得到SUPI。格式转换意味着转换成5G核心网能够识别的格式，可以参见第二种方式中的相关描述，此处不再赘述。其中，SUPI type可以是SUCI中的第三部分信息。
另外，需要说明的是，如果FN-RG的身份信息中的第一部分中包括用于指示SUPI type的信息，这里在构成SUPI type时，可以直接基于第一部分和第二部分构成SUPI，无需再添加SUPI type。
第二种方式：所述第一部分信息是所述FN-RG的身份信息中的第一部分格式转换后的信息，所述第二部分信息包括所述FN-RG的身份信息中的第二部分格式转换后的信息。
另外需要理解的是，本申请实施例中所述的FN-RG的身份信息中的第一部分和FN-RG的身份信息的第二部分是指FN-RG的身份信息的两部分，这两部分组合可以是FN-RG的身份信息的全部信息也可以是FN-RG身份信息的部分信息。
示例性地，以FN-RG的身份信息包括原始身份信息和设备相关信息为例，第二部分可以是将FN-RG的原始身份信息结合设备相关信息的一部分构成的部分信息，第一部分信息可以延伸身份信息的一部分。第二部分也可以是FN-RG原始身份信息的一部分信息，或者是FN-RG的原始身份信息；第一部分可以是设备相关信息的一部分信息，或者设备相关信息。
本申请实施例中的格式转换，意味着W-AGF将FN-RG的身份信息转换成5G核心网能够识别的格式。比如，前文提到的FN-RG的原始身份信息或者原始身份信息与设备相关信息的结合可能还不是5G核心网能够识别的格式。因此，W-AGF可以将FN-RG的身份信息进一步做格式转换，使其变成5G核心网能够识别的格式。其中包括直接将FN-RG身份的比特位直接复用的方法，或者是采用设定规则计算后得出的结果。比如FN-RG的身份信息的前5bit为第一部分信息，但是在SUPI构成中，第一部分信息却需要6bit，那 么就需要定义一个转换规则，可以直接将5bit的信息转换成SUPI构成中的第一部分信息。转换规则可以是一种对应关系列表，也可以是一种可逆的变换方法。可逆的意思是UDM可以做逆向操作，得到原始的FN-RG的身份信息的前5bit。
示例性地，W-AGF可以将FN-RG的身份信息的第一部分格式转换后作为Home network Identifier或Releam部分，第二部分格式转换后得到类似于MSIN或username的信息作为Scheme Output的输入，最终获得Scheme Output，也就是说第二种方式提及的获得SUCI的方法可以认为是：对将FN-RG的身份信息进行格式转换后，并采用NULL Scheme得到的。
示例性地，在该第二种方式下，构成SUPI时，可以将第一部分信息和第二部分信息组合再添加SUPI type得到SUPI。
另外，需要说明的是，如果FN-RG的身份信息中的第一部分进行格式转换后中包括用于指示SUPI type的信息，这里在构成SUPI type时，可以直接基于第一部分和第二部分构成SUPI，无需再添加SUPI type。
第三种方式：所述第一部分信息包括所述FN-RG的身份信息中的第一部分，所述第二部分信息为根据所述FN-RG的身份信息中的第二部分加密得到的。
针对所述FN-RG的身份信息的第一部分和第二部分的说明参见第二种方式中的描述，此处不再赘述。
示例性地，FN-RG的身份信息中第一部分可以直接被用作构成SUPI的一部分，比如设备相关信息或者设备相关信息的一部分，第二部分可以作为SUPI的另一部分，该另一部分可以直接用作scheme input用于获得SUCI中的scheme output，第二部分为FN-RG的原始身份信息或者原始身份信息的一部分。通过该两部分构成SUPI时，比如，可以直接将该两部分组合再添加SUPI type得到SUPI，或者直接将该两部分进行格式转换再添加SUPI type得到SUPI。
示例性地，在该第三种方式下，UDM在基于SUCI生成SUPI时，一种方式是，可以将第一部分信息和解密后的第二部分信息(例如scheme input)组合再添加SUPI type得到SUPI。另一种方式是，可以分别对SUCI中的第一部分信息和解密后第二部分信息进行格式转换再组合添加SUPI type得到SUPI。
其中，第一种方式可以类比于SUCI是采用NULL Scheme生成的，则第三种方式，可以相当于选择了一个安全保护机制(profile)后，将FN-RG的身份信息或者身份信息的一部分通过加密得到。再比如，W-AGF将FN-RG的身份信息的一部分信息格式转换后作为Home network Identifier或Releam，另一部分信息作为scheme input进行加密，最终得到scheme output。
第四种方式：所述第一部分信息是所述FN-RG的身份信息中的第一部分格式转换后的信息，所述第二部分信息是对所述FN-RG的身份信息中的第二部分格式转换后的信息再加密得到的。此方式与第二种方式对应，表示的是FN-RG的身份信息无法直接被5G核心网使用，全部都需要做相应的格式转换。格式转换的描述可以参考第二种方式。第一部分和第二部分的描述可以参见第二种方式，此处不再赘述。比如，W-AGF将FN-RG的身份信息的第一部分格式转换后确定为Home network Identifier或Releam,第二部分格式转换后为类似于MSIN的信息或username的信息，确定为Scheme Input。
示例性地，FN-RG的身份信息中第一部分进行格式转换后可以直接被用作构成SUPI 的一部分，比如设备相关信息或者设备相关信息的一部分，第二部分进行转换后可以作为SUPI的另一部分，该另一部分可以直接用作scheme input用于获得SUCI中的scheme output，第二部分可以为FN-RG的原始身份信息或者原始身份信息的一部分。
示例性地，在该第四种方式下，UDM在基于SUCI生成SUPI时，可以将第一部分信息和解密后的第二部分信息(例如scheme input)组合再添加SUPI type得到SUPI。
下面以设备相关信息包括所述FN-RG的运营商信息(比如，FN-RG所属的运营商的信息，或者FN-RG的合作运营商信息)作为示例对上述第一种方式-第四种方式进行详细说明。
在该情况下，第一部分信息可以基于所述FN-RG的身份信息中的设备相关信息或者设备相关信息的一部分来确定，比如将FN-RG的运营商信息的全部或者部分直接作为第一部信息。
分信息，或者将FN-RG的运营商信息的全部或者部分进行格式转换后作为第一部分信息。
第二部分信息可以基于所述FN-RG的原始身份信息来确定。比如，将所述FN-RG的原始身份信息中的部分或者全部信息作为第二部分信息，或者，将对所述FN-RG的原始身份信息中的部分或者全部信息加密得到的信息作为SUCI中用于确定SUPI的第二部分信息，或者将所述FN-RG的原始身份信息中的部分或者全部信息进行格式转换后再加密得到的信息作为用于确定SUPI的第二部分信息。
以图2B或图2C所示的SUCI的结构为例，第一部分信息可以作为Home network Identifier或者releam部分，第二部分信息作为Scheme Output。从所述W-AGF的配置信息获得FN-RG的运营商的信息可以与IMSI中MCC+MNC的格式相同，或与NSI格式的releam部分相同，则可以将获得的FN-RG的运营商的信息添加在SUCI的Home network Identi fier或releam部分。从所述W-AGF的配置信息获得FN-RG所注册的运营商的信息也可以与IMSI中MCC+MNC的格式不同，则可以将获得的FN-RG所注册的运营商的信息转换为MCC+MNC的格式，或NSI格式的releam部分后，再将转换格式后的FN-RG所注册的运营商的信息添加在SUCI的Home network Identifier或releam部分。
另外，需要说明的是，W-AGF所支持接入的运营商可能仅包括一个，则从配置信息中获取FN-RG所属的运营商的信息时，无需根据FN-RG的身份信息来确定FN-RG所属的运营商的信息，可以直接根据W-AGF所支持接入的运营商确定FN-RG所属的运营商的信息，并将确定的FN-RG的运营商的信息或者FN-RG的运营商的信息进行格式转换后的信息添加在SUCI的Home network Identifier或者releam部分。比如，W-AGF为***的安全网关，在S901接收到FN-RG的身份信息后，无需解析FN-RG的身份信息中的具体内容，W-AGF直接确定***对应的MCC+MNC的值并作为Home network Identifier或者releam部分。
作为一种示例，针对上述第一种方式-第五种方式，SUCI在包括上述第一部分信息和第二部分信息以外，还可以包括用于构成SUPI的SUPI的类型信息，所述SUPI的类型信息指示所述永久身份标识为FN-RG的身份标识。比如，图2B或者图2C所示的SUCI结构中SUPI type。SUPI type的值不同于IMSI和Network Specific Identifier对应的SUPI type值，比如SUPI type值可以为2，用于指示SUPI为FN-RG的身份标识。
第五种方式，第一部分信息可以是确定的SUPI的类型，比如SUPI type。示例性地，可以根据FN-RG的身份信息确定SUPI type，或者根据层二消息类型，判断是FN-RG接入， 则W-AGF判断是FN-RG接入，进而确定SUPI type。确定的SUPI Type，可以重用现有的NSI对应的类型，也可以新定义一个类型。比如，新定义的类型代表不具备NAS能力的接入设备接入，比如固网设备(例如FN-RG)接入。第二部分信息可以是FN-RG的身份信息的全部或者部分信息，也可以是FN-RG的身份信息的全部或者部分信息的格式转换后的信息，还可以是FN-RG的身份信息的全部或者部分信息加密后的信息，还可以是FN-RG的身份信息的全部或者部分信息格式转换后再加密后的信息。其中关于格式转换，以及加密如前述，此处不再赘述。
示例性地，SUCI中可以包括SUPI type，SUPI type可以是第一部分信息和第二部分信息以外的部分，比如上述第一种方式-第五种方式，还可以是作为第一部分信息，比如第六种方式。
作为一种示例，SUCI中还可以包括路由指示符(Routing indicator)，路由指示符用于AMF查找和确定可以为FN-RG服务的AUSF和AUSF查找和确定可以为FN-RG服务的UDM。
所述路由指示符可以是从所述W-AGF的配置信息中获得的。应理解的是，第一种情况：运营商可以规定只有某一个、或某几个AUSF、UDM/ARPF/SIDF用于处理FN-RG的接入，不同的运营商规定的能够处理FN-RG的接入的AUSF、UDM/ARPF/SIDF可能相同也可以不同。第二种情况是，运营商不做任何规定，也就是说所有的AUSF、UDM/ARPF/SIDF都可以处理FN-RG的接入。不同的方式下，Routing Indicator的确定方法不同。
在第一种情况下，W-AGF中的配置信息可以包括用于处理FN-RG的接入的AUSF、UDM/ARPF/SIDF对应的Routing Indicator。因此，在这种情况下W-AGF中配置的Routing indicator可以有一个、或多个。若有多个，W-AGF可以根据在配置信息包括的多个Routing indicator中随机选择一个即可或者根据运营商的划分规则根据FN-RG的身份信息选择合适的那个。此时Routing Indicator用于指示可以为固网服务的AUSF、UDM/ARPF/SIDF。可选地，在该情况下，Routing Indicator也可以设置为固定的值，比如设置为最大值9999。
示例性的，当W-AGF所支持接入的运营商包括多个时，W-AGF的配置信息中还包括不同的运营商的信息所对应的Routing Indicator。即配置信息包括不同的运营商信息、Routing Indicator的对应关系，从而在为FN-RG生成SUCI的过程中，可以根据所述FN-RG所属的运营商的信息或合作运营商信息从所述固网安全网关的配置信息中获取。可选地，配置信息还可以为更细粒度的，比如配置中的对应关系还加入FN-RG的身份信息中的部分信息，比如配置信息中包括运营商信息或合作运营商信息、Routing Indicator和身份信息中的路由字段部分的对应关系。
当所有的AUSF、UDM/ARPF/SIDF都可以处理FN-RG的接入的第二种情况下，Routing indicator可以为默认值，比如为0。
在又一种示例中，SUCI中还可以包括公钥标识符，所述公钥标识符所标识的公钥用于对所述永久身份标识中的第二部分信息进行加密。所述公钥标识符从W-AGF的配置信息中获得的。W-AGF的配置信息中包括公钥标识符与公钥的对应关系。
一种情况中：W-AGF支持接入1个运营商时，采用的公钥不作限制，即不同的FN-RG可以采用相同或者不同的公钥。则W-AGF在确定公钥标识符，可以从配置的1个或多个公钥标识符中选择一个。
另一种情况中，在W-AGF支持接入多个运营商的情况下，不同的运营商所采用的公钥可以不同，则W-AGF的配置信息中还可以包括的运营商的信息与公钥标识符(或者公钥)的对应关系，从而W-AGF可以根据所述FN-RG所属的运营商的信息，或者合作运营商信息从所述W-AGF的配置信息中获得的公钥标识符。
示例性地，公钥标识符，可以是图2B或者图2C所示的SUCI结构中的Home Network Public Key Id，是对Scheme output的输入进行加密所采用的密钥。
在又一种情况下，如果W-AGF没有被配置公钥，则W-AGF选择NULL Scheme方式。
SUCI中还可以包括安全保护机制标识符。安全保护机制标识符可以用于指示对Scheme output的输入所采用的安全保护机制。例如，安全保护机制标识符可以是图2B或者图2C所示的SUCI结构中的Protection scheme Id。Home Network Public Key Id具体的确定方式可以参见图2B或者图2C所示的Protection scheme Id的确定方式。
需要说明的是，W-AGF可以仅配置一种安全保护机制，SUCI中可以不包括安全保护机制标识符，即采用配置的该安全保护机制对Scheme output的输入进行加密。示例性地，如果W-AGF没有被配置安全保护机制，则W-AGF只能选择NULL Scheme。
可选地，即使W-AGF中配置了公钥，运营商也可以通过配置使W-AGF选择NULL Scheme。当然若W-AGF无法找到FN-RG的标识信息或者W-AGF确定的运营商的信息对应的公钥，W-AGF也选择NULL Scheme。在选择NULL Scheme的情况下，Home Network Public Key Id可以添加0。
S903，所述W-AGF向移动网的AMF发送第二请求消息，所述第二请求消息用于请求将所述FN-RG注册到核心网，所述第二请求消息中可以携带所述SUCI。第二请求消息中还可以携带第一鉴权成功指示，所述第一鉴权成功指示用于指示所述W-AGF确定所述FN-RG为合法的接入设备。
示例性地，通信***中可能不是所有的AMF都可以处理FN-RG的接入，在该情况下，一种方式是，W-AGF中可以配置有用于处理FN-RG的接入的一个或者多个AMF的标识信息，从而W-AGF可以从配置信息中选择一个AMF的标识信息，将该第二请求消息发送给选择的AMF的标识信息对应的AMF。另一种方式是W-AGF中可以配置好用于选择能够处理FN-RG的接入的AMF的选择策略，从而W-AGF根据选择策略选择能够处理FN-RG的接入的AMF，并将该第二请求消息发送给选择的AMF。
S904，AMF向AUSF发送第一服务请求消息。第一服务请求消息中包括SUCI。若第二请求消息携带第一鉴权成功指示，则第一服务请求消息中携带第一鉴权成功指示。示例性地，该第一服务请求消息可以是Nausf_UEAuthentication_Authenticate Request，也可以是其他类型的服务请求消息，比如，第一服务请求消息可以是一条专门为FN-RG提供服务的服务请求消息，比如Nausf_FN-RGAuthentication_Authenticate Request。
示例性地，SUCI中包括Routing Indicator，AMF可以根据SUCI中的Routing Indicator和/或Homenetwork identifier(或Releam部分)确定AUSF，并向选择的AUSF发送第一服务请求消息。
进一步地，若SUCI中的Routing Indicator为0，那么AMF可以根据第一鉴权成功指示确定所述第二请求消息属于FN-RG注册流程，根据预配置的信息选择可以为这个FN-RG服务的AUSF。比如，预配置的信息可以是预先配置的能够处理FN-RG的接入的AUSF的标识信息，或者是用于选择能够处理FN-RG的接入的AUSF的选择策略。也就是说，SUCI 中的Routing Indicator为0时，确定AUSF和UDM/ARPF/SIDF的是AMF，不再是根据SUCI中携带的Routing Indicator。示例性地，AMF可以进一步将SUCI中的Routing Indicator替换成可以找到AUSF和UDM/ARPF/SIDF的相应值。另一种理解是，如果Routing Indicator为0，那么AMF可以任意选择AUSF。
S905，AUSF向UDM发送第二服务请求消息。第二服务请求消息中包括SUCI。若第一服务请求消息携带第一鉴权成功指示，则第二服务请求消息中携带第一鉴权成功指示。示例性地，该第二服务请求消息可以是Nudm_UEAuthentication_Get Request，也可以是其他类型的服务请求消息，比如，第一服务请求消息可以是一条专门为FN-RG提供服务的服务请求消息，比如Nudm_FN-RGAuthentication_Get Request。
示例性地，SUCI中包括Routing Indicator，AUSF可以根据SUCI中的Routing Indicator和/或Home network identifier(或Releam部分)确定UDM，并向选择的UDM发送所述第二服务请求消息。
进一步地，若SUCI中的Routing Indicator为0，那么AUSF可以将第二服务请求消息发送给任意一个UDM。比如，AUSF可以根据第一鉴权成功指示确定所述第一服务请求消息属于FN-RG注册流程，根据预配置的信息或者其他网元反馈的信息选择可以为这个FN-RG服务的UDM。比如，预配置的信息可以是预先配置的能够处理FN-RG的接入的DUM的标识信息，或者是用于选择能够处理FN-RG的接入的UDM的选择策略。也就是说，SUCI中的Routing Indicator为0时，确定UDM/ARPF/SIDF的是AUSF，不再是根据SUCI中携带的Routing Indicator。示例性地，AMF可以进一步将SUCI中的Routing Indicator替换成可以找到UDM/ARPF/SIDF的相应值。比如，通过网络存储功能(network repository function，NRF)网元反馈的UDM信息。
S906，UDM根据所述第二服务请求消息中的SUCI获得FN-RG的SUPI。
一种方式是，UDM从SUCI中直接获得SUPI。另一种方式是，UDM从SUCI获得FN-RG的身份信息或者FN-RG身份信息的一部分，然后在根据获得的FN-RG的身份信息或者FN-RG身份信息的一部分获取SUPI。示例性地，如果FN-RG要使用FN-RG的身份信息或者FN-RG的身份信息的一部分生成SUPI，那么UDM就需要通过SUCI获取FN-RG的身份信息或者FN-RG的身份信息的一部分，然后再根据FN-RG的身份信息或者FN-RG的身份信息的一部分生成SUPI。
示例性的，W-AGF在生成SUCI时，SUCI中包括用于确定SUPI的两部分信息，分别为第一部分信息和第二部分信息，则UDM可以通过SUCI中的这两部分信息得到FN-RG的身份信息或者FN-RG身份信息的一部分，或通过这两部分信息直接获得FN-RG的SUPI或者FN-RG的SUPI的一部分。
需要说明的是，本申请实施例中，SUCI和SUPI的采用的格式可以相同也可以不同，比如，两者均采用NAI格式，再比如，两者均采用用于针对不具有NAS能力的接入设备所采用的格式，比如称为无NAS接入指示符(Non-NAS access identifier，NNAI)，当然采用其它的称呼，本申请实施例对此不作具体限定。示例性地，在应用到固网时，两者可以均采用针对固网设备定义的格式，比如可以称为固网接入指示符(fix access identifier，FAI)或者称为，当然还可以是其它的称呼，本申请对此不作具体限定。后续描述时以NNAI为例。再比如两者采用的格式不同，一个采用NAI，另一种采用NNAI。NNAI格式可以为指示固网接入的SUPI Type和身份信息2部分构成。身份信息采用NAI格式。NAI格式的 身份信息部分可以是直接将固网身份信息使用在5G核心网中，即5G核心网可以认识、处理原始的固网身份信息。比如，固网身份信息直接为Line ID，或者HFC Identifier；也可以是Line ID，或HFC Identifier等类型的固网身份信息结合其他信息后的具有5G核心网内唯一性的身份信息。NAI格式的域名部分可以是NSI格式的SUPI的域名，还可以是结合了其他信息具的域名。进一步地，NNAI可以与SUPI Type绑定。比如，若SUPI Type采用了一个新定义的值，那么这个值对应的固网身份信息的格式就是NNAI格式。NNAI在5G核心网中可以是固定长度的，比如32bit。如果FN-RG的身份信息大于32bit，则可以选择直接使用一部分FN-RG的身份信息写入NNAI中。写入方法会提前规定好。如果FN-RG的身份信息小于等于32bit，那么可以直接把FN-RG的身份信息写入NNAI中。既可以从高位往低位写，又可以从低位往高位写。没有写满的部位自动填充特殊值，比如为0。
如下示例性的描述根据SUCI获得SUPI的方式：
方式一，UDM可以将SUCI中的用于确定SUPI的两部分信息组合得到FN-RG的身份信息或者FN-RG身份信息的一部分，FN-RG的身份信息或者FN-RG身份信息的一部分可以直接作为SUPI或者SUPI的一部分。
方式一可以适用于SUCI与SUPI采用的格式相同的情况。
比如，SUCI和SUPI均可以采用NAI格式，则在使用NULL scheme的时候，假设NAI格式的SUCI可以为[email protected]。那么第一部分信息可以为user17，第二部分信息为@example.com。因此可以将user17和@example.com合并再添加SUCI中包括的SUPI type(type2)获得SUPI。再比如，第一部分信息为type2，第二部分信息为[email protected]，因此可以将type2和[email protected]组合获得SUPI。其中的user17就是FN-RG的原始身份信息LineID或FN-RG的身份信息。
再比如，SUCI和SUPI均可以采用固网设备新定义的格式NNAI。假设SUCI占用32bit，从32bit中截取其中用于确定SUPI的两部分信息得到SUPI。比如，第一部分信息为SUPI type，第二部分信息可以是FN-RG的身份信息(或者身份信息的一部分)或者身份信息(或者身份信息的一部分)经过格式转换后的信息。FN-RG的身份信息可以采用与SUCI相同的格式，则第二部分信息可以是FN-RG的身份信息(或者身份信息的一部分)，FN-RG的身份信息也可以采用与SUCI不同的格式，则第二部分信息可以是身份信息(或者身份信息的一部分)经过格式转换后的信息。
示例性的，SUCI中用于确定SUPI的第一部分信息和第二部分信息可以是采用S902中的第一种方式或者第二种方式或者第五种方式获得的。
方式二，将SUCI中用于确定SUPI的第二部分信息解密，并将解密后的第二部分信息与第一部分信息组合得到FN-RG的身份信息或者FN-RG身份信息的一部分，或者获得FN-RG的身份信息对应的SUPI或者FN-RG身份信息对应的SUPI的一部分。
示例性地，SUCI中用于确定SUPI的第一部分信息和第二部分信息可以是采用S902中的第三种方式或者第四种方式或者第五种方式获得的。
方式二与方式一类似，可以适用于SUCI与SUPI采用的格式相同的情况。方式一类比于SUCI是采用NULL Scheme生成的，获取SUPI时无需解密操作，则方式三，在解析SUPI时，可以相当于选择了一个安全保护机制(profile)，采用该安全保护机制解密得到。
方式三，将SUCI的用于确定SUPI的第一部分信息和第二部分信息进行格式转换并组 合得到FN-RG的身份信息或者FN-RG身份信息的一部分，或者得到FN-RG的SUPI或者SUPI的一部分。
方式三可以适用SUCI与SUPI采用的格式不同的情况下。SUCI的格式可以FN-RG身份信息的格式相同也可以不同。如果SUCI的格式与FN-RG身份信息的格式相同，则从第一部分信息和第二部分信息可以直接获得FN-RG的身份信息或者身份信息的一部分。然后对FN-RG的身份信息或者身份信息的一部分进行格式转换得到FN-RG的SUPI或者SUPI的一部分。示例性地，对于格式转换得到SUPI的一部分的情况，在SUCI中可以包括其它部分信息用于构成SUPI，从而从SUCI的其它部分信息获取SUPI的另一部分用来构成SUPI。
如果SUCI的格式与FN-RG身份信息的格式不同，SUPI的格式可以与FN-RG的格式相同，则对第一部分信息和第二部分信息进行格式转换可以获得FN-RG的身份信息或者身份信息的一部分。一种示例中，FN-RG的身份信息或者身份信息的一部分即作为SUPI，另一种示例中，FN-RG的身份信息或者身份信息的一部分可以是构成SUPI的一部分，或者从而FN-RG的身份信息或者身份信息的一部分中截取部分信息作为SUPI。
作为一种示例，SUCI的第一部分信息和第二部分信息可以是采用S902中的第一种方式或者第二种方式或者第五种方式获得的，即可以是直接使用FN-RG的身份信息(或者身份信息的一部分)作为SUCI的第一部分信息和第二部分信息，也可以是FN-RG的身份信息(或者身份信息的一部分)进行格式转换的作为SUCI的第一部分信息和第二部分信息。
方式四，将SUCI的第二部分信息解密并进行格式转换，并将格式转换后的第二部分信息与格式转换后的第一部分信息组合得到FN-RG的身份信息或者FN-RG身份信息的一部分，或获得FN-RG的身份信息对应的SUPI或者FN-RG身份信息对应的SUPI的一部分。
方式一可以适用于SUCI与SUPI采用的格式不同的情况。其中，SUCI的格式可以FN-RG身份信息的格式相同也可以不同。
方式四与方式三类似，可以适用于SUCI与SUPI采用的格式不同的情况。方式三类比于SUCI是采用NULL Scheme生成的，获取SUPI时无需解密操作，则方式四，在解析SUPI时，可以相当于选择了一个安全保护机制(profile)，采用该安全保护机制解密得到。
UDM在获得SUPI后，可以从签约数据库查询FN-RG的SUPI，来确定FN-RG是否为合法的固网设备。比如，通过查询，确定签约数据库中存在这个FN-RG的SUPI，则确定FN-RG为合法的固网设备。示例性地，UDM确定当前服务于固网设备时，可以确定通过特定的方式生成AV或者不生成AV。
UDM可以根据第二服务请求消息确定第二服务请求消息是否属于FN-RG注册流程(或者说根据第二服务请求消息确定是否UDM当前服务于固网设备，比如FN-RG)。比如，根据SUCI中的SUPI type确定第二服务请求消息属于FN-RG注册流程，或者根据固网鉴权结果指示确定第二服务请求消息属于FN-RG注册流程，或者根据第二服务请求消息的类型确定第二服务请求消息属于FN-RG注册流程。一种示例中，可以采用UE的注册核心网的方式，即UDM可以生成一个鉴权向量AV，该鉴权向量可以是设定值，还可以根据FN-RG的SUPI或者FN-RG的身份信息或者身份信息的一部分生成鉴权向量。具体生成方式，以及后续的注册流程参见图10对应的实施例的描述。
另一种示例中，UDM无需生成鉴权向量，本图9所示的实施例中以该方式为例来描 述后续注册流程。
S907，UDM发送第二服务响应消息给AUSF。其中，第二服务响应消息的具体形式与第S905的第二服务请求消息相对应。比如，S905中第二服务请求消息为Nudm_UEAuthentication_Get Request消息，则S907中的第二服务响应消息为Nudm_UEAuthentication_Get Response消息。若S907的第二服务请求消息为固网相关的服务化请求消息，则S907的第二服务响应消息为相应的服务化响应消息，比如第二服务请求消息为Nudm_FN-RGAuthentication_Get Request，第二服务响应消息可以为Nudm_FN-RGAuthentication_Get Response。
第二服务响应消息中包括S906中生成的SUPI。
可选地，第二服务响应消息中还携带第二鉴权成功指示。第二鉴权成功指示用于指示UDM进一步确定了FN-RG鉴权成功(或者说进一步确定FN-RG为合法的接入设备)，可以理解为UDM同意FN-RG接入5G核心网。
该第二鉴权成功指示可以与W-AGF上传的第一鉴权成功指示相同，也可以由UDM重新生成。因此，UDM的确定方法可以直接信任W-AGF上传的指示信息，也可以进一步查找签约数据库，确定FN-RG是否合法。比如可以接入5G核心网的FN-RG的签约信息存储在UDM的数据库中，从而UDM可以根据SUPI查找数据库，确定当前FN-RG是可以接入5G核心网的。UDM再结合其固网鉴权成功的指示(第一鉴权成功指示)，因此UDM确定允许该FN-RG接入5G核心网，换句话说，FN-RG在5G核心网鉴权成功(或者说FN-RG在5G核心网是合法的接入设备)。
需要说明的是，本申请实施例中以接入设备接入到5G核心网为例进行说明，当然还可以应用于未来的核心网***，比如6G核心网。
AUSF在接收到第二服务响应消息后，根据第二服务响应消息确定不再发起鉴权流程，直接执行S908。具体的，AUSF根据SUPI type确定不发起鉴权流程(也就是跳过对FN-RG的鉴权流程)，换句话说，第二服务响应消息中的SUPI type指示所述AUSF跳过鉴权流程。或者AUSF根据第二鉴权成功指示确定不发起鉴权流程(换句话说，第二服务响应消息中的第二鉴权成功指示用于指示所述AUSF跳过鉴权流程，或者用于指示FN-RG在5G核心网为合法的接入设备，从而所述AUSF认为无需再执行鉴权操作)，或者AUSF根据SUPI type和第一鉴权成功指示，确定不发起鉴权流程，换句话说，第二服务响应消息中的SUPI type和第一鉴权成功指示共同指示所述AUSF跳过鉴权流程。或者，当第二服务响应消息为固网相关的服务化响应消息时，AUSF可以根据第二服务响应消息的消息类型确定不发起鉴权流程，换句话说，第二服务响应消息的消息类型指示所述AUSF跳过鉴权流程。
S908，AUSF向AMF发送第一服务响应消息。其中，第一服务响应消息的具体形式与第S904的第一服务请求消息相对应。比如，S904中第一服务请求消息为Nausf_UEAuthentication_Authenticate Request消息，则S908中的第一服务响应消息为Nausf_UEAuthentication_Authenticate Response消息。若S904的第一服务请求消息为固网相关的服务化请求消息，则S908的第一服务响应消息为相应的服务化响应消息，比如第一服务请求消息为Nausf_FN-RGAuthentication_Authenticate Request，第一服务响应消息可以为Nausf_FN-RGAuthentication_Authenticate Response。
第一服务响应消息中携带SUPI，还可以携带第二鉴权成功指示。
S909，AMF将SUPI存储下来。
AMF判断不进行鉴权流程和/或是否需要进行安全激活流程。安全激活流程就是NAS SMC流程。AMF的判断方法可以参考步骤S908AUSF判断方法。AUSF判断不需要进行鉴权流程，则对应的AMF判断不需要进行鉴权流程和/或是否需要进行安全激活流程。
S910，AMF进行其余的注册流程，与现有类似，此处不再赘述。
S911，AMF为W-AGF分配5G-GUTI。并发送第二完成消息给W-AGF。第二完成消息中含有5G-GUTI。
在S902中W-AGF生成SUCI时，直接根据FN-RG的身份信息生成SUCI。若采用这种方式，则W-AGF在收到第二完成消息后，需要采用与UDM生成SUPI同样的方式生成SUPI。在S902中W-AGF生成SUCI可以先根据FN-RG的身份信息生成SUPI，再根据SUPI生成SUCI。若采用这种方式，则W-AGF在收到第二完成消息后，无需再生成SUPI，直接执行S912。
S912，W-AGF保存5G-GUTI，并向FN-RG发送第一完成消息。可选地，若5G核心网无法直接使用或识别FN-RG的身份信息的情况下，并且若W-AGF之前没有生成SUPI，则在此步生成SUPI。若5G核心网可以直接使用或识别FN-RG的身份信息的情况下，则W-AGF可以不需要生成SUPI。但是如果为了与UE的注册方式兼容，则可以生成SUPI。
可选地，第一完成消息中包括5G-GUTI。
参见图10所示，为本申请实施例提供的另一种注册方法流程示意图。
S1001-S1006，参见S901-S906。
S1007，所述UDM生成鉴权向量。
一种示例中，鉴权向量为设定值，比如鉴权向量可以是全0或全1的鉴权向量AV。
可选地，UDM确定FN-RG在固网鉴权成功后，再生成设定值的鉴权向量AV。
另一种示例中，由于UDM/ARPF/SIDF的配置信息中并没有固网设备的长期密钥K，因此无法从UDM/ARPF/SIDF中获取长期密钥K再通过EAP-AKA’或者5G AKA的方式生成鉴权向量。本申请提供另一种方式，基于FN-RG的身份信息或者FN-RG的SUPI来生成鉴权向量。如下示例性的描述几种基于FN-RG的身份信息或者FN-RG的SUPI来生成鉴权向量的方式：
第一方式：对FN-RG的身份信息的全部信息或者身份信息的部分信息或者FN-RG的SUPI进行演变处理，演变处理后的值作为长期密钥K，基于长期密钥K生成鉴权向量。示例性地，基于确定的长期密钥K采用EAP-AKA’或者5G AKA的鉴权方式生成鉴权向量。
第二方式：对FN-RG的身份信息的全部信息或者身份信息的部分信息或者FN-RG的SUPI进行演变处理，演变处理后的值作为Kausf，再基于Kausf生成鉴权向量。
以基于Kausf采用5G AKA的鉴权方式为例，所述鉴权向量包括第一期望响应XRES*、第一认证令牌AUTN、认证服务秘钥Kausf和随机数RAND，所述第一期望响应XRES*和第一认证令牌AUTN均为预设值，比如均为0。
以基于Kausf采用EAP-AKA’的鉴权方式为例，所述鉴权向量包括第二期望响应XRES、第二认证令牌AUTN、认证服务秘钥Kausf和随机数RAND，所述第二期望响应XRES和第二认证令牌AUTN均为预设值，比如均为0。
第三方式：对FN-RG的身份信息的全部信息或者身份信息的部分信息或者FN-RG的SUPI进行演变处理，演变处理后的值作为CK和IK，在基于CK和IK生成鉴权向量。
以基于Kausf采用5G AKA的鉴权方式为例，所述鉴权向量包括第一期望响应XRES*、 第一认证令牌AUTN、CK、IK和随机数RAND，所述第一期望响应XRES*和第一认证令牌AUTN均为预设值，比如均为0。
以基于Kausf采用EAP-AKA’的鉴权方式为例，所述鉴权向量包括第二期望响应XRES、第二认证令牌AUTN、CK’、IK’和随机数RAND，所述第二期望响应XRES和第二认证令牌AUTN均为预设值，比如均为0。CK’、IK’基于CK和IK推演得到。
S1008，UDM发送第二服务响应消息给AUSF。其中，第二服务响应消息的具体形式与第S1005的第二服务请求消息相对应。第二服务响应消息中包括S1006中生成的SUPI和鉴权向量。第二服务响应消息中还可以携带第二鉴权成功指示。第二鉴权成功指示用于指示UDM对FN-RG鉴权成功(或者说确定FN-RG为合法的接入设备)。该第二鉴权成功指示可以与W-AGF上传的第一鉴权成功指示相同，也可以由UDM重新生成。
AUSF在接收到第二服务响应消息后，根据第二服务响应消息确定不再发起鉴权流程，直接执行S1009和S1010。具体的，AUSF根据SUPI type确定第二服务响应消息属于FN-RG注册流程，则不发起鉴权流程。或者AUSF根据第二鉴权成功指示确定第二服务响应消息属于FN-RG注册流程，不发起鉴权流程。或者，当第二服务响应消息为固网相关的服务化响应消息时，AUSF可以根据第二服务响应消息的消息类型确定第二服务响应消息属于FN-RG注册流程，则不发起鉴权流程。或者，在鉴权向量为设定值时，AUSF可以根据设定值的鉴权向量来确定第二服务响应消息属于FN-RG注册流程。
S1009，AUSF从鉴权向量中获取Kausf，再根据Kausf推演出Kseaf。
示例性地，AUSF将鉴权向量中的固定一段作为Kausf，比如采用EAP-AKA’鉴权方式，可以将鉴权向量中的CK’和IK’确定为Kausf；再比如采用5G AKA鉴权方式，可以将鉴权向量中的CK和IK确定为Kausf。
当鉴权向量为设定值时，比如全0或全1，则Kausf的全部比特为也是全0或者全1，此时，Kseaf的全部比特也为全0或者全1。
S1010，AUSF向SEAF发送第一服务响应消息。针对第一服务响应消息的消息类型描述参见S908，此处不再赘述。第一服务响应消息中包括Kseaf和SUPI。第一服务响应消息中还可以包括第二鉴权成功指示。
S1011，SEAF根据Kseaf生成Kamf。
当鉴权向量为设定值时，比如全0或全1，Kamf的全部比特位可以与Kseaf相同。当SEAF与AMF为不同的设备时，SEAF将Kamf传递给AMF。可选地，SEAF在判断FN-RG鉴权成功后，将Kamf发送给AMF。SEAF可以根据第二鉴权成功指示判断FN-RG是否为合法的接入设备，或根据Kseaf特殊值判断是否FN-RG为合法的接入设备。
另外，SEAF在S1004接收到第一鉴权成功指示后，保存第一鉴权成功指示，则SEAF根据Kseaf生成Kamf，在根据保存的第一鉴权成功指示判断鉴权成功后，将Kamf传递给AMF。
一种示例中，AMF判断跳过NAS SMC激活流程的方法可以参考步骤S909，此外，AMF还可以根据设定值的Kseaf(比如，全部比特位为0或者全部比特位为1)或设定值的鉴权向量判断跳过NAS SMC激活流程。执行S1012-S1014。
另一种示例中，采用基于FN-RG的身份信息或者FN-RG的SUPI来生成鉴权向量的方式的情况下，AMF可以按照UE的鉴权流程执行，即AMF不跳过NAS SMC激活流程。AMF会进一步使用Kamf生成NAS加密密钥Knasenc和NAS完整性保护密钥Knasint。 具体的NAS SMC激活流程可以参见S601-S605，此处不再赘述。再执行S1012-S1014。
S1012-S1014，参见S910-S012，此处不再赘述。
基于与方法实施例同一发明构思，本申请实施例还提供了一种通信装置，用于执行上述如图9～图10所示的方法实施例中所述安全接入网关(比如W-AGF)执行的方法，相关特征可参见上述方法实施例，此处不再赘述。作为一种示例，如图11所示，所述装置包括接收单元1101和处理单元1102和发送单元1103。
接收单元1101，用于接收接入设备发送的第一请求消息，所述第一请求消息携带所述接入设备的原始身份信息，所述接入设备不具备非接入层NAS能力，所述安全接入网关具备NAS能力；
所述处理单元1102，用于在接收到所述第一请求消后，向核心网发起对所述接入设备的注册流程，根据所述接入设备的身份信息为所述接入设备生成隐藏身份标识，所述接入设备的身份信息仅包括所述原始身份信息，或者所述接入设备的身份信息包括所述原始身份信息和设备相关信息，所述设备相关信息包括所述接入设备的运营商信息、接入设备的接入时间信息和接入设备的位置信息中一项或者多项；
所述发送单元1103，用于向核心网的第一核心网网元发送第二请求消息，所述第二请求消息用于请求将所述接入设备注册到核心网，所述第二请求消息携带所述隐藏身份标识。
在一种可能的设计中，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定。
示例性地，第一部分信息可以是home network identifier，第二部分信息可以是scheme out。
在一种可能的设计中，所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定，包括：
所述第一部分信息为所述接入设备的身份信息中的第一部分，所述第二部分信息为所述接入设备的身份信息中的第二部分，且第一部分和第二部分在所述接入设备的身份信息中不重叠，或者，所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息包括所述接入设备的身份信息中的所述第二部分格式转换后的信息，或者，所述第一部分信息包括所述接入设备的身份信息中的所述第一部分，所述第二部分信息为根据所述接入设备的身份信息中的所述第二部分信息加密得到的，或者，所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息是对所述接入设备的身份信息中的所述第二部分格式转换后的信息再加密得到的。
在一种可能的设计中，所述接入设备的身份信息中的第一部分为：所述接入设备的身份信息中所述设备相关信息或者所述设备相关信息的一部分。
在一种可能的设计中，所述隐藏身份标识还包括所述永久身份标识的类型信息，所述永久身份标识的类型信息指示所述永久身份标识为接入设备的身份标识。
在一种可能的设计中，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；
所述第一部分信息为所述永久身份标识的类型，所述第二部分信息基于所述接入设备的身份信息确定。
在一种可能的设计中，所述隐藏身份标识中还包括路由指示符，所述路由指示符用于确定解密所述隐藏身份标识的核心网网元。
在一种可能的设计中，所述路由指示符为根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
在一种可能的设计中，所述隐藏身份标识还包括公钥标识符，所述公钥标识符所标识的公钥用于对所述接入设备的身份信息中的部分或者全部信息进行加密；所述公钥标识符是根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
在一种可能的设计中，所述第二请求消息中还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示所述安全接入网关确定所述接入设备为合法的接入设备。
具体的关于隐藏身份信息的相关描述可以参见图9所示的实施例，此处不再赘述。
基于与方法实施例同一发明构思，本申请实施例还提供了一种通信装置，应用于第二核心网网元，用于执行上述如图9～图10所示的方法实施例中所述第二核心网网元(UDM/ARPF/SIDF)执行的方法，相关特征可参见上述方法实施例，此处不再赘述。作为一种示例，如图12所示，所述装置包括接收单元1201和处理单元1202和发送单元1203。
接收单元1201，用于接收第三核心网网元发送的服务请求消息，所述服务请求消息包括来自安全接入网关的隐藏身份标识，所述隐藏身份标识指示接入设备的身份信息，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力。
处理单元1202，用于根据所述隐藏身份标识生成所述接入设备的永久身份标识；所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，向所述第三核心网网元发送服务响应消息，所述服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。
在一种可能的设计中，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息和所述第二部分信息是由所述接入设备的身份信息确定的；所述处理单元1202，在根据所述隐藏身份标识生成所述接入设备的永久身份标识时，具体用于根据所述隐藏身份标识的所述第一部分信息和所述第二部分信息生成所述接入设备的永久身份标识。
在一种可能的设计中，所述永久身份标识包括所述第一部分信息和第二部分信息组合后的信息；或者，
所述永久身份标识包括对所述第一部分信息和所述第二部分信息进行格式转换并组合后的信息；或者，
所述永久身份标识包括对所述第二部分信息进行解码并将解密后的第二部分信息与所述第一部分信息组合后的信息；或者，
所述永久身份标识包括对所述第二部分信息进行解码后进行格式转换，以及对所述第一部分信息进行格式转换，将格式转换后的第一部分信息和第二部分信息组合后的信息。
在一种可能的设计中，所述隐藏身份标识还包括所述永久身份标识的类型，则所述永久身份标识还包括所述永久身份标识的类型。
在一种可能的设计中，所述第一部分信息用于指示所述接入设备所注册的运营商的信息，所述第二部分信息用于指示所述接入设备的身份。
在一种可能的设计中，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息为所述永久身份标识的类型，所 述第二部分信息是由所述接入设备的身份信息确定的；
所述处理单元1202，在根据所述隐藏身份标识指示的所述接入设备的身份信息生成所述接入设备的永久身份标识时，具体用于：
所述第二核心网网元将所述第一部分信息以及从所述第二部分信息解析得到的信息组合得到所述接入设备的永久身份标识。
在一种可能的设计中，所述服务请求消息中还包括第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入网关确定所述接入设备为合法的接入设备；
所述处理单元1202，还用于在所述发送单元1203向所述第三核心网网元发送服务响应消息之前，根据所述第一鉴权成功指示确定所述安全接入网关已确定所述接入设备为合法的接入设备。
在一种可能的设计中，所述服务响应消息中包括所述接入设备的永久身份标识，所述永久身份标识包括所述指示信息，所述指示信息为所述永久身份标识的类型。
在一种可能的设计中，所述指示信息为第二鉴权成功指示，所述第二鉴权成功指示用于指示所述接入设备在核心网为合法的接入设备。
在一种可能的设计中，所述服务响应中还包括鉴权向量，所述鉴权向量为设定值。
在一种可能的设计中，所述设定值的鉴权向量作为所述指示信息用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述处理单元1202在根据所述永久身份标识确定所述接入设备为合法的接入设备时，生成鉴权向量，所述鉴权向量包括第一期望响应XRES*、第一认证令牌AUTN、认证服务秘钥Kausf和随机数RAND，所述第一期望响应XRES*和第一认证令牌AUTN均为设定值；其中，所述Kausf是根据所述接入设备的身份信息的部分或者全部信息确定的；或者，所述Kausf是根据所述长久身份标识确定的；或者，所述Kausf是根据第一加密秘钥CK、第一完整性秘钥IK确定的，所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的。
在一种可能的设计中，处理单元1202在根据所述永久身份标识确定所述接入设备为合法的接入设备时，具体用于根据长期密钥K生成鉴权向量，所述长期密钥K是根据所述接入设备的长久身份标识确定的，或者所述长期密钥K是根据所述接入设备的身份信息的部分或者全部信息确定的。
在一种可能的设计中，所述鉴权向量包括第二期望响应XRES、第二认证令牌AUTN、第二加密秘钥CK’、第二完整性秘钥IK’和随机数RAND；
所述第二加密秘钥CK’和第二完整性秘钥IK’是根据第一加密秘钥CK和第一完整性秘钥IK确定的；
所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的，所述第二期望响应XRES和第二认证令牌AUTN均为设定值。
基于与方法实施例同一发明构思，本申请实施例还提供了一种通信装置，应用于第一核心网网元，用于执行上述如图9～图10所示的方法实施例中所述第一核心网网元(AMF/SEAF)执行的方法，相关特征可参见上述方法实施例，此处不再赘述。作为一种 示例，如图13所示，所述装置包括接收单元1301和处理单元1302和发送单元1303。
在安全接入设备向核心网触发对接入设备的注册流程时，发送单元1303向第三核心网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；所述接收单元1301接收所述第三核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示所述第一核心网网元跳过对所述接入设备的鉴权流程的指示信息；所述处理单元1302根据所述永久身份标识为所述接入设备分配全球唯一临时标识GUTI。
在一种可能的设计中，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指示用于指示所述接入设备在所述核心网为合法的接入设备。
基于与方法实施例同一发明构思，本申请实施例还提供了一种通信装置，应用于第三核心网网元，用于执行上述如图9～图10所示的方法实施例中所述第三核心网网元(AUSF)执行的方法，相关特征可参见上述方法实施例，此处不再赘述。作为一种示例，如图14所示，所述装置包括接收单元1401和处理单元1402和发送单元1403。
在安全接入设备向核心网触发对接入设备的注册流程时，发送单元1403向第二核心网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；所述接收单元1401接收所述第二核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。所述处理单元1402根据所述指示信息确定跳过对所述接入设备的鉴权流程，从而直接跳过鉴权流程，节省资源，提高效率。
在一种可能的设计中，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
在一种可能的设计中，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指 示用于指示所述接入设备在所述核心网为合法的接入设备鉴权成功。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
该集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台终端设备(可以是个人计算机，手机，或者网络设备等)或处理器(processor)执行本申请各个实施例该方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
在本申请实施例中，所述安全接入网元和第一核心网网元、第二核心网网元和第三核心网网元均可以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。
在一个简单的实施例中，如图15所示的通信装置1500，包括至少一个处理器1501、存储器1502，可选的，还可以包括通信接口1503。
存储器1502可以是易失性存储器，例如随机存取存储器；存储器也可以是非易失性存储器，例如只读存储器，快闪存储器，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)、或者存储器1502是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1502可以是上述存储器的组合。
本申请实施例中不限定上述处理器1501以及存储器1502之间的具体连接介质。本申请实施例在图中以存储器1502和处理器1501之间通过总线1504连接，总线1504在图中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。该总线1504可以分为地址总线、数据总线、控制总线等。为便于表示，图15中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器1501可以具有数据收发功能，能够与其他设备进行通信，在如图15装置中，也可以设置独立的数据收发模块，例如通信接口1503，用于收发数据；处理器1501在与其他设备进行通信时，可以通过通信接口1503进行数据传输。
一种示例中，当所述安全接入网关采用图15所示的形式时，图15中的处理器1501可以通过调用存储器1502中存储的计算机执行指令，使得所述安全接入网关可以执行上述任一方法实施例中的所述W-AGF执行的方法。
具体的，图11的发送单元、接收单元和处理单元的功能/实现过程均可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现。或者，图11中的处理单元的功能/实现过程可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现，图11的发送单元和接收单元的功能/实现过程可以通过图15中的通信接口1503来实现。
另一种示例中，当所述第二核心网网元采用图15所示的形式时，图15中的处理器1501可以通过调用存储器1502中存储的计算机执行指令，使得所述第二核心网网元可以执行上述任一方法实施例中的所述UDM或者ARPF或者SIDF执行的方法。
具体的，图12的发送单元、接收单元和处理单元的功能/实现过程均可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现。或者，图12中的处理单元的功能/实现过程可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现，图12的发送单元和接收单元的功能/实现过程可以通过图15中的通信接口1503来实现。
又一种示例中，当所述第一核心网网元采用图15所示的形式时，图15中的处理器1501可以通过调用存储器1502中存储的计算机执行指令，使得所述第一核心网网元可以执行上述任一方法实施例中的所述AMF或者SEAF执行的方法。
具体的，图13的发送单元、接收单元和处理单元的功能/实现过程均可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现。或者，图13中的处理单元的功能/实现过程可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现，图13的发送单元和接收单元的功能/实现过程可以通过图15中的通信接口1503来实现。
再一种示例中，当所述第三核心网网元采用图15所示的形式时，图15中的处理器1501可以通过调用存储器1502中存储的计算机执行指令，使得所述第三核心网网元可以执行上述任一方法实施例中的所述AMF或者SEAF执行的方法。
具体的，图14的发送单元、接收单元和处理单元的功能/实现过程均可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现。或者，图14中的处理单元的功能/实现过程可以通过图15中的处理器1501调用存储器1502中存储的计算机执行指令来实现，图14的发送单元和接收单元的功能/实现过程可以通过图15中的通信接口1503来实现。
本领域内的技术人员应明白，本申请的实施例可提供为方法、***、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机 或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (76)

  1. 一种注册方法，其特征在于，包括：
    安全接入网关接收接入设备发送的第一请求消息，所述安全接入网关在接收到所述第一请求消后，向核心网发起对所述接入设备的注册流程，所述第一请求消息携带所述接入设备的原始身份信息，所述接入设备不具备非接入层NAS能力，所述安全接入网关具备NAS能力；
    所述安全接入网关根据所述接入设备的身份信息为所述接入设备生成隐藏身份标识，所述接入设备的身份信息仅包括所述原始身份信息，或者所述接入设备的身份信息包括所述原始身份信息和设备相关信息，所述设备相关信息包括所述接入设备的运营商信息、接入设备的接入时间信息和接入设备的位置信息中一项或者多项；
    所述安全接入网关向核心网的第一核心网网元发送第二请求消息，所述第二请求消息用于请求将所述接入设备注册到核心网，所述第二请求消息携带所述隐藏身份标识。
  2. 如权利要求1所述的方法，其特征在于，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；
    所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定。
  3. 如权利要求2所述的方法，其特征在于，所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定，包括：
    所述第一部分信息为所述接入设备的身份信息中的第一部分，所述第二部分信息为所述接入设备的身份信息中的第二部分，且第一部分和第二部分在所述接入设备的身份信息中不重叠，或者，
    所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息包括所述接入设备的身份信息中的所述第二部分格式转换后的信息，或者，
    所述第一部分信息包括所述接入设备的身份信息中的所述第一部分，所述第二部分信息为根据所述接入设备的身份信息中的所述第二部分信息加密得到的，或者，
    所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息是对所述接入设备的身份信息中的所述第二部分格式转换后的信息再加密得到的。
  4. 如权利要求3所述的方法，其特征在于，所述接入设备的身份信息中的第一部分为：所述接入设备的身份信息中所述设备相关信息或者所述设备相关信息的一部分。
  5. 如权利要求2-4任一项所述的方法，其特征在于，所述隐藏身份标识还包括所述永久身份标识的类型信息，所述永久身份标识的类型信息指示所述永久身份标识为接入设备的身份标识。
  6. 如权利要求1所述的方法，其特征在于，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；
    所述第一部分信息为所述永久身份标识的类型，所述第二部分信息基于所述接入设备的身份信息确定。
  7. 如权利要求2-6所述的方法，其特征在于，所述隐藏身份标识中还包括路由指示符，所述路由指示符用于确定解密所述隐藏身份标识的核心网网元。
  8. 如权利要求7所述的方法，其特征在于，所述路由指示符为根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
  9. 如权利要求1-8任一项所述的方法，其特征在于，所述隐藏身份标识还包括公钥标识符，所述公钥标识符所标识的公钥用于对所述接入设备的身份信息中的部分或者全部信息进行加密；
    所述公钥标识符是根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
  10. 如权利要求1-9任一项所述的方法，其特征在于，所述第二请求消息中还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示所述安全接入网关确定所述接入设备为合法的接入设备。
  11. 一种注册方法，其特征在于，包括：
    第二核心网网元接收第三核心网网元发送的服务请求消息，所述服务请求消息包括来自安全接入网关的隐藏身份标识，所述隐藏身份标识指示接入设备的身份信息，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；
    所述第二核心网网元根据所述隐藏身份标识获取所述接入设备的永久身份标识；
    所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，向所述第三核心网网元发送服务响应消息，所述服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。
  12. 如权利要求11所述的方法，其特征在于，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息和所述第二部分信息是由所述接入设备的身份信息确定的；
    所述第二核心网网元根据所述隐藏身份标识获取所述接入设备的永久身份标识，包括：
    所述第二核心网网元根据所述隐藏身份标识的所述第一部分信息和所述第二部分信息生成所述接入设备的永久身份标识。
  13. 如权利要求12所述的方法，其特征在于，所述永久身份标识包括所述第一部分信息和第二部分信息组合后的信息；或者，
    所述永久身份标识包括对所述第一部分信息和所述第二部分信息进行格式转换并组合后的信息；或者，
    所述永久身份标识包括对所述第二部分信息进行解码并将解密后的第二部分信息与所述第一部分信息组合后的信息；或者，
    所述永久身份标识包括对所述第二部分信息进行解码后进行格式转换，以及对所述第一部分信息进行格式转换，将格式转换后的第一部分信息和第二部分信息组合后的信息。
  14. 如权利要求13所述的方法，其特征在于，所述隐藏身份标识还包括所述永久身份标识的类型，则所述永久身份标识还包括所述永久身份标识的类型。
  15. 如权利要求12-14任一项所述的方法，其特征在于，所述第一部分信息用于指示所述接入设备所注册的运营商的信息，所述第二部分信息用于指示所述接入设备的身份。
  16. 如权利要求11所述的方法，其特征在于，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息为所述永久身份标识的类型，所述第二部分信息是由所述接入设备的身份信息确定的；
    所述第二核心网网元根据所述隐藏身份标识获取所述接入设备的永久身份标识，包括：
    所述第二核心网网元将所述第一部分信息以及从所述第二部分信息解析得到的信息组合得到所述接入设备的永久身份标识。
  17. 如权利要求11-16任一项所述的方法，其特征在于，所述服务请求消息中还包括第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入网关确定所述接入设备为合法的接入设备；
    在向所述第三核心网网元发送服务响应消息之前，还包括：
    所述第二核心网网元根据所述第一鉴权成功指示确定在安全接入网关上所述接入设备为合法的接入设备。
  18. 如权利要求11-17任一项所述的方法，其特征在于，所述服务响应消息中包括所述接入设备的永久身份标识，所述永久身份标识包括所述指示信息，所述指示信息为所述永久身份标识的类型。
  19. 如权利要求11-18任一项所述的方法，其特征在于，所述指示信息为第二鉴权成功指示，所述第二鉴权成功指示用于指示所述接入设备在核心网为合法的接入设备。
  20. 如权利要求11-19任一项所述的方法，其特征在于，所述服务响应中还包括鉴权向量，所述鉴权向量为设定值。
  21. 如权利要求20所述的方法，其特征在于，所述设定值的鉴权向量作为所述指示信息用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  22. 如权利要求11-19任一项所述的方法，其特征在于，还包括：
    所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，生成鉴权向量，所述鉴权向量包括第一期望响应XRES*、第一认证令牌AUTN、认证服务秘钥Kausf和随机数RAND，所述第一期望响应XRES*和第一认证令牌AUTN均为设定值；
    其中，所述Kausf是根据所述接入设备的身份信息的部分或者全部信息确定的；或者，
    所述Kausf是根据所述长久身份标识确定的；或者，
    所述Kausf是根据第一加密秘钥CK、第一完整性秘钥IK确定的，所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的。
  23. 如权利要求11-19任一项所述的方法，其特征在于，还包括：
    所述第二核心网网元在根据所述永久身份标识确定所述接入设备为合法的接入设备时，所述第二核心网网元根据长期密钥K生成鉴权向量，所述长期密钥K是根据所述接入设备的长久身份标识确定的，或者所述长期密钥K是根据所述接入设备的身份信息的部分或者全部信息确定的。
  24. 如权利要求11-19任一项所述的方法，其特征在于，所述鉴权向量包括第二期望响应XRES、第二认证令牌AUTN、第二加密秘钥CK’、第二完整性秘钥IK’和随机数RAND；
    所述第二加密秘钥CK’和第二完整性秘钥IK’是根据第一加密秘钥CK和第一完整性秘钥IK确定的；
    所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的，所述第二期望响应XRES和第二认证令牌AUTN均 为设定值。
  25. 一种注册方法，其特征在于，包括：
    在安全接入设备向核心网触发对接入设备的注册流程时，第一核心网网元向第三核心网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；
    所述第一核心网网元接收所述第三核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示所述第一核心网网元跳过对所述接入设备的鉴权流程的指示信息；
    所述第一核心网网元根据所述永久身份标识为所述接入设备分配全球唯一临时标识GUTI。
  26. 如权利要求25所述的方法，其特征在于，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  27. 如权利要求25所述的方法，其特征在于，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  28. 如权利要求25所述的方法，其特征在于，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
    所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  29. 如权利要求25-28任一项所述的方法，其特征在于，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指示用于指示所述接入设备在所述核心网为合法的接入设备。
  30. 一种注册方法，其特征在于，包括：
    在安全接入设备向核心网触发对接入设备的注册流程时，第三核心网网元向第二核心网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；
    所述第三核心网网元接收所述第二核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。
  31. 如权利要求30所述的方法，其特征在于，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  32. 如权利要求30所述的方法，其特征在于，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  33. 如权利要求30所述的方法，其特征在于，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
    所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  34. 如权利要求30-33任一项所述的方法，其特征在于，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指示用于指示所述接入设备在所述核心网为合法的接入设备鉴权成功。
  35. 一种通信装置，其特征在于，包括：
    接收单元，用于接收接入设备发送的第一请求消息，所述第一请求消息携带所述接入设备的原始身份信息，所述接入设备不具备非接入层NAS能力，所述接收单元所属的安全接入网关具备NAS能力；
    处理单元，用于在所述接收单元接收到所述第一请求消后，向核心网发起对所述接入设备的注册流程；
    所述处理单元，还用于根据所述接入设备的身份信息为所述接入设备生成隐藏身份标识，所述接入设备的身份信息仅包括所述原始身份信息，或者所述接入设备的身份信息包括所述原始身份信息和设备相关信息，所述设备相关信息包括所述接入设备的运营商信息、接入设备的接入时间信息和接入设备的位置信息中一项或者多项；
    发送单元，用于向核心网的第一核心网网元发送第二请求消息，所述第二请求消息用于请求将所述接入设备注册到核心网，所述第二请求消息携带所述隐藏身份标识。
  36. 如权利要求35所述的装置，其特征在于，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；
    所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定。
  37. 如权利要求36所述的装置，其特征在于，所述第一部分信息和所述第二部分信息由所述接入设备的身份信息确定，包括：
    所述第一部分信息为所述接入设备的身份信息中的第一部分，所述第二部分信息为所述接入设备的身份信息中的第二部分，且第一部分和第二部分在所述接入设备的身份信息中不重叠，或者，
    所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息包括所述接入设备的身份信息中的所述第二部分格式转换后的信息，或者，
    所述第一部分信息包括所述接入设备的身份信息中的所述第一部分，所述第二部分信息为根据所述接入设备的身份信息中的所述第二部分信息加密得到的，或者，
    所述第一部分信息是所述接入设备的身份信息中的所述第一部分格式转换后的信息，所述第二部分信息是对所述接入设备的身份信息中的所述第二部分格式转换后的信息再加密得到的。
  38. 如权利要求37所述的装置，其特征在于，所述接入设备的身份信息中的第一部分为：所述接入设备的身份信息中所述设备相关信息或者所述设备相关信息的一部分。
  39. 如权利要求36-38任一项所述的装置，其特征在于，所述隐藏身份标识还包括所述永久身份标识的类型信息，所述永久身份标识的类型信息指示所述永久身份标识为接入设备的身份标识。
  40. 如权利要求35所述的装置，其特征在于，所述隐藏身份标识至少包括用于确定所述接入设备的永久身份标识的第一部分信息和第二部分信息；
    所述第一部分信息为所述永久身份标识的类型，所述第二部分信息基于所述接入设备的身份信息确定。
  41. 如权利要求36-40所述的装置，其特征在于，所述隐藏身份标识中还包括路由指示符，所述路由指示符用于确定解密所述隐藏身份标识的核心网网元。
  42. 如权利要求41所述的装置，其特征在于，所述路由指示符为根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
  43. 如权利要求35-42任一项所述的装置，其特征在于，所述隐藏身份标识还包括公钥标识符，所述公钥标识符所标识的公钥用于对所述接入设备的身份信息中的部分或者全部信息进行加密；
    所述公钥标识符是根据所述接入设备所注册的运营商的信息从所述安全接入网关的配置信息中获得的。
  44. 如权利要求35-43任一项所述的装置，其特征在于，所述第二请求消息中还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示所述安全接入网关确定所述接入设备为合法的接入设备。
  45. 一种通信装置，其特征在于，包括：
    接收单元，用于接收第三核心网网元发送的服务请求消息，所述服务请求消息包括来自安全接入网关的隐藏身份标识，所述隐藏身份标识指示接入设备的身份信息，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；
    处理单元，用于根据所述隐藏身份标识获取所述接入设备的永久身份标识；
    发送单元，用于在所述处理单元根据所述永久身份标识确定所述接入设备为合法的接入设备时，向所述第三核心网网元发送服务响应消息，所述服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。
  46. 如权利要求45所述的装置，其特征在于，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息和所述第二部分信息是由所述接入设备的身份信息确定的；
    所述处理单元，具体用于根据所述隐藏身份标识的所述第一部分信息和所述第二部分信息获取所述接入设备的永久身份标识。
  47. 如权利要求46所述的装置，其特征在于，所述永久身份标识包括所述第一部分信息和第二部分信息组合后的信息；或者，
    所述永久身份标识包括对所述第一部分信息和所述第二部分信息进行格式转换并组合后的信息；或者，
    所述永久身份标识包括对所述第二部分信息进行解码并将解密后的第二部分信息与所述第一部分信息组合后的信息；或者，
    所述永久身份标识包括对所述第二部分信息进行解码后进行格式转换，以及对所述第一部分信息进行格式转换，将格式转换后的第一部分信息和第二部分信息组合后的信息。
  48. 如权利要求47所述的装置，其特征在于，所述隐藏身份标识还包括所述永久身份标识的类型，则所述永久身份标识还包括所述永久身份标识的类型。
  49. 如权利要求46-48任一项所述的装置，其特征在于，所述第一部分信息用于指示所述接入设备所注册的运营商的信息，所述第二部分信息用于指示所述接入设备的身份。
  50. 如权利要求45所述的装置，其特征在于，所述隐藏身份标识至少包括用于生成所述接入设备的永久身份标识的第一部分信息和第二部分信息，所述第一部分信息为所述永久身份标识的类型，所述第二部分信息是由所述接入设备的身份信息确定的；
    所述处理单元，具体用于将所述第一部分信息以及从所述第二部分信息解析得到的信息组合得到所述接入设备的永久身份标识。
  51. 如权利要求45-50任一项所述的装置，其特征在于，所述服务请求消息中还包括第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入网关确定所述接入设备为合法的接入设备；
    所述处理单元，还用于在所述发送单元向所述第三核心网网元发送服务响应消息之前，根据所述第一鉴权成功指示确定在安全接入网关上所述接入设备为合法的接入设备。
  52. 如权利要求45-51任一项所述的装置，其特征在于，所述服务响应消息中包括所述接入设备的永久身份标识，所述永久身份标识包括所述指示信息，所述指示信息为所述永久身份标识的类型。
  53. 如权利要求45-52任一项所述的装置，其特征在于，所述指示信息为第二鉴权成功指示，所述第二鉴权成功指示用于指示所述接入设备在核心网为合法的接入设备。
  54. 如权利要求45-53任一项所述的装置，其特征在于，所述服务响应中还包括鉴权向量，所述鉴权向量为设定值。
  55. 如权利要求54所述的装置，其特征在于，所述设定值的鉴权向量作为所述指示信息用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  56. 如权利要求45-53任一项所述的装置，其特征在于，所述处理单元还用于：
    在根据所述永久身份标识确定所述接入设备为合法的接入设备时，生成鉴权向量，所述鉴权向量包括第一期望响应XRES*、第一认证令牌AUTN、认证服务秘钥Kausf和随机数RAND，所述第一期望响应XRES*和第一认证令牌AUTN均为设定值；
    其中，所述Kausf是根据所述接入设备的身份信息的部分或者全部信息确定的；或者，
    所述Kausf是根据所述长久身份标识确定的；或者，
    所述Kausf是根据第一加密秘钥CK、第一完整性秘钥IK确定的，所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的。
  57. 如权利要求45-53任一项所述的装置，其特征在于，所述处理单元，还用于在根据所述永久身份标识确定所述接入设备为合法的接入设备时，所述第二核心网网元根据长期密钥K生成鉴权向量，所述长期密钥K是根据所述接入设备的长久身份标识确定的，或者所述长期密钥K是根据所述接入设备的身份信息的部分或者全部信息确定的。
  58. 如权利要求45-54任一项所述的装置，其特征在于，所述鉴权向量包括第二期望响应XRES、第二认证令牌AUTN、第二加密秘钥CK’、第二完整性秘钥IK’和随机数RAND；
    所述第二加密秘钥CK’和第二完整性秘钥IK’是根据第一加密秘钥CK和第一完整性秘钥IK确定的；
    所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的身份信息的部分或者全部信息确定的，或者所述第一加密秘钥CK和所述第一完整性秘钥IK均是根据所述接入设备的长久身份标识确定的，所述第二期望响应XRES和第二认证令牌AUTN均为设定值。
  59. 一种通信装置，其特征在于，包括：
    发送单元，用于在安全接入设备向核心网触发对接入设备的注册流程时，向第三核心 网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；
    接收单元，用于接收所述第三核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示所述第一核心网网元跳过对所述接入设备的鉴权流程的指示信息；
    处理单元，用于根据所述永久身份标识为所述接入设备分配全球唯一临时标识GUTI。
  60. 如权利要求59所述的装置，其特征在于，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  61. 如权利要求59所述的装置，其特征在于，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  62. 如权利要求59所述的装置，其特征在于，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
    所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  63. 如权利要求59-62任一项所述的装置，其特征在于，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指示用于指示所述接入设备在所述核心网为合法的接入设备。
  64. 一种通信装置，其特征在于，包括：
    发送单元，用于在安全接入设备向核心网触发对接入设备的注册流程时，向第二核心网网元发送服务请求消息，所述服务请求消息携带所述接入设备的隐藏身份标识，所述接入设备不具备NAS能力，所述安全接入网关具备NAS能力；
    接收单元，用于接收所述第二核心网网元发送的服务响应消息，所述服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述服务响应消息包括用于指示第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。
  65. 如权利要求64所述的装置，其特征在于，所述服务响应消息携带的永久身份标识包括所述指示信息，所述指示信息为永久身份标识的类型，用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  66. 如权利要求64所述的装置，其特征在于，所述服务响应消息的消息类型指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  67. 如权利要求64所述的装置，其特征在于，所述服务请求消息还携带第一鉴权成功指示，所述第一鉴权成功指示用于指示安全接入设备确定所述接入设备为合法的接入设备；
    所述第一鉴权成功指示与所述永久身份标识的类型共同指示所述第三核心网网元跳过对所述接入设备的鉴权流程。
  68. 如权利要求64-67任一项所述的装置，其特征在于，所述服务响应消息还携带第二鉴权成功指示，所述第二鉴权指示用于指示所述接入设备在所述核心网为合法的接入设备鉴权成功。
  69. 一种通信装置，其特征在于，包括通信接口、处理器和存储器；
    所述存储器用于存储计算机执行指令；
    所述处理器用于执行所述存储器所存储的计算机执行指令，以使所述通信装置通过所述通信接口收发消息，并实现如权利要求1至34任一项所述的方法中如下设备的功能：所述安全接入设备，所述第二核心网网元，第一核心网网元，或者第三核心网网元。
  70. 一种计算机可读存储介质，其特征在于，所述存储介质存储有计算机指令，当所述计算机指令被通信装置执行时，使得所述通信装置执行如权利要求1至34中任一项所述的方法。
  71. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机指令，当所述计算机指令被通信装置执行时，使得所述通信装置执行如权利要求1至34中任一项所述的方法。
  72. 一种通信***，其特征在于，包括第二核心网网元和第三核心网网元；
    所述第三核心网网元，用于向第二核心网网元发送第一服务请求消息，所述第一服务请求消息携带接入设备的隐藏身份标识，所述隐藏身份标识指示接入设备的身份信息，所述接入设备不具备NAS能力；
    第二核心网网元，用于接收到第三核心网网元发送的所述第一服务请求消息后，根据所述隐藏身份标识获取所述接入设备的永久身份标识；在根据所述永久身份标识确定所述接入设备为合法的接入设备时，向所述第三核心网网元发送第一服务响应消息，所述第一服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息；
    所述第三核心网网元，还用于接收所述第二核心网网元发送的第一服务响应消息，所述第一服务响应消息携带所述接入设备的隐藏身份标识所对应的永久身份标识，所述第一服务响应消息包括用于指示所述第三核心网网元跳过对所述接入设备的鉴权流程的指示信息。
  73. 如权利要求72所述的***，其特征在于，所述第二核心网网元为统一数据管理UDM，或者，所述第三核心网网元为认证服务功能AUSF。
  74. 如权利要求72或73所述的***，其特征在于，还包括第一核心网网元；
    所述第一核心网网元，用于向所述第三核心网网元发送第二服务请求消息，所述第二服务请求消息携带所述隐藏身份标识；
    所述第三核心网网元，具体用于在接收到所述第二服务请求消息时，向所述第二核心网网元发送所述第一服务请求消息；
    所述第三核心网网元，接收到所述第一服务请求响应时，还用于向所述第一核心网网元发送第二服务响应消息，所述第二服务响应消息包括用于指示所述第一核心网网元跳过对所述接入设备的鉴权流程的指示信息。
  75. 如权利要求74所述的***，其特征在于，还包括安全接入网关；
    所述安全接入网关，用于接收接入设备发送的第一请求消息，在接收到所述第一请求消息后，向核心网发起对所述接入设备的注册流程，根据所述接入设备的身份信息为所述接入设备生成隐藏身份标识，并向核心网的第一核心网网元发送第二请求消息；
    其中，所述第一请求消息携带所述接入设备的原始身份信息，所述接入设备不具备非接入层NAS能力，所述安全接入网关具备NAS能力；所述接入设备的身份信息仅包括所述原始身份信息，或者所述接入设备的身份信息包括所述原始身份信息和设备相关信息， 所述设备相关信息包括所述接入设备的运营商信息、接入设备的接入时间信息和接入设备的位置信息中一项或者多项；所述第二请求消息携带所述隐藏身份标识；
    所述第一核心网网元，具体用于在接收到所述第二请求消息后，向所述第三核心网网元发送所述第二服务请求消息。
  76. 如权利要求74或75所述的***，其特征在于，所述第一核心网网元为接入和移动性控制功能AMF。
PCT/CN2020/087914 2019-04-29 2020-04-29 一种注册方法及通信装置 WO2020221324A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910353248.9A CN111866858A (zh) 2019-04-29 2019-04-29 一种注册方法及通信装置
CN201910353248.9 2019-04-29

Publications (1)

Publication Number Publication Date
WO2020221324A1 true WO2020221324A1 (zh) 2020-11-05

Family

ID=72966144

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/087914 WO2020221324A1 (zh) 2019-04-29 2020-04-29 一种注册方法及通信装置

Country Status (2)

Country Link
CN (1) CN111866858A (zh)
WO (1) WO2020221324A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11956628B2 (en) 2020-11-23 2024-04-09 Cisco Technology, Inc. Openroaming for private communication systems
US11962585B2 (en) 2019-08-20 2024-04-16 Cisco Technology, Inc. Guest onboarding of devices onto 3GPP-based networks with use of realm-based discovery of identity providers and mutual authentication of identity federation peers

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200413253A1 (en) * 2019-06-26 2020-12-31 Qualcomm Incorporated Method and apparatus for enabling 5g services with pre-5g universal integrated circuit card (uicc)
CN112491829B (zh) * 2020-11-13 2023-04-28 中移雄安信息通信科技有限公司 基于5g核心网和区块链的mec平台身份认证方法及装置
CN114554474A (zh) * 2020-11-18 2022-05-27 中国电信股份有限公司 Nsa用户漫游到sa的接入方法、***和网络互通功能实体
CN115226103A (zh) * 2021-04-21 2022-10-21 华为技术有限公司 一种通信方法及装置
CN115915121A (zh) * 2021-08-05 2023-04-04 华为技术有限公司 一种通信方法以及相关装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108683510A (zh) * 2018-05-18 2018-10-19 兴唐通信科技有限公司 一种加密传输的用户身份更新方法
CN108934022A (zh) * 2017-05-25 2018-12-04 华为技术有限公司 一种注册方法及装置
EP3468130A1 (en) * 2017-10-06 2019-04-10 Gemalto Sa A method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, corresponding security element, physical or virtual element and terminal cooperating with this security element

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108934022A (zh) * 2017-05-25 2018-12-04 华为技术有限公司 一种注册方法及装置
EP3468130A1 (en) * 2017-10-06 2019-04-10 Gemalto Sa A method for transmitting to a physical or virtual element of a telecommunications network an encrypted subscription identifier stored in a security element, corresponding security element, physical or virtual element and terminal cooperating with this security element
CN108683510A (zh) * 2018-05-18 2018-10-19 兴唐通信科技有限公司 一种加密传输的用户身份更新方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
CHINA MOBILE: "Derivation of SUPI from SUCI", 3GPP TSG-CT WG4 MEETING #90 C4-191437, 12 April 2019 (2019-04-12), XP051745256, DOI: 20200709164051A *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11962585B2 (en) 2019-08-20 2024-04-16 Cisco Technology, Inc. Guest onboarding of devices onto 3GPP-based networks with use of realm-based discovery of identity providers and mutual authentication of identity federation peers
US11956628B2 (en) 2020-11-23 2024-04-09 Cisco Technology, Inc. Openroaming for private communication systems

Also Published As

Publication number Publication date
CN111866858A (zh) 2020-10-30

Similar Documents

Publication Publication Date Title
WO2020221324A1 (zh) 一种注册方法及通信装置
JP6707717B2 (ja) デバイスプロビジョニングプロトコル（ｄｐｐ）のためのコンフィギュレータ鍵パッケージ
CN109842880B (zh) 路由方法、装置及***
CN111669276B (zh) 一种网络验证方法、装置及***
US11751049B2 (en) Distributed EAP-TLS authentication for wireless networks with concealed user identities
JP6924848B2 (ja) 鍵生成方法、ユーザ機器、装置、コンピュータ可読記憶媒体、および通信システム
US10798082B2 (en) Network authentication triggering method and related device
EP3709692A1 (en) Routing method, apparatus and system
JP6504630B2 (ja) Ｇｐｒｓシステム鍵強化方法、ｓｇｓｎデバイス、ｕｅ、ｈｌｒ／ｈｓｓ、およびｇｐｒｓシステム
WO2018170617A1 (zh) 一种基于非3gpp网络的入网认证方法、相关设备及***
EP3058694B1 (en) Establishing a secure connection between a master device and a slave device
US10299120B2 (en) Methods and arrangements for identification of user equipments for authentication purposes
JP2018532325A (ja) ユーザ機器ｕｅのアクセス方法、アクセスデバイス、およびアクセスシステム
KR101529115B1 (ko) 하이브리드 네트워크를 위한 프로토콜-특정 키들
WO2014127751A1 (zh) 无线终端配置方法及装置和无线终端
JP2022529837A (ja) パラメータ送信方法及び装置
CN104982053A (zh) 用于获得认证无线设备的永久身份的方法和网络节点
US20190149326A1 (en) Key obtaining method and apparatus
JP6471039B2 (ja) 無線通信システムおよび無線端末
WO2021031053A1 (zh) 一种通信方法、装置及***
CN117501653A (zh) 操作无线网络的装置、***和方法
WO2020147602A1 (zh) 一种认证方法、装置和***
JP2020505845A (ja) 緊急アクセス中のパラメータ交換のための方法およびデバイス
US10390224B2 (en) Exception handling in cellular authentication
WO2014113921A1 (zh) 移动通信***的安全认证的方法和网络设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20798284

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20798284

Country of ref document: EP

Kind code of ref document: A1