WO2021087696A1 - 身份认证方法及通信装置 - Google Patents
身份认证方法及通信装置 Download PDFInfo
- Publication number
- WO2021087696A1 WO2021087696A1 PCT/CN2019/115441 CN2019115441W WO2021087696A1 WO 2021087696 A1 WO2021087696 A1 WO 2021087696A1 CN 2019115441 W CN2019115441 W CN 2019115441W WO 2021087696 A1 WO2021087696 A1 WO 2021087696A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- terminal device
- uas
- authentication
- network device
- network
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/30—Services specially adapted for particular environments, situations or purposes
- H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/50—Secure pairing of devices
Definitions
- the present invention relates to the field of communication, in particular to an identity authentication method and communication device.
- the unmanned aerial system is generally composed of two parts of equipment, namely the unmanned aerial vehicle (UAV) and the remote control of the drone (UAV controller).
- the drone can fly autonomously or by receiving and following the instructions of the remote control.
- data can also be transmitted between the drone and the remote control.
- the drone can send photos and videos to the remote control through aerial photography (including data reception and storage functions).
- the communication (control and data transmission) between the remote control and the UAV is usually carried out through a wireless signal (such as WiFi) point-to-point direct connection.
- mobile communication networks have many commercial advantages: wide area coverage, high reliability, support for high-speed mobility, etc.
- UAV systems can achieve high-reliability flights beyond the visual range.
- the mobile communication network also provides more reliable supervision methods for the regulatory authorities to prevent incidents such as drones interfering with aircraft flight operations and launching terrorist attacks with drones, ensuring the safety of the drone system and the public Safety.
- the UAV system is introduced into the mobile communication network, how to improve the security of the UAV system equipment access and use the mobile communication network is an urgent problem to be solved at present.
- the embodiments of the present invention provide an identity authentication method and device, which can perform UAS authentication on equipment in an unmanned aerial vehicle system in a mobile communication network, which is beneficial to improve the security of the unmanned aerial system equipment accessing and using the mobile communication network.
- an embodiment of the present application provides an identity authentication method.
- the method includes: a first network device receives a first request sent by a first terminal device, the first request carries first authentication indication information, and the first authentication
- the instruction information is used to request UAS certification for the first terminal device, which is a device in the UAS; the first network device sends a second request to the first terminal device, and the second request is used to request Obtain the UAS ID of the first terminal device;
- the first network device receives the UAS ID of the first terminal device sent by the first terminal device, and sends the UAS ID of the first terminal device to the second network device;
- the second network device is based on the UAS ID UAS authentication is performed on the first terminal device;
- the second network device sends the UAS authentication result of the first terminal device to the first network device; the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- the first terminal device can be authenticated based on the UAS identifier of the first terminal device. Since the UAS logo of the first terminal device is the logo configured by the equipment manufacturer for the first terminal device, or the UAS logo of the first terminal device is a UAS service provider/vertical industry is a UAS system user using a UAS system or UAS unmanned The UAV system user/UAS service identification provided by the drone system service/UAS business. Therefore, based on the method described in the first aspect, it is possible to prevent terminal devices produced by equipment manufacturers that have not contracted with operators from using mobile communication networks, or to prevent UAV systems from service providers or vertical industries that have not contracted with operators.
- the user/unmanned aerial vehicle system service/unmanned aerial vehicle system business uses drones (or remote controllers) to access the mobile communication network, which improves the security of the mobile communication network.
- the first authentication indication information is registration type information, or UAS type information of the first terminal device
- the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
- the first network device may also determine whether to perform UAS authentication on the first terminal device; the first network device is specifically determining whether to perform UAS authentication on the first terminal device.
- the second request is sent to the first terminal device. Based on this possible implementation, terminal devices that do not meet UAS certification requirements can be screened out first, and UAS certification is only performed on terminal devices that meet UAS certification requirements, which is beneficial to reducing the authentication workload of the second network device.
- the specific implementation manner for the first network device to determine whether to perform UAS authentication on the first terminal device is: the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device UAS certification. For example, when the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is not yet authenticated, the first network device determines to perform UAS authentication on the first terminal device. When the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is an authentication success or an authentication failure state, it is determined not to perform UAS authentication on the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device determines whether to The specific implementation manner for the first terminal device to perform UAS authentication is: the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
- the UAS type information received by the first network device is consistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
- the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
- the UAS type information corresponding to the SUPI or GPSI of the first terminal device can be understood as the UAS type supported by the core card in the first terminal device.
- the first network device determines that the UAS type information received by the first network device does not match the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it indicates that the core card (such as the SIM card) in the first terminal device is wrong Used locally or stolen on the first terminal device. Therefore, if the first network device determines that the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, the subsequent UAS authentication process may not be continued. In this way, it can be avoided that the mobile communication network can be used when the first terminal device incorrectly uses the core card or uses the stolen core card.
- the core card such as the SIM card
- the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
- the UAS type information received by the first network device is consistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
- the UAS type information corresponding to SUPI or GPSI can be understood as UAS type information that the core card corresponding to SUPI or GPSI does not support.
- the second network device determines whether to perform UAS authentication on the first terminal device; the second network device performs UAS authentication on the first terminal device.
- the specific implementation manner is: when the second network device determines to perform UAS authentication on the first terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identifier. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the first network device and the second network device.
- the specific implementation manner for the second network device to determine whether to perform UAS authentication on the first terminal device is: the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device UAS certification.
- the specific implementation and beneficial effects of this possible implementation can be found in the specific implementation and beneficial effects that the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device. Go into details.
- the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device may also Send the UAS type information of the first terminal device to the second network device; the specific implementation manner for the second network device to determine whether to perform UAS authentication on the first terminal device is: the second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
- the terminal device performs UAS authentication.
- the specific implementation manner and beneficial effects of this possible implementation manner can participate in the foregoing specific implementation manner and beneficial effects of the first network device determining whether to perform UAS authentication on the first terminal device based on the UAS type information, which will not be repeated here.
- the second request is also used to request to obtain UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS;
- the first network device can also receive the UAS type information of the first terminal device sent by the first terminal device, and the first network device sends the information of the first terminal device to the second network device.
- UAS type information; a specific implementation manner for the second network device to determine whether to perform UAS authentication on the first terminal device is: the second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
- the specific implementation manner and beneficial effects of this possible implementation manner can participate in the foregoing specific implementation manner and beneficial effects of the first network device determining whether to perform UAS authentication on the first terminal device based on the UAS type information, which will not be repeated here.
- the first request also carries the SUCI or GUTI of the first terminal device.
- the first network device can also send the SUPI or GPSI of the first terminal device to the second network device. Or GPSI is obtained based on the SUCI or GUTI of the first terminal device; the second network device determines whether to perform UAS authentication on the first terminal device: the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS identifier and the SUPI or GPSI of the first terminal device Whether to perform UAS authentication on the first terminal device. Based on this possible implementation manner, it is possible to prevent the core card of the first terminal device from being randomly replaced.
- the first network device and the second network device may also update the UAS authentication status identifier of the first terminal device based on the UAS authentication result. In this way, the UAS authentication status of the first terminal device can be found later.
- the method further includes the following steps: the second network device determines the UAS identifier of the second terminal device associated with the first terminal device; The second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device; the second network device sends the UAS authentication result of the second terminal device to the first network device; the first network device sends the UAS authentication result of the second terminal device to the first terminal device.
- the UAS authentication result or association indication information of the second terminal device the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal
- the UAS authentication result of the device is obtained; the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device, or sends the UAS authentication result of the second terminal device and the association indication information. Based on this
- the second network device determines whether to allow UAS authentication for the first terminal device and the second terminal device. If UAS authentication is allowed for the first terminal device and the second terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identity of the first terminal device, and performs UAS authentication on the second terminal device based on the UAS identity of the second terminal device The device is UAS certified.
- the second network device sends instruction information to the first network device, the instruction information indicating that the first terminal device and the second terminal device have failed to associate ,
- the first network device sends the instruction information to the first terminal device and the second terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the second network device may specifically determine whether to allow UAS authentication for the first terminal device and the second terminal device based on the location and distance between the first terminal device and the second terminal device.
- the distance between the first terminal device and the second terminal device may be used as a restriction condition, so that the first terminal device that does not meet the distance restriction condition is rejected for pairing use with the second terminal device. Therefore, there is no need to authenticate the association relationship between the first terminal device and the second terminal device. Based on this possible implementation manner, it is beneficial to enhance security and reduce the authentication workload of the second network device.
- the method further includes the following steps: the second network device determines the UAS identity or the UAS identity of the second terminal device associated with the first terminal device. SUPI or GPSI; the second network device sends the UAS identity or SUPI or GPSI of the second terminal device associated with the first terminal device to the first network device; the first network device receives the UAS identity or SUPI or GPSI of the second terminal device After that, send the UAS identification of the second terminal device to the second network device; the second network device performs UAS authentication on the second terminal device based on the UAS identification of the second terminal device; the second network device sends the second terminal to the first network device The UAS authentication result of the device; after receiving the UAS authentication result of the second terminal device, the first network device sends the UAS authentication result of the second terminal device or the association indication information to the first terminal device, and the association indication information is used to indicate the first terminal The association result between the device and the second terminal device, the association indication information
- the first network device determines whether to perform UAS authentication on the second terminal device. If so, the first network device sends the UAS identifier of the second terminal device to the second network device.
- the first network device sends instruction information to the first terminal device, and the instruction information indicates that the first terminal device and the second terminal device have failed to associate. For example, the first network device may determine whether to perform UAS authentication on the second terminal device based on whether the second terminal device is powered on. For another example, the first network device may determine whether to perform UAS authentication on the second terminal device based on the location and distance between the first terminal device and the second terminal device.
- the first request also carries new association indication information.
- a specific implementation manner for the first network device to send the UAS identification of the first terminal device to the second network device is as follows: the first network device sends the UAS identification of the first terminal device and the new association indication information to the second network device.
- the method further includes the following step: the second network device sends to the first network device a message for acquiring the first association information of the first terminal device Request; the first network device sends to the first terminal device a request for obtaining the first associated information of the first terminal device; the first network device receives the first associated information of the first terminal device sent by the first terminal device; first The network device sends the first association information of the first terminal device to the second network device; the second network device determines that the first association information matches the second association information.
- the specific implementation manner for the second network device to send the UAS authentication result of the first terminal device to the first network device is: the second network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first network device.
- UAS identification or SUPI or GPSI after the first network device receives the UAS authentication result of the first terminal device and the UAS identification or SUPI or GPSI of the second terminal device, the first network device also sends the second terminal device's UAS authentication result or association indication information, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device get.
- the first network device may also send the UAS authentication result or association indication information of the first terminal device to the second terminal device. Based on this possible implementation manner, UAS authentication can be performed on the first terminal device and the second terminal device, and the newly-added association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
- the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the second network device may determine whether to allow the newly-added association relationship of the first terminal device. If the association relationship of the first terminal device is allowed to be added, the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be added, then the indication information for indicating the failure of the new association is sent to the first network device, and the first network device sends the newly added association to the first terminal device. Information indicating that the association failed. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the second network device may also store the association relationship between the first terminal device and the second terminal device.
- the second network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
- the first request also carries new association indication information for requesting a new association relationship.
- the first network device may also perform the following steps: A terminal device sends a request for acquiring the first associated information of the first terminal device; the first network device receives the first associated information sent by the first terminal device; the first network device determines that the first associated information is sent by the second terminal device The second association information matches; the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device, and the association indication information is used to indicate the association result between the first terminal device and the second terminal device.
- the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
- UAS authentication can be performed on the first terminal device and the second terminal device, and the newly-added association relationship between the first terminal device and the second terminal
- the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
- the first network device may also send the association relationship to the second network device for storage.
- the method further includes the following steps:
- the first network device receives the first association request sent by the first terminal device, where the first association request is used to request a new association relationship; the first network device sends the first association request to the second network device; the second network device sends the The first network device sends a first acquisition request; the first network device sends a first acquisition request to the first terminal device; the first network device receives the first association information sent by the first terminal device; the first network device sends the second network device Send the first association information; the first network device receives the second association request sent by the second terminal device, the second association request is used to request a new association relationship; the first network device sends the second association request to the second network device The second network device sends a second acquisition request to the first network device; the first network device sends a second acquisition request to the second terminal device; the first network device receives the second association information sent by the second terminal device; the first network The device sends second association information to the second network device; the second network device determines that the first association information matches the second association information; the second network device sends the
- the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the first network device. After receiving the second association request, the second network device may also determine whether to allow a new association relationship for the second terminal device. If it is determined that it is allowed to add an association relationship for the second terminal device, the second association request is sent to the first network device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the second network device may store the association relationship between the first terminal device and the second terminal device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device.
- the method further includes the following steps: the first network device receives a first association request from the first terminal device, and the first association request is used to request a connection with the first terminal device.
- the second terminal device adds an association relationship; the first network device sends the first association request to the second network device; the second network device sends the first association request to the first network device; the first network device sends to the second terminal device The first association request; the first network device receives the association confirmation instruction information sent by the second terminal device; the first network device sends the association confirmation instruction information to the second network device; the second network device sends the association success to the first network device Indication information; the first network device sends the association success indication information to the first terminal device and the second terminal device. Based on this possible implementation manner, the newly-added association relationship between the first terminal device and the second terminal device can be authenticated.
- the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the first network device. Optionally, otherwise, sending indication information for indicating failure of the newly-added association to the first network device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the second network device may store the association relationship between the first terminal device and the second terminal device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device.
- the first request may also carry the UAS identifier of the first terminal device, so that the first network device does not need to send the second request to the first terminal device, and does not need to receive the first terminal device.
- UAS ID sent in response to the second request.
- the first network device after receiving the first request carrying the first authentication indication information and the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device. Based on this possible implementation manner, through one information exchange, the first network device can obtain the first authentication indication information and the UAS identifier of the first terminal device, which facilitates faster UAS authentication of the first terminal device.
- an embodiment of the present application provides an identity authentication method.
- the method includes: a first network device receives a first request sent by a first terminal device, the first request carries first authentication indication information, and the first authentication
- the instruction information is used to request UAS certification for the first terminal device, which is a device in the UAS; the first network device sends a second request to the first terminal device, and the second request is used to request Obtain the UAS ID of the first terminal device;
- the first network device receives the UAS ID of the first terminal device sent by the first terminal device;
- the first network device sends the UAS ID of the first terminal device to the second network device;
- the first network device Receiving the UAS authentication result of the first terminal device sent by the second network device; the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- the first authentication indication information is registration type information, or UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
- the first network device may also determine whether to perform UAS authentication on the first terminal device; the first network device sends the first terminal device to the first terminal device.
- the specific implementation for sending the second request is: when the first network device determines to perform UAS authentication on the first terminal device, the first network device sends the second request to the first terminal device.
- a specific implementation manner for the first network device to determine whether to perform UAS authentication on the first terminal device is: the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device. UAS certification.
- the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device determines whether A specific implementation manner of performing UAS authentication on the first terminal device is: the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
- the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS; the first network device may also send The second network device sends the UAS type information of the first terminal device.
- the second request is also used to request to obtain UAS type information of the first terminal device, where the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS;
- the first network device can also receive the UAS type information of the first terminal device sent by the first terminal device; the first network device can also send the first terminal device to the second network device UAS type information of the device.
- the first network device updates the UAS authentication status of the first terminal device based on the UAS authentication result.
- the method further includes the following steps: the first network device receives the second network device associated with the first terminal device sent by the second network device.
- the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device As a result, or send the UAS authentication result and association indication information of the second terminal device.
- UAS authentication can be performed on the first terminal device and the second terminal device, and the stored association relationship between the first terminal device and the second terminal device can be authenticated or authorized, avoiding any two
- the pairing of devices is helpful to improve the security of the mobile communication network.
- the method further includes the following step: the first network device receives the second terminal device's UAS ID sent by the second network device UAS ID or SUPI or GPSI; send the UAS ID of the second terminal device to the second network device; after receiving the UAS authentication result of the second terminal device, the first network device sends the UAS authentication result of the second terminal device to the first terminal device Or association indication information, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; A network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information to the second terminal device.
- the first network device determines whether to perform UAS authentication on the second terminal device. If so, the first network device sends the UAS identifier of the second terminal device to the second network device.
- the first network device sends instruction information to the first terminal device, and the instruction information indicates that the first terminal device and the second terminal device have failed to associate. For example, the first network device may determine whether to perform UAS authentication on the second terminal device based on whether the second terminal device is powered on. For another example, the first network device may determine whether to perform UAS authentication on the second terminal device based on the location and distance between the first terminal device and the second terminal device.
- the first request also carries new association indication information.
- a specific implementation manner for the first network device to send the UAS identification of the first terminal device to the second network device is as follows: the first network device sends the UAS identification of the first terminal device and the new association indication information to the second network device. After the first network device sends the UAS identifier of the first terminal device and the new association indication information to the second network device, the method further includes the following steps: the first network device sends to the first terminal device the information used to obtain the first terminal device A request for the first association information; the first network device receives the first association information of the first terminal device sent by the first terminal device; the first network device sends the first association information of the first terminal device to the second network device.
- the specific implementation manner for the first network device to receive the UAS authentication result of the first terminal device sent by the second network device is as follows: the first network device receives the UAS authentication result of the first terminal device and the second terminal sent by the second network device The UAS ID or SUPI or GPSI of the device; after the first network device receives the UAS authentication result of the first terminal device and the UAS ID or SUPI or GPSI of the second terminal device, the first network device also sends the second terminal to the first terminal device
- the UAS authentication result or association indication information of the device the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the UAS of the second terminal device
- the certification result is obtained.
- the first network device may also send the UAS authentication result or association indication information of the first terminal device to the second terminal device.
- the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the first request also carries new association indication information for requesting a new association relationship.
- the first network device may also perform the following steps: A terminal device sends a request for acquiring the first associated information of the first terminal device; the first network device receives the first associated information sent by the first terminal device; the first network device determines that the first associated information is sent by the second terminal device The second association information matches; the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device, and the association indication information is used to indicate the association result between the first terminal device and the second terminal device.
- the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
- the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device. Based on this possible implementation manner, it is beneficial to reduce the authentication workload of the second network device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
- the first network device may also send the association relationship to the second network device for storage.
- the first request may also carry the UAS identifier of the first terminal device, so that the first network device does not need to send the second request to the first terminal device, and does not need to receive the first terminal device.
- UAS ID sent in response to the second request.
- the first network device after receiving the first request carrying the first authentication indication information and the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device. Based on this possible implementation manner, through one information exchange, the first network device can obtain the first authentication indication information and the UAS identifier of the first terminal device, which facilitates faster UAS authentication of the first terminal device.
- the beneficial effects of the second aspect and the possible implementation manners of the second aspect can be referred to the beneficial effects of the foregoing first aspect and the possible implementation manners of the first aspect, which are not repeated here.
- an embodiment of the present application provides an identity authentication method.
- the method includes: a first terminal device sends a first request to a first network device, the first request carries first authentication indication information, and the first authentication indication information is used for To request UAS authentication for the first terminal device; the first terminal device receives the second request sent by the first network device, the second request is used to request the UAS identification of the first terminal device; the first terminal device responds to the second request , Sending the UAS identifier of the first terminal device to the first network device; the first terminal device receives the UAS authentication result of the first terminal device sent by the first network device.
- the first authentication indication information is registration type information, or UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS .
- the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
- the second request is also used to request to obtain the UAS type information of the first terminal device, and the first terminal device may also send the UAS type information of the first terminal device to the first network device.
- the first terminal device may also receive the UAS authentication result of the second terminal device associated with the first terminal device; the first terminal device is based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device.
- the UAS authentication result determines the association result between the first terminal device and the second terminal device.
- the first terminal device may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device.
- the UAS authentication result of the device is obtained.
- the first request also carries new association indication information.
- the first terminal device can also receive the UAS authentication result of the second terminal device; the first terminal device determines the association between the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device result.
- the first terminal device may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS authentication result of the device is obtained.
- the first terminal device receives a request sent by the first network device to obtain the first association information of the first terminal device; the first terminal device sends the first terminal device's first associated information to the first network device.
- One association information the first terminal device can also receive the UAS authentication result of the second terminal device; the first terminal device determines the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device The association result of the terminal device.
- the first terminal device may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS authentication result of the device is obtained.
- the first terminal device after the first terminal device passes UAS authentication, the first terminal device sends a first association request to the first network device, and the first association request is used to request a new association relationship; the first terminal device Receive the first acquisition request sent by the first network device; the first terminal device sends the first association information to the first network device; the first terminal device receives the association success indication information, the association success indication information is used to instruct the first terminal device to communicate with The second terminal device is successfully associated.
- the first terminal device after passing the UAS authentication, sends a first association request to the first network device, and the first association request is used to request a new association relationship with the second terminal device; the first terminal The device receives the indication of successful association.
- the first request may also carry the UAS identifier of the first terminal device, so that the first network device does not need to send the second request to the first terminal device, and does not need to receive the first terminal device. UAS ID sent in response to the second request.
- the beneficial effects of the third aspect and the possible implementation manners of the third aspect can be referred to the beneficial effects of the foregoing first aspect and the possible implementation manners of the first aspect, which will not be repeated here.
- a communication device in a fourth aspect, may be a network device, or a device in a network device, or a device that can be used in conjunction with a network device. Wherein, the communication device may also be a chip system.
- the communication device can perform the method described in the second aspect.
- the function of the communication device can be realized by hardware, or by hardware executing corresponding software.
- the hardware or software includes one or more units corresponding to the above-mentioned functions.
- the unit can be software and/or hardware.
- a communication device may be a terminal device, or a device in a terminal device, or a device that can be matched and used with a terminal device.
- the communication device may also be a chip system.
- the communication device can perform the method described in the third aspect.
- the function of the communication device can be realized by hardware, or by hardware executing corresponding software.
- the hardware or software includes one or more units corresponding to the above-mentioned functions.
- the unit can be software and/or hardware.
- the communication device may be a network device, a device in a network device, or a device that can be matched and used with the network device. Or it can be a chip in a network device.
- the communication device includes a communication interface and a processor, and the communication interface is used for communication between the device and other devices, such as sending and receiving data or signals.
- the communication interface may be a transceiver, circuit, bus, module, or other type of communication interface, and other devices may be terminal devices or network devices.
- the processor is used to call a set of programs, instructions or data to execute the method described in the second aspect above.
- the device may also include a memory for storing programs, instructions or data called by the processor. The memory is coupled with the processor, and when the processor executes instructions or data stored in the memory, the method described in the second aspect can be implemented.
- an embodiment of the present application provides a communication device.
- the communication device may be a terminal device, or a device in a terminal device, or a device that can be matched and used with the terminal device. Or it can be a chip in a terminal device.
- the communication device includes a communication interface and a processor, and the communication interface is used for communication between the device and other devices, such as sending and receiving data or signals.
- the communication interface may be a transceiver, circuit, bus, module, or other type of communication interface, and other devices may be network devices.
- the processor is used to call a set of programs, instructions or data to execute the method described in the third aspect.
- the device may also include a memory for storing programs, instructions or data called by the processor. The memory is coupled with the processor, and when the processor executes instructions or data stored in the memory, the method described in the third aspect can be implemented.
- an embodiment of the present application provides a chip system, which includes a processor and may also include a memory, configured to implement the method described in the second or third aspect.
- the chip system can be composed of chips, or it can include chips and other discrete devices.
- an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium is used to store instructions, and when the instructions are executed, the method described in the first aspect or the third aspect is achieve.
- embodiments of the present application provide a computer program product including instructions, which when executed, enable the method described in the first aspect or the third aspect to be implemented.
- FIG. 1 is a schematic diagram of a 5G system architecture provided by an embodiment of the present application.
- FIG. 2 is a schematic flowchart of a UAV system based on a mobile communication network provided by an embodiment of the present application
- FIG. 3 is a schematic flowchart of an identity authentication method provided by an embodiment of the present application.
- FIG. 4 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 5 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 6 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 7 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 8 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 9 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 10 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 11 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 12 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 13 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 14 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 15 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 16 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 17 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 18 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- FIG. 19 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
- FIG. 20 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
- FIG. 21a is a schematic structural diagram of another communication device provided by an embodiment of the present application.
- FIG. 21b is a schematic structural diagram of another communication device provided by an embodiment of the present application.
- GSM global system of mobile communication
- CDMA code division multiple access
- WCDMA broadband code division multiple access
- GPRS general packet radio service
- LTE long term evolution
- FDD frequency division duplex
- TDD LTE Time division duplex
- UMTS universal mobile telecommunication system
- WiMAX worldwide interoperability for microwave access
- the network architecture shown in Fig. 1 is based on the 5G network architecture based on the service-oriented architecture defined in the 3GPP standardization process as an example.
- the network architecture may include three parts, namely a terminal device part, an operator network, and a data network (DN).
- the terminal equipment part includes terminal equipment 110, which may also be referred to as user equipment (UE).
- the terminal device 110 in the embodiment of the present application is a device with a wireless transceiver function, which can be connected to one or more core networks (CN) via the access network device in the access network (AN) 140 To communicate.
- the terminal device 110 may also be referred to as an access terminal, a terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a wireless network device, a user agent, or a user device.
- the terminal device 110 can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as a ship, etc.); it can also be deployed in the air (such as a plane, a balloon, a satellite, etc.).
- the terminal device 110 may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, or a wireless local loop (WLL).
- SIP session initiation protocol
- WLL wireless local loop
- PDAs personal digital assistants
- PDAs personal digital assistants
- vehicle-mounted devices wearable devices, drones, or the Internet of Things
- car Terminals in networking fifth generation (5G) networks, and terminals of any form in future networks, relay user equipment, or future evolution of public land mobile network (PLMN) A terminal, etc.
- PLMN public land mobile network
- the relay user equipment may be, for example, a 5G residential gateway (RG).
- RG 5G residential gateway
- the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving (self-driving), and a remote Wireless terminals in medical (remote medical), wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, and smart homes Wireless terminal and so on.
- VR virtual reality
- AR augmented reality
- WLAN remote Wireless terminals in medical
- the part of various communication systems operated by operators can be referred to as operator networks.
- the operator’s network can also be called the public land mobile network (PLMN) network. It is a network established and operated by the government or an operator approved by it to provide land mobile communication services to the public, mainly mobile A mobile network operator (MNO) is a public network that provides users with mobile broadband access services.
- the operator network or PLMN network described in the embodiments of this application may specifically be a network that meets the requirements of the 3rd generation partnership project (3rd generation partnership project, 3GPP) standard, referred to as the 3GPP network.
- 3rd generation partnership project 3rd generation partnership project
- 3GPP networks are operated by operators, including but not limited to fifth-generation mobile communication (5th-generation, 5G) networks (referred to as 5G networks), and fourth-generation mobile communication (4th-generation, 4G) networks (referred to as 4G networks) , Third-generation mobile communication technology (3rd-generation, 3G) network (referred to as 3G network) and second-generation wireless telephone technology (2nd-generation wireless telephone technology, 2G) network (referred to as 2G network), etc.
- 5G networks fifth-generation mobile communication
- 4G networks fourth-generation mobile communication (4th-generation, 4G) networks
- 3G network Third-generation mobile communication technology
- 2G network second-generation wireless telephone technology
- an operator network ie, an MNO network
- the operator network can include network exposure function (NEF) 131, network storage function (network function repository function, NRF) 132, policy control function (PCF) 133, unified data management (unified data management, UDM) network element 134, application function (AF) 135, authentication server function (authentication server function, AUSF) 136, access and mobility management function (AMF) 137, session management function ( session management function (SMF) 138, user plane function (UPF) 139, (radio) access network ((radio) access network, (R) AN) 140, etc.
- the part other than the (wireless) access network 140 part may be referred to as a core network (core network, CN) part or a core network part.
- core network core network
- CN core network
- the data network DN 120 may also be referred to as a packet data network (PDN), and is usually a network outside the operator's network, such as a third-party network.
- the operator network can access multiple data network DN 120, and multiple services can be deployed on the data network DN 120, which can provide services such as data and/or voice for the terminal device 110.
- the data network DN 120 may be a private network of a smart factory, the sensors installed in the workshop of the smart factory may be terminal devices 110, and the data network DN 120 may have a sensor control server deployed, and the control server may provide services for the sensors.
- the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
- the data network DN 120 may be the internal office network of a company.
- the mobile phone or computer of the company's employee can be the terminal device 110, and the employee's mobile phone or computer can access information and data resources on the company's internal office network.
- the terminal device 110 may establish a connection with the operator's network through an interface (such as N1, etc.) provided by the operator's network, and use services such as data and/or voice provided by the operator's network.
- the terminal device 110 may also access the data network DN 120 through the operator network, and use the operator services deployed on the data network DN 120, and/or services provided by a third party.
- the above-mentioned third party may be a service party other than the operator's network and the terminal device 110, and may provide other data and/or voice services for the terminal device 110.
- the specific form of expression of the above-mentioned third party can be determined according to actual application scenarios, and is not limited here.
- the access network RAN 140 is a sub-network of the operator's network, and is an implementation system between the service node and the terminal device 110 in the operator's network. To access the operator's network, the terminal device 110 first passes through the RAN 140, and then can connect to the service node of the operator's network through the RAN 140.
- the access network equipment (RAN equipment) in the embodiments of the present application is a type of equipment that provides wireless communication functions for the terminal equipment 110, and may also be referred to as a network equipment.
- the RAN equipment includes but is not limited to: the next generation base station in the 5G system Node (next generation node basestation, gNB), evolved node B (evolved node B, eNB) in long term evolution (LTE), radio network controller (RNC), node B (node B) , NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseband unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), small cell equipment (pico), mobile switching center, or network equipment in the future network, etc.
- next generation base station in the 5G system Node
- gNB next generation node basestation
- eNB evolved node B
- LTE long term evolution
- RNC radio network controller
- node B node B
- BSC base station controller
- BTS base transcei
- access network devices In systems using different wireless access technologies, the names of devices with access network device functions may be different. For the convenience of description, in all the embodiments of the present application, the above-mentioned devices that provide wireless communication functions for the terminal device 110 are collectively referred to as access network devices.
- Access and mobility management function AMF also known as AMF network function or AMF network function entity
- AMF network function or AMF network function entity is a control plane network function provided by the operator's network, responsible for the access control and mobility of terminal equipment 110 accessing the operator's network Sexual management, for example, includes functions such as mobile status management, assigning user temporary identities, and authenticating and authorizing users.
- the session management function SMF (also referred to as SMF network function or SMF network function entity) 138 is a control plane network function provided by the operator network, and is responsible for managing the protocol data unit (PDU) session of the terminal device 110.
- the PDU session is a channel used to transmit PDUs, and the terminal device needs to transmit PDUs to each other through the PDU session and the data network DN 120.
- the SMF network function 138 is responsible for establishing, maintaining, and deleting PDU sessions.
- the SMF network function 138 includes session management (such as session establishment, modification, and release, including the maintenance of the tunnel between the user plane function UPF 139 and the access network AN 140), the selection and control of the UPF network function 139, service and session continuity ( service and session continuity (SSC) mode selection, roaming and other session-related functions.
- session management such as session establishment, modification, and release, including the maintenance of the tunnel between the user plane function UPF 139 and the access network AN 140
- SSC service and session continuity
- the user plane function UPF (also referred to as UPF network function or UPF network function entity) 139 is a gateway provided by the operator, and is a gateway for communication between the operator's network and the data network DN 120.
- the UPF network function 139 includes user plane-related functions such as data packet routing and transmission, packet inspection, service usage reporting, quality of service (QoS) processing, lawful monitoring, upstream packet inspection, and downstream packet storage.
- QoS quality of service
- the unified data management network element UDM also known as UDM network function or UDM network function entity
- UDM network function entity is a control plane function provided by the operator, and is responsible for storing the subscriber permanent identifier (SUPI) of subscribers in the operator’s network. ), credential, security context, contract data and other information. Among them, SUPI will be encrypted first during transmission, and the encrypted SUPI is called a subscription concealed identifier (SUCI).
- the information stored in the UDM network function 134 can be used for authentication and authorization of the terminal device 110 accessing the operator's network.
- the contracted users of the above-mentioned operator's network may specifically be users who use the services provided by the operator's network, such as users who use China Telecom's mobile phone core card, or users who use China Mobile's mobile phone core card.
- the permanent contract identifier SUPI of the aforementioned subscriber may be the number of the mobile phone core card, etc.
- the credential and security context of the aforementioned subscriber may be a small file stored such as the encryption key of the mobile phone core card or information related to the encryption of the mobile phone core card for authentication and/or authorization.
- the aforementioned security context may be data (cookie) or token (token) stored on the user's local terminal (for example, mobile phone).
- the contract data of the aforementioned subscriber may be the supporting service of the mobile phone core card, such as the data package of the mobile phone core card or the use of the network.
- permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to information related to authentication and authorization.
- no distinction or restriction is made for the convenience of description. If no special instructions are given, the embodiments of the present application will be described using a security context as an example, but the embodiments of the present application are also applicable to authentication and/or authorization information in other expression modes.
- Authentication server function AUSF also called AUSF network function or AUSF network function entity
- AUSF network function 136 is a control plane function provided by the operator, usually used for level 1 authentication, that is, between the terminal device 110 (subscribed user) and the operator's network Certification.
- the AUSF network function 136 After the AUSF network function 136 receives the authentication request initiated by the subscriber, it can authenticate and/or authorize the subscriber through the authentication information and/or authorization information stored in the UDM network function 134, or generate the subscriber’s information through the UDM network function 134. Authentication and/or authorization information.
- the AUSF network function 136 can feed back authentication information and/or authorization information to the subscriber.
- the network open function NEF (also called NEF network function or NEF network function entity) 131 is a control plane function provided by the operator.
- the NEF network function 131 opens the external interface of the operator's network to a third party in a secure manner.
- the SMF network function 138 needs to communicate with a third-party network function
- the NEF network function 131 can serve as a relay for the SMF network function 138 to communicate with a third-party network entity.
- the NEF network function 131 is used as a relay, it can be used as the translation of the identification information of the subscriber and the translation of the identification information of the third-party network function.
- the NEF network function 131 when the NEF network function 131 sends the SUPI of the subscriber from the operator network to the third party, it can translate the SUPI into its corresponding external identity (identity, ID). Conversely, when the NEF network function 131 sends the external ID (third party's network entity ID) to the operator's network, it can be translated into SUPI.
- ID identity
- the NEF network function 131 sends the external ID (third party's network entity ID) to the operator's network, it can be translated into SUPI.
- the policy control function PCF (also referred to as a PCF network function or a PCF network function entity) 133 is a control plane function provided by an operator, and is used to provide the SMF network function 138 with a policy for a PDU session.
- Policies can include charging-related policies, QoS-related policies, and authorization-related policies.
- the network slice selection function (NSSF) (not shown in the figure) is responsible for determining the network slice instance, selecting the AMF network function 137, and so on.
- Nnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers.
- the meaning of these interface serial numbers can be referred to the meaning defined in the 3GPP standard protocol, which is not limited here.
- the terminal device 110 is used as an example for the UE.
- the name of the interface between the various network functions in FIG. 1 is only an example. In a specific implementation, the name of the interface of the system architecture It may also be other names, which are not specifically limited in the embodiments of the present application.
- the mobility management network function in the embodiment of the present application may be the AMF network function 137 shown in FIG. 1, or may be other network functions having the aforementioned AMF network function 137 in the future communication system.
- the mobility management network function in this application may also be a mobility management entity (MME) in long term evolution (LTE), etc.
- MME mobility management entity
- the mobility management network function is the AMF network function 137 as an example for description.
- the AMF network function 137 is referred to as AMF for short, and the terminal device 110 is referred to as the UE. That is, the AMF described later in the embodiments of the present application can be replaced with a mobility management network function, and the UE can be replaced with a terminal device.
- the network architecture shown in Figure 1 (such as the 5G network architecture) adopts a service-based architecture and common interfaces.
- the traditional network element functions are split into several self-contained and self-managed based on network function virtualization (NFV) technology.
- NFV network function virtualization
- Reusable network function service module by flexibly defining the service module collection, customized network function reconstruction can be realized, and the business process can be formed through a unified service call interface externally.
- the schematic diagram of the network architecture shown in FIG. 1 can be understood as a schematic diagram of a service-based 5G network architecture in a non-roaming scenario. For roaming scenarios, the embodiments of this application are also applicable.
- mobile communication networks have many commercial advantages: wide area coverage, high reliability, support for high-speed mobility, etc. Through the use of network connections, UAV systems can achieve high-reliability flights beyond the visual range.
- the mobile communication network also provides more reliable supervision methods for the regulatory authorities to prevent incidents such as drones interfering with aircraft flight operations and launching terrorist attacks with drones, ensuring the safety of the drone system and the public Safety.
- the terminal equipment of the UAV system using the mobile communication network needs to be authenticated, or the UAV system users using the terminal equipment need to be authenticated, or An unmanned aerial system service/unmanned aerial system business that uses terminal equipment is required to be certified. After the certification is passed, the terminal device or UAV system user or the UAV system service/UAS business can use the mobile communication network.
- the core network equipment in the mobile communication network authenticates the terminal equipment based on the terminal identification (such as SUPI) pre-configured by the PLMN and the corresponding credential.
- the terminal identification pre-configured in the PLMN corresponds to a core card (such as a SIM card, or a Subscriber Identification Module card, also called a subscriber identification module/card) in a one-to-one correspondence.
- a core card such as a SIM card, or a Subscriber Identification Module card, also called a subscriber identification module/card
- the same SIM card is configured in any terminal device, and the authentication result is the same in the same situation. That is, the terminal identification pre-configured by the PLMN and the corresponding credential have no direct relationship with the terminal device itself.
- the terminal device 1 can pass the identity authentication based on the terminal identification (such as SUPI) corresponding to the SIM card.
- the SIM card is configured in the terminal device 2, and the terminal device 2 can also pass the identity authentication based on the terminal identification (such as SUPI) corresponding to the SIM card. Therefore, terminal equipment is authenticated through the existing equipment authentication process, and drones or remote control terminal equipment produced by equipment manufacturers that have not contracted with operators can also be connected to the mobile communication network, which has an impact on the security of the mobile communication network. The impact.
- the embodiments of the present application provide an identity authentication method and device, which can perform identity authentication on the terminal device based on the UAS identity of the terminal device (drone or remote control).
- the UAS identity of the terminal device can be 1) Equipment manufacturer The identity assigned to the equipment itself; 2) UAS service providers/vertical industry provides UAS users/UAS users who use UAS systems or UAS services/UAS businesses System service/unmanned aerial vehicle system business identification; 3) other identifications related to unmanned aerial vehicle system different from SIM card.
- the UAS identification of the terminal device, or the user identification of the UAS system, or the service/service identification, etc. are user identifications that are different from the SIM card identification.
- the identification of the terminal device based on the UAS identification of the terminal device can prevent the drone (or remote control) produced by the equipment manufacturer that has not contracted with the operator from accessing the mobile communication network, or can prevent the operator from not signing the contract with the operator Of service providers or UAV system users/UAV system services/UAV system businesses in vertical industries use UAVs (or remote controls) to access mobile communication networks, which improves the security of mobile communication networks.
- the identity authentication of the terminal equipment based on the UAS identification of the terminal equipment can also enable the UAV equipment manufacturer/UAS system service provider/vertical industry to access the UAS equipment produced/serviced/owned by it. Access to the mobile communication network has certain control and management rights.
- identification described in the present invention is not limited to being issued by entities such as equipment manufacturers, service providers, and vertical industries, and may also be any other entity.
- the following description only takes the identification issued by the equipment manufacturer for the device as an example.
- the embodiments of the present application are also applicable.
- FIG. 2 is a system architecture of an unmanned aerial vehicle system based on a mobile communication network provided by an embodiment of the present application.
- the system architecture includes an unmanned aerial vehicle, an unmanned aerial vehicle remote control, a radio access network (RAN), a core network (CN), and a second network device.
- the core network includes the first network device.
- the second network device may be located in the core network or outside the core network.
- the mobile communication network may be the network of the above-mentioned communication system, such as: global system of mobile communication (GSM) system, code division multiple access (CDMA) system, broadband code division Multiple access (wideband code division multiple access, WCDMA) system, general packet radio service (general packet radio service, GPRS), long term evolution (LTE) system, LTE frequency division duplex (frequency division duplex) , FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) system or mobile communication network in new radio (NR) and future communication systems.
- GSM global system of mobile communication
- CDMA code division multiple access
- WCDMA broadband code division Multiple access
- GPRS general packet radio service
- LTE long term evolution
- LTE frequency division duplex frequency division duplex
- FDD frequency division duplex
- TDD LTE time division duplex
- UMTS universal mobile telecommunication system
- RAN1 and RAN2 provide services for remote controllers and drones respectively. If the remote control and the drone are covered by the same RAN, the two RANs can also refer to the same RAN. Similarly, CN1 and CN2 provide services to RAN1 and RAN2 respectively. If the RAN (RAN1 and RAN2 can be the same or different) accessed by the drone and the remote control are served by the same CN, then these two core networks can also refer to Generation of the same core network. Two first network devices may refer to the same first network device. In the system shown in Figure 2, the drone remote control controls the drone through the network, and communicates and interacts with the drone.
- the command from the remote controller is sent to the drone via RAN1, CN1, CN2, and RAN2.
- the mobile communication system is a 5G communication system
- the Unmanned Aerial Vehicle (UAV) and the drone remote control in the Unmanned Aerial System (UAS) respectively correspond to the two different UEs 110 in FIG. 1.
- the RAN here corresponds to the two access networks AN140 in Figure 1 respectively.
- unmanned aerial vehicles can also be called unmanned aerial vehicles or aerial vehicles.
- the drone remote control may be a device specially produced for remotely controlling drones, or it may be any of the aforementioned terminal devices 110 such as a smart phone or a wearable device.
- the first network device may be an access and mobility management function (AMF) or a security anchor function (SEAF) or other core network devices.
- AMF access and mobility management function
- SEAF security anchor function
- AMF For the description of AMF, please refer to the above description of AMF in Figure 1, which will not be repeated here.
- SEAF The authentication function that interacts with AUSF and NG-UE in the core network, and accepts the intermediate key (intermediate key) generated in the NG-UE authentication process from AUSF. SEAF will also interact with MM functions and SCMF. It is located in the security environment of the operator's network and will not be exposed to unauthorized access. In the roaming scenario, the SEAF is located on the visited network.
- the second network device may be located in the core network or outside the core network.
- the second network device may be an Unmaned Aerial Vehicle Traffic Management (UTM) device, or may be other core network devices or non-core network devices.
- UDM Unmaned Aerial Vehicle Traffic Management
- the second network device stores the relevant information of the drone and the remote control, for example, it stores the UAS identification and credential assigned to the drone (or remote control) by the contracted device manufacturer at the factory.
- Each drone (or remote control) has a unique (one or more) UAS identification and corresponding credentials configured at the factory. Different drones (or remote controllers) correspond to different UAS logos and credentials.
- the second network device can perform the control on the drone (or remote control) based on the UAS identification of the drone (or remote control) and the corresponding credential. Authentication. The identity authentication of the drone (or remote control) fails, and the drone (or remote control) cannot use the mobile communication network.
- the UAS identifier of the terminal device may be an identity identifier assigned to the device by the device manufacturer
- the UAS identifier of the terminal device is the identifier of the device itself. Therefore, performing identity authentication on the terminal device based on the UAS identification of the terminal device can prevent drones (or remote controls) produced by equipment manufacturers that have not contracted with the operator from accessing the mobile communication network, thereby improving the security of the mobile communication network.
- UAS logos and credentials can also be issued and configured by entities such as UAS service providers and vertical industries. When initializing UAS services and services by service providers and vertical industries, it is possible to configure unique (one or more) UAS identifiers and corresponding credentials for UAS users/UAS/UAS services.
- the drone cannot use the mobile communication network without the identity authentication of the second network device based on the identity provided by the drone system service provider or the vertical industry and the corresponding credential. Therefore, the identification of the terminal device based on the UAS identification of the terminal device can prevent the service provider who has not contracted with the mobile communication network operator or the UAV system user/UAS system service/UAV system business of the vertical industry.
- the use of drones (or remote controllers) to access the mobile communication network improves the security of the mobile communication network.
- FIG. 3 is a schematic flowchart of an identity authentication method provided by an embodiment of the present application.
- the identity authentication method includes the following steps 301 to 307.
- the subject of the method execution shown in FIG. 3 may be the first terminal device, the first network device, and the second network device.
- the method execution subject shown in FIG. 3 may be the chip in the first terminal device, the chip in the first network device, and the chip in the second network device.
- FIG. 3 uses the first terminal device, the first network device, and the second network device as the execution body of the method as an example for description.
- the first terminal device is a device in an unmanned aerial vehicle system, for example, it may be an unmanned aerial vehicle or a remote control of an unmanned aerial vehicle.
- the first network device may be AMF or SEAF or other core network devices.
- the second network device may be UTM or other network devices that can authenticate the UAV system.
- the execution subject of the identity authentication method shown in the other figures of the embodiment of the present application is the same, and will not be repeated hereafter. among them:
- the first terminal device sends a first request to the first network device.
- the first request may be a registration request (registration request) or a service request (service request), or other types of requests.
- the first request carries first authentication indication information, and the first authentication indication information is used to request UAS authentication for the first terminal device.
- the so-called UAS authentication refers to the identity authentication of the equipment in the UAS based on the UAS identification of the equipment. If the UAS authentication is passed, it indicates that the identity of the UAS device is legal. If the UAS authentication fails, it indicates that the UAS device identity is illegal and cannot access the mobile communication network.
- the UAS logo is the identity identifier (ID) assigned by the drone manufacturer to the drone and the remote control when it leaves the factory. Different drones and remote controllers correspond to different UAS logos. Each drone and remote control has a unique (one or more) UAS identification and corresponding credentials configured at the factory. Alternatively, the UAS logo and credential can also be assigned or configured by UAS service providers or vertical industries. For the description of the UAS logo, please refer to the above description, which is not limited here.
- the first authentication indication information may have the following three forms: a, b, and c:
- the first authentication indication information is the registration type (RegistrationType) information in the first request.
- the first request may be a registration request.
- the registration type information is a parameter or information element (InformationElement) existing in the existing registration request.
- InformationElement InformationElement
- a value can be added to the registration type information.
- the value of the newly added registration type information may be UAS registration or UAS authentication.
- the registration type information represents the first authentication indication information, which is used to request UAS authentication for the first terminal device. Using the registration type information to request UAS authentication for the first terminal device can avoid adding a new parameter or information element to request UAS authentication for the first terminal device, and can reduce changes to the existing communication process.
- the first authentication indication information is UAS type information of the first terminal device.
- the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS.
- the UAS type information may be a drone type or a remote control type.
- the UAS type information of the first terminal device by using the UAS type information of the first terminal device as the first authentication indication information, it can notify the first network device of the UAS type of the first terminal device and request the first network device for UAS authentication. , That is, two goals can be achieved by sending one type of information, which is beneficial to saving signaling overhead.
- the first authentication indication information is indication information other than registration type information and UAS type information. For example, additional information elements or parameters may be added to the first request to indicate the first authentication indication information.
- the first request carries UAS type information of the first terminal device.
- the first request may also carry UAS type information of the first terminal device.
- the first authentication instruction information is in form b.
- the first network device can also send the UAS type information of the first terminal device to the second network device, so that the second network device can use the corresponding authentication method to authenticate the first terminal device based on the UAS type information of the first terminal device.
- the terminal device performs UAS authentication.
- the second network device may use different authentication methods for UAS certification for the drone and the remote control, or the security strength or security process required for UAS certification for the drone and the remote control may be different.
- the first request also carries the subscription concealed identifier (SUCI) of the first terminal device or the globally unique temporary UE identity (GUTI).
- SUCI subscription concealed identifier
- GUI globally unique temporary UE identity
- the first network device sends a second request to the first terminal device.
- the first network device after receiving the first request, sends the second request to the first terminal device.
- the second request is used to request to obtain the UAS identifier of the first terminal device.
- the first network device may first perform the first authentication with the first terminal device, and establish NAS security with the first terminal device. After the first authentication with the first terminal device is passed, and after the NAS security with the first terminal device is established, the second request is sent to the first terminal device.
- the first authentication refers to the two-way authentication performed by the network and the first terminal device.
- the first authentication includes two authentication procedures: 5G-AKA (AKA: Authentication and Key Agreement) and EAP-AKA’. These two types of authentication are based on the terminal identifier (such as SUPI in the 5G system) pre-configured in the PLMN network and the corresponding credential (Credentails) to authenticate the first terminal device.
- 5G-AKA AKA: Authentication and Key Agreement
- EAP-AKA EAP-AKA
- the messages exchanged between the first terminal device and the first network device are protected by security, for example, with encryption protection and integrity protection. Therefore, after NAS security is established between the first network device and the first terminal device, obtaining the UAS identifier from the first terminal device is beneficial to prevent the UAS identifier from being leaked and tampered with.
- the first network device may also first detect whether it needs to perform the first authentication with the first terminal device. If it is necessary to perform the first authentication with the first terminal device, perform the first authentication with the first terminal device, and establish NAS security with the first terminal device.
- EAP extensible authentication protocol
- the first network device may carry the second request in an EAP message and send it.
- the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
- the first terminal device after receiving the second request, the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
- the EAP mechanism to perform UAS authentication on the first terminal device as an example.
- the first terminal device may carry the UAS identifier in the EAP message and send it to the first network device.
- the UAS logo can be transmitted through EAP messages.
- the first terminal in response to the second request, may also send the UAS type of the first terminal device to the first network device.
- UAS type messages cannot usually be carried in EAP messages and need to be sent in other ways. That is to say, in a possible implementation, the first terminal device needs to use different messages or different positions (or methods) in the same message to send the UAS ID and UAS type (for example, the UAS ID is placed in the EAP container, and the UAS The type is placed outside the EAP container).
- the first device may directly obtain the UAS identifier according to the first request in step 301.
- steps 302 and 303 are optional and do not need to be performed.
- the first request optionally includes the terminal's subscription identifier SUCI or GUTI, and the first network device obtains SUPI based on SUCI or GUTI. If the first network device stores the corresponding relationship between the terminal identifier SUPI and the UAS identifier, then The first network may also directly obtain the UAS identifier through the corresponding relationship.
- the first network device sends the UAS identifier of the first terminal device to the second network device.
- the first network device after obtaining the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device.
- the first network device may also send the UAS type of the first terminal device or/and the identifier of the terminal device (such as SUPI or GPSI) to the second network device.
- the UAS type and the identifier of the terminal device usually cannot be carried in the EAP message and need to be sent in other ways. That is, in a possible implementation, the first network device needs to use different messages or different locations (or methods) in the same message to send the UAS identifier and the UAS type (and/or the identifier of the terminal device).
- the UAS identifier can be placed in the EAP container, and the UAS type (and/or the terminal device identifier) is placed outside the EAP container for transmission.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the second network device after receiving the UAS identifier of the first terminal device, performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device and the corresponding credential.
- the second network device may use the EAP mechanism to perform UAS authentication on the first terminal device.
- the EAP-TLS authentication method using the EAP mechanism performs UAS authentication on the first terminal device based on the UAS identifier.
- the second network device sends the UAS authentication result of the first terminal device to the first network device.
- the second network device after the second network device performs UAS authentication on the first terminal device based on the UAS identifier, the second network device sends the UAS authentication result of the first terminal device to the first network device.
- the second network device may also update the UAS authentication status identifier of the first terminal device based on the UAS authentication result of the first terminal device.
- the UAS authentication status identifier is used to indicate the UAS authentication status.
- the UAS authentication status of the first terminal device may include four states: UAS authentication passed, UAS authentication failed, UAS authentication pending and not yet authenticated. For example, when the UAS authentication status flag is 01, it indicates that the authentication is passed. When the UAS authentication status flag is 00, it indicates that the authentication has failed. When the UAS authentication status is marked as 10, it indicates the status of authentication to be completed. When the UAS authentication status is marked as 11, it indicates that it is not yet authenticated.
- UAS certification results include UAS certification passed and UAS certification failure. For example, if the UAS authentication result is that the UAS authentication is passed, the UAS authentication status flag can be updated to 01.
- the UAS authentication status can be updated to 00.
- the second network device can update the UAS authentication status of the first terminal device, so that the UAS authentication status of the first terminal device can be subsequently checked.
- the authentication status of UAS authentication passed or UAS authentication failed and the validity period and other information can be attached to indicate the validity period of the authentication status. If the authentication status is passed or failed and is within the validity period, there is no need to re-authenticate; if After this period, the certification status is no longer valid and needs to be updated. This patent does not limit the validity period and so on.
- the second network device stores a corresponding relationship between the UAS authentication status identifier and the UAS identifier of the first terminal device or the subscriber permanent identifier (SUPI) or the general public subscription identifier GPSI.
- the second network device finds the UAS authentication status identifier of the first terminal device according to the UAS identifier or SUPI or GPSI of the first terminal device, and updates the UAS authentication status identifier of the first terminal device based on the UAS authentication result of the first terminal device.
- the second network device obtains the UAS authentication status identifier of the first terminal device according to the UAS authentication result, and stores the UAS authentication status identifier of the first terminal device Correspondence with the UAS identifier or SUPI or GPSI of the first terminal device, so that the UAS authentication status identifier of the first terminal device can be found subsequently based on the UAS identifier or SUPI or GPSI of the first terminal device.
- the first request sent by the first terminal device in step 301 carries the user subscription identifier (subscription concealed identifier, SUCI) (or GUTI) of the first terminal device.
- the first network device may obtain the SUPI or GPSI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and then send the SUPI or GPSI of the first terminal device to the second network device. If the second network device can store the corresponding relationship between the UAS authentication status identifier and the SUPI or GPSI of the first terminal device, the second network device searches, stores, or updates the UAS of the first terminal device according to the SUPI or GPSI sent by the first terminal device Authentication status identifier.
- the first network device obtains the SUPI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and then sends it to the first terminal device.
- the second network device sends the SUPI of the first terminal device.
- the first network device obtains the GPSI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and sends the GPSI of the first terminal device to the second network device.
- the first network device may send the SUCI (or GUTI) of the first terminal device to UDM, and the UDM converts the SUCI (or GUTI) of the first terminal device into the first
- the SUPI or GPSI of the terminal device then sends the SUPI or GPSI of the first terminal device to the first network device.
- the second network device may store the first terminal device after passing the authentication of the first terminal device. Correspondence between the UAS ID of the terminal equipment and SUPI or GPSI.
- the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- the first network device After receiving the UAS authentication result of the first terminal device, the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- the first terminal device can receive the UAS authentication result of the first terminal device.
- the subsequent first terminal device can use the mobile communication network. If the UAS authentication result is that the authentication fails, the subsequent first terminal device cannot use the mobile communication network.
- the first network device may also update the UAS authentication status identifier of the first terminal device based on the UAS authentication result of the first terminal device.
- the second network device may send the UAS authentication result of the first terminal device and the SUPI or GPSI of the first terminal device to the first network device.
- the first network device receives the UAS authentication result of the first terminal device and the SUPI or GPSI of the first terminal device, it can find the UAS authentication status identifier of the first terminal device according to the SUPI or GPSI of the first terminal device, and based on the first terminal device's SUPI or GPSI.
- the UAS authentication result of the terminal device updates the UAS authentication status identifier of the first terminal device.
- the first network device obtains the UAS authentication status identifier of the first terminal device according to the UAS authentication result, and stores the UAS authentication status identifier of the first terminal device Correspondence with the SUPI or GPSI of the first terminal device, so that the UAS authentication status identifier of the first terminal device can be found subsequently based on the SUPI or GPSI of the first terminal device.
- the UAS identifier is carried in the EAP message for transmission, and the first network device (such as AMF) does not parse the EAP message in the usual implementation manner. In this case, the first network device will not obtain or store the UAS identification information. Therefore, the storage mode of the UAS authentication status identifier in the first network device should use the terminal ID (SUPI or GPSI) as the identifier instead of the UAS identifier.
- the second network device can send the UAS authentication result of the first terminal device and the UAS identifier carried in the EAP message to the first network device.
- the first network device reads the UAS identifier in the EAP message, and then stores the corresponding relationship between the UAS authentication status identifier and the UAS identifier of the first terminal device, or searches for the UAS authentication status identifier based on the UAS identifier, and updates the UAS authentication status identifier.
- the first network device can also store the correspondence between the UAS identifier of the first terminal device and the SUPI or GPSI.
- step 307 may not be performed.
- the foregoing steps 301 to 307 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 301 to 307.
- the second network device can authenticate the identity of the first terminal device based on the UAS identity of the first terminal device. Since the UAS identity of the first terminal device is configured by the equipment manufacturer, the UAS identity of the first terminal device is the identity of the first terminal device itself. Therefore, the authentication of the first terminal device based on the UAS identification of the first terminal device can prevent the first terminal device produced by a device manufacturer that has not contracted with the operator from using the mobile communication network, or can prevent services that have not been contracted with the operator Providers or UAV system users/unmanned aerial systems services/unmanned aerial systems services of vertical industries use drones (or remote controllers) to access mobile communication networks, which improves the security of mobile communication networks. At the same time, the implementation of the embodiments of this application can enable drone equipment manufacturers/UAS service providers/vertical industries to have certain control over whether the drone system equipment they produce/service/own can access the mobile communication network. Management rights.
- FIG. 4 is a schematic flowchart of an identity authentication method provided by an embodiment of the present application.
- the identity authentication method shown in FIG. 4 is an optimization of the identity authentication method shown in FIG. 3.
- the difference between the identity authentication method shown in FIG. 4 and FIG. 3 is that the first network device in FIG. 4 needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the first network device sends a second request to the first terminal device. And the second network device also needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the identity authentication method includes the following steps 401 to 410. among them:
- the first terminal device sends a first request to the first network device.
- the first request may be a registration request (registration request) or a service request (service request), or other types of requests.
- the first request carries first authentication indication information.
- the first authentication indication information is used to request UAS authentication for the first terminal device. For related descriptions of the first request and the first authentication indication information, please refer to the description under 301 above, which will not be repeated here.
- the first network device performs the first authentication with the first terminal device, and establishes NAS security with the first terminal device.
- the first network device determines whether to perform UAS authentication on the first terminal device.
- step 402 may not be executed.
- step 402 may be performed after step 403.
- the first network device determines whether to perform UAS authentication on the first terminal device.
- step 404 is executed.
- step 403 may not be executed. That is, after the first network device receives the first request, when the first network device determines to perform UAS authentication on the first terminal device, step 404 is executed.
- the first network device when it determines not to perform UAS authentication on the first terminal device, it may send a UAS authentication failure message to the first terminal device, or send a message indicating that it is not necessary to perform UAS authentication on the first terminal device.
- the indication message for UAS authentication, or other indication messages to be sent, is not limited in the embodiment of the present application.
- the following describes four ways for the first network device to determine whether to perform UAS authentication on the first terminal device.
- the first network device can also determine whether to perform UAS authentication on the first terminal device in other ways. Make restrictions, where:
- the first network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device.
- the first network device determines to perform UAS authentication on the first terminal device.
- the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is an authentication success state or an authentication failure state, it is determined not to perform UAS authentication on the first terminal device.
- the first network device may store the UAS authentication status identifier of the first terminal device.
- the UAS authentication status identifier is used to indicate the UAS authentication status.
- the UAS authentication status may include authentication success, authentication failure, not yet authenticated, and pending authentication status. For example, when the UAS authentication status flag is 01, it indicates that the authentication is successful. When the UAS authentication status flag is 00, it indicates that the authentication has failed. When the UAS authentication status flag is 10, it indicates the authentication status to be completed. When the UAS authentication status is marked as 11, it indicates that it is not yet authenticated. If the UAS authentication status indicated by the UAS authentication status identifier of the first terminal device is authentication success or authentication failure, it is proved that the previous UAS authentication is still valid.
- step 404 may be performed to perform subsequent operations on the first terminal device. UAS certification process.
- the first network device may store the corresponding relationship between the SUPI or GPSI of the first terminal device and the UAS authentication status identifier of the first terminal device.
- the first request sent by the first terminal device may also carry the SUCI (or GUTI) of the first terminal device.
- the first network device obtains the SUPI or GPSI of the first terminal device based on the SUCI (or GUTI) of the first terminal device, and then obtains the UAS authentication state identifier corresponding to the SUPI or GPSI of the first terminal device from the stored UAS authentication state.
- the first network device may directly send the UAS authentication status of the first terminal device to the first terminal device .
- the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
- the first request carries UAS type information of the first terminal device. If the first authentication indication information is information other than UAS type information, for example, it may be registration type information, then the first request may carry the first authentication indication information and UAS type information. If the first authentication indication information is UAS type information, the first request carries the first authentication indication information.
- Fig. 5 takes the first request carrying the first authentication indication information and UAS type information as an example.
- the UAS type information received by the first network device is consistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
- the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
- the UAS type information corresponding to the SUPI or GPSI of the first terminal device may be stored in the first network device.
- the UAS type information corresponding to the SUPI or GPSI of the first terminal device may be understood as the UAS type information supported by the core card (such as a SIM card) corresponding to the SUPI or GPSI of the first terminal device.
- the first request may also carry SUCI, and the first network device obtains the SUPI or GPSI of the first terminal device based on the SUCI.
- the first network device obtains corresponding UAS type information according to the SUPI or GPSI of the first terminal device.
- the first network device stores the corresponding relationship between SUPI and UAS type information shown in Table 1 below.
- the UAS type information corresponding to SUPI1 is a drone
- the UAS type information corresponding to SUPI2 is a drone
- the UAS type information corresponding to SUPI3 is a remote control.
- SUPI1 and SUPI2 belong to the SUPI corresponding to the first type of SIM card
- SUPI3 belongs to the SUPI corresponding to the second type of SIM card.
- the first type of SIM card can only be configured on the drone
- the second type of SIM card can only be configured on the remote control.
- SUPI1 and SUPI2 correspond to the drone type
- SUPI3 corresponds to the remote control type.
- the received SUCI is SUCI1.
- the first network device obtains SUPI1 based on SUCI1.
- the first network device determines the drone type corresponding to SUPI1 according to Table 1 above. Therefore, the first network device determines that the UAS type information received by the first network device is UAS type information corresponding to the SUPI or GPSI of the first terminal device.
- the received SUCI is SUCI1.
- the first network device obtains SUPI1 based on SUCI1.
- the first network device determines the drone type corresponding to SUPI1 according to Table 1 above. Therefore, the first network device determines that the UAS type information received by the first network device is not UAS type information corresponding to the SUPI or GPSI of the first terminal device. This indicates that the first type of SIM card that should be deployed on the drone has been misused or stolen on the remote control. Therefore, if the first network device determines that the UAS type information received by the first network device is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device, the subsequent UAS authentication process may not be continued. In this way, it can be avoided that the mobile communication network can be used when the first terminal device incorrectly uses the core card or uses the stolen core card.
- the UAS type information received by the first network device is not the UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined to perform UAS authentication on the first terminal device.
- the UAS type information received by the first network device is UAS type information corresponding to the SUPI or GPSI of the first terminal device, it is determined not to perform UAS authentication on the first terminal device.
- the UAS type information corresponding to SUPI or GPSI can be understood as UAS type information that is not supported by the core card corresponding to SUPI or GPSI.
- the first network device can obtain the first terminal device's information from the UDM or the second network device.
- UAS type information corresponding to SUPI or GPSI.
- the first network device may also send a notification to the first terminal device.
- the terminal device sends a message indicating that the UAS authentication fails.
- the first terminal device may be notified that the UAS type information of the first terminal device carried in the first request is inconsistent with the UAS type information corresponding to the SUPI or GPSI of the first terminal device. In this way, after receiving the notification, the first terminal device can prompt the user that the configuration of the core card (such as the SIM card) is incorrect.
- the first network device determines whether the first terminal device exists in the list of devices allowed to perform UAS authentication. If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined not to perform UAS authentication on the first terminal device. In this way, it can also be understood that the first network device stores a list of devices that are allowed to perform UAS authentication.
- the list of devices allowed to perform UAS authentication stored by the first network device is specifically a SUPI list of devices allowed to perform UAS authentication.
- the first request also carries the SUCI of the first terminal device.
- the first network device can obtain the SUPI of the first terminal device based on the SUCI of the first terminal device.
- the first network device determines whether the SUPI of the first terminal device exists in the stored SUPI list of devices that are allowed to perform UAS authentication. If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined that UAS authentication does not need to be performed on the first terminal device. In a possible implementation, not requiring UAS authentication is equivalent to successful authentication. In another possible implementation, not requiring UAS authentication is equivalent to authentication failure.
- the SUPI list of the first terminal device that is allowed to perform UAS authentication stored by the first network device is shown in Table 2 below.
- the first terminal device 1 to the first terminal device 3 are the first terminal devices that perform UAS authentication.
- the SUPIs of the first terminal device 1 to the first terminal device 3 are SUPI1 to SUPI3, respectively.
- the first network device converts the SUCI carried in the first request to SUPI4. If SUPI4 is the same as any one of SUPI1 to SUPI3, the first network device determines to perform UAS authentication on the first terminal device.
- SUPI4 is the same as SUPI1, it is proved that the first terminal device that sent the first request is the first terminal device 1, and the first network device determines to perform UAS authentication on the first terminal device that sent the first request.
- SUPI4 is different from any one of SUPI1 to SUPI3, the first network device determines not to perform UAS authentication on the first terminal device.
- the first network device determines whether the first terminal device exists in the list of devices that are not allowed to perform UAS authentication. If yes, it is determined not to perform UAS authentication on the first terminal device. If not, it is determined to perform UAS authentication on the first terminal device. In this way, it can also be understood that the first network device stores a blacklist of devices that are not allowed to perform UAS authentication.
- the list of devices that are not allowed to perform UAS authentication stored by the first network device is specifically a SUPI list of devices that are not allowed to perform UAS authentication.
- the first request also carries the SUCI of the first terminal device.
- the first network device can obtain the SUCI of the first terminal device based on the SUCI of the first terminal device. If the SUPI of the first terminal device exists in the SUPI list of devices that are not allowed to perform UAS authentication stored by the first network device, the first network device determines not to perform UAS authentication on the first terminal device.
- the first network device determines to perform UAS authentication on the first terminal device. In a possible implementation, it is determined in way 4 that UAS authentication is not performed on the first terminal device, which is equivalent to UAS authentication failure.
- the first network device may also send the received SUCI to UDM.
- the UDM receives the SUCI, it can convert the SUCI to SUPI.
- the UDM determines whether to perform UAS authentication on the first terminal device.
- the specific implementation manner for the UDM to determine whether to perform UAS authentication on the first terminal device is the same as the specific implementation manner for the first network device to determine whether to perform UAS authentication on the first terminal device in the foregoing manners 3 to 4, and will not be repeated here.
- the UDM may send the determined result to the first network device, and the first network device determines whether to perform UAS authentication for the first terminal device or not to perform UAS authentication for the first terminal device according to the determination result sent by the UDM.
- the first network device may send a message for indicating the UAS authentication result to the first terminal device.
- the first network device may also combine multiple methods in the foregoing manner 1 to manner 4 to determine whether to perform UAS authentication on the first terminal device.
- the first network device may also determine whether to perform UAS authentication on the first terminal device in another manner, which is not limited in the embodiment of the present application.
- the first network device sends a second request to the first terminal device.
- the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
- the first network device sends the UAS identifier of the first terminal device to the second network device.
- step 404 to step 406 refer to the specific implementation manners of step 302 to step 304, and details are not described herein.
- the second network device determines whether to perform UAS authentication on the first terminal device.
- the second network device determines whether to perform UAS authentication on the first terminal device.
- step 407 may not be executed. That is, after the second network device receives the UAS identifier of the first terminal device, when the second network device determines to perform UAS authentication on the first terminal device, step 408 is executed.
- the second network device when the second network device determines not to perform UAS authentication on the first terminal device, it can send a UAS authentication failure message to the first network device, and the first network device sends UAS authentication failure to the first terminal device. news.
- the second network device may send to the first network device indication information indicating that the first terminal device is not to be authenticated (or successfully authenticated) by the first network device. Sending to the first terminal device indication information for indicating that UAS authentication is not performed on the first terminal device (or the authentication is successful).
- the second network device determines not to perform UAS authentication on the first terminal device, it may send other indication information to the first network device, and the first network device sends it to the first terminal device.
- the following introduces five ways for the second network device to determine whether to perform UAS authentication on the first terminal device.
- the second network device can also determine whether to perform UAS authentication on the first terminal device in other ways. Make restrictions, where:
- Manner 1 The second network device determines whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device.
- Mode 1 of the second network device please refer to the specific implementation principle of Mode 1 of the first network device, which will not be repeated here.
- the second network device may also store the corresponding relationship between the UAS identifier of the first terminal device and the UAS authentication status identifier of the first terminal device.
- the first network device obtains the UAS authentication state identifier corresponding to the UAS identifier of the first terminal device from the stored UAS authentication state. Then, based on the obtained UAS authentication status identifier, it is determined whether to perform UAS authentication on the first terminal device.
- Manner 2 The second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information.
- the first request also carries UAS type information of the first terminal device. If the first authentication indication information is information other than UAS type information, for example, it may be registration type information, then the first request may carry the first authentication indication information and UAS type information. If the first authentication indication information is UAS type information, the first request carries the first authentication indication information. Fig. 5 takes the first request carrying the first authentication indication information and UAS type information as an example.
- the first network device may also send the UAS type information of the first terminal device to the second network device.
- the second request is also used to request to obtain UAS type information of the first terminal device.
- the first terminal device After receiving the second request, the first terminal device also sends UAS type information to the first network device.
- the first terminal device may send the UAS type information of the first terminal device and the UAS identifier to the first network device together, or send the two pieces of information to the first network device separately.
- the first network device After receiving the UAS type information and UAS identifier sent by the first terminal device, the first network device sends the UAS type information and UAS identifier of the first terminal device to the second network device.
- the UAS type information can be sent to the second network device together with the UAS identifier, or the two can be sent separately.
- the second network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information and the first network device determines whether to perform UAS authentication on the first terminal device based on the received UAS type information. Principle The same is not repeated here.
- the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS identifier of the first terminal device and the SUPI or GPSI of the first terminal device.
- the first request also carries the SUCI (or GUTI) of the first terminal device.
- the first network device also sends the SUPI or GPSI of the first terminal device to the second network device.
- the SUPI or GPSI of the first terminal device can be sent together with the UAS ID of the first terminal device, or sent separately from the UAS ID of the first terminal device, for example, sent in two different messages or different in the same message Location, different methods (one in the container, one outside the container), different cells or different containers to send, etc.
- the second network device determines whether to perform UAS authentication on the first terminal device based on the UAS identifier of the first terminal device and the SUPI or GPSI of the first terminal device.
- the specific implementation manner is: the second network device It is determined whether the UAS identifier of the first terminal device and the SUPI or GPSI of the first terminal device have a corresponding relationship (or binding relationship). If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined not to perform UAS authentication on the first terminal device.
- the UAS identifier has a corresponding relationship with SUPI or GPSI, which means that the core card (such as a SIM card) corresponding to the SUPI or GPSI needs to be bound to the terminal device corresponding to the UAS identifier.
- the UAS ID of the first terminal device has a corresponding relationship with the SUPI or GPSI of the first terminal device, it means that the core card (such as the SIM card) installed in the first terminal device is bound to the UAS ID of the first terminal device. Core card. Otherwise, it means that the core card (such as a SIM card) installed in the first terminal device is not a core card used in binding with the UAS identifier of the first terminal device. Therefore, by implementing this possible implementation, when the core card (such as a SIM card) installed in the first terminal device is a core card that is bound to the first terminal device, the second network device will perform the operation on the first terminal device. UAS certification.
- the second network device When the core card (such as a SIM card) installed in the first terminal device is not a core card bound to the first terminal device, the second network device will not perform UAS authentication on the first terminal device (or equivalent to authentication failure). Therefore, when the core card installed in the first terminal device is not a core card bound to the first terminal device, the first terminal device cannot use the mobile communication network. This can prevent random replacement and embezzlement of the core card of the first terminal device.
- the core card such as a SIM card
- the corresponding relationship between the UAS identifier and SUPI stored by the second network device is shown in Table 3 below. If the first terminal device is the first terminal device 1, and the first network device sends the UAS identifier 1 and SUPI2 to the second network device, the second network device determines that the UAS identifier 1 of the first terminal device 1 and SUPI2 do not have a corresponding relationship , The second network device determines that the UAS authentication of the first terminal device is an authentication failure. If the first network device sends UAS ID 1 and SUPI1 to the second network device, the second network device determines that the UAS ID of the first terminal device 1 has a corresponding relationship with SUPI, and the second network device continues to perform UAS on the first terminal device. Certification. The second network device determines whether the UAS identifier of the first terminal device has a corresponding relationship with the GPSI in the same principle, which is not repeated here.
- the second network device may send to the first terminal device via the first network device a message indicating UAS authentication failure news.
- the first network device may be notified to the first terminal device that its UAS identifier does not have a corresponding relationship with SUPI or GPSI.
- Manner 4 The second network device determines whether the first terminal device exists in the list of devices allowed to perform UAS authentication. If yes, it is determined to perform UAS authentication on the first terminal device. If not, it is determined not to perform UAS authentication on the first terminal device.
- the second network device determines whether the first terminal device exists in the list of devices that are not allowed to perform UAS authentication. If yes, it is determined not to perform UAS authentication on the first terminal device. If not, it is determined to perform UAS authentication on the first terminal device.
- the second network device may also determine whether to perform UAS authentication on the first terminal device according to the UAS identification or GPSI of the first terminal device in the manner 4 to manner 5.
- the implementation principle is the same as the implementation principle in which the first network device determines whether to perform UAS authentication on the first terminal device according to the SUPI of the first terminal device in the foregoing manner 3 to manner 4, and will not be repeated here.
- the second network device may also combine multiple methods in the foregoing manner 1 to manner 5 to determine whether to perform UAS authentication on the first terminal device.
- the second network device may also determine whether to perform UAS authentication on the first terminal device in another manner, which is not limited in the embodiment of the present application.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier.
- the second network device sends the UAS authentication result of the first terminal device to the first network device.
- the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- step 408 to step 410 can participate in the specific implementation manners of the above-mentioned 305 to step 307, which will not be repeated here.
- step 403 and step 407 may be executed, or only step 403 may be executed, or only step 407 may be executed.
- Step 404 and step 405 may not be executed, and the description is similar to step 302 and step 303, and will not be repeated here.
- Step 410 may not be executed.
- the foregoing steps 401 to 410 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 401 to 410.
- terminal devices that do not meet UAS certification requirements can be screened out first, and UAS certification is only performed on terminal devices that meet the certification requirements, which is beneficial to reducing the authentication workload of the second network device.
- FIG. 7 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the identity authentication method shown in FIG. 7 and the identity authentication method shown in FIG. 3 are parallel solutions.
- the difference between the identity authentication method shown in FIG. 7 and FIG. 3 is that in FIG. 3, the UAS identifier of the first terminal device is obtained by the first network device through a second request.
- the first request in FIG. 7 also carries the UAS identifier of the first terminal device.
- the identity authentication method includes the following steps 701 to 705. among them:
- the first terminal device sends a first request to the first network device.
- the first request carries the first authentication indication information and the UAS identifier of the first terminal device.
- the first authentication indication information please refer to the description under step 301, which will not be repeated here.
- the first request carries UAS type information of the first terminal device.
- the first request also carries the user subscription identifier (subscription concealed identifier, SUCI) of the first terminal device.
- the first terminal device before step 701 is performed, performs the first authentication with the first network device, and establishes NAS security with the first network device. After the first terminal device passes the first authentication and establishes NAS security with the first network device, the messages exchanged between the first terminal device and the first network device are securely protected, for example, with encryption protection and integrity sexual protection. Therefore, the first terminal device can carry the UAS identifier of the first terminal device in the first request, and the UAS identifier of the first terminal device will not be leaked.
- the first network device can avoid the additional steps of sending the second request (step 302 and step 303 in FIG. 3) to obtain the UAS identifier, thereby improving efficiency And save network resources.
- the first network device sends the UAS identifier of the first terminal device to the second network device.
- the first network device after receiving the UAS identifier of the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device.
- the first network device may carry the UAS identifier in the EAP message and send it to the second network device.
- the first network device may also send the UAS type or/and the identifier SUPI (or GPSI) of the first terminal device to the second network device. Similar to the description of step 303, the UAS type and SUPI (or GPSI) need to be sent through a different location (or method) in a message different from sending the UAS identification or in the same message for sending the UAS identification.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier.
- the second network device sends the UAS authentication result of the first terminal device to the first network device.
- the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- step 703 to step 705 please refer to the specific implementation manners of the above-mentioned 305 to step 307, which will not be repeated here.
- step 704 when the second network device sends the UAS authentication result of the first network device to the first network device, it needs to carry the UAS identifier, or/and the UAS type, or/and the SUPI (or GPSI) ).
- the first network device can store and update the UAS authentication status and identity (UAS identity, UAS type, SUPI (or SUPI)) of the first terminal device.
- the foregoing step 705 may not be performed.
- the foregoing steps 701 to 705 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 701 to 705.
- FIG. 8 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the identity authentication method shown in FIG. 8 is an optimization of the identity authentication method shown in FIG. 7.
- the difference between the identity authentication method shown in FIG. 8 and FIG. 7 is that in FIG. 8 the first network device needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the first network device sends the UAS identifier of the first terminal device to the second network device. And the second network device also needs to determine whether to authenticate the first terminal device. If it is determined to authenticate the first terminal device, the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the identity authentication method includes the following steps 801 to 808. among them:
- the first network device performs first authentication with the first terminal device, and establishes NAS security with the first terminal device.
- the first terminal device sends a first request to the first network device.
- the first request carries the first authentication indication information and the UAS identifier of the first terminal device.
- the first authentication indication information please refer to the description under step 301, which will not be repeated here.
- the network will assign a globally unique temporary UE identity (GUTI) to the terminal. Therefore, the first request may also carry the GUTI of the first terminal device.
- the SUPI or GPSI of the first terminal device subsequently used by the first network device may be obtained based on the GUTI of the first terminal device.
- the first network device determines whether to perform UAS authentication on the first terminal device. When the first network device determines to perform UAS authentication on the first terminal device, step 804 is executed.
- step 803 refer to the specific implementation of step 403 above.
- the first network device sends the UAS identifier of the first terminal device to the second network device.
- the first network device may also send the UAS type or/and the identifier SUPI (or GPSI) of the first terminal device to the second network device. Similar to the description of step 303, the UAS type and SUPI (or GPSI) need to be sent through a different location (or method) in a message different from sending the UAS identification or in the same message for sending the UAS identification.
- the second network device determines whether to perform UAS authentication on the first terminal device. When the second network device determines to perform UAS authentication on the first terminal device, step 806 is executed.
- step 804 to step 805 refer to the specific implementation of step 406 to step 407 above.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier.
- the second network device sends the UAS authentication result of the first terminal device to the first network device.
- the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- step 806 to step 808 please refer to the specific implementation manners of step 305 to step 307, which will not be repeated here.
- step 807 when the second network device sends the UAS authentication result of the first network device to the first network device, it may carry the UAS identifier, or/and the UAS type, or/and the SUPI (or GPSI) ).
- the first network device can store and update the UAS authentication status and identity (UAS identity, UAS type, SUPI (or GPSI)) of the first terminal.
- both step 803 and step 805 may be executed, or one of them may be executed.
- the above step 808 may not be performed.
- the foregoing steps 801 to 808 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing steps 801 to 808.
- the terminal devices that do not meet the certification requirements can be screened out first, and UAS certification is only performed on the terminal devices that meet the certification requirements, which is conducive to reducing the certification work of the first network device and the second network device the amount.
- FIG. 9 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the identity authentication method shown in FIG. 9 is an optimization of the identity authentication method shown in FIG. 3.
- the difference between the identity authentication method shown in FIG. 9 and FIG. 3 is that the second network device in FIG. 9 stores an association relationship (or a pairing relationship or a corresponding relationship or a binding relationship between the first terminal device and the second terminal device). ).
- the second network device in FIG. 9 stores an association relationship (or a pairing relationship or a corresponding relationship or a binding relationship between the first terminal device and the second terminal device). ).
- it is also necessary to authorize or authenticate the association relationship between the first terminal device and the second terminal device that is, to determine the first terminal device. Whether the association relationship between the device and the second terminal device is available or valid.
- the first terminal device and the second terminal device can be paired for use. Otherwise, the first terminal device and the second terminal device cannot be paired for use.
- the first terminal device may be a drone, and the second terminal device may be a remote controller of the drone.
- the first terminal device may be a remote controller of a drone, and the second terminal device may be a drone.
- the UAS type information of the first terminal device and the second terminal device are different.
- the identity authentication method includes the following steps 901 to 912. among them:
- the first terminal device sends a first request to the first network device.
- the first request carries first authentication indication information.
- the first authentication indication information is used to request UAS authentication for the first terminal device.
- the first network device sends a second request to the first terminal device.
- the first network device after receiving the first request, sends the second request to the first terminal device.
- the second request is used to request to obtain the UAS identifier of the first terminal device.
- the first terminal device sends the UAS identifier of the first terminal device to the first network device in response to the second request.
- the first network device sends the UAS identifier of the first terminal device to the second network device.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the second network device sends the UAS authentication result of the first terminal device to the first network device.
- the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- step 901 to step 907 can be referred to the specific implementation manners of step 301 to step 307 above, which will not be repeated here.
- the second network device determines the UAS identifier of the second terminal device associated with the first terminal device.
- step 908 to step 910 may be performed after step 904 and before step 905 or step 906.
- step 908 to step 910 may be performed after step 906.
- the steps in step 908 to step 910 may be executed simultaneously with step 905 or step 906.
- FIG. 9 takes the execution of step 908 after step 906 as an example.
- the second network device pre-stores the association relationship between the first terminal device and the second terminal device.
- the association relationship may also be referred to as a correspondence relationship or a pairing relationship or a binding relationship.
- the association relationship is described below.
- the association relationship between the first terminal device and the second terminal device stored by the second network device may be configured in the second network device when the first terminal device and the second terminal device leave the factory.
- the association relationship between the first terminal device and the second terminal device may be stored in the second network device after the first terminal device and the second terminal device are successfully associated before.
- association relationship between the first terminal device and the second terminal device may be stored in the second network device after the association is made when the UAS service provider signs a contract with the network operator.
- the present invention does not limit how the association relationship is configured in the second network, and it will not be listed here.
- the second network device stores the association relationship between the first terminal device and the second terminal device in the form of storing the association relationship between the UAS identifier of the first terminal device and the UAS identifier of the second terminal device. Therefore, the second network device can determine the UAS identity of the second terminal device according to the UAS identity of the first terminal device. Further, the second network device can determine the SUPI or GPSI of the second terminal device according to the binding relationship between the UAS identifier and the terminal identifier SUPI or GPSI (for example, as described in Table 3).
- the association relationship between the drone and the remote controller stored in the second network device may be as shown in Table 4 below.
- one remote controller can be associated with one or more drones, and one drone can also be associated with one or more remote controllers.
- remote control 1 has an association relationship with UAV 1 and UAV 2
- remote control 2 has an association relationship with UAV 3.
- the second network device stores the relationship between the UAS ID 4 of the remote control 1 and the UAS ID 1 of the drone 1 and the UAS ID 2 of the drone 2, and stores the UAS ID 5 of the remote control 2 and the drone 3
- the UAS identifies the 3 association relationship.
- the first terminal device is UAV 1, according to the association relationship in Table 4 below, it can be determined that the UAS identifier of the second terminal device is UAS identifier 4. If the first terminal device is the remote controller 1, then there are two second terminal devices, namely the UAV 1 and the UAV 2. According to the association relationship in Table 4 below, based on UAS ID 4, UAS ID 1 of UAV 1 and UAS ID 2 of UAV 2 can be obtained. If the UAS ID and SUPI have an association relationship as shown in Table 3, according to the association relationship in Table 4 below, based on the UAS ID 4, the SUPI ID 1 of UAV 1 and the SUPI ID 2 of UAV 2 can be obtained.
- the first request also carries device indication information, and the device indication information is used to determine the second terminal device.
- the device indication information may indicate the number or serial number or name of the second terminal devices that need to be associated, so as to determine the first terminal device from the multiple second terminal devices.
- a terminal device needs to be associated with a second terminal device.
- the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- the second network device determines the UAS identity (and the second terminal identity SUPI) of the second terminal device associated with the first terminal device, it is based on the UAS identity (and the second terminal identity of the second terminal device) of the second terminal device.
- SUPI Perform UAS authentication on the second terminal device.
- the principle that the second network device performs UAS authentication on the second terminal device based on the UAS identity of the second terminal device is the same as the principle that the first network device performs UAS authentication on the first terminal device based on the UAS identity of the first terminal device. Go into details.
- the second network device sends the UAS authentication result of the second terminal device to the first network device.
- the second network device after the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device, it sends the UAS authentication result of the second terminal device to the first network device.
- the second network device when the second network device sends the UAS authentication result of the first terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate The UAS authentication result received by the first network device is the UAS authentication result of the first terminal device.
- the second network device when the second network device sends the UAS authentication result of the second terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the second terminal device to the first network device to instruct the first network device to receive The UAS authentication result of is the UAS authentication result of the second terminal device.
- the second network device when the second network device sends the UAS authentication result of the first terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the second terminal device to the first network device to indicate The first terminal device is associated with the second terminal device. And/or, when the second network device sends the UAS authentication result of the second terminal device to the first network device, it may also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate the first terminal device Associated with the second terminal device. Therefore, the first network device knows that the UAS authentication result of the first terminal device is also sent to the second terminal device, and the UAS authentication result of the second terminal device is also sent to the first terminal device. In addition, the first network device may save the association relationship between the first terminal device and the second terminal device.
- the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device.
- the first network device after the first network device receives the UAS authentication result of the second terminal device sent by the second network device, it sends it to the first terminal device (the first terminal device is determined according to the SUPI or UAS identification of the first terminal) UAS authentication result or association indication information of the second terminal device.
- the association indication information is used to indicate whether the first terminal device and the second terminal device are successfully associated.
- the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. For example, if the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both authenticated, the association indication information is used to indicate that the first terminal device and the second terminal device are successfully associated. Otherwise, the association indication information is used to indicate that the first terminal device fails to associate with the second terminal device.
- the first network device can also directly send the UAS authentication result of the second terminal device to the first terminal device, and the first terminal device itself determines the first terminal based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Whether the device and the second terminal device are successfully associated.
- the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device.
- the first network device after the first network device receives the UAS authentication result of the second terminal device sent by the second network device, it sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device. As a result, or send the UAS authentication result and association indication information of the second terminal device to the second terminal device.
- step 906 and step 910 can be performed at the same time, that is, the second network device can transfer the UAS authentication result of the first terminal device to the UAS authentication result of the second terminal device.
- the UAS authentication result and the UAS authentication result of the second terminal device are carried in the same message and sent to the first network device.
- the first network device then sends the message to the first terminal device and the second terminal device.
- the message may also include the UAS identity or SUPI or GPSI of the first terminal device, and the UAS identity or SUPI or GPSI of the second terminal device.
- the UAS ID or SUPI or GPSI of the first terminal device is used to determine the first terminal device and distinguish the UAS authentication result of the first terminal device
- the UAS ID or SUPI or GPSI of the second terminal device is used to determine the second terminal device and distinguish the first terminal device.
- the second network device may determine the SUPI or GPSI of the second terminal device based on the SUPI or GPSI of the first terminal device.
- the second network device may determine the SUPI or GPSI of the second terminal device based on the UAS identifier of the second terminal device.
- the first network device may first send the UAS authentication result of the first terminal device to the first terminal device. . After receiving the UAS authentication result of the second terminal device, the UAS authentication result or association indication information of the second terminal device is sent to the first terminal device. Alternatively, after receiving the UAS authentication result of the first terminal device, the first network device first does not send the UAS authentication result of the first terminal device. When receiving the UAS authentication result of the second terminal device, the first network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information to the first terminal device in the same message. When the first network device receives the UAS authentication result of the second terminal device, it can send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device in the same message. .
- the first network device may first send the UAS authentication result of the second terminal device to the second terminal device .
- the UAS authentication result or association indication information of the first terminal device is sent to the second terminal device.
- the first network device first does not send the UAS authentication result of the second terminal device.
- the first network device receives the UAS authentication result of the first terminal device, it sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device in the same message.
- the first network device receives the UAS authentication result of the first terminal device, it can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device in the same message.
- step 906 is performed before step 910, and in step 907, a UAS authentication status identifier for indicating that the UAS authentication status of the second terminal device is the authentication status to be completed is also sent.
- step 906 is performed after step 910, in step 912, the first network device sends the UAS authentication result of the second terminal device to the second terminal device and is used to indicate that the UAS authentication status of the first terminal device is pending authentication.
- the UAS authentication status identifier of the status is performed before step 910, and in step 907, a UAS authentication status identifier for indicating that the UAS authentication status of the second terminal device is the authentication status to be completed is also sent.
- step 912 the first network device sends the UAS authentication result of the second terminal device to the second terminal device and is used to indicate that the UAS authentication status of the first terminal device is pending authentication.
- the UAS authentication status identifier of the status is performed before step 910, and in step 907, a UAS authentication status identifier for indicating
- step 905 before step 905 is executed, it may be determined whether to perform UAS authentication on the second terminal device. If it is determined to perform UAS authentication on the second terminal device, step 905 is executed. Optionally, the second network device may also determine whether to perform UAS authentication on the second terminal device before performing UAS authentication on the second terminal device based on the UAS identifier of the second terminal device. If it is determined to perform UAS authentication on the second terminal device, step 909 is executed.
- the second network device determining whether to perform UAS authentication on the first terminal device or the second terminal device refer to the specific implementation of the second network device determining whether to perform UAS authentication on the first terminal device in the embodiment corresponding to FIG. 4 above. Method to realize.
- the second network device sends instruction information to the first network device, the instruction information indicating that the first terminal device and the second terminal device have failed to associate ,
- the first network device sends the instruction information to the first terminal device and the second terminal device.
- step 908 may be performed first, that is, to determine the UAS identifier of the second terminal device associated with the first terminal device.
- the second network device determines whether to perform UAS authentication on the first terminal device and the second terminal device based on the position and distance between the first terminal device and the second terminal device. For example, if the distance between the first terminal device and the second terminal device is less than or equal to the preset distance, it is determined to perform UAS authentication on the first terminal device and the second terminal device, and the first network device executes step 905 and step 909.
- the second network device may send instruction information to the first network device, and the instruction information may indicate that the first terminal device is associated with the second terminal device Failed or invalid.
- the first network device sends the instruction information to the first terminal device and the second terminal device.
- the first network device may not send the first terminal device and the second terminal device to the first terminal device.
- the UAS authentication result of the first terminal device and the second terminal device are not sent to the second terminal device.
- the first network device may send association indication information to the first terminal device and the second terminal device to indicate the second terminal device. Whether the association between the first terminal device and the second terminal device is successful.
- the second terminal device may also actively initiate UAS authentication.
- the process of the second terminal device actively initiating UAS authentication is similar to step 901 to step 906, that is, the first terminal device in step 901 to step 906 is replaced with the second terminal device.
- the first network device may store the association relationship between the first terminal device and the second terminal device. After receiving the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device, the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first terminal device, And sending the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device.
- the association relationship between the first terminal device and the second terminal device may also be stored by the second network device.
- the second network device sends the UAS authentication result of the first terminal device, it indicates the identity of the second terminal device (such as UAS ID or SUPI or GPSI), and when the second network device sends the UAS authentication result of the second terminal device, it indicates The identity of the first terminal device (such as UAS identity or SUPI or GPSI).
- the first network device After receiving the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device, the first network device can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first terminal device , And sending the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device.
- steps 901 to 903 in the solution shown in FIG. 9 can also be replaced with step 701 in FIG. 7 to improve efficiency and save network resources.
- the foregoing steps 901 to 912 may also have other execution orders, and the present application does not limit the execution order of each of the foregoing steps 901 to 912.
- UAS authentication can be performed on the first terminal device and the second terminal device, and the stored association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
- FIG. 10 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the identity authentication method shown in FIG. 10 and the identity authentication method shown in FIG. 9 are parallel solutions.
- the difference between the identity authentication method shown in FIG. 10 and FIG. 9 is that in the identity authentication method shown in FIG. 9, the second network device initiates the authentication of the second terminal device.
- the first network device initiates the authentication of the second terminal device.
- the identity authentication method includes the following steps 1001 to 1013. among them:
- the first terminal device sends a first request to the first network device.
- the first request carries first authentication indication information.
- the first authentication indication information is used to request UAS authentication for the first terminal device.
- the first network device sends a second request to the first terminal device.
- the first network device after receiving the first request, sends the second request to the first terminal device.
- the second request is used to request to obtain the UAS identifier of the first terminal device.
- the first terminal device sends the UAS identifier of the first terminal device to the first network device.
- the first network device sends the UAS identifier of the first terminal device to the second network device.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- step 1001 to step 1005 please refer to the specific implementation manners of step 301 to step 305, which will not be repeated here.
- the second network device determines the SUPI or GPSI or UAS identifier of the second terminal device associated with the first terminal device.
- step 1006 can be performed before or after step 1005.
- the second network device pre-stores the association relationship between the first terminal device and the second terminal device.
- This association relationship may also be referred to as a correspondence relationship or a pairing relationship.
- the association relationship between the first terminal device and the second terminal device stored by the second network device may be configured in the second network device when the first terminal device and the second terminal device leave the factory.
- the association relationship between the first terminal device and the second terminal device may be stored in the second network device after the first terminal device and the second terminal device are successfully associated before.
- the association relationship between the first terminal device and the second terminal device may be stored in the second network device after the association is made when the UAS service provider signs a contract with the network operator.
- the present invention does not limit how the association relationship is configured in the second network, and it will not be listed here.
- the second network device stores the association relationship between the first terminal device and the second terminal device in the form of storing the association between the UAS identifier or SUPI or GPSI of the first terminal device and the UAS identifier or SUPI or GPSI of the second terminal device. relationship. Therefore, the second network device can determine the UAS identity or SUPI or GPSI of the second terminal device according to the UAS identity or SUPI or GPSI of the first terminal device.
- the first request also carries device indication information, and the device indication information is used to determine the second terminal device.
- the device indication information may indicate the number or serial number or name of the second terminal devices that need to be associated.
- the second network device sends the UAS authentication result of the first terminal device and the SUPI or GPSI or UAS identifier of the second terminal device to the first network device.
- the UAS authentication result of the first terminal device and the SUPI or GPSI or UAS identifier of the second terminal device may be carried in the same message or in different messages.
- the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- the first network device after receiving the UAS authentication result of the first terminal device from the second network device, the first network device sends the UAS authentication result of the first terminal device to the first terminal device.
- the first network device after the first network device receives the SUPI or GPSI or UAS identifier of the second terminal device, it can also obtain the UAS authentication status identifier of the second terminal device, and send the second terminal device to the first terminal device.
- the UAS certification status identifier if the obtained UAS authentication status identifier indicates that it has not been authenticated, step 1009 is executed. If the obtained UAS authentication status identifier indicates the authentication success or authentication failure status, step 1009 to step 1011 may not be performed, and the first network device can directly perform steps 1012 and 1013 to combine the UAS authentication status identifier of the second terminal device with the first The UAS authentication results of the terminal device are respectively sent to the first terminal device and the second terminal device.
- the first network device sends the UAS identifier of the second terminal device to the second network device.
- the first network device after the first network device receives the SUPI or GPSI or UAS identifier of the second terminal device, it can send the UAS identifier of the second terminal device to the second network device, that is, the first network device initiates a connection to the second network device. UAS certification of the device.
- the first network device also needs to request the second terminal device to obtain the UAS identifier of the second terminal device. After the UAS identifier of the second terminal device is acquired, the UAS identifier of the second terminal device is sent to the second network device. Alternatively, if the corresponding relationship between the SUPI or GPSI of the second terminal device and the UAS identifier of the second terminal device is stored in the first network device, the first network device may also obtain the second terminal device based on the SUPI or GPSI of the second terminal device. The UAS ID of the terminal device.
- step 1005 it may be determined whether to perform UAS authentication for the first terminal device. If it is determined to perform UAS authentication for the first terminal device, step 1005 is executed.
- the second network device may also determine whether to perform UAS authentication on the first terminal device based on the position and distance between the first terminal device and the second terminal device. For the specific implementation manner, refer to the corresponding description in the embodiment corresponding to Fig. 9 and will not be repeated here.
- the first network device may first determine whether to perform UAS authentication on the second terminal device. If it is determined to perform UAS authentication on the second terminal device, the UAS identifier of the second terminal device is sent to the second network device. Otherwise, optionally, the first network device may send instruction information to the first terminal device and the second terminal device, the instruction information indicating that the first terminal device fails to associate with the second terminal device.
- the first network device can be based on whether the second terminal device is turned on, the distance between the first terminal device and the second terminal device, the UAS authentication status of the second terminal device, and the UAS type of the second terminal device One or more of information, etc., to determine whether to perform UAS authentication on the second terminal device. For example, if the second terminal device is not in the powered-on state, it is determined not to perform UAS authentication on the second terminal device. If the second terminal device is in the powered-on state, it is determined to perform UAS authentication on the second terminal device, and step 1009 is executed.
- the distance between the first terminal device and the second terminal device, the UAS authentication status of the second terminal device, and the UAS type information of the second terminal device to determine whether to perform UAS authentication on the terminal device can be referred to the above description for specific implementations. , I won’t repeat it here.
- the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- the second network device after receiving the UAS identifier of the second terminal device, performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- the principle that the second network device performs UAS authentication on the second terminal device based on the UAS identity of the second terminal device is the same as the principle that the first network device performs UAS authentication on the first terminal device based on the UAS identity of the first terminal device. Go into details.
- the second network device sends the UAS authentication result of the second terminal device to the first network device.
- the second network device after the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device, it sends the UAS authentication result of the second terminal device to the first network device.
- the first network device sends the UAS authentication result or association indication information of the second terminal device to the first terminal device.
- the first network device after receiving the UAS authentication result of the second terminal device, sends the UAS authentication result or association indication information of the second terminal device to the first terminal device.
- the association indication information is used to indicate whether the first terminal device and the second terminal device are successfully associated.
- the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. For example, if the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both authenticated, the association indication information is used to indicate that the first terminal device and the second terminal device are successfully associated. Otherwise, the association indication information is used to indicate that the first terminal device fails to associate with the second terminal device.
- the first network device can also directly send the UAS authentication result of the second terminal device to the first terminal device, and the terminal device itself determines the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Whether the second terminal device is successfully associated.
- the first network device sends the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or association indication information to the second terminal device.
- the first network device after the first network device receives the UAS authentication result of the second terminal device sent by the second network device, it sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device. As a result, or, send the UAS authentication result of the first terminal device and the association indication information to the second terminal device.
- the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device together, or separately send the UAS authentication result of the first terminal device and the second terminal device to the second terminal device. 2.
- UAS authentication result of the terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the first terminal device together, or separately send the UAS authentication result of the first terminal device and the UAS authentication result of the first terminal device to the first terminal device.
- UAS authentication result of the second terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device to the second terminal device together, or separately send the UAS authentication result of the first terminal device and the UAS authentication result of the first terminal device to the first terminal device.
- the second network device when the second network device sends the UAS authentication result of the first terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate The UAS authentication result received by the first network device is the UAS authentication result of the first terminal device.
- the second network device when the second network device sends the UAS authentication result of the second terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the second terminal device to the first network device to instruct the first network device to receive The UAS authentication result of is the UAS authentication result of the second terminal device.
- the second network device when the second network device sends the UAS authentication result of the second terminal device to the first network device, it can also send the UAS ID or SUPI or GPSI of the first terminal device to the first network device to indicate The first terminal device is associated with the second terminal device. Therefore, the first network device knows that the UAS authentication result of the first terminal device is also sent to the second terminal device, and the UAS authentication result of the second terminal device is also sent to the first terminal device.
- step 1006 may not be executed.
- step 1007 the UAS identifier or SUPI or GPSI of the second terminal device is not carried.
- the first network device stores the association relationship between the first terminal device and the second terminal device. For example, the association relationship between the UAS identifier of the first terminal device and the UAS identifier of the second terminal device is stored.
- the first network device determines the UAS identifier of the second terminal device associated with the first terminal device.
- the subsequent steps 1010 to 1013 are executed.
- steps 1001 to 1003 in the solution shown in FIG. 10 can also be replaced with step 701 in FIG. 7.
- the foregoing step 1001 to step 1013 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1001 to step 1013.
- the first terminal device and the second terminal device can be authenticated, and the association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
- FIG. 11 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the difference between the identity authentication method shown in FIG. 11 and the identity authentication method shown in FIG. 9 and FIG. 10 is that the solutions shown in FIG. 9 and FIG. The association relationship is authorized or authenticated.
- the second network device does not store the association relationship between the first terminal device and the second terminal device.
- the solution shown in FIG. 11 is to authorize or authenticate the newly-added association relationship between the first terminal device and the second terminal device.
- the identity authentication method includes the following steps 1101 to 1116. among them:
- the second terminal device sends a third request to the first network device.
- the third request carries second authentication indication information and newly added association indication information.
- the second authentication indication information is used to request UAS authentication for the second terminal device.
- the newly-added association instruction information is used to request the newly-added association relationship.
- the first network device sends a fourth request to the second terminal device.
- the first network device after receiving the third request, sends the fourth request to the second terminal device.
- the fourth request is used to request to obtain the UAS identifier of the second terminal device.
- the second terminal device sends the UAS identifier of the second terminal device to the first network device.
- the first network device sends the UAS identifier of the second terminal device and the new association indication information to the second network device.
- the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- step 1101 to step 1105 please refer to the specific implementation manners of step 301 to step 305 above, and details are not described herein.
- step 1102 and step 1103 may not be performed to improve efficiency and save network resources.
- the second network device sends a request for obtaining second association information of the second terminal device to the first network device.
- the first network device sends a request for obtaining second association information of the second terminal device to the second terminal device.
- the second terminal device sends the second association information of the second terminal device to the first network device.
- the first network device sends the second association information of the second terminal device to the second network device.
- step 11051 to step 11054 may be executed in a process in which the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- steps 11051 to 11054 may be performed after step 1104 and before step 1105.
- step 11051 to step 11054 can be performed after step 1105.
- FIG. 11 takes as an example that steps 11051 to 11054 are performed in the process in which the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- the second association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
- the second network device sends the UAS authentication result of the second terminal device to the first network device.
- the first network device sends the UAS authentication result of the second terminal device to the second terminal device.
- step 1101 to step 1107 can refer to the specific implementation manners of step 301 to step 307 above, and details are not described herein.
- the second terminal device sends the first request to the first network device.
- the first request carries first authentication indication information and newly added association indication information.
- the first authentication indication information is used to request UAS authentication for the first terminal device.
- the newly-added association instruction information is used to request the newly-added association relationship.
- the first network device sends a second request to the first terminal device.
- the first network device after receiving the first request, sends the second request to the first terminal device.
- the second request is used to request to obtain the UAS identifier of the first terminal device.
- step 1109 and step 1110 may not be performed to improve efficiency and save network resources.
- the first terminal device In response to the second request, the first terminal device sends the UAS identifier of the first terminal device to the first network device.
- the first network device sends the UAS identifier of the first terminal device and the new association indication information to the second network device.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the second network device sends a request for acquiring the first association information of the first terminal device to the first network device.
- the first network device sends a request for obtaining first association information of the first terminal device to the first terminal device.
- the first terminal device sends the first association information of the first terminal device to the first network device.
- the first network device sends the first association information of the first terminal device to the second network device.
- step 11121 to step 11124 may be executed in a process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- step 11121 to step 11124 may be executed after step 1111 and before step 1112.
- step 11121 to step 11124 may be executed after step 1112.
- FIG. 11 takes as an example the execution of steps 11121 to 11124 in the process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the first association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
- the second network device determines that the first association information matches the second association information.
- the second network device After receiving the first associated information, the second network device will search for associated information that matches the first associated information. In this embodiment of the application, the second network device finds that the first association information matches the second association information.
- the matching of the first associated information with the second associated information may mean that the first associated information is the same as the second associated information. For example, the first associated information is the password "12345", and the second associated information is also the password "12345", then the first associated information matches the second associated information. If the first association information sent by the first terminal device matches the second association information sent by the second terminal device, the second network device determines the terminal device with which the first terminal device and the second terminal device want to establish an association relationship.
- the second network device sends the UAS authentication result of the first terminal device and the UAS identification or SUPI or GPSI of the second terminal device to the first network device.
- the UAS identifier or SUPI or GPSI of the second terminal device is used to indicate that the second terminal device wants to establish an association relationship with the first terminal device.
- the first network device can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device, and send the UAS authentication result of the first terminal device to the second terminal device Or association indication information to indicate the association result between the first terminal device and the second terminal device.
- the SUPI or GPSI of the second terminal device in the second network device may be sent by the first network device to the second network device or stored in the second network device with the UAS identifier of the second terminal device.
- the SUPI or GPSI of the associated second terminal device may be sent by the first network device to the second network device or stored in the second network device with the UAS identifier of the second terminal device.
- the second network device sends the UAS authentication result of the first terminal device and the UAS identifier or SUPI or GPSI of the second terminal device to the first network device.
- the first network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device.
- the association indication information is used to indicate whether the first terminal device and the second terminal device are successfully associated.
- the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. For example, if the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both authenticated, the association indication information is used to indicate that the first terminal device and the second terminal device are successfully associated. Otherwise, the association indication information is used to indicate that the first terminal device fails to associate with the second terminal device.
- the first network device can also directly send the UAS authentication result of the second terminal device to the first terminal device, and the first terminal device itself determines the first terminal based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Whether the device and the second terminal device are successfully associated.
- the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
- the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the UAS of the first terminal device to the first terminal device
- the authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information together to the second terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
- the UAS authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
- the first network device may determine whether to allow the new association relationship of the second terminal device to be added. If the association relationship of the second terminal device is allowed to be added, step 1203 is executed, that is, a fourth request is sent to the second terminal device. Optionally, if the association relationship of the second terminal device is not allowed to be newly added, then the indication information for indicating the failure of the newly-added association is sent to the second terminal device.
- the first network device may store an identification list (such as a SUPI list or a GPSI list) of terminal devices that allow new association relationships, and if the second terminal device is in the identification list, it is determined that the association of the second terminal device is allowed to be added relationship. If the second terminal device is not in the identification list, it is determined that the association relationship of the second terminal device is not allowed to be added.
- an identification list such as a SUPI list or a GPSI list
- the first network device may store an identification list (such as a SUPI list or GPSI list) of terminal devices that are not allowed to add association relationships, and if the second terminal device is in the identification list, it is determined that the second terminal is not allowed to be added The association relationship of the device. If the second terminal device is not in the identification list, it is determined that the association relationship of the second terminal device is allowed to be added.
- an identification list such as a SUPI list or GPSI list
- the second network device may determine whether to allow the new association relationship of the second terminal device to be added. If the association relationship of the second terminal device is allowed to be added, the UAS authentication is performed on the second terminal device based on the UAS identifier of the second terminal device. Optionally, if the association relationship of the second terminal device is not allowed to be added, the indication information for indicating the failure of the new association is sent to the first network device, and the first network device sends the newly added association to the second terminal device. Information indicating that the association failed.
- the specific implementation principle please refer to the foregoing description, which will not be repeated here.
- the first network device may determine whether to allow the new association relationship of the first terminal device to be added. If the association relationship of the first terminal device is allowed to be added, step 1211 is executed, that is, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device.
- the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device.
- the second network device may determine whether to allow the newly-added association relationship of the first terminal device. If the association relationship of the first terminal device is allowed to be added, the UAS authentication is performed on the first terminal device based on the UAS identifier of the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be added, then the indication information for indicating the failure of the new association is sent to the first network device, and the first network device sends the newly added association to the first terminal device. Information indicating that the association failed. For the specific implementation principle, please refer to the foregoing description, which is not repeated here.
- the second network device may also store the association relationship between the first terminal device and the second terminal device.
- step 1219 can be performed before step 1216 or after step 1216.
- the second network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
- the foregoing step 1101 to step 1116 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1101 to step 1116.
- FIG. 13 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the difference between the identity authentication method shown in FIG. 13 and the identity authentication method shown in FIG. 11 is that FIG. 11 is determined by the second network device that the first associated information matches the second associated information, and FIG. 13 is determined by the first network device It is determined that the first associated information and the second associated information match.
- the identity authentication method includes the following steps 1131 to 1116. among them:
- the second terminal device sends a third request to the first network device.
- the third request carries the second authentication indication information and the newly added association indication information.
- the second authentication indication information is used to request UAS authentication for the second terminal device.
- the first network device sends a fourth request to the second terminal device.
- the first network device after receiving the third request, sends the fourth request to the second terminal device.
- the fourth request is used to request to obtain the UAS identifier of the second terminal device.
- the second terminal device sends the UAS identifier of the second terminal device to the first network device.
- the first network device sends the UAS identifier of the second terminal device to the second network device.
- the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- the first network device sends a request for obtaining second association information of the second terminal device to the second terminal device.
- the second terminal device sends the second association information of the second terminal device to the first network device.
- step 13051 to step 13052 may be executed in a process in which the second network device performs UAS authentication on the second terminal device based on the UAS identifier of the second terminal device.
- steps 13051 to 13052 may be performed after step 1304 and before step 1305.
- step 13051 to step 13052 may be performed after step 1305, or after step 1306, or after step 1307.
- FIG. 13 takes as an example that steps 13051 to 13052 are performed during the UAS authentication of the second terminal device by the second network device based on the UAS identifier of the second terminal device.
- the second association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
- the second network device sends the UAS authentication result of the second terminal device to the first network device.
- the first network device sends the UAS authentication result of the second terminal device to the second terminal device.
- step 1301 to step 1307 please refer to the specific implementation manners of step 301 to step 307 above, which will not be repeated here.
- step 1302 and step 1303 may not be performed to improve efficiency and save network resources.
- the second terminal device sends the first request to the first network device.
- the first request carries the first authentication indication information and the newly added association indication information.
- the first authentication indication information is used to request UAS authentication for the first terminal device.
- the newly-added association instruction information is used to request the newly-added association relationship.
- the first network device sends a second request to the first terminal device.
- the first network device after receiving the first request, sends the second request to the first terminal device.
- the second request is used to request to obtain the UAS identifier of the first terminal device.
- the first terminal device In response to the second request, the first terminal device sends the UAS identifier of the first terminal device to the first network device.
- steps 1309 and 1310 may not be executed to improve efficiency and save network resources.
- the first network device sends the UAS identifier of the first terminal device to the second network device.
- the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the first network device sends a request for acquiring first association information of the first terminal device to the first terminal device.
- the first terminal device sends the first association information of the first terminal device to the first network device.
- step 13121 to step 13122 may be executed in a process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- step 13121 to step 13122 may be performed after step 1311 and before step 1312.
- step 13121 to step 13122 may be performed after step 1312.
- FIG. 11 takes as an example that steps 13121 to 13122 are performed in the process in which the second network device performs UAS authentication on the first terminal device based on the UAS identifier of the first terminal device.
- the first association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
- the second network device sends the UAS authentication result of the first terminal device to the first network device.
- the first network device determines that the first association information matches the second association information.
- the first network device After receiving the first associated information, the first network device will search for associated information that matches the first associated information. In this embodiment of the application, the first network device finds that the first association information matches the second association information. Then, the first network device determines that the first terminal device and the second terminal device need to establish an association relationship. Therefore, the first network device can send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device, and send the UAS authentication result of the first terminal device to the second terminal device Or associated instructions.
- association indication information please refer to the previous description, which is not repeated here.
- step 1314 may be performed before or after the first network device receives the UAS authentication result of the first terminal device.
- the first network device sends the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or association indication information to the first terminal device.
- the first network device sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
- the first network device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the UAS of the first terminal device to the first terminal device
- the authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information together to the second terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
- the UAS authentication result and the UAS authentication result or association indication information of the second terminal device may send the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device or the association indication information together to the first terminal device, or separately send the second terminal device's UAS authentication result to the second terminal device.
- the first network device may determine whether to allow the new association relationship of the second terminal device to be added. If the association relationship of the second terminal device is allowed to be added, a fourth request is sent to the second terminal device. Optionally, if the association relationship of the second terminal device is not allowed to be newly added, then the indication information for indicating the failure of the newly-added association is sent to the second terminal device.
- the specific implementation principle please refer to the foregoing description, which will not be repeated here.
- the first network device may determine whether to allow the newly-added association relationship of the first terminal device. If the association relationship of the first terminal device is allowed to be added, the second request is sent to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, then the indication information used to indicate the failure of the newly-added association is sent to the first terminal device.
- the specific implementation principle please refer to the foregoing description, which will not be repeated here.
- the first network device may also store the association relationship between the first terminal device and the second terminal device.
- step 1419 can be performed before step 1417 or after step 1417.
- the first network device may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
- the first network device may also send the association relationship to the second network device for storage.
- the foregoing steps 1301 to 1316 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing steps 1301 to 1316.
- the first terminal device and the second terminal device can be authenticated, and the newly established association relationship between the first terminal device and the second terminal device can be authenticated or authorized.
- FIG. 15 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the identity authentication method shown in Fig. 15 is different from Figs. 11-14 in that Figs. 11-14 are for authorizing or authenticating the newly-added association relationship during the UAS authentication process of the terminal device.
- FIG. 15 shows the authorization or authentication of the newly-added association relationship after the UAS authentication of the first terminal device and the second terminal device are passed.
- the identity authentication method includes the following steps 1501 to 1518. among them:
- the first terminal device passes UAS authentication.
- the second terminal device passes UAS authentication.
- step 1503 and step 1505 are executed after step 1501 and step 1502, respectively.
- the first terminal device sends a first association request to the first network device, where the first association request is used to request a new association relationship.
- the first association request may carry the UAS identifier of the first terminal device, the terminal identifier (such as SUCI or GUTI), and the UAS type information of the first terminal device.
- the UAS type information is used to indicate the device type of the first terminal device in the UAS.
- the first network device sends the first association request to the second network device.
- the first network device after receiving the first association request, sends the first association request to the second network device.
- the first terminal device sends a second association request to the first network device, where the second association request is used to request a new association relationship.
- the second association request may carry the UAS identifier of the second terminal device, the terminal identifier (such as SUCI or GUTI), and the UAS type information of the second terminal device.
- the UAS type information is used to indicate the device type of the second terminal device in the UAS.
- the first network device forwards the second association request to the second network device.
- the first network device after receiving the second association request, sends the second association request to the second network device.
- the second network device sends a first acquisition request to the first network device, where the first acquisition request is used to acquire the first association information.
- the second network device after receiving the first association request, sends the first acquisition request to the first network device.
- the first network device sends the first acquisition request to the first terminal device.
- the first network device after receiving the first acquisition request, the first network device sends the first acquisition request to the first terminal device.
- the second network device sends a second acquisition request to the first network device, where the second acquisition request is used to acquire second association information.
- the second network device after receiving the second association request, sends the second acquisition request to the first network device.
- the first network device sends the second acquisition request to the second terminal device.
- the first network device after receiving the second acquisition request, the first network device sends the second acquisition request to the second terminal device.
- the first terminal device sends the first association information to the first network device.
- the first terminal device after receiving the first acquisition request, the first terminal device sends the first association information to the first network device.
- the first association information and the second association information may be information used to establish an association relationship, such as a password, a pass phrase, and a credential.
- the first network device sends the first association information to the second network device.
- the first network device after receiving the first association information, the first network device sends the first association information to the second network device.
- the second terminal device sends second association information to the first network device.
- the second terminal device after receiving the second acquisition request, the second terminal device sends the second association information to the first network device.
- the first network device sends second association information to the second network device.
- the first network device after receiving the second association information, the first network device sends the second association information to the second network device.
- the second network device determines that the first association information matches the second association information.
- the second network device sends the association success indication information to the first network device.
- the association success indication information is used to indicate that the first terminal device and the second terminal device are successfully associated.
- the second network device after receiving the first association information and the second association information, the second network device can determine whether the first association information and the second association information match. If they match, step 1516 is executed, that is, the association success indication information is sent to the first network device. If the first association information matches the second association information, it indicates that the first terminal device and the second terminal device want to establish an association relationship. Since both the first terminal device and the second terminal device have passed UAS authentication, the second network device may send the association success indication information to the first network device.
- the second network device may send the association failure indication information to the first network device, and the first network device sends the association failure indication information to the first network device.
- the terminal device and the second terminal device may send the association failure indication information to the first network device, and the first network device sends the association failure indication information to the first network device.
- step 1516 if the first association information matches the second association information, it is also possible to determine whether to perform step 1516 based on the UAS type information of the first terminal device and the UAS type information of the second terminal device. For example, if the UAS type information of the first terminal device and the UAS type information of the second terminal device are not the same, step 1516 is executed. If the UAS type information of the first terminal device and the UAS type information of the second terminal device are the same, the second network device sends association failure indication information to the first network device to indicate that the first terminal device and the second terminal device fail to associate. And the first network device sends the association failure indication information to the first terminal device and the second terminal device.
- the first network device sends the association success indication information to the first terminal device.
- the first network device sends the association success indication information to the second terminal device.
- step 1501, step 1503, step 1504, step 1507, step 1508, step 1511, step 1512 are messages for the first terminal device
- step 1502, step 1505, step 1506, step 1509, step 1510, Steps 1513 and 1514 are messages for the second terminal.
- the present invention does not limit the sequence of executing the message directed to the first terminal device and executing the message directed to the second terminal device.
- the message of the first terminal device and the message of the second terminal device are alternately performed, or the steps of the first terminal device may be executed first, and then the steps of the second terminal device may be executed, or various combinations may be used.
- the sequence of step 1517 and step 1518 can also be interchanged.
- the foregoing step 1501 to step 1518 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1501 to step 1518.
- the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first acquisition request is sent to the first network device. Optionally, otherwise, sending indication information for indicating failure of the newly-added association to the first network device. The first network device sends the instruction information to the first terminal device. For how to determine whether to allow a new association relationship for the first terminal device, refer to the foregoing description.
- the first network device may also determine whether to allow a new association relationship for the first terminal device. After receiving the first association request, the first network device determines whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the second network device. Otherwise, sending indication information for indicating failure of the newly added association to the first terminal device.
- the second network device may store the association relationship between the first terminal device and the second terminal device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device.
- the association relationship between the first terminal device and the second terminal device can be authenticated.
- FIG. 17 is a schematic flowchart of another identity authentication method provided by an embodiment of the present application.
- the identity authentication method shown in Fig. 17 is different from Figs. 11-14 in that Figs. 11-14 are in the process of UAS authentication performed by the terminal device to authorize or authenticate the newly-added association relationship.
- FIG. 17 shows the authorization or authentication of the newly-added association relationship after the UAS authentication of the first terminal device and the second terminal device are passed.
- the identity authentication method includes the following steps 1701 to 1700. among them:
- the first terminal device passes UAS authentication.
- the second terminal device passes UAS authentication.
- step 1703 and step 1705 are executed after step 1701 and step 1702, respectively.
- the first terminal device sends a first association request to the first network device, where the first association request is used to request a new association relationship with the second terminal device.
- the first association request may carry the UAS identifier of the first terminal device, the terminal identifier of the first terminal device (such as SUCI or GUTI), and the UAS type information of the first terminal device.
- the first association request may also carry the UAS identifier of the second terminal device, the terminal identifier of the second terminal device (such as SUCI or GUTI), and the UAS type information of the second terminal device.
- the UAS type information is used to indicate the device type of the device in the UAS.
- the first network device sends the first association request to the second network device.
- the first network device after receiving the first association request, sends the first association request to the second network device.
- the second network device sends the first association request to the first network device.
- the second network device after receiving the first association request, sends the first association request to the first network device.
- the first network device sends the first association request to the second terminal device.
- the first network device after receiving the first association request, sends the first association request to the second terminal device.
- the second terminal device sends association confirmation instruction information to the first network device.
- the second terminal device after receiving the first association request, sends the association confirmation instruction information to the first network device.
- the second terminal device may also send association rejection indication information to the first network device, which is used to indicate rejection of association with the first terminal device. For example, after receiving the first association request, the second terminal device may output prompt information to prompt whether to accept the association request of the first terminal device.
- the second terminal device After receiving the association confirmation operation, sends the association confirmation instruction information to the first network device.
- the second terminal device After receiving the association rejection operation, sends the association rejection indication information to the first network device.
- the first network device sends the association confirmation instruction information to the second network device.
- the first network device after receiving the association confirmation instruction information, the first network device sends the association confirmation instruction information to the second network device.
- the second network device sends the association success indication information to the first network device.
- the second network device receives the association confirmation indication information, and sends the association success indication information to the first network device.
- the association success indication information is used to indicate that the first terminal device and the second terminal device are successfully associated.
- the second network device may also send the association failure indication information to the first network device, which is used to instruct the first terminal device and The second terminal device fails to associate. After receiving the association failure indication information, the first network device sends the association failure indication information to the first terminal device and the second terminal device.
- the first network device sends the association success indication information to the first terminal device.
- the first network device sends the association success indication information to the second terminal device.
- the first network device after receiving the association success indication information, the first network device sends the association success indication information to the first terminal device and the second terminal device.
- the second network device may also determine whether to allow a new association relationship for the first terminal device. If it is determined that it is allowed to add an association relationship for the first terminal device, the first association request is sent to the first network device. Optionally, otherwise, sending indication information for indicating the failure of the newly-added association to the first network device. For how to determine whether to allow a new association relationship for the first terminal device, refer to the foregoing description.
- the second network device may store the association relationship between the first terminal device and the second terminal device.
- the first network device may also store the association relationship between the first terminal device and the second terminal device.
- the foregoing step 1701 to step 1711 may also have other execution orders, and the present application does not limit the execution order of the respective steps in the foregoing step 1701 to step 1711.
- the association relationship between the first terminal device and the second terminal device can be authenticated.
- FIG. 19 shows a schematic structural diagram of a communication device according to an embodiment of the present application.
- the communication device shown in FIG. 19 may be used to perform part or all of the functions of the first network device in the method embodiments described in FIG. 3 to FIG. 17.
- the device can be a network device, a device in a network device, or a device that can be matched and used with the network device.
- the communication device may also be a chip system.
- the communication device shown in FIG. 19 may include a receiving unit 1901 and a sending unit 1902. among them:
- the receiving unit 1901 is configured to receive a first request sent by a first terminal device, the first request carries first authentication instruction information, and the first authentication instruction information is used to request UAS authentication for the first terminal device.
- the terminal device is a device in the UAS;
- the sending unit 1902 is used to send a second request to the first terminal device, the second request is used to request to obtain the UAS identifier of the first terminal device;
- the receiving unit 1901 is also used to receive the first terminal device The UAS identifier of the first terminal device sent by the device;
- the sending unit 1902 is also used to send the UAS identifier of the first terminal device to the second network device;
- the receiving unit 1901 is also used to receive the first terminal device sent by the second network device
- the sending unit 1902 is also used to send the UAS authentication result of the first terminal device to the first terminal device.
- the first authentication indication information is registration type information or UAS type information of the first terminal device
- the UAS type information indicates the device type of the first terminal device in the UAS.
- the communication device further includes: a processing unit, configured to determine whether to perform UAS authentication for the first terminal device; the sending unit 1902 sends the second request to the first terminal device in a specific manner: When a terminal device performs UAS authentication, it sends a second request to the first terminal device.
- a processing unit configured to determine whether to perform UAS authentication for the first terminal device
- the sending unit 1902 sends the second request to the first terminal device in a specific manner: When a terminal device performs UAS authentication, it sends a second request to the first terminal device.
- the method for the processing unit to determine whether to perform UAS authentication on the first terminal device is specifically: determining whether to perform UAS authentication on the first terminal device based on the UAS authentication status identifier of the first terminal device.
- the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type, service type, or service type of the first terminal device in the UAS;
- the method for the device to perform UAS authentication is specifically: determining whether to perform UAS authentication for the first terminal device based on the received UAS type information.
- the first request carries UAS type information of the first terminal device, and the UAS type information indicates the device type of the first terminal device in the UAS; the sending unit 1902 is further configured to send the first terminal device to the second network device.
- UAS type information of a terminal device UAS type information of a terminal device.
- the second request is also used to request to obtain the UAS type information of the first terminal device, and the UAS type information indicates the device type of the first terminal device in the UAS;
- the receiving unit 1901 is also used to receive the first terminal device.
- the sending unit 1902 is further configured to send the UAS type information of the first terminal device to the second network device.
- the first network device further includes a processing unit configured to update the UAS authentication status of the first terminal device based on the UAS authentication result.
- the receiving unit 1901 may also receive the UAS authentication result of the second terminal device associated with the first terminal device sent by the second network device;
- the sending unit 1902 is further configured to send the UAS authentication result or association indication information of the second terminal device to the first terminal device, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information Obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device;
- the sending unit 1902 is further configured to send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device to the second terminal device , Or send the UAS authentication result and association indication information of the second terminal device.
- the receiving unit 1901 may also receive the UAS identifier or SUPI or GPSI of the second terminal device sent by the second network device; Send the UAS identification of the second terminal device to the second network device; after the receiving unit 1901 receives the UAS authentication result of the second terminal device, the sending unit 1902 is further configured to send the UAS authentication result of the second terminal device to the first terminal device or Association indication information, the association indication information is used to indicate an association result between the first terminal device and the second terminal device, the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device; the sending unit 1902. It is also used to send the UAS authentication result of the second terminal device and the UAS authentication result of the first terminal device or the association indication information to the second terminal device.
- the first network device further includes a processing unit, which is used to determine whether the second terminal device is associated with the first terminal device after the receiving unit 1901 receives the UAS identifier or SUPI or GPSI of the second terminal device. The terminal device performs UAS authentication. If so, the sending unit 1902 sends the UAS identifier of the second terminal device to the second network device. Optionally, if it is determined that UAS authentication for the second terminal device is not allowed, the sending unit 1902 sends instruction information to the first terminal device, the instruction information indicating that the first terminal device and the second terminal device have failed to associate.
- a processing unit which is used to determine whether the second terminal device is associated with the first terminal device after the receiving unit 1901 receives the UAS identifier or SUPI or GPSI of the second terminal device. The terminal device performs UAS authentication. If so, the sending unit 1902 sends the UAS identifier of the second terminal device to the second network device. Optionally, if it is determined that UAS authentication for the second terminal device is not allowed, the sending unit 19
- the first request also carries new association indication information.
- the specific implementation manner of the sending unit 1902 sending the UAS identifier of the first terminal device to the second network device is: sending the UAS identifier of the first terminal device and the newly added association indication information to the second network device.
- the sending unit 1902 sends to the first terminal device a request for acquiring the first association information of the first terminal device; receiving unit 1901 receives the first association information of the first terminal device sent by the first terminal device; the sending unit 1902 sends the first association information of the first terminal device to the second network device.
- the specific implementation manner of the receiving unit 1901 receiving the UAS authentication result of the first terminal device sent by the second network device is: receiving the UAS authentication result of the first terminal device and the UAS identification of the second terminal device sent by the second network device or SUPI or GPSI; after the receiving unit 1901 receives the UAS authentication result of the first terminal device and the UAS identifier or SUPI or GPSI of the second terminal device, the sending unit 1902 also sends the UAS authentication result or association of the second terminal device to the first terminal device Indication information, the association indication information is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is obtained based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device.
- the sending unit 1902 may also send the UAS authentication result or association indication information of the first terminal device to the second terminal device.
- the receiving unit 1901 may determine whether to allow the new association relationship of the first terminal device to be added. If it is allowed to add the association relationship of the first terminal device, the sending unit 1902 sends a second request to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, the sending unit 1902 sends to the first terminal device indication information for indicating that the newly-added association fails.
- the first request also carries new association indication information, which is used to request a new association relationship.
- the sending unit 1902 sends to the first terminal device for obtaining the first terminal device.
- a request for the first association information of a terminal device the receiving unit 1901 receives the first association information sent by the first terminal device; the processing unit determines that the first association information matches the second association information sent by the second terminal device; the sending unit 1902 Send the UAS authentication result or association indication information of the second terminal device to the first terminal device, the association indication information is used to indicate the association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS of the first terminal device
- the authentication result and the UAS authentication result of the second terminal device are obtained; the sending unit 1902 sends the UAS authentication result or association indication information of the first terminal device to the second terminal device.
- the processing unit may determine whether to allow the new association relationship of the first terminal device to be added. If it is allowed to add the association relationship of the first terminal device, the sending unit 1902 sends a second request to the first terminal device. Optionally, if the association relationship of the first terminal device is not allowed to be newly added, the sending unit 1902 sends to the first terminal device indication information for indicating that the newly-added association fails.
- the processing unit may also store the association relationship between the first terminal device and the second terminal device.
- the processing unit may also store the association relationship between the first terminal device and the second terminal device only when it is determined that the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device are both certified.
- the first request may also carry the UAS identifier of the first terminal device, so that the sending unit 1902 does not need to send the second request to the first terminal device, and the receiving unit 1901 does not need to receive the first terminal device.
- FIG. 19 shows a schematic structural diagram of a communication device according to an embodiment of the present application.
- the communication device shown in FIG. 19 may be used to perform part or all of the functions of the first terminal device in the method embodiments described in FIG. 3 to FIG. 17.
- the device may be a terminal device, a device in a terminal device, or a device that can be matched and used with the terminal device.
- the communication device may also be a chip system.
- the communication device shown in FIG. 19 may include a receiving unit 1901 and a sending unit 1902. among them:
- the sending unit 1902 is configured to send a first request to a first network device, where the first request carries first authentication indication information, and the first authentication indication information is used to request UAS authentication for the communication device;
- the receiving unit 1901 is configured to receive a second request sent by the first network device, where the second request is used to request to obtain the UAS identifier of the communication device;
- the sending unit 1902 is further configured to send the UAS identifier of the communication device to the first network device in response to the second request;
- the receiving unit 1901 is further configured to receive the UAS authentication result of the communication device sent by the first network device.
- the first authentication indication information is registration type information, or UAS type information of the communication device, and the UAS type information indicates the device type of the communication device in the UAS.
- the first request carries UAS type information of the communication device, and the UAS type information indicates the device type, service type, or service type of the communication device in the UAS.
- the second request is also used to request to obtain UAS type information of the communication device
- the sending unit 1902 is further configured to send UAS type information of the communication device to the first network device.
- the receiving unit 1901 may also receive the UAS authentication result of the second terminal device associated with the first terminal device; the processing unit is based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device. Determine the association result between the first terminal device and the second terminal device.
- the receiving unit 1901 may also receive association indication information, where the association indication information is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information.
- the first request also carries new association indication information.
- the receiving unit 1901 may also receive the UAS authentication result of the second terminal device; the processing unit determines the association result of the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device.
- the receiving unit 1901 may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS certification result was obtained.
- the receiving unit 1901 receives a request sent by the first network device for obtaining the first association information of the first terminal device; the sending unit 1902 sends the first association information of the first terminal device to the first network device Information; the receiving unit 1901 may also receive the UAS authentication result of the second terminal device; the first terminal device determines the UAS authentication result of the first terminal device and the second terminal device based on the UAS authentication result of the first terminal device and the UAS authentication result of the second terminal device Association results. Alternatively, the receiving unit 1901 may also receive association indication information, which is used to indicate an association result between the first terminal device and the second terminal device, and the association indication information is based on the UAS authentication result of the first terminal device and the second terminal device. The UAS certification result was obtained.
- the sending unit 1902 after passing UAS authentication, sends a first association request to the first network device, and the first association request is used to request a new association relationship; the receiving unit 1901 receives the first network device's sending The sending unit 1902 sends the first association information to the first network device; the receiving unit 1901 receives the association success indication information, the association success indication information is used to indicate that the first terminal device is successfully associated with the second terminal device.
- the sending unit 1902 after passing UAS authentication, sends a first association request to the first network device, and the first association request is used to request a new association relationship with the second terminal device; the receiving unit 1901 receives Indication of successful association.
- FIG. 20 shows a communication device 200 provided by an embodiment of this application, which is used to implement the function of the first network device in the foregoing method.
- the device may be a network device or a device for a network device.
- the network device can be AMF, SEAF, and so on.
- the device used for the network device may be a chip system or a chip in the network device. Among them, the chip system can be composed of chips, and can also include chips and other discrete devices.
- the communication device 200 includes at least one processor 2020, configured to implement the data processing function of the first network device in the method provided in the embodiment of the present application.
- the apparatus 200 may further include a communication interface 2010, which is used to implement the transceiving operation of the first network device in the method provided in the embodiment of the present application.
- the communication interface may be a transceiver, circuit, bus, module, or other type of communication interface, which is used to communicate with other devices through a transmission medium.
- the communication interface 2010 is used for the device in the device 200 to communicate with other devices.
- the processor 2020 uses the communication interface 2010 to send and receive data, and is used to implement the method described in the foregoing method embodiment.
- the device 200 may further include at least one memory 2030 for storing program instructions and/or data.
- the memory 2030 and the processor 2020 are coupled.
- the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
- the processor 2020 may cooperate with the memory 2030 to operate.
- the processor 2020 may execute program instructions stored in the memory 2030. At least one of the at least one memory may be included in the processor.
- connection medium between the aforementioned communication interface 2010, the processor 2020, and the memory 2030 is not limited in the embodiment of the present application.
- the memory 2030, the communication interface 2020, and the communication interface 2010 are connected by a bus 2040.
- the bus is represented by a thick line in FIG. 20.
- the connection mode between other components is only for schematic illustration. , Is not limited.
- the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one thick line is used to represent in FIG. 20, but it does not mean that there is only one bus or one type of bus.
- the communication interface 2010 may output or receive a baseband signal.
- the apparatus 200 is specifically the first network device, what the communication interface 2010 outputs or receives may be a radio frequency signal.
- the processor may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, which may implement or Perform the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
- the general-purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
- FIG. 21a shows a communication device 210 provided by an embodiment of the application, which is used to implement the function of the first terminal device in the foregoing method.
- the device may be a terminal device or a device for terminal devices.
- the terminal device may be a mobile phone, a wearable device, or a tablet computer.
- the device used for the terminal device may be a chip system or a chip in the terminal device. Among them, the chip system can be composed of chips, and can also include chips and other discrete devices.
- the apparatus 210 includes at least one processor 2121, configured to implement the data processing function of the first terminal device in the method provided in the embodiment of the present application.
- the apparatus 210 may further include a communication interface 2110, which is used to implement the receiving and sending operations of the first terminal device in the method provided in the embodiment of the present application.
- the communication interface may be a transceiver, a circuit, a bus, a module, or other types of communication interfaces, which are used to communicate with other devices through a transmission medium.
- the communication interface 2110 is used for the device in the device 210 to communicate with other devices.
- the processor 2121 uses the communication interface 2110 to send and receive data, and is used to implement the method described in the foregoing method embodiment.
- the device 210 may also include at least one memory 2130 for storing program instructions and/or data.
- the memory 2130 and the processor 2121 are coupled.
- the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, and may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
- the processor 2121 may cooperate with the memory 2130.
- the processor 2121 may execute program instructions stored in the memory 2130. At least one of the at least one memory may be included in the processor.
- the embodiment of the present application does not limit the specific connection medium between the communication interface 2110, the processor 2121, and the memory 2130.
- the memory 2130, the communication interface 2121, and the communication interface 2110 are connected by a bus 2140.
- the bus is represented by a thick line in FIG. 21a.
- the connection mode between other components is only for schematic illustration. , Is not limited.
- the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used to represent in FIG. 21a, but it does not mean that there is only one bus or one type of bus.
- the communication interface 2110 may output or receive a baseband signal.
- the processor may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, which may implement or Perform the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
- the general-purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
- FIG. 21b is a schematic structural diagram of another terminal device 2100 provided in an embodiment of this application.
- the terminal device can perform the operations performed by the first terminal device in the foregoing method embodiment.
- FIG. 21b only shows the main components of the terminal device.
- the terminal device 2100 includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device.
- the processor is mainly used to process the communication protocol and communication data, and to control the entire terminal device, execute the software program, and process the data of the software program, for example, to support the terminal device to execute the processes described in FIGS. 3-17.
- the memory is mainly used to store software programs and data.
- the radio frequency circuit is mainly used for the conversion of baseband signal and radio frequency signal and the processing of radio frequency signal.
- the antenna is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
- the terminal device 2100 may also include input and output devices, such as a touch screen, a display screen, a keyboard, etc., which are mainly used to receive data input by the user and output data to the user. It should be noted that some types of terminal devices may not have input and output devices.
- the processor can read the software program in the storage unit, interpret and execute the software program, and process the data of the software program.
- the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
- the radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal to the outside in the form of electromagnetic waves through the antenna.
- the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.
- FIG. 21b shows only one memory and a processor. In an actual terminal device, there may be multiple processors and memories.
- the memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.
- the processor may include a baseband processor and a central processing unit (CPU).
- the baseband processor is mainly used to process communication protocols and communication data, and the CPU is mainly used to process the entire terminal.
- the equipment controls, executes the software program, and processes the data of the software program.
- the processor may also be a network processor (network processor, NP) or a combination of CPU and NP.
- the processor may further include a hardware chip.
- the aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
- the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.
- the memory may include volatile memory (volatile memory), such as random-access memory (RAM); the memory may also include non-volatile memory (non-volatile memory), such as flash memory (flash memory) , Hard disk drive (HDD) or solid-state drive (solid-state drive, SSD); the memory may also include a combination of the above types of memory.
- the antenna and radio frequency circuit with the transceiver function can be regarded as the communication unit 2101 of the terminal device 2100, and the processor with the processing function can be regarded as the terminal device 2100.
- the communication unit 2101 may also be called a transceiver, a transceiver, a transceiving device, etc., and is used to implement a transceiving function.
- the device for implementing the receiving function in the communication unit 2101 can be regarded as the receiving unit, and the device for implementing the sending function in the communication unit 2101 as the sending unit, that is, the communication unit 2101 includes a receiving unit and a sending unit.
- the receiving unit may also be called a receiver, a receiver, a receiving circuit, etc.
- the sending unit may be called a transmitter, a transmitter, or a transmitting circuit, etc.
- the communication unit 2101 and the processing unit 2102 may be integrated into one device or separated into different devices.
- the processor and the memory may also be integrated into one device or separate into different devices.
- the communication unit 2101 may be used to perform the transceiving operation of the first terminal device in the foregoing method embodiment.
- the processing unit 2102 may be used to perform the data processing operation of the first terminal device in the foregoing method embodiment.
- the embodiment of the present invention also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when it runs on a processor, the method flow of the foregoing method embodiment is realized.
- the embodiment of the present invention also provides a computer program product.
- the computer program product runs on a processor, the method flow of the above method embodiment is realized.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
- Telephonic Communication Services (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
终端设备的SUPI | UAS类型信息 |
终端设备1的SUPI1 | 无人机类型 |
终端设备2的SUPI2 | 无人机类型 |
终端设备3的SUPI3 | 遥控器类型 |
序号 | 进行UAS认证的终端设备的SUPI |
1 | 终端设备1的SUPI1 |
2 | 终端设备2的SUPI2 |
3 | 终端设备3的SUPI3 |
UAS标识 | SUPI |
终端设备1的UAS标识1 | SUPI1 |
终端设备2的UAS标识2 | SUPI2 |
终端设备3的UAS标识3 | SUPI3 |
Claims (36)
- 一种身份认证方法,其特征在于,所述方法包括:第一网络设备接收第一终端设备发送的第一请求,所述第一请求携带所述第一认证指示信息,所述第一认证指示信息用于请求对所述第一终端设备进行无人机***UAS认证;所述第一网络设备向所述第一终端设备发送第二请求,所述第二请求用于请求获取所述第一终端设备的UAS标识;所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS标识,并向第二网络设备发送所述第一终端设备的UAS标识;所述第二网络设备基于所述UAS标识对所述第一终端设备进行UAS认证;所述第二网络设备向所述第一网络设备发送所述第一终端设备的UAS认证结果;所述第一网络设备向所述第一终端设备发送所述第一终端设备的UAS认证结果。
- 根据权利要求1所述的方法,其特征在于,所述第一认证指示信息为注册类型信息,或所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
- 根据权利要求1或2所述的方法,其特征在于,所述第一网络设备接收第一终端设备发送的第一请求之后,所述方法还包括:所述第一网络设备确定是否对所述第一终端设备进行UAS认证;所述第一网络设备向所述第一终端设备发送第二请求,包括:当所述第一网络设备确定对所述第一终端设备进行UAS认证时,所述第一网络设备向所述第一终端设备发送第二请求。
- 根据权利要求3所述的方法,其特征在于,所述第一网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第一网络设备基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求3所述的方法,其特征在于,所述第一请求携带所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型;所述第一网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第一网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求1~5中任意一项所述的方法,其特征在于,所述第二网络设备接收所述第一网络设备发送的UAS标识之后,所述方法还包括:所述第二网络设备确定是否对所述第一终端设备进行UAS认证;所述第二网络设备对所述第一终端设备进行UAS认证,包括:当所述第二网络设备确定对所述第一终端设备进行UAS认证时,所述第二网络设备基于所述UAS标识对所述第一终端设备进行UAS认证。
- 根据权利要求6所述的方法,其特征在于,所述第二网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第二网络设备基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求6所述的方法,其特征在于,所述第一请求携带所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型;所述方法还包括:所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息;所述第二网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第二网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求6所述的方法,其特征在于,所述第二请求还用于请求获取所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型;所述第一网络设备向所述第一终端设备发送第二请求之后,所述方法还包括:所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS类型信息;所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息;所述第二网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第二网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求6所述的方法,其特征在于,所述第一请求还携带所述第一终端设备的SUCI或GUTI,所述方法还包括:所述第一网络设备向所述第二网络设备发送所述第一终端设备的SUPI或GPSI,所述第一终端设备的SUPI或GPSI根据所述第一终端设备的SUCI或GUTI得到;所述第二网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第二网络设备基于所述UAS标识与所述第一终端设备的SUPI或GPSI确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求1~10中任意一项所述的方法,其特征在于,所述方法还包括:所述第一网络设备和所述第二网络设备基于所述UAS认证结果更新所述第一终端设备的UAS认证状态标识。
- 一种身份认证方法,其特征在于,所述方法包括:第一网络设备接收第一终端设备发送的第一请求,所述第一请求携带所述第一认证指示信息,所述第一认证指示信息用于请求对所述第一终端设备进行无人机***UAS认证, 所述第一终端设备为UAS中的设备;所述第一网络设备向所述第一终端设备发送第二请求,所述第二请求用于请求获取所述第一终端设备的UAS标识;所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS标识;所述第一网络设备向第二网络设备发送所述第一终端设备的UAS标识;所述第一网络设备接收所述第二网络设备发送的所述第一终端设备的UAS认证结果;所述第一网络设备向所述第一终端设备发送所述第一终端设备的UAS认证结果。
- 根据权利要求12所述的方法,其特征在于,所述第一认证指示信息为注册类型信息,或所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
- 根据权利要求12或13所述的方法,其特征在于,所述第一网络设备接收第一终端设备发送的第一请求之后,所述方法还包括:所述第一网络设备确定是否对所述第一终端设备进行UAS认证;所述第一网络设备向所述第一终端设备发送第二请求,包括:当所述第一网络设备确定对所述第一终端设备进行UAS认证时,所述第一网络设备向所述第一终端设备发送第二请求。
- 根据权利要求14所述的方法,其特征在于,所述第一网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第一网络设备基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求14所述的方法,其特征在于,所述第一请求携带所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型;所述第一网络设备确定是否对所述第一终端设备进行UAS认证,包括:所述第一网络设备基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求12~16中任意一项所述的方法,其特征在于,所述第一请求携带所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型;所述方法还包括:所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息。
- 根据权利要求12~16中任意一项所述的方法,其特征在于,所述第二请求还用于请求获取所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型;所述第一网络设备向所述第一终端设备发送第二请求之后,所述方法还包括:所述第一网络设备接收所述第一终端设备发送的所述第一终端设备的UAS类型信息;所述第一网络设备向所述第二网络设备发送所述第一终端设备的UAS类型信息。
- 根据权利要求12~18中任意一项所述的方法,其特征在于,所述方法还包括:所述第一网络设备基于所述UAS认证结果更新所述第一终端设备的UAS认证状态。
- 一种身份认证方法,其特征在于,应用于第一终端设备,所述第一终端设备为无人机***UAS中的设备,所述方法包括:所述第一终端设备向第一网络设备发送第一请求,所述第一请求携带第一认证指示信息,所述第一认证指示信息用于请求对所述第一终端设备进行UAS认证;所述第一终端设备接收所述第一网络设备发送的第二请求,所述第二请求用于请求获取所述第一终端设备的UAS标识;所述第一终端设备响应于所述第二请求,向所述第一网络设备发送所述第一终端设备的UAS标识;所述第一终端设备接收所述第一网络设备发送的所述第一终端设备的UAS认证结果。
- 根据权利要求20所述的方法,其特征在于,所述第一认证指示信息为注册类型信息,或所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
- 根据权利要求20或21所述的方法,其特征在于,所述第一请求携带所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
- 根据权利要求20所述的方法,其特征在于,所述第二请求还用于请求获取所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型;所述方法还包括:所述第一终端设备向所述第一网络设备发送所述第一终端设备的UAS类型信息。
- 一种通信装置,其特征在于,所述通信装置包括:接收单元,用于接收第一终端设备发送的第一请求,所述第一请求携带所述第一认证指示信息,所述第一认证指示信息用于请求对所述第一终端设备进行无人机***UAS认证,所述第一终端设备为UAS中的设备;发送单元,用于向所述第一终端设备发送第二请求,所述第二请求用于请求获取所述第一终端设备的UAS标识;所述接收单元,还用于接收所述第一终端设备发送的所述第一终端设备的UAS标识;所述发送单元,还用于向第二网络设备发送所述第一终端设备的UAS标识;所述接收单元,还用于接收所述第二网络设备发送的所述第一终端设备的UAS认证结果;所述发送单元,还用于向所述第一终端设备发送所述第一终端设备的UAS认证结果。
- 根据权利要求24所述的通信装置,其特征在于,所述第一认证指示信息为注册类型信息,或所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型。
- 根据权利要求24或25所述的通信装置,其特征在于,所述通信装置还包括:所述处理单元,用于确定是否对所述第一终端设备进行UAS认证;所述发送单元向所述第一终端设备发送第二请求的方式具体为:当确定对所述第一终端设备进行UAS认证时,向所述第一终端设备发送第二请求。
- 根据权利要求26所述的通信装置,其特征在于,所述处理单元确定是否对所述第一终端设备进行UAS认证的方式具体为:基于所述第一终端设备的UAS认证状态标识确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求26所述的通信装置,其特征在于,所述第一请求携带所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型;所述处理单元确定是否对所述第一终端设备进行UAS认证的方式具体为:基于接收的所述UAS类型信息确定是否对所述第一终端设备进行UAS认证。
- 根据权利要求24~28中任意一项所述的通信装置,其特征在于,所述第一请求携带所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型;所述发送单元,还用于向所述第二网络设备发送所述第一终端设备的UAS类型信息。
- 根据权利要求24~28中任意一项所述的通信装置,其特征在于,所述第二请求还用于请求获取所述第一终端设备的UAS类型信息,所述UAS类型信息指示所述第一终端设备在所述UAS中的设备类型、业务类型或服务类型;所述接收单元,还用于接收所述第一终端设备发送的所述第一终端设备的UAS类型信息;所述发送单元,还用于向所述第二网络设备发送所述第一终端设备的UAS类型信息。
- 一种通信装置,其特征在于,所述通信装置包括:发送单元,用于向第一网络设备发送第一请求,所述第一请求携带第一认证指示信息,所述第一认证指示信息用于请求对所述通信装置进行UAS认证;接收单元,用于接收所述第一网络设备发送的第二请求,所述第二请求用于请求获取所述通信装置的UAS标识;所述发送单元,还用于响应于所述第二请求,向所述第一网络设备发送所述通信装置的UAS标识;所述接收单元,还用于接收所述第一网络设备发送的所述通信装置的UAS认证结果。
- 根据权利要求31所述的通信装置,其特征在于,所述第一认证指示信息为注册类型信息,或所述通信装置的UAS类型信息,所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型。
- 根据权利要求31或32所述的通信装置,其特征在于,所述第一请求携带所述通信装置的UAS类型信息,所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型。
- 根据权利要求31所述的通信装置,其特征在于,所述第二请求还用于请求获取所述通信装置的UAS类型信息,所述UAS类型信息指示所述通信装置在所述UAS中的设备类型、业务类型或服务类型;所述发送单元,还用于向所述第一网络设备发送所述通信装置的UAS类型信息。
- 一种通信装置,其特征在于,包括处理器和通信接口,所述通信接口用于与其它通信装置进行通信;所述处理器用于运行程序,以使得所述通信装置以实现权利要求12至19中任一项所述的方法或使得所述通信装置以实现权利要求20至23中任一项所述的方法。
- 一种计算机可读存储介质,其特征在于,计算机可读存储介质中存储有指令,当其在计算机上运行时,使得计算机执行上述权利要求12至19中任意一项所述的方法或上述权利要求20至23中任意一项所述的方法。
Priority Applications (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
BR112022008022A BR112022008022A2 (pt) | 2019-11-04 | 2019-11-04 | Método de autenticação de identidade e aparelho de comunicações |
CN201980101723.1A CN114600487B (zh) | 2019-11-04 | 2019-11-04 | 身份认证方法及通信装置 |
PCT/CN2019/115441 WO2021087696A1 (zh) | 2019-11-04 | 2019-11-04 | 身份认证方法及通信装置 |
EP19951274.0A EP4044644A4 (en) | 2019-11-04 | 2019-11-04 | IDENTITY AUTHENTICATION PROCESS AND COMMUNICATION DEVICE |
US17/736,750 US20220272533A1 (en) | 2019-11-04 | 2022-05-04 | Identity authentication method and communications apparatus |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/CN2019/115441 WO2021087696A1 (zh) | 2019-11-04 | 2019-11-04 | 身份认证方法及通信装置 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/736,750 Continuation US20220272533A1 (en) | 2019-11-04 | 2022-05-04 | Identity authentication method and communications apparatus |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2021087696A1 true WO2021087696A1 (zh) | 2021-05-14 |
Family
ID=75848610
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2019/115441 WO2021087696A1 (zh) | 2019-11-04 | 2019-11-04 | 身份认证方法及通信装置 |
Country Status (5)
Country | Link |
---|---|
US (1) | US20220272533A1 (zh) |
EP (1) | EP4044644A4 (zh) |
CN (1) | CN114600487B (zh) |
BR (1) | BR112022008022A2 (zh) |
WO (1) | WO2021087696A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2024114431A1 (zh) * | 2022-11-29 | 2024-06-06 | 中移(成都)信息通信科技有限公司 | 通信***、方法、装置、相关设备及存储介质 |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20230379696A1 (en) * | 2022-05-19 | 2023-11-23 | Verizon Patent And Licensing Inc. | On-demand subscription concealed identifier (suci) deconcealment for select applications |
CN115603982B (zh) * | 2022-09-30 | 2024-05-28 | 重庆长安汽车股份有限公司 | 车载终端安全认证方法及装置、电子设备、存储介质 |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20180090013A1 (en) * | 2016-09-23 | 2018-03-29 | Sharp Laboratories Of America, Inc. | Unmanned aircraft and operation thereof |
US20180281946A1 (en) * | 2017-03-31 | 2018-10-04 | T-Mobile U.S.A., Inc. | Authorizing drone access to fulfillment centers |
CN108702356A (zh) * | 2017-05-19 | 2018-10-23 | 深圳市大疆创新科技有限公司 | 身份验证方法、设备、机器可读存储介质以及*** |
WO2019028746A1 (zh) * | 2017-08-10 | 2019-02-14 | 北京小米移动软件有限公司 | 无人机接入方法及装置 |
WO2019047066A1 (zh) * | 2017-09-06 | 2019-03-14 | 北京小米移动软件有限公司 | 无人机接入方法及装置 |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101521660B (zh) * | 2008-02-27 | 2012-10-03 | 华为技术有限公司 | 会话发起协议注册方法、认证及授权方法、***及设备 |
WO2017042403A1 (es) * | 2015-09-09 | 2017-03-16 | Tecteco Security Systems, S.L. | Control seguro de vehículos no tripulados |
CN109511115B (zh) * | 2017-09-14 | 2020-09-29 | 华为技术有限公司 | 一种授权方法和网元 |
CN109561429B (zh) * | 2017-09-25 | 2020-11-17 | 华为技术有限公司 | 一种鉴权方法及设备 |
US20220369363A1 (en) * | 2019-08-23 | 2022-11-17 | Idac Holdings, Inc. | Authentication and authorization to access a network by an unmanned aerial vehicle |
-
2019
- 2019-11-04 EP EP19951274.0A patent/EP4044644A4/en active Pending
- 2019-11-04 WO PCT/CN2019/115441 patent/WO2021087696A1/zh unknown
- 2019-11-04 BR BR112022008022A patent/BR112022008022A2/pt unknown
- 2019-11-04 CN CN201980101723.1A patent/CN114600487B/zh active Active
-
2022
- 2022-05-04 US US17/736,750 patent/US20220272533A1/en active Pending
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20180090013A1 (en) * | 2016-09-23 | 2018-03-29 | Sharp Laboratories Of America, Inc. | Unmanned aircraft and operation thereof |
US20180281946A1 (en) * | 2017-03-31 | 2018-10-04 | T-Mobile U.S.A., Inc. | Authorizing drone access to fulfillment centers |
CN108702356A (zh) * | 2017-05-19 | 2018-10-23 | 深圳市大疆创新科技有限公司 | 身份验证方法、设备、机器可读存储介质以及*** |
WO2019028746A1 (zh) * | 2017-08-10 | 2019-02-14 | 北京小米移动软件有限公司 | 无人机接入方法及装置 |
WO2019047066A1 (zh) * | 2017-09-06 | 2019-03-14 | 北京小米移动软件有限公司 | 无人机接入方法及装置 |
Non-Patent Citations (2)
Title |
---|
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Unmanned Aerial System support in 3GPP; Stage 1; Release 16", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 22.125, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V1.0.0, 4 December 2018 (2018-12-04), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, pages 1 - 9, XP051591010 * |
See also references of EP4044644A4 * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2024114431A1 (zh) * | 2022-11-29 | 2024-06-06 | 中移(成都)信息通信科技有限公司 | 通信***、方法、装置、相关设备及存储介质 |
Also Published As
Publication number | Publication date |
---|---|
EP4044644A1 (en) | 2022-08-17 |
CN114600487A (zh) | 2022-06-07 |
BR112022008022A2 (pt) | 2022-07-12 |
EP4044644A4 (en) | 2022-10-19 |
US20220272533A1 (en) | 2022-08-25 |
CN114600487B (zh) | 2023-12-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10798767B2 (en) | Method and apparatus for relaying user data between a secure connection and a data connection | |
JP2022502922A (ja) | 3gppプライベートlan | |
WO2016085001A1 (ko) | 스몰셀 환경을 지원하는 무선 접속 시스템에서 위치 비밀성 보호를 지원하는 방법 및 장치 | |
WO2021136211A1 (zh) | 授权结果的确定方法及装置 | |
US20220272533A1 (en) | Identity authentication method and communications apparatus | |
WO2020056611A1 (zh) | 用于网络切片鉴权的方法和设备 | |
US20220086145A1 (en) | Secondary Authentication Method And Apparatus | |
US20230048066A1 (en) | Slice authentication method and apparatus | |
TWI799064B (zh) | 一種金鑰標識的生成方法以及相關裝置 | |
WO2021063298A1 (zh) | 实现外部认证的方法、通信装置及通信*** | |
US20240137762A1 (en) | Base station providing virtual wireless router | |
US20240129710A1 (en) | Methods and apparatus for subscription authorization enhancement | |
WO2023160199A1 (zh) | 一种接入通信网络的方法和装置 | |
WO2023016160A1 (zh) | 一种会话建立方法和相关装置 | |
US20220264435A1 (en) | Access control method and communications apparatus | |
WO2021195816A1 (zh) | 一种通信方法、装置及*** | |
US20240163670A1 (en) | Wireless communication method and apparatus | |
US20240187856A1 (en) | Registration authentication based on a capability | |
US20230354028A1 (en) | Method, system, and apparatus for generating key for inter-device communication | |
WO2023246457A1 (zh) | 安全决策协商方法及网元 | |
US20240179519A1 (en) | Communication method and related apparatus | |
WO2022237898A1 (zh) | 用于在线签约的方法、通信装置、介质及芯片 | |
WO2020215272A1 (zh) | 通信方法、通信装置和通信*** | |
CN117796043A (zh) | 向受制于准入控制的网络切片的注册 | |
CN117242810A (zh) | 无线通信***中的终端操作方法和设备 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 19951274 Country of ref document: EP Kind code of ref document: A1 |
|
REG | Reference to national code |
Ref country code: BR Ref legal event code: B01A Ref document number: 112022008022 Country of ref document: BR |
|
ENP | Entry into the national phase |
Ref document number: 2019951274 Country of ref document: EP Effective date: 20220513 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 112022008022 Country of ref document: BR Kind code of ref document: A2 Effective date: 20220427 |