WO2021134724A1 - 认证方法、装置及*** - Google Patents

认证方法、装置及*** Download PDF

Info

Publication number
WO2021134724A1
WO2021134724A1 PCT/CN2019/130983 CN2019130983W WO2021134724A1 WO 2021134724 A1 WO2021134724 A1 WO 2021134724A1 CN 2019130983 W CN2019130983 W CN 2019130983W WO 2021134724 A1 WO2021134724 A1 WO 2021134724A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
iab
node
host
authentication
Prior art date
Application number
PCT/CN2019/130983
Other languages
English (en)
French (fr)
Inventor
刘菁
戴明增
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2019/130983 priority Critical patent/WO2021134724A1/zh
Priority to CN201980103050.3A priority patent/CN114830705A/zh
Publication of WO2021134724A1 publication Critical patent/WO2021134724A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • This application relates to the field of communication technology, in particular to authentication methods, devices and systems.
  • IAB integrated access backhaul
  • the IAB technology combines the wireless access link and wireless backhaul.
  • the transmission link is integrated and does not require a separate antenna (usually optical fiber) for the backhaul link, enabling operators to install 5G antennas in places where it is difficult to deploy optical fibers or the cost of deploying optical fibers is too high.
  • 5G-authentication and key agreement 5G-authentication and key agreement
  • 5G-AKA extensible authentication protocol-AKA'
  • EAP-AKA' extensible authentication protocol
  • 5G-AKA or EAP-AKA' authentication method requires that the IAB node must be configured with a universal subscriber identity module (USIM) card, which increases the cost of the IAB node.
  • USIM universal subscriber identity module
  • the embodiments of the application provide an authentication method, device and system.
  • the IAB donor (donor) can use the certificate authentication method to authenticate the IAB node based on the ability to support certificate authentication reported by the IAB node. Therefore, the IAB node does not need to be configured with a USIM card Then the security authentication when entering the network can be completed, which reduces the cost of the IAB node.
  • an IAB scenario is used as an example for description.
  • the IAB node can be replaced with a relay node, and the IAB host can be replaced with a host node.
  • an authentication method and its corresponding authentication device are provided.
  • the IAB host receives the first message from the IAB node, the first message includes first indication information, the first indication information is used to indicate the authentication method supported by the IAB node, and the authentication method supported by the IAB node includes certificate authentication;
  • IAB According to the first indication information, the host determines that the IAB node uses certificate authentication; the IAB host sends a second message to the IAB node, and the second message includes second indication information for instructing the IAB node to use certificate authentication; where the IAB host is the IAB node’s Parent node; or, the IAB node is connected to the IAB host through one or more other IAB nodes.
  • the first message may be a radio resource control (radio resource control, RRC) connection establishment request message (setup request); or, the first message may be an RRC connection establishment complete message (setup complete).
  • RRC radio resource control
  • the second message may be an RRC connection establishment message (setup). If the first message is an RRC connection establishment complete message, the second message may be an RRC message sent by the IAB host to the IAB node after the RRC connection establishment complete message.
  • the IAB host can determine that the IAB node uses certificate authentication according to the ability to support certificate authentication reported by the IAB node, and send a second message to the IAB node to instruct the IAB node to use the certificate authentication method for security authentication, so that the IAB Nodes do not need to configure the USIM card to complete the security authentication when accessing the network, which reduces the cost of the IAB node, and the authentication process only involves the interaction between the IAB host and the IAB node, without the involvement of the core network, reducing the impact on the core network.
  • the method before the IAB host receives the first message from the IAB node, the method further includes: the IAB host sends a system broadcast message, the system broadcast message includes third indication information, and the third indication information is used to indicate the IAB
  • the host supports certificate authentication.
  • the IAB host may carry the third indication information in the system broadcast message to notify the IAB node that the IAB host supports the certificate authentication mode.
  • the authentication method supported by the IAB node further includes at least one of the following authentication methods: 5G-authentication and key agreement AKA, extensible authentication protocol EAP-AKA' or EAP-transport layer security TLS.
  • the method further includes: the IAB host receives a third message from the IAB node; the IAB host authenticates the IAB node according to the third message; wherein ,
  • the third message carries at least one of the following information: the electronic serial number ESN of the IAB node, the certificate of the IAB node, or the signature of the third message by the IAB node.
  • the IAB host may authenticate the IAB node according to the third message from the IAB node that includes certificate-related information.
  • the third message includes the certificate of the IAB node, the certificate of the IAB node comes from the certificate issuing server CA; the certificate of the IAB node includes the CA signature, and the IAB host has the CA public key from the CA; the IAB host according to the third Message, to authenticate the IAB node, including: the IAB host uses the CA public key to verify the CA signature.
  • the third message further includes the signature of the IAB node on the third message, and the certificate of the IAB node also includes the public key of the IAB node; the IAB host authenticates the IAB node according to the third message, and further includes: If the IAB host uses the CA public key to verify the CA signature, the IAB host obtains the IAB node's public key from the IAB node's certificate, and uses the IAB node's public key to verify the signature of the third message.
  • the third message also includes the ESN of the IAB node.
  • the IAB host has an ESN whitelist from the operation management and maintenance server OAM; the IAB host authenticates the IAB node according to the third message, and also includes: The IAB host uses the public key of the IAB node to verify the signature of the third message, and the IAB host verifies the consistency between the ESN of the IAB node and the ESN included in the certificate of the IAB node; or, if the IAB host uses the public key of the IAB node The signature verification of the third message by the key passes, and the IAB host uses the ESN whitelist to verify the ESN of the IAB node.
  • the method may further include: the IAB host sends a fourth message to the IAB node.
  • the fourth message may carry at least one of the following information: the electronic serial number (ESN) of the IAB host, the certificate of the IAB host, or the signature of the fourth message by the IAB host, etc.
  • the IAB host can also send a fourth message to the IAB node, so that the IAB node can authenticate the IAB host according to the fourth message, thereby completing the IAB host and Two-way authentication process between IAB nodes.
  • the method further includes: the IAB host receives request information from the IAB node, the request information is used to instruct to obtain the certificate of the IAB node; in response to the request Information, the IAB host obtains the certificate of the IAB node from the operator CA through the core network; the IAB host sends the certificate of the IAB node to the IAB node.
  • the signaling transmission involved in the above process can be carried on the signaling radio bearer SRB1 for transmission; or, it can be carried on the pre-configured data radio bearer DRB for transmission.
  • an authentication method and its corresponding communication device are provided.
  • the IAB node sends a first message to the IAB host, the first message includes first indication information, the first indication information is used to indicate the authentication method supported by the IAB node, and the authentication method supported by the IAB node includes certificate authentication;
  • the IAB node Receive a second message from the IAB host, the second message includes second indication information for instructing the IAB node to use certificate authentication; where the IAB host is the parent node of the IAB node; or the IAB node passes through one or more other IAB nodes Connect with the IAB host.
  • the first message may be an RRC connection establishment request message; or, the first message may be an RRC connection establishment complete message. If the first message is an RRC connection establishment request message, the second message may be an RRC connection establishment message. If the first message is an RRC connection establishment complete message, the second message may be an RRC message sent by the IAB host to the IAB node after the RRC connection establishment complete message.
  • the IAB node reports the ability to support certificate authentication to the IAB host, and receives a second message including second indication information for instructing the IAB node to use certificate authentication, so as to instruct the IAB node to use the certificate authentication method for security authentication , So that the IAB node can complete the security authentication when accessing the network without configuring the USIM card, reducing the cost of the IAB node, and making the authentication process only involve the interaction between the IAB host and the IAB node, without the involvement of the core network, reducing the need for The influence of the core network.
  • the method before the IAB node sends the first message to the IAB host, the method further includes: the IAB node receives a system broadcast message from the IAB host, the system broadcast message includes the third indication information, and the third indication information is used To instruct the IAB host to support the certificate authentication method.
  • the authentication method supported by the IAB node also includes at least one of the following authentication methods: 5G-authentication and key agreement AKA, Extensible Authentication Protocol EAP-AKA' or EAP-Extensible Authentication Protocol TLS .
  • the method further includes: the IAB node sends a third message to the IAB host, and the third message carries at least one of the following information: The electronic serial number ESN, the certificate of the IAB node, and the signature of the third message by the IAB node.
  • the method may further include: the IAB node receives a fourth message from the IAB host, and authenticates the IAB host according to the fourth message.
  • the fourth message may carry at least one of the following information: the electronic serial number (ESN) of the IAB host, the certificate of the IAB host, or the signature of the fourth message by the IAB host, etc.
  • the IAB node after the IAB node sends the third message to the IAB host, the IAB node receives the fourth message from the IAB host, so that the IAB node can authenticate the IAB host according to the fourth message, thereby completing the communication between the IAB host and the IAB node The two-way authentication process.
  • the method further includes: the IAB node sends request information to the IAB host, and the request information is used to indicate to obtain the certificate of the IAB node;
  • the certificate of the IAB node hosted by the IAB may be carried on the signaling radio bearer SRB1 for transmission; or, it may be carried on the pre-configured data radio bearer DRB for transmission.
  • a communication device for implementing the above-mentioned various methods.
  • the communication device may be the IAB host in the first aspect described above, or a device including the IAB host described above; or, the communication device may be the IAB node in the second aspect described above, or a device including the IAB node described above.
  • the communication device includes a module, unit, or means corresponding to the foregoing method, and the module, unit, or means can be implemented by hardware, software, or hardware execution of corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above-mentioned functions.
  • a communication device including: a processor and a memory; the memory is used to store computer instructions, and when the processor executes the instructions, the communication device executes the method described in any of the above aspects.
  • the communication device may be the IAB host in the foregoing first aspect or a device including the foregoing IAB host; or, the communication device may be the IAB node in the foregoing second aspect, or a device including the foregoing IAB node.
  • a communication device including: a processor; the processor is configured to couple with a memory, and after reading an instruction in the memory, execute the method according to any one of the foregoing aspects according to the instruction.
  • the communication device may be the IAB host in the foregoing first aspect or a device including the foregoing IAB host; or, the communication device may be the IAB node in the foregoing second aspect, or a device including the foregoing IAB node.
  • a computer-readable storage medium stores instructions that, when run on a computer, enable the computer to execute the method described in any of the above aspects.
  • a computer program product containing instructions which when running on a computer, enables the computer to execute the method described in any of the above aspects.
  • a communication device for example, the communication device may be a chip or a chip system
  • the communication device includes a processor for implementing the functions involved in any of the foregoing aspects.
  • the communication device further includes a memory for storing necessary program instructions and data.
  • the communication device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices.
  • a communication system in a ninth aspect, includes the IAB host described in the foregoing aspect and the IAB node described in the foregoing aspect.
  • FIG. 1 is a structural diagram of an IAB network provided by an embodiment of this application.
  • FIG. 2 is a flow chart of an IAB node/IAB host applying for a certificate from a CA according to an embodiment of the application;
  • FIG. 3 is a schematic diagram of the hardware structure of a communication device provided by an embodiment of the application.
  • FIG. 4 is a flowchart of an authentication method provided by an embodiment of the application.
  • FIG. 5 is a flowchart of another authentication method provided by an embodiment of the application.
  • FIG. 6 is a schematic diagram of an authentication method provided by an embodiment of the application.
  • FIG. 7 is a schematic diagram of another authentication method provided by an embodiment of the application.
  • FIG. 8 is a schematic diagram of another authentication method provided by an embodiment of the application.
  • FIG. 9 is a schematic diagram of an authentication method provided by an embodiment of the application.
  • FIG. 10 is a flowchart of another authentication method provided by an embodiment of the application.
  • FIG. 11 is a flowchart of another authentication method provided by an embodiment of the application.
  • FIG. 12 is a flowchart of another authentication method provided by an embodiment of this application.
  • FIG. 13 is a flowchart of another authentication method provided by an embodiment of this application.
  • FIG. 14 is a flowchart of another authentication method provided by an embodiment of the application.
  • FIG. 15 is a structural diagram of an IAB node provided by an embodiment of this application.
  • FIG. 16 is a structural diagram of an IAB host provided by an embodiment of the application.
  • At least one item (a) refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • words such as “first” and “second” are used to distinguish the same or similar items with substantially the same function and effect. Those skilled in the art can understand that words such as “first” and “second” do not limit the quantity and order of execution, and words such as “first” and “second” do not limit the difference.
  • the authentication method provided by the embodiment of the present application can be applied to the communication system 100 shown in FIG. 1.
  • the communication system 10 may include an IAB host 20 and an IAB node 30, where the IAB host may also be referred to as a host IAB, or an IAB base station, etc., which is not limited in this application.
  • the IAB node 30 can directly access the IAB host 20, that is, the IAB host is the parent node of the IAB node, and this scenario is called a single-hop access backhaul integrated scenario.
  • the IAB node 30 can access the IAB host 20 through other IAB nodes (for example, the IAB node 40), that is, the IAB node is connected to the IAB host through one or more other IAB nodes. This scenario is called multi-hop access backhaul. Integrated scene.
  • the IAB network may adopt a centralized unit-distributed unit (CU-DU) separation architecture, that is, the IAB host 20 is hosted by the IAB host DU (referred to as the host DU) 21 and IAB host CU (referred to as host CU) 22 are composed of two parts.
  • the IAB node 30 is composed of two parts: an IAB node DU (referred to as node DU) 31 and an IAB node mobile terminal (mobile terminal, MT) (referred to as node MT) 32.
  • IAB-MT may also be referred to as IAB-UE, which is not limited in this application.
  • the donor CU 22 is used to provide a control function, and can send control signaling to the IAB node through the donor DU 21.
  • the host DU 21 can transfer the signaling from the host CU 22 to the IAB node, and can also transmit data from its child nodes (ie, the IAB node 30 or the IAB node 40 or the terminal device 50 shown in FIG. 1) back to the IAB node.
  • the node DU 31 is used to provide access services for its child nodes and to provide uplink and downlink data transmission between its child nodes and the IAB node 30.
  • the child node of the node DU 31 may be the terminal device 50 or other IAB nodes.
  • the node MT 32 has a function similar to a terminal device, and can be used to return the data transmitted by the node DU 31 from its child nodes. For example, in a multi-hop scenario, the data is returned to the IAB node 40, or, In the single-hop scenario, the data is directly sent back to the IAB host 20.
  • the IAB host may receive a first message from the IAB node that includes first indication information, and the first indication information may indicate the authentication supported by the IAB node Ways include certificate authentication. Therefore, the IAB host can determine that the IAB node uses certificate authentication according to the first indication information, and send a second message including the second indication information for instructing the IAB node to use the certificate authentication to the IAB node.
  • the IAB host can determine that the IAB node uses certificate authentication according to the ability to support certificate authentication reported by the IAB node, and send a second message to the IAB node to instruct the IAB node to use the certificate authentication method for security authentication, so that the IAB node No need to configure the USIM card to complete the security authentication when accessing the network, reducing the cost of the IAB node, and the authentication process only involves the interaction between the IAB host and the IAB node, without the involvement of the core network, reducing the impact on the core network.
  • the IAB node access to the network may include the first access after the IAB node is turned on, or the re-access after the IAB node device is powered off, etc.
  • the embodiment of the present application does not limit the specific scenario of the IAB access to the network.
  • the IAB host may be the parent node of the IAB node; or, the IAB node may also be connected to the IAB host through one or more other IAB nodes.
  • the IAB node and the IAB host may be devices of the same manufacturer, or devices of different manufacturers.
  • the IAB node uses the certificate authentication method for security authentication when accessing the network
  • the IAB node and the IAB host are devices of the same manufacturer
  • the IAB node and the IAB host can apply to the certificate authority (CA) of the manufacturer respectively Obtain a certificate (or called a digital certificate).
  • CA certificate authority
  • the IAB node and the IAB host can apply to the Huawei CA for certificates respectively.
  • the IAB node and the IAB host can apply to the Huawei CA respectively when the device leaves the factory. Obtain a certificate.
  • This application does not limit the time for IAB nodes and IAB hosts to apply to Huawei CA for certificates.
  • the process of the IAB node and the IAB host respectively applying to the CA to obtain a certificate may be as shown in FIG. 2.
  • the IAB node/IAB host sends a certificate request message to the CA.
  • the certificate request message may include the identity information of the IAB node/IAB host.
  • the CA can generate a corresponding certificate for the IAB node/IAB host according to the certificate request message from the IAB node/IAB host, and send a certificate response message to the IAB node/IAB host.
  • the certificate response message includes that the CA is an IAB node/IAB The certificate generated by the host.
  • the certificate generated by the CA for the IAB node/IAB host may contain one or more of the following information:
  • CA signature that is, the CA uses its own private key to sign the certificate of the IAB host/IAB node.
  • the information contained in the certificate of the IAB node/IAB host is not limited to the above examples, and the certificate of the IAB node/IAB host may also include other information, which is not limited in this application.
  • the CA can also send the CA's public key information to the IAB node/IAB host.
  • the CA may carry the public key information of the CA in the certificate response message; further exemplary, the CA may also send the public key information of the CA to the IAB node/IAB host through other messages.
  • the embodiment of the present application does not limit the manner in which the CA sends the public key information of the CA to the IAB node/IAB host.
  • the IAB node and the IAB host can obtain their respective certificates from the CA through the above process, so that the IAB node and the IAB host can use the obtained certificates to pass the communication between the IAB node and the IAB host.
  • Certificate authentication can be completed by interaction, and the entire authentication process is completed on the air interface side without the involvement of the core network.
  • certificate authentication can also be called private authentication between IAB nodes and IAB hosts, which is compared with the core requirements in the prior art.
  • the authentication method of network participation can speed up the IAB node authentication process and shorten the time delay of the IAB node's network access process.
  • FIG. 3 shows a schematic diagram of the hardware structure of a communication device provided by an embodiment of the application.
  • the communication device 300 includes a processor 301, a communication line 302, a memory 303, and at least one communication interface (in FIG. 3, it is only exemplary and the communication interface 304 is included as an example for illustration).
  • the processor 301 may be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of this application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication line 302 may include a path to transmit information between the aforementioned components.
  • the communication interface 304 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 303 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage (Including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures and can be used by a computer Any other media accessed, but not limited to this.
  • the memory may exist independently, and is connected to the processor through the communication line 302. The memory can also be integrated with the processor.
  • the memory 303 is used to store computer-executed instructions for executing the solution of the application, and the processor 301 controls the execution.
  • the processor 301 is configured to execute computer-executable instructions stored in the memory 303, so as to implement the token acquisition and transmission methods provided in the following embodiments of the present application.
  • the computer-executable instructions in the embodiments of the present application may also be referred to as application program codes, which are not specifically limited in the embodiments of the present application.
  • the processor 301 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 3.
  • the communication device 300 may include multiple processors, such as the processor 301 and the processor 308 in FIG. 3. Each of these processors can be a single-CPU (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (for example, computer program instructions).
  • the communication device 300 may further include an output device 305 and an input device 306.
  • the output device 305 communicates with the processor 301 and can display information in a variety of ways.
  • the output device 305 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • the input device 306 communicates with the processor 301 and can receive user input in a variety of ways.
  • the input device 306 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.
  • the aforementioned communication device 300 may be a general-purpose device or a special-purpose device.
  • the communication device 300 may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or a similar structure in Figure 3 equipment.
  • PDA personal digital assistant
  • the embodiment of the present application does not limit the type of the communication device 300.
  • the IAB node can be replaced with a relay node, and the IAB host can be replaced with a host node.
  • the relay node is connected to the host node.
  • the connection can be a direct connection, for example, through a backhaul link. That is, the host node is the parent node of the relay node; or, the connection can be an indirect connection, for example, through two or more backhaul links, that is, the host node can communicate with the host node through one or more other relay nodes. connection.
  • an authentication method provided by an embodiment of this application may include:
  • the IAB node sends a first message to an IAB host.
  • the first message includes first indication information.
  • the first indication information is used to indicate an authentication method supported by the IAB node.
  • the authentication method supported by the IAB node includes certificate authentication.
  • the IAB host can be the parent node of the IAB node, that is, the IAB node is directly connected to the IAB host, which corresponds to a single-hop scenario; or the IAB node can be connected to the IAB host through one or more other IAB nodes, that is, the IAB node Access to the IAB host through other IAB nodes corresponds to a multi-hop scenario.
  • the authentication methods supported by the IAB node may also include at least one of the following authentication methods: 5G-AKA, EAP-AKA' or EAP-transport layer security (EAP-transport layer security, EAP-TLS), etc. .
  • the first message may be a radio resource control (radio resource control, RRC) connection establishment request message (setup request).
  • RRC radio resource control
  • the first message may be an RRC connection setup complete message (setup complete).
  • first message may also be other types of messages, and the embodiment of the present application does not limit the type of the first message.
  • the IAB host determines that the IAB node uses certificate authentication according to the first indication information.
  • the first message includes first indication information for indicating the authentication mode supported by the IAB node, where the authentication mode supported by the IAB node includes certificate authentication. Therefore, the IAB host can determine that the IAB node can use certificate authentication according to the first indication information in the first message indicating that the authentication mode supported by the IAB node includes certificate authentication.
  • step 402 is an optional step. That is, after step 401, step 403 is directly executed. That is, after the IAB host receives the first message from the IAB node, the IAB host may send a second message to the IAB node in response to the first message.
  • the IAB host sends a second message to the IAB node, where the second message includes second indication information for instructing the IAB node to use certificate authentication.
  • the second message may be an RRC connection establishment message (setup). If the first message is an RRC connection establishment complete message, the second message may be an RRC message sent by the IAB host to the IAB node after the RRC connection establishment complete message, such as an RRC reconfiguration message, or SMC (security mode command, security mode command) ) Message, or a newly defined RRC message.
  • RRC connection establishment message setup
  • SMC security mode command, security mode command
  • the IAB host can determine that the IAB node uses certificate authentication according to the ability to support certificate authentication reported by the IAB node, and send a second message to the IAB node to instruct the IAB node to use certificate authentication.
  • Security authentication so that the IAB node can complete the security authentication when entering the network without configuring the USIM card, reducing the cost of the IAB node, and the authentication process only involves the interaction between the IAB host and the IAB node, without the involvement of the core network, which reduces Impact on the core network.
  • the method may further include:
  • the IAB host sends a system broadcast message, the system broadcast message includes third indication information, and the third indication information is used to indicate that the IAB host supports a certificate authentication method.
  • the IAB host may carry the third indication information in the system broadcast message to notify the IAB node that the IAB host supports the certificate authentication mode.
  • the IAB host may send the third indication information through system information block 1 (SIB1). It is understandable that the IAB host may also send the third indication information through other SIBs, and the embodiment of the present application does not limit the form in which the IAB host sends the third indication information.
  • SIB1 system information block 1
  • the method may further include:
  • the IAB node sends a third message to the IAB host.
  • the third message may carry at least one of the following information: the electronic serial number (ESN) of the IAB node, the certificate of the IAB node, or the signature of the third message by the IAB node, and so on.
  • the third message may also carry a random number generated by the IAB node, and the random number may be used for key derivation after the certificate is authenticated. It is understandable that the third message may also carry other information related to the certificate authentication of the IAB node, and the embodiment of the present application does not specifically limit the information carried in the third message.
  • the third message may be an RRC connection establishment complete message. If the first message is an RRC connection establishment complete message, the third message may be an RRC message sent by the IAB host to the IAB node after the second message, such as a security mode complete (SMC) message, or a newly defined message RRC news.
  • SMC security mode complete
  • the IAB host and the IAB node are devices of the same manufacturer, the IAB host and the IAB node can respectively apply to the manufacturer's CA to obtain a certificate. That is, the certificate of the IAB host and the certificate of the IAB node come from the certificate issuing server CA of the same manufacturer.
  • the IAB host authenticates the IAB node according to the third message.
  • the third message may include the certificate of the IAB node and the signature of the IAB node on the third message.
  • the certificate of the IAB node comes from the certificate issuing server CA; the certificate of the IAB node includes the CA signature and the public key of the IAB node.
  • the IAB host has the certificate from the CA The CA public key.
  • the CA may send the CA public key together with the certificate of the IAB host to the IAB host; further illustratively, the CA may also send the CA public key of the CA to the IAB host through other messages.
  • the embodiment of this application does not limit the manner in which the IAB host receives the CA public key from the CA.
  • the method for the IAB host to authenticate the IAB node according to the third message may include at least one of the following methods: the verification of the CA signature by the CA public key, and the verification of the signature of the third message by the public key of the IAB node. Check the consistency of the ESN in the third message with the ESN in the certificate of the IAB node, or check the ESN whitelist of the ESN in the third message, etc.
  • the above authentication methods can be used alone or in combination. That is, the IAB host can use one or more of the above authentication methods to authenticate the IAB node according to the third message, which is not limited in the embodiment of the present application.
  • step 503 may include: the IAB host uses the CA public key to verify the CA signature contained in the certificate of the IAB node.
  • the IAB host uses the CA public key to verify the CA signature; if the IAB host uses the CA public key to verify the CA signature, it means that the certificate of the IAB node is legal, the IAB node is a legal node, and the IAB host The certification of the IAB node passed.
  • the CA signature included in the certificate of the IAB node is the signature of the certificate by the CA using the CA private key.
  • the CA signature can be a verification value generated by the CA using the CA private key for the certificate.
  • the IAB host uses the CA public key to verify the CA signature, which may include: the IAB host uses the CA public key to generate another verification value for the certificate of the IAB node; and compares the generated verification value with the CA signature. If the generated verification value is consistent with the CA signature, the verification is passed; if the generated verification value is inconsistent with the CA signature, the verification has failed.
  • the third message may include the certificate of the IAB node, and the certificate of the IAB node includes the CA signature.
  • the IAB node ie, the sender shown in Figure 6
  • the IAB host can use the CA public key to verify the CA signature, if After the verification is passed, it indicates that the certificate is legal, the IAB node is a legal node, and the IAB host has passed the authentication of the IAB node.
  • step 503 may include: the IAB host verifies the signature of the third message using the public key of the IAB node.
  • the IAB host uses the CA public key to verify the CA signature; if the IAB host uses the CA public key to verify the CA signature, the IAB host obtains the IAB node’s public from the IAB node’s certificate. Key, and use the public key to verify the signature of the third message.
  • the IAB host uses the CA public key to verify the CA signature; if the IAB host uses the CA public key to verify the CA signature, it means that the certificate of the IAB node is legal. Then, the IAB host can use the public key of the IAB node contained in the certificate of the IAB node to verify the signature of the third message to verify that the third message has not been tampered with during transmission.
  • the signature of the third message is the signature of the third message by the IAB node using the private key of the IAB node; the private key of the IAB node and the public key of the IAB node are a pair of matching authentication keys.
  • the IAB host uses the public key contained in the IAB node’s certificate to verify the signature of the third message, it means that the received third message has not been tampered with, and then the IAB host then uses the IAB contained in the third message.
  • the ESN of the node performs authentication of the IAB node.
  • the third message may also include the ESN of the IAB node, which may be referred to as ESN1; the certificate of the IAB node may include another ESN, which may be referred to as ESN2.
  • Step 503 may include: the IAB host verifies the consistency of ESN1 and ESN2 included in the certificate of the IAB node.
  • the IAB host may further verify that ESN1 is consistent with the ESN2 included in the certificate of the IAB node. If ESN1 is consistent with ESN2, the IAB node is a legal node, and the IAB host has passed the authentication of the IAB node.
  • the IAB host may also have an ESN whitelist from an operation management and maintenance server (operation administration and maintenance, OAM).
  • Step 503 may include: the IAB host uses the ESN whitelist to verify the information included in the third message ESN1 of the IAB node.
  • the IAB host can also use the ESN whitelist to verify the IAB node included in the third message ESN1. Specifically, the IAB host can verify whether ESN1 is included in the ESN whitelist. If ESN1 is included in the ESN whitelist, the IAB node is a legitimate node, and the IAB host has passed the authentication of the IAB node.
  • the manner in which the IAB host authenticates the IAB node according to the third message is not limited to the above example, and the IAB host may also authenticate the IAB node in other ways, which is not limited in the embodiment of the present application.
  • the method may further include:
  • the IAB host sends a fourth message to the IAB node.
  • the fourth message may carry at least one of the following information: the electronic serial number (ESN) of the IAB host, the certificate of the IAB host, or the signature of the fourth message by the IAB host, etc.
  • the fourth message may also carry a random number generated by the IAB host, and the random number may be used for key derivation after the certificate is authenticated. It is understandable that the fourth message may also carry other information associated with the certificate authentication of the IAB host, and the embodiment of the present application does not specifically limit the information carried in the fourth message.
  • the IAB node authenticates the IAB host according to the fourth message.
  • the manner in which the IAB node authenticates the IAB host according to the fourth message may be similar to the manner in which the IAB host authenticates the IAB node according to the third message described in step 503.
  • the method for the IAB node to authenticate the IAB host according to the fourth message may include at least one of the following methods: the verification of the CA signature by the CA public key, and the verification of the signature of the fourth message by the public key of the IAB host. Check the consistency of the ESN in the fourth message with the ESN in the certificate of the IAB host, or check the ESN whitelist of the ESN in the fourth message, etc.
  • the above authentication methods can be used alone or in combination. That is, the IAB node can use one or more of the above authentication methods to authenticate the IAB host according to the fourth message. For details, please refer to the description in step 503, which will not be repeated here.
  • the IAB host can also send a fourth message to the IAB node, so that the IAB node can authenticate the IAB host according to the fourth message, thereby completing the IAB host and Two-way authentication process between IAB nodes.
  • the IAB host may include an IAB host DU and an IAB host CU.
  • the IAB node may include an IAB node MT and an IAB node DU.
  • the authentication methods shown in Figs. 4 and 5 above can be performed between the IAB host DU, the IAB host CU, and the IAB node MT.
  • the interaction between the IAB host and the IAB node in the authentication methods shown in FIGS. 4 and 5 above mainly involves the direct interaction between the IAB host DU and the IAB node MT, and the message transfer between the IAB host DU and the IAB host CU.
  • the messages transmitted in step 1005, step 1006, step 1009, step 1011, step 1014, and step 1016 shown in FIG. 10 are the messages of step 1004, step 1007, step 1008, step 1012, step 1013, and step 1017, respectively. Transit.
  • another authentication method provided in this embodiment of the present application may include:
  • the IAB host DU sends a system broadcast message.
  • the system broadcast message may include third indication information.
  • the third indication information is used to indicate that the IAB host supports a certificate authentication method.
  • the certificate authentication mode supported by the IAB host is determined by the IAB host CU.
  • the IAB host CU may send the instruction information supporting the certificate authentication mode to the IAB host DU.
  • the IAB host DU and the IAB host CU can be connected through the F1 interface. Therefore, the IAB host CU can send the instruction information supporting the certificate authentication method to the IAB host DU through the F1 connection establishment response message (setup response).
  • the IAB host supports the certificate authentication method determined by the IAB host DU.
  • the IAB host DU can send the instruction information supporting the certificate authentication mode to the IAB host CU.
  • the IAB host DU may send the indication information of supporting the certificate authentication mode to the IAB host CU through the F1 connection establishment request message (setup request).
  • the IAB host DU may carry the third indication information in the system broadcast message to notify the IAB node MT that the IAB host supports the certificate authentication mode.
  • the IAB host DU may send the third indication information through system information block 1 (SIB1). It is understandable that the IAB host DU may also send the third indication information through other SIBs, and the embodiment of the present application does not limit the form in which the IAB host DU sends the third indication information.
  • SIB1 system information block 1
  • the system broadcast message may be the system broadcast message described in step 501 in FIG. 5, that is, step 1001 may correspond to step 501 in FIG. 5.
  • the IAB node MT After receiving the system broadcast message from the IAB host DU, the IAB node MT sends MSG1 to the IAB host DU.
  • MSG1 is used for the preamble transmission of the random access process.
  • the MSG1 is the first message in the random access process, and may also be referred to as a preamble message, which is explained here in a unified manner, and will not be repeated here.
  • the IAB host DU After receiving MSG1, the IAB host DU sends MSG2 to the IAB node MT.
  • MSG2 is a random access response message. Among them, MSG2 is a response message for the above-mentioned MSG1.
  • step 1002 and step 1003 jointly constitute a random access (RA) process.
  • the method may further include:
  • the IAB node MT sends an RRC connection establishment request message (RRC setup request) to the IAB host DU.
  • RRC setup request RRC connection establishment request
  • the RRC connection establishment request message may also be referred to as MSG3.
  • the IAB host DU sends the first F1 application layer protocol (F1 application protocol, F1AP) message carrying the RRC connection establishment request message to the IAB host CU.
  • F1 application layer protocol F1 application protocol, F1AP
  • the IAB host DU encapsulates the RRC connection establishment request message in the first F1AP message, and sends it to the IAB host CU through the F1 interface.
  • the first F1AP message may be an initial uplink RRC message transfer message (Initial UL RRC Message Transfer).
  • the IAB donor CU sends a second F1AP message carrying the RRC connection establishment message to the IAB donor DU.
  • the second F1AP message may be a downlink RRC message transfer message (DL RRC Message Transfer).
  • the IAB host DU sends the RRC connection establishment message to the IAB node MT.
  • the IAB host DU after the IAB host DU receives the second F1AP message carrying the RRC connection establishment message from the IAB host CU, it can send the RRC connection establishment message to the IAB node MT.
  • the RRC connection establishment message may also be referred to as MSG4.
  • the RRC connection establishment message may include air interface configuration information, so that the IAB node MT can establish an RRC connection according to the air interface configuration information after receiving the RRC connection establishment message.
  • the IAB node will establish a signaling radio bearer 1 (signalling radio bearer 1, SRB1).
  • SRB1 can be used to transmit RRC messages.
  • the RRC messages between the IAB node MT and the IAB host DU involved in the steps after step 1007 can all be carried on the SRB1 for transmission.
  • the IAB node MT sends an RRC connection establishment complete message to the IAB host DU.
  • the RRC connection establishment complete message may include the first indication information.
  • the RRC connection establishment complete message may also be called MSG5, and is used to notify the IAB host that the RRC connection has been established.
  • the first indication information is used to indicate the authentication method supported by the IAB node, and the authentication method supported by the IAB node includes certificate authentication.
  • the authentication methods supported by the IAB node may also include at least one of the following authentication methods: 5G-AKA, EAP-AKA, or EAP-TLS, etc.
  • the RRC connection establishment complete message may also include IAB node indication information to indicate that the IAB node is currently accessing the network.
  • the RRC connection establishment complete message may be the first message described in step 401 in FIG. 4, that is, step 1008 may correspond to step 401 in FIG.
  • the IAB host DU sends the third F1AP message carrying the RRC connection establishment complete message to the IAB host CU.
  • the IAB host DU encapsulates the RRC connection establishment complete message in the third F1AP message, and sends it to the IAB master CU through the F1 interface.
  • the third F1AP message may be a UL RRC Message Transfer message.
  • step 1004 to step 1009 together constitute an RRC setup (RRC setup) process.
  • the method may further include:
  • the IAB host CU determines that the IAB node uses certificate authentication according to the RRC connection establishment completion message carried in the third F1AP message.
  • the third F1AP message carries the RRC connection establishment complete message
  • the RRC connection establishment complete message includes the first indication information for indicating the authentication method supported by the IAB node, where the authentication method supported by the IAB node includes certificate authentication. Therefore, the IAB host CU may determine that the IAB node can use certificate authentication according to the first indication information that indicates that the authentication mode supported by the IAB node includes certificate authentication carried in the RRC connection establishment complete message.
  • step 1010 may correspond to step 402 in FIG. 4.
  • the IAB host CU sends the fourth F1AP message carrying the RRC message X to the IAB host DU.
  • the RRC message X includes second indication information for instructing the IAB node to use certificate authentication.
  • the fourth F1AP message may be a DL RRC Message Transfer message.
  • the RRC message X may be an existing RRC message, for example, an RRC reconfiguration message, or a security mode command (SMC) message.
  • the RRC message X may also be a newly defined RRC message.
  • the second indication information may be indication information used to instruct the IAB node to report the certificate. It can be understood that the IAB host CU may also instruct the IAB node to use certificate authentication through other types of second indication information, which is not limited in this embodiment of the application.
  • the IAB host DU sends an RRC message X to the IAB node MT.
  • the IAB host CU carries the certificate authentication information of the IAB node in the RRC message, and sends it to the IAB node MT through the relay of the IAB host DU.
  • the RRC message X may be the second message described in step 403 in FIG. 4, that is, step 1012 may correspond to step 403 in FIG. 4.
  • the IAB node MT sends an RRC message Y to the IAB host DU.
  • the RRC message Y may be an existing RRC message, for example, a security mode complete (SMC) message, etc.; or, the RRC message Y may also be a newly defined RRC message.
  • SMC security mode complete
  • the embodiment of this application does not limit the type of the RRC message Y.
  • the RRC message Y may include the certificate-related information of the IAB node, so that the IAB node MT can report the certificate to the IAB host DU through the RRC message Y.
  • the RRC message Y may carry at least one of the following information: the electronic serial number ESN of the IAB node, the certificate of the IAB node, or the signature of the third message by the IAB node, and so on.
  • the RRC message Y may also carry a random number generated by the IAB node, and the random number may be used for key derivation after the certificate is authenticated. It is understandable that the RRC message Y may also carry other information related to the certificate authentication of the IAB node, and the embodiment of the application does not specifically limit the information carried in the RRC message Y.
  • the RRC message Y may be the third message described in step 502 in FIG. 5; that is, step 1013 may correspond to step 502 in FIG. 5.
  • the IAB host DU sends the fifth F1AP message carrying the RRC message Y to the IAB host CU.
  • the IAB host DU encapsulates the RRC message Y in the fifth F1AP message, and sends it to the IAB host CU through the F1 interface.
  • the fifth F1AP message may be a UL RRC Message Transfer message.
  • the IAB host CU authenticates the IAB node according to the RRC message Y.
  • the IAB host CU may have the CA public key from the CA.
  • the RRC message Y may include the certificate of the IAB node, and the certificate of the IAB node includes the CA signature.
  • the IAB host CU may use the CA public key to verify the CA signature. If the IAB host CU uses the CA public key to verify the CA signature, it means that the certificate of the IAB node is legal, and the IAB node is a legal node, so the IAB host CU passes the authentication of the IAB node.
  • the IAB host CU uses the CA public key to verify the CA signature; if the IAB host CU uses the CA public key to verify the CA signature, it means that the certificate of the IAB node is legal. Then, the IAB host CU can also use the public key contained in the certificate of the IAB node to verify the message signature of the RRC message Y to verify that the RRC message Y has not been tampered with during transmission; where The message signature is the signature of the RRC message Y by the IAB node using the private key of the IAB node.
  • the IAB host CU If the IAB host CU passes the verification of the message signature of the RRC message Y using the public key contained in the certificate of the IAB node, it means that the received RRC message Y has not been tampered with, so the IAB host CU performs further steps according to the RRC message Y Authenticate the IAB node.
  • the RRC message Y may also include the electronic serial number (ESN) of the IAB node, which may be referred to as ESN1; the certificate of the IAB node may include ESN2.
  • ESN1 electronic serial number
  • the IAB host CU can verify the consistency of ESN1 and ESN2 included in the certificate of the IAB node. Specifically, the IAB host can verify the consistency of the aforementioned ESN1 and ESN2. If ESN1 and ESN2 are consistent, the IAB node is a legitimate node, and the IAB host CU has passed the authentication of the IAB node.
  • the IAB host CU also has the ESN whitelist obtained from the CA, and the IAB host CU can use the ESN whitelist to verify the ESN1 of the IAB node included in the RRC message Y. Specifically, the IAB host can verify whether ESN1 is included in the ESN whitelist. If ESN1 is included in the ESN whitelist, the IAB node is a legitimate node, and the IAB host CU has passed the authentication of the IAB node.
  • the manner in which the IAB host CU authenticates the IAB node according to the RRC message Y is not limited to the above example, and the IAB host CU may also authenticate the IAB node in other ways.
  • the embodiment of the present application does not limit the manner in which the IAB host CU authenticates the IAB node according to the RRC message Y.
  • step 1015 may correspond to step 503 in FIG. 5.
  • the method may further include:
  • the IAB host CU sends the sixth F1AP message carrying the RRC message Z to the IAB host DU.
  • the RRC message Z may be an existing RRC message; or, the RRC message Z may also be a newly defined RRC message.
  • the embodiment of this application does not limit the type of the RRC message Z.
  • the RRC message Z includes the certificate-related information of the IAB host.
  • the RRC message Z may carry at least one of the following information: the electronic serial number ESN of the IAB host, the certificate of the IAB host, or the signature of the third message by the IAB host, and so on.
  • the RRC message Z may also carry a random number generated by the IAB host, and the random number may be used for key derivation after the certificate is authenticated. It is understandable that the RRC message Z may also carry other information associated with the certificate authentication of the IAB host, and the embodiment of the present application does not specifically limit the information carried in the RRC message Z.
  • the sixth F1AP message may be a DL RRC Message Transfer message.
  • the IAB host DU sends an RRC message Z to the IAB node MT.
  • the IAB host CU After the IAB host CU receives the sixth F1AP message carrying the RRC message Z from the IAB host CU, it can send the RRC message Z to the IAB node MT.
  • the RRC message Z may be the fourth message described in step 504 in FIG. 5; that is, step 1017 may correspond to step 504 in FIG. 5.
  • the IAB node MT authenticates the IAB host according to the RRC message Z.
  • the method for the IAB node MT to authenticate the IAB host according to the RRC message Z may be similar to the method described in step 1015, which will not be repeated here.
  • step 1018 may correspond to step 505 in FIG. 5.
  • the IAB node MT sends an RRC connection establishment complete message to the IAB host DU.
  • the RRC connection establishment complete message carries the first indication information that the authentication method supported by the IAB node includes certificate authentication.
  • the IAB host CU determines that the IAB node uses certificate authentication according to the first indication information.
  • the IAB host CU sends the second instruction information for instructing the IAB node to use certificate authentication to the IAB node MT via the IAB host DU.
  • the IAB node MT sends an RRC message Y carrying certificate-related information to the IAB host CU via the IAB host DU, so that the IAB host CU authenticates the IAB node according to the RRC message Y in step 1015.
  • the IAB host shown in step 1010 to step 1012 in FIG. 10 may not be executed to determine the certificate authentication and send it to the IAB The node notifies that the determined authentication method is a certificate authentication process, that is, after step 1009, step 1013 is directly executed.
  • the IAB node does not need to receive the second indication information from the IAB host instructing the IAB node to use certificate authentication before sending to the IAB host including The RRC message Y of the certificate-related information; instead, the IAB node can directly send the RRC message Y including the certificate-related information to the IAB host.
  • the authentication process in FIG. 10 may also be advanced.
  • another authentication method provided in this embodiment of the application may include:
  • the IAB host DU sends a system broadcast message.
  • the system broadcast message may include third indication information.
  • the third indication information is used to indicate that the IAB host supports a certificate authentication method.
  • the IAB node MT After receiving the system broadcast message from the IAB host DU, the IAB node MT sends MSG1 to the IAB host DU.
  • the IAB host DU After receiving MSG1, the IAB host DU sends MSG2 to the IAB node MT.
  • MSG2 is a random access response message. Among them, MSG2 is a response message for the above-mentioned MSG1.
  • step 1101 to step 1103 respectively correspond to step 1001 to step 1003 in FIG. 10, and the specific content can be referred to the description of FIG. 10, which will not be repeated here.
  • the IAB node MT sends an RRC connection setup request message (RRC setup request) to the IAB donor DU, where the RRC connection setup request message may include the first indication information.
  • RRC setup request RRC connection setup request message
  • the RRC connection establishment request message may also be referred to as MSG3.
  • the first indication information is used to indicate the authentication method supported by the IAB node, and the authentication method supported by the IAB node includes certificate authentication.
  • the authentication methods supported by the IAB node may also include at least one of the following authentication methods: 5G-AKA, EAP-AKA, or EAP-TLS, etc.
  • the RRC connection establishment complete message may also include IAB node indication information to indicate that the IAB node is currently accessing the network.
  • the RRC connection establishment request message may be the first message described in step 401 in FIG. 4; that is, step 1104 may correspond to step 401 in FIG. 4.
  • the IAB host DU sends the first F1AP message carrying the RRC connection establishment request message to the IAB host CU.
  • the IAB host DU after receiving the RRC connection establishment request message from the IAB node MT, the IAB host DU encapsulates the RRC connection establishment request message in the first F1AP message and sends it to the IAB host CU through the F1 interface.
  • the IAB host CU determines that the IAB node uses certificate authentication according to the RRC connection establishment request message.
  • the first F1AP message carries the RRC connection establishment request message
  • the RRC connection establishment request message includes the first indication information for indicating the authentication method supported by the IAB node, where the authentication method supported by the IAB node includes certificate authentication. Therefore, the IAB host CU may determine that the IAB node can use certificate authentication according to the first indication information that indicates that the authentication mode supported by the IAB node includes certificate authentication carried in the RRC connection establishment request message.
  • step 1106 may correspond to step 402 in FIG. 4.
  • the IAB host CU sends a second F1AP message carrying the RRC connection establishment message to the IAB host DU.
  • the RRC connection establishment message includes second indication information for instructing the IAB node to use certificate authentication.
  • the second indication information may be indication information used to instruct the IAB node to report the certificate. It can be understood that the IAB host CU may also instruct the IAB node to use certificate authentication through other types of second indication information, which is not limited in this embodiment of the application.
  • the IAB host DU sends the RRC connection establishment message to the IAB node MT.
  • the IAB host DU can send the RRC connection establishment message to the IAB node MT.
  • the RRC connection establishment message may also be referred to as MSG4.
  • the RRC connection establishment message may include air interface configuration information, so that the IAB node MT can establish an RRC connection according to the air interface configuration information after receiving the RRC connection establishment message.
  • the IAB node will establish SRB1.
  • SRB1 can be used to transmit RRC messages.
  • the RRC messages between the IAB node MT and the IAB host DU involved in the steps after step 1108 can all be carried on the SRB1 for transmission.
  • the RRC connection establishment message may be the second message described in step 403 in FIG. 4; that is, step 1108 may correspond to step 403 in FIG. 4.
  • the IAB node MT sends an RRC connection establishment complete message to the IAB host DU.
  • the RRC connection establishment complete message may also be called MSG5, and is used to notify the IAB host that the RRC connection has been established.
  • the RRC connection establishment complete message may include the certificate-related information of the IAB node, so that the IAB node MT can report the certificate to the IAB host DU through the RRC connection establishment complete message.
  • the RRC connection establishment complete message may carry at least one of the following information: the electronic serial number ESN of the IAB node, the certificate of the IAB node, or the signature of the third message by the IAB node, and so on.
  • the RRC message Y may also carry a random number generated by the IAB node, and the random number may be used for key derivation after the certificate is authenticated. It is understandable that the RRC connection establishment complete message may also carry other information associated with the certificate authentication of the IAB node. The embodiment of the application does not specifically limit the information carried in the RRC connection establishment complete message.
  • the RRC connection establishment complete message may be the third message described in step 502 in FIG. 5; that is, step 1109 may correspond to step 502 in FIG. 5.
  • the IAB host DU sends the third F1AP message carrying the RRC connection establishment complete message to the IAB host CU.
  • the IAB host DU After receiving the RRC connection establishment complete message from the IAB node MT, the IAB host DU encapsulates the RRC connection establishment complete message in the third F1AP message, and sends it to the IAB master CU through the F1 interface.
  • the IAB host CU authenticates the IAB node according to the RRC connection establishment complete message.
  • the IAB host CU may authenticate the IAB node in a manner similar to the method described in step 1015, which will not be repeated here.
  • step 1111 may correspond to step 503 in FIG. 5.
  • the IAB host CU sends the sixth F1AP message carrying the RRC message Z to the IAB host DU.
  • the RRC message Z includes the certificate-related information of the IAB host.
  • the RRC message Z may carry at least one of the following information: the electronic serial number ESN of the IAB host, the certificate of the IAB host, or the signature of the third message by the IAB host, and so on.
  • the RRC message Z may also carry a random number generated by the IAB host, and the random number may be used for key derivation after the certificate is authenticated. It is understandable that the RRC message Z may also carry other information associated with the certificate authentication of the IAB host, and the embodiment of the present application does not specifically limit the information carried in the RRC message Z.
  • the IAB host DU sends an RRC message Z to the IAB node MT.
  • the RRC message Z may be the fourth message described in step 504 in FIG. 5; that is, step 1113 may correspond to step 504 in FIG. 5.
  • the IAB node MT authenticates the IAB host according to the RRC message Z.
  • step 1114 may correspond to step 505 in FIG. 5.
  • step 1112 to step 1114 respectively correspond to step 1016 to step 1018 in FIG. 10, and the specific content can be referred to the description of FIG. 10, which will not be repeated here.
  • the IAB node MT sends an RRC connection establishment request message (MSG3) to the IAB host DU.
  • the RRC connection establishment request message carries the authentication methods supported by the IAB node, including the first part of certificate authentication.
  • One instruction information One instruction information.
  • the IAB host CU determines that the IAB node uses certificate authentication according to the first indication information.
  • the IAB host CU sends the second instruction information for instructing the IAB node to use certificate authentication to the IAB node MT through the RRC connection establishment message (MSG4) via the IAB host DU.
  • the IAB node MT sends an RRC connection establishment complete message (MSG5) that carries certificate-related information to the IAB host CU via the IAB host DU, so that the IAB host CU can follow the RRC connection establishment complete message in step 1111 , To authenticate the IAB node.
  • MSG5 RRC connection establishment complete message
  • the IAB host sends the indication information for determining the certificate authentication of the IAB node to the IAB node through the RRC message. Moreover, after the MSG5 message, after the IAB node receives the certificate authentication instruction information from the IAB host, the IAB node sends its certificate and other information to the IAB host, and the IAB host completes the authentication of the IAB node.
  • the IAB host sends the instruction information for determining that the IAB node uses certificate authentication to the IAB node through the MSG4 message.
  • the IAB node sends its certificate and other information to the IAB host in MSG5. Therefore, compared with the embodiment shown in FIG. 10, the embodiment shown in FIG. 11 advances the IAB authentication process to the start of the RRC establishment process, thereby further reducing the delay of the IAB node's network access process.
  • the foregoing embodiment mainly describes that when the IAB node and the IAB host are devices of the same manufacturer, the IAB node and the IAB host can obtain the certificates issued by the manufacturer’s CA respectively in advance, so that when the IAB node accesses the network, the IAB node and the IAB host use The obtained certificate can be authenticated through the interaction between the IAB node and the IAB host, and the entire authentication process is completed on the air interface side without the involvement of the core network.
  • the IAB node and the IAB host may also be devices of different vendors.
  • the IAB node When the IAB node is switched/re-established/moved, it may cause the IAB node to connect with the IAB host of a different manufacturer. For example, when the quality of the link between the IAB node and the IAB host becomes poor and data transmission between the two cannot be guaranteed, the IAB node may switch to another IAB host of a different manufacturer. For another example, when an IAB node is moving, it may move to another IAB host of a different manufacturer, and the IAB node needs to switch to another IAB host of a different manufacturer.
  • the IAB node and the IAB host cannot obtain the certificate through the CA of the same manufacturer, and the solution of the foregoing embodiment may no longer be applicable.
  • the IAB node and the IAB host need to obtain a certificate issued by the operator from the operator's CA. After the IAB node and the IAB host obtain the certificate from the operator's CA server respectively, two-way authentication and key negotiation can be performed.
  • FIG. 12 may include steps 1101 to 1108 shown in FIG. 11, and after step 1108, the method may further include:
  • the IAB node MT sends an RRC connection establishment complete message to the IAB host DU.
  • the RRC connection establishment complete message may also be called MSG5, and is used to notify the IAB host that the RRC connection has been established.
  • the RRC connection establishment complete message may include IAB node indication information to indicate that the IAB node is currently accessing the network.
  • the IAB node may obtain the certificate of the IAB node from the operator CA through the core network via the IAB host.
  • the specific process for an IAB node to apply for an operator certificate is as follows:
  • the IAB host sends related information about the operator CA to the IAB node.
  • the related information of the operator CA may include: CA name (name) and/or CA uniform resource locator (URL), etc. It is understandable that the relevant information of the operator CA may also include other information, which is not limited in the embodiment of the present application.
  • the IAB node In response to the relevant information of the operator CA, the IAB node sends a certificate management protocol version 2 (certificate management protocol version 2, CMPV2) initial request message (intial request) to the IAB host.
  • certificate management protocol version 2 certificate management protocol version 2, CMPV2
  • the CMPV2intial request is used to request a certificate from the CA obtained in step 1202.
  • the IAB host forwards the CMPV2intial request to the operator CA through the core network server.
  • the operator CA In response to the CMPV2 initial request, the operator CA sends a CMPV2 initial response message (intial response) to the IAB host through the core network server.
  • the CMPV2intial response is used to respond to the request message of the IAB node, and may include the certificate of the IAB node.
  • the IAB host forwards the CMPV2intial response to the IAB node.
  • the IAB node In response to the CMPV2 initial response, the IAB node sends a CMPV2 certification confirmation message (certification confirm) to the IAB host.
  • the CMPV2certification confirm is used to indicate to the CA that the certificate of the IAB node has been received.
  • the IAB host forwards the CMPV2 certification confirmation to the operator CA through the core network server.
  • the operator CA sends a CMPV2 public key infrastructure (Public Key Infrastructure, PKI) confirmation message (confirm) to the IAB host through the core network server.
  • CMPV2 public key infrastructure Public Key Infrastructure, PKI
  • the CMPV2PKI confirm is used to confirm the receipt of the CMPV2 certification confirm message.
  • the IAB host forwards the CMPV2PKI confirmation to the operator CA through the core network server.
  • the IAB node obtains the certificate of the IAB node from the operator CA through the core network server via the IAB host.
  • the IAB host can obtain the certificate of the IAB host in advance from the operator CA.
  • the IAB host may obtain its own certificate from the operator CA when the IAB host accesses the core network.
  • the IAB host can also obtain the certificate of the IAB host from the operator CA in other ways.
  • the IAB node and the IAB host can use the obtained certificate to perform mutual authentication and key negotiation.
  • the IAB node and the IAB host use the obtained certificate to perform mutual authentication and key negotiation through the EAP-TLS process, and the specific process is as follows:
  • the IAB host sends an EAP request (request) TLS start message (start) to the IAB node.
  • the EAP request TLS start is used to instruct the IAB node to perform EAP-TLS authentication.
  • the IAB node In response to EAP request TLS start, the IAB node sends an EAP response client hello message to the IAB host.
  • the EAP response client hello message is used to confirm the receipt of the EAP request TLS start message.
  • the IAB host sends an EAP request server hello, certificate, and certificate request message to the IAB node.
  • the EAP request server hello, certificate, and certificate request messages are used to request the IAB node to provide certificate information.
  • the message also carries certificate information related to the IAB host, so that the IAB node can perform the authentication of the IAB host.
  • the IAB node sends EAP response certificate, client key exchange, change cipher spec, and finished messages to the IAB host.
  • the IAB node sends the EAP response certificate, client key exchange, change cipher spec, finished message to the IAB host.
  • the EAP response certificate, client key exchange, change cipher spec, finished message is used for the IAB
  • the node reports the certificate information it obtained from the operator CA to the IAB host, so that the IAB host can perform the authentication of the IAB node.
  • the IAB host sends an EAP request change cipher spec, finished message to the IAB node.
  • the IAB host sends an EAP request change cipher spec, finished message to the IAB node.
  • the EAP request change cipher spec, finished message is used to instruct the IAB host to complete the authentication of the IAB node.
  • the The message also carries information such as the encryption algorithm used by the IAB node designated by the IAB host.
  • the IAB node sends an EAP response message (response) to the IAB host.
  • the EAP response message is used to respond to the receipt of the EAP request change cipher spec and finished message.
  • the IAB host sends an EAP success message (success) to the IAB node.
  • the EAP success message is used to indicate the completion of the EAP-TLS authentication process.
  • the IAB node and the IAB host have completed mutual authentication and key negotiation. After this, the IAB host can acquire the capabilities of the IAB node.
  • the specific process for the IAB host to obtain the capability of the IAB node is as follows:
  • the IAB host sends a capability enquiry message (capability enquiry) to the IAB node.
  • the capability enquiry message is used to instruct IAB energy-saving to report the air interface capability information it supports.
  • the IAB node In response to the capability enquiry, the IAB node sends capability information (capability information) to the IAB host.
  • capability information capability information
  • the capability information message includes various capability information of the IAB node, such as whether the IAB node supports multi-input and multi-output (MIMO) capabilities, whether it supports dual-connection functions, and the security algorithms supported by the IAB node.
  • MIMO multi-input and multi-output
  • the security mode between the IAB host and the IAB node can be activated.
  • the specific process of the security mode activation between the IAB host and the IAB node is as follows:
  • the IAB host sends a security mode command message (security mode command) to the IAB node.
  • the security mode command message is used to indicate the security algorithm used by the air interface of the IAB node, including: encryption algorithm and integrity protection algorithm.
  • the IAB node In response to the security mode command, the IAB node sends a security mode complete message (security mode complete) to the IAB host.
  • the security mode complete message is used to confirm the receipt of the security mode command message.
  • the IAB node can establish SRB2 and a data radio bearer (DRB).
  • DRB data radio bearer
  • the IAB host sends an RRC reconfiguration message (reconfiguration) to the IAB node.
  • the RRC reconfiguration message is used to instruct the IAB node to establish the corresponding SRB2 and DRB according to the configuration information of the IAB host.
  • SRB2 can be used to transmit non-access stratum (NAS) messages, has a lower priority than SRB1, and always configures SRB2 after the security mode is activated.
  • DRB can be used to transmit user plane data.
  • the IAB node In response to the RRC reconfiguration, the IAB node sends an RRC reconfiguration complete message (reconfiguration complete) to the IAB host.
  • the RRC reconfiguration complete message is used to indicate that the RRC reconfiguration is complete, and SRB2 and DRB have been established.
  • SRB1 is established in step 1108, and the above process of applying for an operator certificate and the two-way authentication and key agreement process occur after the establishment of SRB1 and before the establishment of SRB2 and DRB.
  • SRB1 is mainly used to transmit RRC messages, and the messages in the above process of applying for operator certificate and the two-way authentication and key agreement process are application layer messages, not RRC messages, therefore, the process of applying for operator certificate and two-way authentication and key agreement are application-layer messages. How the message in the process is transmitted between the IAB node and the IAB host needs to be considered.
  • all the messages in the above procedure of applying for an operator certificate and the procedures of mutual authentication and key agreement can be transmitted on the default DRB or the pre-configured DRB.
  • the default DRB or the pre-configured DRB is pre-established before the procedure of applying for an operator certificate.
  • the IAB host can carry the configuration information of the default DRB in MSG4, and establish an initial DRB in advance according to the configuration information when establishing the RRC connection. Since the default DRB or the pre-configured DRB is established before the security mode activation process shown in step 1220 to step 1221, the default DRB or the pre-configured DRB has no security protection and is only used to transmit the above process of applying for operator certificate and Messages in the two-way authentication and key agreement process.
  • the two-way authentication between devices of different vendors during the access process is realized by obtaining the certificate issued by the operator CA from the operator CA, and there is no need for the IAB node to configure the USIM card, saving IAB nodes the cost of.
  • FIGS. 4 to 12 are all described by taking a single-hop scenario where the IAB host is the parent node of the IAB node as an example, and the authentication method provided by the present invention can also be used for the IAB node In a multi-hop scenario where other IAB nodes are connected to the IAB host.
  • the IAB host completes the authentication of the IAB node
  • the IAB node completes the authentication of the IAB host.
  • the other IAB nodes between the IAB node and the IAB host are only used for signaling routing and forwarding.
  • the embodiment of the present application discloses an authentication method, which is applied to an IAB host. As shown in FIG. 13, the method may include the following steps 1301 to 1303:
  • the IAB host receives a first message from an IAB node.
  • the first message includes first indication information.
  • the first indication information is used to indicate an authentication method supported by the IAB node.
  • the authentication method supported by the IAB node includes certificate authentication.
  • the IAB host determines that the IAB node uses certificate authentication according to the first indication information.
  • the IAB host sends a second message to the IAB node, where the second message includes second indication information for instructing the IAB node to use certificate authentication.
  • the IAB host may be the parent node of the IAB node; or, the IAB node may be connected to the IAB host through one or more other IAB nodes.
  • the operation of the IAB host can refer to the operation of the IAB host in the embodiment shown in FIG. 4 and the above-mentioned related text description, which will not be repeated here.
  • the embodiment of the present application also discloses an authentication method, which is applied to an IAB node. As shown in FIG. 14, the method includes the following steps 1401-step 1402:
  • An IAB node sends a first message to an IAB host, where the first message includes first indication information, where the first indication information is used to indicate an authentication method supported by the IAB node, and the authentication method supported by the IAB node includes certificate authentication.
  • the IAB node receives a second message from the IAB host, where the second message includes second indication information for instructing the IAB node to use certificate authentication.
  • the IAB host may be the parent node of the IAB node; or, the IAB node is connected to the IAB host through one or more other IAB nodes.
  • the operation of the IAB node can refer to the operation of the IAB node in the embodiment shown in FIG. 4 and the above related text description, which will not be repeated here.
  • the foregoing mainly introduces the solutions provided by the embodiments of the present application from the perspective of interaction between various network elements.
  • the above-mentioned IAB node or IAB host includes hardware structures and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • the embodiment of the present application may divide the functional modules of the IAB node or the IAB host according to the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • FIG. 15 shows a possible composition diagram of the IAB node 1500 involved in the above embodiment.
  • the IAB node 1500 may include processing The unit 1501 and the transceiver unit 1502.
  • processing unit 1501 may be used to support the IAB node 1500 to perform the above step 505, etc., and/or other processes used in the technology described herein.
  • the transceiver unit 1502 may be used to support the IAB node 1500 to perform step 401, step 403, step 501, step 502, step 504, etc., and/or other processes used in the technology described herein.
  • FIG. 16 shows a possible composition diagram of the IAB host 1600 involved in the above embodiment.
  • the IAB host 1600 may include processing Unit 1601 and transceiver unit 1602.
  • the processing unit 1601 may be used to support the IAB host 1600 to perform the above steps 402, 503, etc., and/or other processes used in the technology described herein.
  • the transceiver unit 1602 may be used to support the IAB host 1600 to perform step 401, step 403, step 501, step 502, step 504, etc., and/or other processes used in the technology described herein.
  • an embodiment of the present application further provides an authentication device (for example, the authentication device may be a chip or a chip system), the authentication device includes a processor, and is configured to implement the method in any of the foregoing method embodiments.
  • the authentication device further includes a memory.
  • the memory is used to store necessary program instructions and data, and the processor can call the program code stored in the memory to instruct the authentication device to execute the method in any of the foregoing method embodiments.
  • the memory may not be in the authentication device.
  • the authentication device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices, which is not specifically limited in the embodiment of the present application.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • a software program it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or includes one or more data storage devices such as servers, data centers, etc. that can be integrated with the medium.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the computer may include the aforementioned device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供认证方法、装置及***，可用于中继节点入网时与宿主节点之间的安全认证，宿主节点根据中继节点上报的支持证书认证的能力，确定中继节点的认证方式为证书认证。在该方法中，中继节点先向宿主节点指示中继节点支持证书认证；然后宿主节点确定中继节点使用证书认证；宿主节点向中继节点发送第二消息，指示中继节点使用证书认证。本申请中的方案可以用于通信***，例如可以用于第五代5G网络。

Description

认证方法、装置及*** 技术领域
本申请涉及通信技术领域，尤其涉及认证方法、装置及***。
背景技术
第五代移动通信技术(5th-Generation，5G)网络部署中的一项重要技术为“接入回传一体化”(integrated access backhaul，IAB)技术，IAB技术将无线接入链路和无线回传链路集成在一起，不需要用于回传链路的单独天线(通常为光纤)，使运营商能够将5G天线安装到难以部署光纤或者部署光纤成本过高的地方。
R16标准中规定，IAB节点(node)在入网时，可以使用5G-认证和密钥协商(5G-authentication and key agreement，5G-AKA)或者可扩展认证协议-AKA’(extensible authentication protocol-AKA’，EAP-AKA’)的认证方式，而5G-AKA或者EAP-AKA’认证方式要求IAB节点必须配置全球用户识别卡(universal subscriber identity module，USIM)卡，增加了IAB节点的成本。
发明内容
本申请实施例提供一种认证方法、装置及***，IAB宿主(donor)可以基于IAB节点上报的支持证书认证的能力，采用证书认证的方式对IAB节点进行认证，因此，IAB节点无需配置USIM卡即可完成入网时的安全认证，降低了IAB节点的成本。
为达到上述目的，本申请实施例采用如下技术方案，在下面第一方面至第九方面的方法中，以IAB场景为例进行说明，需要说明的是，下面第一方面至第九方面同样适用于IAB场景以外的中继场景，其中，IAB节点可以替换成中继节点，IAB宿主可以替换成宿主节点。
第一方面，提供了一种认证方法及其相应的认证装置。在该方案中，IAB宿主接收来自IAB节点的第一消息，第一消息包括第一指示信息，第一指示信息用于指示IAB节点支持的认证方式，IAB节点支持的认证方式包括证书认证；IAB宿主根据第一指示信息，确定IAB节点使用证书认证；IAB宿主向IAB节点发送第二消息，第二消息包括用于指示IAB节点使用证书认证的第二指示信息；其中，IAB宿主为IAB节点的父节点；或者，IAB节点通过一个或多个其他IAB节点与IAB宿主连接。
其中，第一消息可以为无线资源控制(radio resource control，RRC)连接建立请求消息(setup request)；或者，第一消息可以为RRC连接建立完成消息(setup complete)。若第一消息为RRC连接建立请求消息，则第二消息可以为RRC连接建立消息(setup)。若第一消息为RRC连接建立完成消息，则第二消息可以为RRC连接建立完成消息之后IAB宿主向IAB节点发送的RRC消息。
在该方案中，IAB宿主可以根据IAB节点上报的支持证书认证的能力，确定IAB节点使用证书认证，并且向IAB节点发送第二消息，以指示IAB节点使用证书认证方式进行安全认证，从而使得IAB节点无需配置USIM卡就可完成入网时的安全认证，降低了IAB节点的成本，并且认证过程仅涉及IAB宿主与IAB节点之间的交互，无 需核心网的参与，减少了对核心网的影响。
在一种可能的设计中，在IAB宿主接收来自IAB节点的第一消息之前，该方法还包括：IAB宿主发送***广播消息，***广播消息包括第三指示信息，第三指示信息用于指示IAB宿主支持证书认证方式。
也就是说，在IAB宿主接收来自IAB节点的第一消息之前，IAB宿主可以在***广播消息中携带第三指示信息，以向IAB节点通知IAB宿主支持证书认证方式。
在一种可能的设计中，IAB节点支持的认证方式还包括以下认证方式中的至少一种：5G-认证和密钥协商AKA、可扩展认证协议EAP-AKA’或EAP-传输层安全TLS。
在一种可能的设计中，在IAB宿主向IAB节点发送第二消息之后，该方法还包括：IAB宿主接收来自IAB节点的第三消息；IAB宿主根据第三消息，对IAB节点进行认证；其中，第三消息中携带以下至少一种信息：IAB节点的电子序列号ESN、IAB节点的证书或IAB节点对第三消息的签名。
也就是说，在IAB宿主向IAB节点发送第二消息之后，IAB宿主可以根据来自IAB节点的包括证书相关信息的第三消息对IAB节点进行认证。
在一种可能的设计中，第三消息包括IAB节点的证书，IAB节点的证书来自证书颁发服务器CA；IAB节点的证书包括CA签名，IAB宿主具有来自CA的CA公钥；IAB宿主根据第三消息，对IAB节点进行认证，包括：IAB宿主使用CA公钥对CA签名进行校验。
在一种可能的设计中，第三消息还包括IAB节点对第三消息的签名，IAB节点的证书还包括IAB节点的公钥；IAB宿主根据第三消息，对IAB节点进行认证，还包括：若IAB宿主使用CA公钥对CA签名的校验通过，则IAB宿主从IAB节点的证书中获取IAB节点的公钥，并使用IAB节点的公钥对第三消息的签名进行校验。
在一种可能的设计中，第三消息还包括IAB节点的ESN，IAB宿主具有来自操作管理和维护服务器OAM的ESN白名单；IAB宿主根据第三消息，对IAB节点进行认证，还包括：若IAB宿主使用IAB节点的公钥对第三消息的签名校验通过，则IAB宿主校验IAB节点的ESN与IAB节点的证书中包括的ESN的一致性；或者，若IAB宿主使用IAB节点的公钥对第三消息的签名校验通过，则IAB宿主使用ESN白名单校验IAB节点的ESN。
在一种可能的设计中，在IAB宿主根据第三消息对IAB节点的认证通过后，该方法还可以包括：IAB宿主向IAB节点发送第四消息。其中，该第四消息中可以携带以下至少一种信息：IAB宿主的电子序列号(electronic serial number，ESN)、IAB宿主的证书或IAB宿主对第四消息的签名等。
也就是说，在IAB宿主根据第三消息对IAB节点的认证通过后，IAB宿主还可以向IAB节点发送第四消息，以使得IAB节点可以根据第四消息来认证IAB宿主，从而完成IAB宿主与IAB节点之间的双向认证过程。
在一种可能的设计中，IAB宿主向所述IAB节点发送第二消息之后，该方法还包括：IAB宿主接收来自IAB节点的请求信息，请求信息用于指示获取IAB节点的证书；响应于请求信息，IAB宿主通过核心网从运营商CA获取IAB节点的证书；IAB宿主向IAB节点发送IAB节点的证书。其中，上述过程涉及的信令传输可以承载在信令无 线承载SRB1上传输；或者，可以承载在预配置的数据无线承载DRB上传输。
第二方面，提供了一种认证方法及其相应的通信装置。在该方案中，IAB节点向IAB宿主发送第一消息，第一消息包括第一指示信息，第一指示信息用于指示IAB节点支持的认证方式，IAB节点支持的认证方式包括证书认证；IAB节点接收来自IAB宿主的第二消息，第二消息包括用于指示IAB节点使用证书认证的第二指示信息；其中，IAB宿主为IAB节点的父节点；或者，IAB节点通过一个或多个其他IAB节点与IAB宿主连接。
其中，第一消息可以为RRC连接建立请求消息；或者，第一消息可以为RRC连接建立完成消息。若第一消息为RRC连接建立请求消息，则第二消息可以为RRC连接建立消息。若第一消息为RRC连接建立完成消息，则第二消息可以为RRC连接建立完成消息之后IAB宿主向IAB节点发送的RRC消息。
在该方案中，IAB节点向IAB宿主上报的支持证书认证的能力，并且接收包括用于指示IAB节点使用证书认证的第二指示信息的第二消息，以指示IAB节点使用证书认证方式进行安全认证，从而使得IAB节点无需配置USIM卡就可完成入网时的安全认证，降低了IAB节点的成本，并且使得认证过程仅涉及IAB宿主与IAB节点之间的交互，无需核心网的参与，减少了对核心网的影响。
在一种可能的设计中，在IAB节点向IAB宿主发送第一消息之前，该方法还包括：IAB节点接收来自IAB宿主的***广播消息，***广播消息包括第三指示信息，第三指示信息用于指示IAB宿主支持证书认证方式。
在一种可能的设计中，IAB节点支持的认证方式还包括以下认证方式中的至少一种：5G-认证和密钥协商AKA、可扩展认证协议EAP-AKA’或EAP-可扩展认证协议TLS。
在一种可能的设计中，在IAB节点接收来自IAB宿主的第二消息之后，该方法还包括：IAB节点向IAB宿主发送第三消息，第三消息中携带以下至少一种信息：IAB节点的电子序列号ESN、IAB节点的证书、IAB节点对第三消息的签名。
在一种可能的设计中，在IAB节点向IAB宿主发送第三消息后，该方法还可以包括：IAB节点接收来自IAB宿主的第四消息，并且根据该第四消息对IAB宿主进行认证。其中，该第四消息中可以携带以下至少一种信息：IAB宿主的电子序列号(electronic serial number，ESN)、IAB宿主的证书或IAB宿主对第四消息的签名等。
也就是说，在IAB节点向IAB宿主发送第三消息后，IAB节点接收来自IAB宿主的第四消息，以使得IAB节点可以根据第四消息来认证IAB宿主，从而完成IAB宿主与IAB节点之间的双向认证过程。
在一种可能的设计中，在IAB节点接收来自IAB宿主的第二消息之后，该方法还包括：IAB节点向IAB宿主发送请求信息，请求信息用于指示获取IAB节点的证书；IAB节点接收来自IAB宿主的IAB节点的证书。其中，上述过程涉及的信令传输可以承载在信令无线承载SRB1上传输；或者，可以承载在预配置的数据无线承载DRB上传输。
第三方面，提供了一种通信装置用于实现上述各种方法。该通信装置可以为上述第一方面中的IAB宿主，或者包含上述IAB宿主的装置；或者，该通信装置可以为上 述第二方面中的IAB节点，或者包含上述IAB节点的装置。所述通信装置包括实现上述方法相应的模块、单元、或手段(means),该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
第四方面，提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机指令，当该处理器执行该指令时，以使该通信装置执行上述任一方面所述的方法。该通信装置可以为上述第一方面中的IAB宿主或者包含上述IAB宿主的装置；或者，该通信装置可以为上述第二方面中的IAB节点，或者包含上述IAB节点的装置。
第五方面，提供了一种通信装置，包括：处理器；所述处理器用于与存储器耦合，并读取存储器中的指令之后，根据所述指令执行如上述任一方面所述的方法。该通信装置可以为上述第一方面中的IAB宿主或者包含上述IAB宿主的装置；或者，该通信装置可以为上述第二方面中的IAB节点，或者包含上述IAB节点的装置。
第六方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述任一方面所述的方法。
第七方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述任一方面所述的方法。
第八方面，提供了一种通信装置(例如，该通信装置可以是芯片或芯片***)，该通信装置包括处理器，用于实现上述任一方面中所涉及的功能。在一种可能的设计中，该通信装置还包括存储器，该存储器，用于保存必要的程序指令和数据。该通信装置是芯片***时，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第三方面至第八方面中任一种设计方式所带来的技术效果可参见上述第一方面或第二方面中不同设计方式所带来的技术效果，此处不再赘述。
第九方面，提供一种通信***，该通信***包括上述方面所述的IAB宿主和上述方面所述的IAB节点。
附图说明
图1为本申请实施例提供的一种IAB网络的结构图；
图2为本申请实施例提供的一种IAB节点/IAB宿主向CA申请获取证书的流程图；
图3为本申请实施例提供的一种通信设备的硬件结构示意图；
图4为本申请实施例提供的一种认证方法的流程图；
图5为本申请实施例提供的另一种认证方法的流程图；
图6为本申请实施例提供的一种认证方式的示意图；
图7为本申请实施例提供的另一种认证方式的示意图；
图8为本申请实施例提供的另一种认证方式的示意图；
图9为本申请实施例提供的一种认证方法的示意图；
图10为本申请实施例提供的另一种认证方法的流程图；
图11为本申请实施例提供的另一种认证方法的流程图；
图12为本申请实施例提供的另一种认证方法的流程图；
图13为本申请实施例提供的另一种认证方法的流程图；
图14为本申请实施例提供的另一种认证方法的流程图；
图15为本申请实施例提供的一种IAB节点的结构图；
图16为本申请实施例提供的一种IAB宿主的结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请实施例提供的认证方法可以应用于如图1所示的通信***100。该通信***10可以包括IAB宿主20和IAB节点30，其中，IAB宿主也可以称为宿主IAB，或者IAB基站等，本申请并不作限定。
其中，IAB节点30可以直接接入IAB宿主20，即，IAB宿主为IAB节点的父节点，该场景称为单跳接入回传一体化场景。或者，IAB节点30可以通过其他IAB节点(例如，IAB节点40)接入IAB宿主20，即，IAB节点通过一个或多个其他IAB节点与IAB宿主连接，该场景称为多跳接入回传一体化场景。
示例性地，如图1所示，IAB网络可以采用集中式单元-分布式单元(central unit-distributed unit，CU-DU)分离架构，即：IAB宿主20由IAB宿主DU(简称为宿主DU)21和IAB宿主CU(简称为宿主CU)22两部分组成。IAB节点30由IAB节点DU(简称为节点DU)31和IAB节点移动终端(mobile terminal，MT)(简称为节点MT)32两部分组成。其中，IAB-MT也可以称为IAB-UE，本申请并不作限定。
其中，宿主CU 22用于提供控制功能，可以将控制信令通过宿主DU 21发送至IAB节点。宿主DU 21可以将来自宿主CU 22的信令中转至IAB节点，并且还可以对来自其子节点(即，图1所示的IAB节点30或IAB节点40或终端设备50)的数据回传至宿主CU 22。节点DU 31用于为其子节点提供接入服务并且提供其子节点与IAB节点30之间的上下行数据传输。节点DU 31的子节点可以为终端设备50，也可以为其他IAB节点等。节点MT 32具有类似于终端设备的功能，可以用于对来自其 子节点的经节点DU 31传输的数据进行回传，例如，在多跳场景下，将数据回传至IAB节点40，或者，在单跳场景下，将数据直接回传至IAB宿主20。
在本申请实施例提供的认证方法、装置及***中，IAB节点入网时，IAB宿主可以接收来自IAB节点的包括第一指示信息的第一消息，该第一指示信息可以指示IAB节点支持的认证方式包括证书认证。从而，IAB宿主可以根据该第一指示信息，确定IAB节点使用证书认证，并且向IAB节点发送包括用于指示IAB节点使用证书认证的第二指示信息的第二消息。也就是说，IAB宿主可以根据IAB节点上报的支持证书认证的能力，确定IAB节点使用证书认证，并且向IAB节点发送第二消息，以指示IAB节点使用证书认证方式进行安全认证，从而使得IAB节点无需配置USIM卡就可完成入网时的安全认证，降低了IAB节点的成本，并且认证过程仅涉及IAB宿主与IAB节点之间的交互，无需核心网的参与，减少了对核心网的影响。
其中，IAB节点入网可以包括IAB节点开机后的首次接入，或者，IAB节点设备断电后的重新接入等，本申请实施例对IAB入网的具体场景不作限定。另外，IAB宿主可以为IAB节点的父节点；或者，IAB节点也可以通过一个或多个其他IAB节点与IAB宿主连接。
其中，IAB节点与IAB宿主可以是同厂商设备，也可以是不同厂商设备。在IAB节点在入网时使用证书认证方式进行安全认证时，若IAB节点和IAB宿主均为同厂商设备时，则IAB节点和IAB宿主可以分别向该厂商的证书颁发服务器(certificate authority，CA)申请获取证书(或者称为数字证书)。示例性地，若IAB节点和IAB宿主均为华为设备，则IAB节点和IAB宿主可以分别向华为CA申请获取证书，作为一种可能，IAB节点和IAB宿主可以在设备出厂时分别向华为CA申请获取证书。本申请对IAB节点和IAB宿主向华为CA申请获取证书的时间不作限定。
示例性地，IAB节点和IAB宿主分别向CA申请获取证书的过程可以如图2所示。首先，IAB节点/IAB宿主向CA发送证书请求消息，该证书请求消息可以包括IAB节点/IAB宿主的身份信息。然后，CA可以根据来自IAB节点/IAB宿主的证书请求消息，为IAB节点/IAB宿主生成对应的证书，并向IAB节点/IAB宿主发送证书响应消息，该证书响应消息包括CA为IAB节点/IAB宿主生成的证书。
示例性地，CA为IAB节点/IAB宿主生成的证书可以包含以下信息中的一种或者多种：
(1)CA为IAB节点/IAB宿主分配的设备序列号；
(2)颁布证书的机构信息，例如：华为CA的信息；
(3)证书的有效期；
(4)证书对应的公钥；或者
(5)CA签名(即：CA使用自己的私钥对IAB宿主/IAB节点的证书的签名)。
可以理解的是，IAB节点/IAB宿主的证书中包含的信息不限于上述示例，IAB节点/IAB宿主的证书还可以包括其他信息，本申请对此不作限定。
另外，CA还可以向IAB节点/IAB宿主发送CA的公钥信息。示例性地，CA可以在证书响应消息中携带CA的公钥信息；再示例性地，CA也可以通过其他消息向IAB节点/IAB宿主发送CA的公钥信息。本申请实施例对CA向IAB节点/IAB宿主发送 CA的公钥信息的方式不作限定。
在IAB节点和IAB宿主为同厂商设备时，IAB节点和IAB宿主可以通过上述过程从CA获取各自的证书，从而IAB节点和IAB宿主可以使用所获取的证书，通过IAB节点和IAB宿主之间的交互就能够完成证书认证，整个认证过程在空口侧完成，而无需核心网的参与，这样的证书认证也可以称为IAB节点和IAB宿主之间的私有认证，相比于现有技术中需要核心网参与的认证方法，可以加快IAB节点认证流程，缩短了IAB节点入网流程的时延。
示例性地，上述IAB宿主或IAB节点可以通过图3中的通信设备(也可以称之为通信装置)来实现。图3所示为本申请实施例提供的通信设备的硬件结构示意图。该通信设备300包括处理器301，通信线路302，存储器303以及至少一个通信接口(图3中仅是示例性的以包括通信接口304为例进行说明)。
处理器301可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路302可包括一通路，在上述组件之间传送信息。
通信接口304，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器303可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路302与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器303用于存储执行本申请方案的计算机执行指令，并由处理器301来控制执行。处理器301用于执行存储器303中存储的计算机执行指令，从而实现本申请下述实施例提供的令牌获取、发送方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器301可以包括一个或多个CPU，例如图3中的CPU0和CPU1。
在具体实现中，作为一种实施例，通信设备300可以包括多个处理器，例如图3中的处理器301和处理器308。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，通信设备300还可以包括输出设备305和输入 设备306。输出设备305和处理器301通信，可以以多种方式来显示信息。例如，输出设备305可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备306和处理器301通信，可以以多种方式接收用户的输入。例如，输入设备306可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的通信设备300可以是一个通用设备或者是一个专用设备。在具体实现中，通信设备300可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital assistant，PDA)、移动手机、平板电脑、无线终端设备、嵌入式设备或有图3中类似结构的设备。本申请实施例不限定通信设备300的类型。
为了方便起见，下面将以单跳场景为例，结合图1至图3对本申请实施例提供的认证方法进行具体阐述。需要说明的是，下面的方法中IAB节点可以替换成中继节点，IAB宿主可以替换成宿主节点，该中继节点和宿主节点连接，该连接可以是直接连接，例如通过一条回传链路，即该宿主节点是该中继节点的父节点；或者，该连接可以是间接连接，例如通过两条以上的回传链路，即该宿主节点可以通过一个或者多个其他中继节点与宿主节点连接。
如图4所示，为本申请实施例提供的一种认证方法，该方法可以包括：
401、IAB节点向IAB宿主发送第一消息，第一消息包括第一指示信息，第一指示信息用于指示IAB节点支持的认证方式，IAB节点支持的认证方式包括证书认证。
其中，IAB宿主可以为IAB节点的父节点，即，IAB节点直接连接到IAB宿主，对应于单跳场景；或者，IAB节点可以通过一个或多个其他IAB节点与IAB宿主连接，即，IAB节点通过其他IAB节点接入IAB宿主，对应于多跳场景。
在一些实现方式中，IAB节点支持的认证方式还可以包括以下认证方式中的至少一种：5G-AKA、EAP-AKA’或EAP-传输层安全(EAP-transport layer security，EAP-TLS)等。
在一些实施方式中，第一消息可以为无线资源控制(radio resource control，RRC)连接建立请求消息(setup request)。
在另一些实施方式中，第一消息可以为RRC连接建立完成消息(setup complete)。
可以理解的是，第一消息还可以为其他类型的消息，本申请实施例对第一消息的类型不作限定。
402、IAB宿主根据第一指示信息，确定IAB节点使用证书认证。
根据上述可知，第一消息包括用于指示IAB节点支持的认证方式的第一指示信息，其中，IAB节点支持的认证方式包括证书认证。因此，IAB宿主可以根据第一消息中的指示IAB节点支持的认证方式包括证书认证的第一指示信息，确定IAB节点可以使用证书认证。
其中，步骤402是可选的步骤。即，在步骤401之后，直接执行步骤403。也就是说，在IAB宿主接收到来自IAB节点的第一消息之后，IAB宿主可以响应于该第一消息，向IAB节点发送第二消息。
403、IAB宿主向IAB节点发送第二消息，第二消息包括用于指示IAB节点使用证书认证的第二指示信息。
其中，若第一消息为RRC连接建立请求消息，则第二消息可以为RRC连接建立消息(setup)。若第一消息为RRC连接建立完成消息，则第二消息可以为RRC连接建立完成消息之后IAB宿主向IAB节点发送的RRC消息，例如：RRC重配置消息，或者SMC(security mode command，安全模式命令)消息，或者新定义的RRC消息。
在步骤401至步骤403描述的方案中，IAB宿主可以根据IAB节点上报的支持证书认证的能力，确定IAB节点使用证书认证，并且向IAB节点发送第二消息，以指示IAB节点使用证书认证方式进行安全认证，从而使得IAB节点无需配置USIM卡就可完成入网时的安全认证，降低了IAB节点的成本，并且认证过程仅涉及IAB宿主与IAB节点之间的交互，无需核心网的参与，减少了对核心网的影响。
在一些实施例中，参见图5，在步骤401之前，该方法还可以包括：
501、IAB宿主发送***广播消息，***广播消息包括第三指示信息，第三指示信息用于指示IAB宿主支持证书认证方式。
也就是说，IAB宿主可以在***广播消息中携带第三指示信息，以向IAB节点通知IAB宿主支持证书认证方式。示例性地，IAB宿主可以通过***信息块1(system information block 1，SIB1)发送该第三指示信息。可以理解的是，IAB宿主还可以通过其他SIB发送第三指示信息，本申请实施例对IAB宿主发送第三指示信息的形式不作限定。
另外，在IAB宿主向IAB节点发送第二消息以指示IAB节点使用证书认证方式之后，即，在步骤403之后，该方法还可以包括：
502、IAB节点向IAB宿主发送第三消息。
其中，该第三消息中可以携带以下至少一种信息：IAB节点的电子序列号(electronic serial number，ESN)、IAB节点的证书或IAB节点对第三消息的签名等。示例性地，该第三消息还可以携带IAB节点生成的随机数，该随机数可以用于证书认证通过后的密钥派生。可以理解的是，该第三消息还可以携带其他与IAB节点的证书认证相关联的信息，本申请实施例对该第三消息中携带的信息不作具体限定。
若第一消息为RRC连接建立请求消息，则第三消息可以为RRC连接建立完成消息。若第一消息为RRC连接建立完成消息，则第三消息可以为在第二消息之后IAB宿主向IAB节点发送的RRC消息，例如：安全模式完成(security mode complete，SMC)消息，或者新定义的RRC消息。
根据前述可知，若IAB宿主和IAB节点为同厂商设备，则IAB宿主和IAB节点可以分别向该厂商的CA申请获取证书。即，IAB宿主的证书和IAB节点的证书来自同厂商的证书颁发服务器CA。
503、IAB宿主根据第三消息，对IAB节点进行认证。
其中，第三消息可以包括IAB节点的证书和IAB节点对第三消息的签名，IAB节点的证书来自证书颁发服务器CA；IAB节点的证书包括CA签名和IAB节点的公钥，IAB宿主具有来自CA的CA公钥。示例性地，CA可以将CA公钥与IAB宿主的证书一起发送给IAB宿主；再示例性地，CA也可以通过其他消息向IAB宿主发送CA的CA公钥。本申请实施例对IAB宿主接收来自CA的CA公钥的方式不作限定。
其中，IAB宿主根据第三消息对IAB节点进行认证的方式可以包括以下几种方式 中的至少一种：CA公钥对CA签名的校验，IAB节点的公钥对第三消息的签名的校验，第三消息中的ESN与IAB节点的证书中的ESN的一致性校验，或第三消息中的ESN的ESN白名单校验等。上述认证方式可以单独使用或者组合使用，即，IAB宿主根据第三消息对IAB节点的认证可以使用上述认证方式中的一个或者多个，本申请实施例对此不作限定。
在一些实现方式中，步骤503可以包括：IAB宿主使用CA公钥对IAB节点的证书中包含的CA签名进行校验。
也就是说，IAB宿主使用CA公钥对CA签名进行校验；若IAB宿主使用CA公钥对CA签名的校验通过，则说明IAB节点的证书合法，IAB节点是合法的节点，IAB宿主对IAB节点的认证通过。
其中，IAB节点的证书中包括的CA签名是CA使用CA私钥对该证书的签名。例如，CA签名可以为CA使用CA私钥对该证书生成的一个校验值。IAB宿主使用CA公钥对CA签名进行校验，可以包括：IAB宿主使用CA公钥对IAB节点的证书生成另一校验值；并对生成的该校验值与CA签名进行比较。若生成的该校验值与CA签名一致，则说明校验通过；若生成的该校验值与CA签名不一致，则说明校验未通过。
示例性地，参见图6，第三消息可以包括IAB节点的证书，IAB节点的证书中包括CA签名。IAB节点(即，图6所示的发送端)将该第三消息发送至IAB宿主(即，图6所示的接收端)后，IAB宿主可以使用CA公钥对CA签名进行校验，若校验通过后，说明该证书合法，IAB节点是合法的节点，IAB宿主对IAB节点的认证通过。
在另一些实现方式中，步骤503可以包括：IAB宿主使用IAB节点的公钥对第三消息的签名进行校验。
示例性地，参见图7，IAB宿主使用CA公钥对CA签名进行校验；若IAB宿主使用CA公钥对CA签名的校验通过，则IAB宿主从IAB节点的证书中获取IAB节点的公钥，并使用该公钥对第三消息的签名进行校验。
也就是说，首先，IAB宿主使用CA公钥对CA签名进行校验；若IAB宿主使用CA公钥对CA签名的校验通过，则说明IAB节点的证书合法。然后，IAB宿主可以使用IAB节点的证书中包含的IAB节点的公钥对该第三消息的签名进行校验，以验证该第三消息在传输过程中没有被篡改。其中，第三消息的签名是IAB节点使用IAB节点的私钥对该第三消息的签名；IAB节点的私钥与IAB节点的公钥是一对匹配的认证密钥。若IAB宿主使用IAB节点的证书中包含的公钥对该第三消息的签名的校验通过，则说明收到的该第三消息未被篡改，然后IAB宿主再根据第三消息中携带的IAB节点的ESN执行对IAB节点的认证。
在另一些实现方式中，第三消息还可以包括IAB节点的ESN，可以称为ESN1；IAB节点的证书中可以包括另一ESN，可以称为ESN2。步骤503可以包括：IAB宿主校验ESN1与IAB节点的证书中包括的ESN2的一致性。
示例性地，参见图8，在图7所示的使用IAB节点的公钥对第三消息的签名的校验通过之后，IAB宿主可以进一步校验ESN1与IAB节点的证书中包括的ESN2的一致性，若ESN1与ESN2一致，则IAB节点为合法的节点，IAB宿主对IAB节点的认证通过。
在另一些实现方式中，IAB宿主还可以具有来自操作管理和维护服务器(operation administration and maintenance，OAM)的ESN白名单，步骤503可以包括：IAB宿主使用ESN白名单校验第三消息中包括的IAB节点的ESN1。
示例性地，参见图9，在图7所示的使用IAB节点的公钥对第三消息的签名的校验通过之后，IAB宿主还可以使用ESN白名单校验第三消息中包括的IAB节点的ESN1。具体地，IAB宿主可以校验ESN1是否包括在该ESN白名单中，若ESN1包括在该ESN白名单中，则IAB节点为合法的节点，IAB宿主对IAB节点的认证通过。
可以理解的是，IAB宿主根据第三消息，对IAB节点进行认证的方式不限于上述示例，IAB宿主还可以通过其他方式对IAB节点进行认证，本申请实施例对此不作限定。
在另一些实施例中，在IAB宿主根据第三消息，对IAB节点的认证通过后，该方法还可以包括：
504、IAB宿主向IAB节点发送第四消息。
其中，该第四消息中可以携带以下至少一种信息：IAB宿主的电子序列号(electronic serial number，ESN)、IAB宿主的证书或IAB宿主对第四消息的签名等。示例性地，该第四消息还可以携带IAB宿主生成的随机数，该随机数可以用于证书认证通过后的密钥派生。可以理解的是，该第四消息还可以携带其他与IAB宿主的证书认证相关联的信息，本申请实施例对该第四消息中携带的信息不作具体限定。
505、IAB节点根据第四消息，对IAB宿主进行认证。
其中，IAB节点根据第四消息对IAB宿主进行认证的方式可以类似于步骤503中描述的IAB宿主根据第三消息对IAB节点进行认证的方式。其中，IAB节点根据第四消息对IAB宿主进行认证的方式可以包括以下几种方式中的至少一种：CA公钥对CA签名的校验，IAB宿主的公钥对第四消息的签名的校验，第四消息中的ESN与IAB宿主的证书中的ESN的一致性校验，或第四消息中的ESN的ESN白名单校验等。上述认证方式可以单独使用或者组合使用，即，IAB节点根据第四消息对IAB宿主的认证可以使用上述认证方式中的一个或者多个，具体可以参考步骤503中的描述，此处不再赘述。
也就是说，在IAB宿主根据第三消息对IAB节点的认证通过后，IAB宿主还可以向IAB节点发送第四消息，以使得IAB节点可以根据第四消息来认证IAB宿主，从而完成IAB宿主与IAB节点之间的双向认证过程。
示例性地，如前所述，当接入回传一体化网络采用CU-DU分离架构时，IAB宿主可以包括IAB宿主DU和IAB宿主CU。IAB节点可以包括IAB节点MT和IAB节点DU。参见图10，上述图4和图5所示的认证方法可以在IAB宿主DU、IAB宿主CU和IAB节点MT之间进行。上述图4和图5所示的认证方法中的IAB宿主与IAB节点的交互主要涉及IAB宿主DU与IAB节点MT之间的直接交互以及IAB宿主DU与IAB宿主CU之间的消息中转。即，图10所示的步骤1005、步骤1006、步骤1009、步骤1011、步骤1014和步骤1016中传输的消息分别是对步骤1004、步骤1007、步骤1008、步骤1012、步骤1013和步骤1017的消息的中转。
具体地，如图10所示，为本申请实施例提供的另一种认证方法，该方法可以包括：
1001、IAB宿主DU发送***广播消息，***广播消息可以包括第三指示信息，第三指示信息用于指示IAB宿主支持证书认证方式。
在一些实现方式中，IAB宿主支持证书认证方式是IAB宿主CU确定的。IAB宿主CU可以向IAB宿主DU发送支持证书认证方式的指示信息。例如，IAB宿主DU与，IAB宿主CU之间可以通过F1接口连接，因此，IAB宿主CU可以通过F1连接建立响应消息(setup response)向IAB宿主DU发送支持证书认证方式的指示信息。
在另一些实现方式中，IAB宿主支持证书认证方式是IAB宿主DU确定的。IAB宿主DU可以向IAB宿主CU发送支持证书认证方式的指示信息。例如，IAB宿主DU可以通过F1连接建立请求消息(setup request)向IAB宿主CU发送支持证书认证方式的指示信息。
也就是说，IAB宿主DU可以在***广播消息中携带第三指示信息，以向IAB节点MT通知IAB宿主支持证书认证方式。示例性地，IAB宿主DU可以通过***信息块1(system information block 1，SIB1)发送该第三指示信息。可以理解的是，IAB宿主DU还可以通过其他SIB发送第三指示信息，本申请实施例对IAB宿主DU发送第三指示信息的形式不作限定。
示例性地，***广播消息可以为图5的步骤501中描述的***广播消息，即，步骤1001可以对应于图5中的步骤501。
1002、IAB节点MT收到来自IAB宿主DU的***广播消息后，向IAB宿主DU发送MSG1。
MSG1用于随机接入过程的前导码传输。该MSG1是随机接入过程的第一条消息，也可以称为前导码消息，在此统一说明，以下不再赘述。
1003、IAB宿主DU收到MSG1后，向IAB节点MT发送MSG2。
MSG2为随机接入响应消息。其中，MSG2是针对上述MSG1的响应消息。
如图10所示，步骤1002和步骤1003共同构成随机接入(random access，RA)过程。在步骤1003之后，该方法还可以包括：
1004、IAB节点MT向IAB宿主DU发送RRC连接建立请求消息(RRC setup request)。
其中，RRC连接建立请求消息也可以称为MSG3。
1005、IAB宿主DU将携带RRC连接建立请求消息的第一F1应用层协议(F1application protocol，F1AP)消息发送给IAB宿主CU。
也就是说，IAB宿主DU在收到来自IAB节点MT的RRC连接建立请求消息后，将该RRC连接建立请求消息封装在第一F1AP消息，通过F1接口发送到IAB宿主CU。该第一F1AP消息可以是初始上行RRC消息中转消息(Initial UL RRC Message Transfer)。
1006、IAB宿主CU响应于RRC连接建立请求消息，向IAB宿主DU发送携带RRC连接建立消息的第二F1AP消息。该第二F1AP消息可以是下行RRC消息中转消息(DL RRC Message Transfer)。
1007、IAB宿主DU将该RRC连接建立消息发送给IAB节点MT。
也就是说，IAB宿主DU在收到来自IAB宿主CU的携带RRC连接建立消息的第 二F1AP消息后，可以将该RRC连接建立消息发送给IAB节点MT。
其中，该RRC连接建立消息也可以称为MSG4。该RRC连接建立消息可以包括空口配置信息，从而使得IAB节点MT在接收到该RRC连接建立消息之后，能够根据该空口配置信息建立RRC连接。通常，在建立RRC连接时，IAB节点会建立信令无线承载1(signalling radio bearer 1，SRB1)。SRB1可以用于传输RRC消息。在步骤1007处建立SRB1之后，步骤1007之后的步骤中涉及的在IAB节点MT与IAB宿主DU之间的RRC消息均可以承载在该SRB1上传输。
1008、IAB节点MT向IAB宿主DU发送RRC连接建立完成消息，RRC连接建立完成消息可以包括第一指示信息。
该RRC连接建立完成消息也可以称为MSG5，用于向IAB宿主通知RRC连接已经建立完成。第一指示信息用于指示IAB节点支持的认证方式，IAB节点支持的认证方式包括证书认证。IAB节点支持的认证方式还可以包括以下认证方式中的至少一种：5G-AKA、EAP-AKA或EAP-TLS等。该RRC连接建立完成消息还可以包括IAB节点指示信息，以指示当前接入网络的是IAB节点。
示例性地，RRC连接建立完成消息可以为图4的步骤401中描述的第一消息，即，步骤1008可以对应于图4中的步骤401。
1009、IAB宿主DU将携带RRC连接建立完成消息的第三F1AP消息发送给IAB宿主CU。
也就是说，IAB宿主DU在收到来自IAB节点MT的RRC连接建立完成消息后，将该RRC连接建立完成消息封装在第三F1AP消息，通过F1接口发送到IAB宿主CU。该第三F1AP消息可以是UL RRC Message Transfer消息。
如图10所示，步骤1004至步骤1009共同构成RRC建立(RRC setup)过程。在步骤1009之后，该方法还可以包括：
1010、IAB宿主CU根据第三F1AP消息中携带的RRC连接建立完成消息，确定IAB节点使用证书认证。
根据上述可知，第三F1AP消息中携带了RRC连接建立完成消息，RRC连接建立完成消息包括用于指示IAB节点支持的认证方式的第一指示信息，其中，IAB节点支持的认证方式包括证书认证。因此，IAB宿主CU可以根据RRC连接建立完成消息中携带的指示IAB节点支持的认证方式包括证书认证的第一指示信息，确定IAB节点可以使用证书认证。
示例性地，步骤1010可以对应于图4中的步骤402。
1011、IAB宿主CU将携带RRC消息X的第四F1AP消息发送给IAB宿主DU，RRC消息X包括用于指示IAB节点使用证书认证的第二指示信息。第四F1AP消息可以是DL RRC Message Transfer消息。
示例性地，该RRC消息X可以是现有RRC消息，例如，RRC重配置消息，或者安全模式命令(security mode command，SMC)消息等。再示例性地，该RRC消息X也可以是新定义的RRC消息。在一些实现方式中，第二指示信息可以为用于指示IAB节点上报证书的指示信息。可以理解，IAB宿主CU还可以通过其他类型的第二指示信息来指示IAB节点使用证书认证，本申请实施例对此不作限定。
1012、IAB宿主DU向IAB节点MT发送RRC消息X。
也就是说，IAB宿主CU将IAB节点使用证书认证的信息携带在RRC消息中，通过IAB宿主DU的中转发送给IAB节点MT。
示例性地，RRC消息X可以为图4的步骤403中描述的第二消息，即，步骤1012可以对应于图4中的步骤403。
1013、IAB节点MT向IAB宿主DU发送RRC消息Y。
该RRC消息Y可以是现有RRC消息，例如可以是安全模式完成(security mode complete，SMC)消息等；或者，该RRC消息Y也可以是新定义的RRC消息。本申请实施例对RRC消息Y的类型不作限定。
RRC消息Y可以包括IAB节点的证书相关信息，使得IAB节点MT可以通过该RRC消息Y向IAB宿主DU上报证书。
其中，RRC消息Y可以携带以下至少一种信息：IAB节点的电子序列号ESN、IAB节点的证书或IAB节点对第三消息的签名等。再示例性地，RRC消息Y还可以携带IAB节点生成的随机数，该随机数可以用于证书认证通过后的密钥派生。可以理解的是，RRC消息Y还可以携带其他与IAB节点的证书认证相关联的信息，本申请实施例对RRC消息Y中携带的信息不作具体限定。
示例性地，RRC消息Y可以为图5的步骤502中描述的第三消息；即，步骤1013可以对应于图5中的步骤502。
1014、IAB宿主DU将携带RRC消息Y的第五F1AP消息发送给IAB宿主CU。
也就是说，IAB宿主DU在收到来自IAB节点MT的RRC消息Y后，将该RRC消息Y封装在第五F1AP消息中，并通过F1接口发送到IAB宿主CU。第五F1AP消息可以是UL RRC Message Transfer消息。
1015、IAB宿主CU根据RRC消息Y，对IAB节点进行认证。
其中，根据前述可知，IAB宿主CU可以具有来自CA的CA公钥。RRC消息Y可以包括IAB节点的证书，IAB节点的证书包括CA签名。
在一些实施例中，IAB宿主CU可以使用CA公钥对CA签名进行校验。若IAB宿主CU使用CA公钥对CA签名的校验通过，则说明IAB节点的证书合法，IAB节点是合法的节点，从而IAB宿主CU对IAB节点的认证通过。
在另一些实施例中，IAB宿主CU使用CA公钥对CA签名进行校验；若IAB宿主CU使用CA公钥对CA签名的校验通过，则说明IAB节点的证书合法。然后，IAB宿主CU还可以使用IAB节点的证书中包含的公钥对该RRC消息Y的消息签名进行校验，以验证该RRC消息Y在传输过程中没有被篡改；其中，该RRC消息Y的消息签名是IAB节点使用IAB节点的私钥对该RRC消息Y的签名。若IAB宿主CU使用IAB节点的证书中包含的公钥对该RRC消息Y的消息签名的校验通过，则说明收到的该RRC消息Y未被篡改，从而IAB宿主CU根据RRC消息Y，进一步对IAB节点进行认证。
在另一些实施例中，RRC消息Y还可以包括IAB节点的电子序列号(electronic serial number，ESN)，可以称为ESN1；IAB节点的证书中可以包括ESN2。IAB宿主CU可以校验ESN1与IAB节点的证书中包括的ESN2的一致性。具体地，IAB宿 主可以校验上述ESN1与ESN2的一致性，若ESN1与ESN2一致，则IAB节点为合法的节点，IAB宿主CU对IAB节点的认证通过。
在另一些实施例中，IAB宿主CU还具有从CA获取到的ESN白名单，IAB宿主CU可以使用ESN白名单校验RRC消息Y中包括的IAB节点的ESN1。具体地，IAB宿主可以校验ESN1是否包括在该ESN白名单中，若ESN1包括在该ESN白名单中，则IAB节点为合法的节点，IAB宿主CU对IAB节点的认证通过。
可以理解的是，IAB宿主CU根据RRC消息Y，对IAB节点进行认证的方式不限于上述示例，IAB宿主CU还可以通过其他方式对IAB节点进行认证。本申请实施例对IAB宿主CU根据RRC消息Y，对IAB节点进行认证的方式不作限定。
示例性地，步骤1015可以对应于图5中的步骤503。
在IAB宿主CU根据RRC消息Y，对IAB节点的认证通过后，该方法还可以包括：
1016、IAB宿主CU将携带RRC消息Z的第六F1AP消息发送给IAB宿主DU。
该RRC消息Z可以是现有RRC消息；或者，该RRC消息Z也可以是新定义的RRC消息。本申请实施例对RRC消息Z的类型不作限定。
RRC消息Z包括IAB宿主的证书相关信息。示例性地，RRC消息Z可以携带以下至少一种信息：IAB宿主的电子序列号ESN、IAB宿主的证书或IAB宿主对第三消息的签名等。再示例性地，RRC消息Z还可以携带IAB宿主生成的随机数，该随机数可以用于证书认证通过后的密钥派生。可以理解的是，RRC消息Z还可以携带其他与IAB宿主的证书认证相关联的信息，本申请实施例对RRC消息Z中携带的信息不作具体限定。
其中，第六F1AP消息可以是DL RRC Message Transfer消息。
1017、IAB宿主DU向IAB节点MT发送RRC消息Z。
也就是说，IAB宿主CU在收到来自IAB宿主CU的携带RRC消息Z的第六F1AP消息之后，可以将该RRC消息Z发送给IAB节点MT。
示例性地，RRC消息Z可以为图5的步骤504中描述的第四消息；即，步骤1017可以对应于图5中的步骤504。
1018、IAB节点MT根据RRC消息Z，对IAB宿主进行认证。
IAB节点MT根据RRC消息Z，对IAB宿主进行认证的方式可以类似于步骤1015中描述的方式，此处不再赘述。
示例性地，步骤1018可以对应于图5中的步骤505。
根据图10的上述描述可知，在步骤1008中，IAB节点MT向IAB宿主DU发送RRC连接建立完成消息，该RRC连接建立完成消息中携带了IAB节点支持的认证方式包括证书认证的第一指示信息。然后，在步骤1010中，IAB宿主CU根据第一指示信息，确定IAB节点使用证书认证。并且通过步骤1011和步骤1012，IAB宿主CU经由IAB宿主DU将用于指示IAB节点使用证书认证的第二指示信息发送给IAB节点MT。之后，通过步骤1013和步骤1014，IAB节点MT经由IAB宿主DU向IAB宿主CU发送携带了证书相关信息的RRC消息Y，使得IAB宿主CU在步骤1015中根据RRC消息Y，对IAB节点进行认证。
在一些实施例中，若步骤1008中的第一指示信息指示IAB节点支持的认证方式只有证书认证，则可以不执行图10中的步骤1010至步骤1012所示的IAB宿主确定证书认证并向IAB节点通知所确定的认证方式为证书认证的过程，即，在步骤1009之后，直接执行步骤1013。也就是说，若第一指示信息指示IAB节点支持的认证方式只有证书认证，则IAB节点无需在收到来自IAB宿主的指示IAB节点使用证书认证的第二指示信息后，才向IAB宿主发送包括证书相关信息的RRC消息Y；而是IAB节点可以直接向IAB宿主发送包括证书相关信息的RRC消息Y。
在其他一些实施例中，也可以将图10中的认证过程提前，如图11所示，为本申请实施例提供的另一种认证方法，该方法可以包括：
1101、IAB宿主DU发送***广播消息，***广播消息可以包括第三指示信息，第三指示信息用于指示IAB宿主支持证书认证方式。
1102、IAB节点MT收到来自IAB宿主DU的***广播消息后，向IAB宿主DU发送MSG1。
1103、IAB宿主DU收到MSG1后，向IAB节点MT发送MSG2。
MSG2为随机接入响应消息。其中，MSG2是针对上述MSG1的响应消息。
其中，步骤1101-步骤1103分别对应于图10中的步骤1001-步骤1003，具体内容可以参见图10的描述，此处不再赘述。
1104、IAB节点MT向IAB宿主DU发送RRC连接建立请求消息(RRC setup request)，该RRC连接建立请求消息可以包括第一指示信息。
其中，RRC连接建立请求消息也可以称为MSG3。第一指示信息用于指示IAB节点支持的认证方式，IAB节点支持的认证方式包括证书认证。IAB节点支持的认证方式还可以包括以下认证方式中的至少一种：5G-AKA、EAP-AKA或EAP-TLS等。该RRC连接建立完成消息还可以包括IAB节点指示信息，以指示当前接入网络的是IAB节点。
示例性地，RRC连接建立请求消息可以为图4的步骤401中描述的第一消息；即，步骤1104可以对应于图4中的步骤401。
1105、IAB宿主DU将携带RRC连接建立请求消息的第一F1AP消息发送给IAB宿主CU。
也就是说，IAB宿主DU在收到来自IAB节点MT的RRC连接建立请求消息后，将该RRC连接建立请求消息封装在第一F1AP消息中，并通过F1接口发送到IAB宿主CU。
1106、IAB宿主CU根据RRC连接建立请求消息，确定IAB节点使用证书认证。
根据上述可知，第一F1AP消息携带了RRC连接建立请求消息，RRC连接建立请求消息包括用于指示IAB节点支持的认证方式的第一指示信息，其中，IAB节点支持的认证方式包括证书认证。因此，IAB宿主CU可以根据RRC连接建立请求消息中携带的指示IAB节点支持的认证方式包括证书认证的第一指示信息，确定IAB节点可以使用证书认证。
示例性地，步骤1106可以对应于图4中的步骤402。
1107、IAB宿主CU响应于RRC连接建立请求消息，向IAB宿主DU发送携带 RRC连接建立消息的第二F1AP消息，RRC连接建立消息包括用于指示IAB节点使用证书认证的第二指示信息。
在一些实现方式中，第二指示信息可以为用于指示IAB节点上报证书的指示信息。可以理解，IAB宿主CU还可以通过其他类型的第二指示信息来指示IAB节点使用证书认证，本申请实施例对此不作限定。
1108、IAB宿主DU将该RRC连接建立消息发送给IAB节点MT。
也就是说，IAB宿主DU在收到来自IAB宿主CU的携带RRC连接建立消息的第二F1AP消息后，可以将该RRC连接建立消息发送给IAB节点MT。
其中，该RRC连接建立消息也可以称为MSG4。该RRC连接建立消息可以包括空口配置信息，从而使得IAB节点MT在接收到该RRC连接建立消息之后，能够根据该空口配置信息建立RRC连接。通常，在建立RRC连接时，IAB节点会建立SRB1。SRB1可以用于传输RRC消息。在步骤1108处建立SRB1之后，步骤1108之后的步骤中涉及的在IAB节点MT与IAB宿主DU之间的RRC消息均可以承载在该SRB1上传输。
示例性地，该RRC连接建立消息可以为图4的步骤403中描述的第二消息；即，步骤1108可以对应于图4中的步骤403。
1109、IAB节点MT向IAB宿主DU发送RRC连接建立完成消息。
该RRC连接建立完成消息也可以称为MSG5，用于向IAB宿主通知RRC连接已经建立完成。RRC连接建立完成消息可以包括IAB节点的证书相关信息，使得IAB节点MT可以通过该RRC连接建立完成消息向IAB宿主DU上报证书。
其中，RRC连接建立完成消息可以携带以下至少一种信息：IAB节点的电子序列号ESN、IAB节点的证书或IAB节点对第三消息的签名等。再示例性地，RRC消息Y还可以携带IAB节点生成的随机数，该随机数可以用于证书认证通过后的密钥派生。可以理解的是，RRC连接建立完成消息还可以携带其他与IAB节点的证书认证相关联的信息，本申请实施例对RRC连接建立完成消息中携带的信息不作具体限定。
示例性地，RRC连接建立完成消息可以为图5的步骤502中描述的第三消息；即，步骤1109可以对应于图5中的步骤502。
1110、IAB宿主DU将携带RRC连接建立完成消息的第三F1AP消息发送给IAB宿主CU。
也就是说，IAB宿主DU在收到来自IAB节点MT的RRC连接建立完成消息后，将该RRC连接建立完成消息封装在第三F1AP消息中，通过F1接口发送到IAB宿主CU。
1111、IAB宿主CU根据RRC连接建立完成消息，对IAB节点进行认证。
IAB宿主CU根据RRC连接建立完成消息，对IAB节点进行认证的方式可以类似于步骤1015中描述的方式，此处不再赘述。
示例性地，步骤1111可以对应于图5中的步骤503。
1112、IAB宿主CU将携带RRC消息Z的第六F1AP消息发送给IAB宿主DU。
RRC消息Z包括IAB宿主的证书相关信息。示例性地，RRC消息Z可以携带以下至少一种信息：IAB宿主的电子序列号ESN、IAB宿主的证书或IAB宿主对第三消 息的签名等。再示例性地，RRC消息Z还可以携带IAB宿主生成的随机数，该随机数可以用于证书认证通过后的密钥派生。可以理解的是，RRC消息Z还可以携带其他与IAB宿主的证书认证相关联的信息，本申请实施例对RRC消息Z中携带的信息不作具体限定。
1113、IAB宿主DU向IAB节点MT发送RRC消息Z。
示例性地，RRC消息Z可以为图5的步骤504中描述的第四消息；即，步骤1113可以对应于图5中的步骤504。
1114、IAB节点MT根据RRC消息Z，对IAB宿主进行认证。
示例性地，步骤1114可以对应于图5中的步骤505。
其中，步骤1112-步骤1114分别对应于图10中的步骤1016-步骤1018，具体内容可以参见图10的描述，此处不再赘述。
根据图11的上述描述可知，在步骤1104中，IAB节点MT向IAB宿主DU发送RRC连接建立请求消息(MSG3)，该RRC连接建立请求消息中携带了IAB节点支持的认证方式包括证书认证的第一指示信息。然后，在步骤1106中，IAB宿主CU根据第一指示信息，确定IAB节点使用证书认证。并且在步骤1107和步骤1108中，IAB宿主CU经由IAB宿主DU，通过RRC连接建立消息(MSG4)将用于指示IAB节点使用证书认证的第二指示信息发送给IAB节点MT。之后，在步骤1109和步骤1110，IAB节点MT经由IAB宿主DU向IAB宿主CU发送携带了证书相关信息的RRC连接建立完成消息(MSG5)，使得IAB宿主CU在步骤1111中根据RRC连接建立完成消息，对IAB节点进行认证。
对比图10和图11可知，在图10所示的实施例中，在MSG5消息之后，IAB宿主才通过RRC消息将确定IAB节点使用证书认证的指示信息发送给IAB节点。并且，在MSG5消息之后，IAB节点从IAB宿主收到使用证书认证的指示信息后，IAB节点才将其证书等信息发送到IAB宿主，由IAB宿主完成对IAB节点的认证。
而在图11所示的实施例中，IAB宿主通过MSG4消息就将确定IAB节点使用证书认证的指示信息发送到IAB节点。IAB节点在MSG5中将其证书等信息发送到IAB宿主。从而，图11所示的实施例相比于图10所示的实施例，将IAB认证过程提前到RRC建立过程开始，从而进一步缩短了IAB节点入网流程的时延。
上述实施例主要描述了IAB节点和IAB宿主为同厂商设备时，IAB节点和IAB宿主事先可以分别从该厂商的CA获取为其颁布的证书，从而在IAB节点入网时，IAB节点和IAB宿主使用所获取的证书，通过IAB节点和IAB宿主之间的交互就能够完成证书认证，整个认证过程在空口侧完成，无需核心网的参与。
然而，IAB节点与IAB宿主也可能为异厂商的设备。在IAB节点发生切换/重建立/移动时，可能导致IAB节点与异厂商的IAB宿主连接。例如，当IAB节点与IAB宿主之间的链路质量变差，不能保证两者之间的数据传输时，IAB节点可能切换至异厂商的另一IAB宿主。再例如，当IAB节点在移动过程中，可能会移动到异厂商的另一个IAB宿主覆盖的范围内，IAB节点需要切换至异厂商的另一IAB宿主。
当IAB节点与IAB宿主为异厂商的设备时，IAB节点与IAB宿主无法通过同厂商的CA获取证书，则前述实施例的方案可能不再适用。为了支持异厂商设备之间的认 证，IAB节点与IAB宿主需要从运营商CA处获取运营商颁发的证书。在IAB节点和IAB宿主分别从运营商CA服务器获取到证书后，可以执行双向认证和密钥协商。
具体地，如图12所示，为本申请实施例提供的另一种认证方法，图12可以包括图11所示的步骤1101至步骤1108，在步骤1108之后，该方法还可以包括：
1201、IAB节点MT向IAB宿主DU发送RRC连接建立完成消息。
该RRC连接建立完成消息也可以称为MSG5，用于向IAB宿主通知RRC连接已经建立完成。该RRC连接建立完成消息可以包括IAB节点指示信息，以指示当前接入网络的是IAB节点。
在步骤1201之后，IAB节点可以经由IAB宿主，通过核心网从运营商CA获取IAB节点的证书。示例性地，IAB节点申请运营商证书的具体流程如下：
1202、IAB宿主向IAB节点发送运营商CA的相关信息。例如，运营商CA的相关信息可以包括：CA名称(name)和/或CA统一资源定位符(uniform resource locator，URL)等。可以理解的是，运营商CA的相关信息还可以包括其他信息，本申请实施例对此不作限定。
1203、响应于运营商CA的相关信息，IAB节点向IAB宿主发送证书管理协议版本2(certificate management protocol version 2，CMPV2)初始请求消息(intial request)。
该CMPV2intial request用于向步骤1202中获取的CA请求获取证书。
1204、IAB宿主通过核心网服务器向运营商CA转发CMPV2intial request。
1205、响应于CMPV2intial request，运营商CA通过核心网服务器向IAB宿主发送CMPV2初始响应消息(intial response)。
该CMPV2intial response用于响应IAB节点的请求消息，可以包括IAB节点的证书。
1206、IAB宿主向IAB节点转发CMPV2intial response。
1207、响应于CMPV2intial response，IAB节点向IAB宿主发送CMPV2认证确认消息(certification confirm)。
该CMPV2certification confirm用于向CA指示已经接收到IAB节点的证书。
1208、IAB宿主通过核心网服务器向运营商CA转发CMPV2certification confirm。
1209、响应于CMPV2certification confirm，运营商CA通过核心网服务器向IAB宿主发送CMPV2公钥基础设施(Public Key Infrastructure，PKI)确认消息(confirm)。
该CMPV2PKI confirm用于对CMPV2certification confirm消息接收进行确认。
1210、IAB宿主通过核心网服务器向运营商CA转发CMPV2PKI confirm。
通过步骤1202至步骤1210，IAB节点经由IAB宿主，通过核心网服务器从运营商CA获取到了IAB节点的证书。
另外，IAB宿主可以从运营商CA预先获取到IAB宿主的证书。例如，IAB宿主可以在IAB宿主接入核心网时获取从运营商CA获取其自身的证书。可以理解，IAB宿主也可以通过其他方式从运营商CA获取到IAB宿主的证书，例如：在IAB节点请求获取证书的过程中，IAB宿主一并请求获取自己的证书，本申请实施例对此不作限定。然后，IAB节点和IAB宿主可以使用所获取的证书进行双向认证和密钥协商。示例性地，IAB节点和IAB宿主使用所获取的证书通过EAP-TLS流程进行双向认证和 密钥协商，具体流程如下：
1211、IAB宿主向IAB节点发送EAP请求(request)TLS开始消息(start)。
该EAP request TLS start用于指示IAB节点执行EAP-TLS认证。
1212、响应于EAP request TLS start，IAB节点向IAB宿主发送EAP response client hello消息。
该EAP response client hello消息用于对EAP request TLS start消息接收的确认。
1213、IAB宿主向IAB节点发送EAP request server hello，certificate，certificate request消息。
该EAP request server hello，certificate，certificate request消息用于请求IAB节点提供证书信息。同时，该消息中还携带了IAB宿主相关的证书信息，以便IAB节点执行对IAB宿主的认证。
1214、IAB节点向IAB宿主发送EAP response certificate，client key exchange，change cipher spec，finished消息。
一旦IAB节点完成对IAB宿主的认证，则IAB节点向IAB宿主发送EAP response certificate,client key exchange,change cipher spec，finished消息，该EAP response certificate，client key exchange，change cipher spec，finished消息用于IAB节点向IAB宿主上报其从运营商CA处获取的证书信息，以便于IAB宿主执行对IAB节点的认证。
1215、IAB宿主向IAB节点发送EAP request change cipher spec，finished消息。
一旦IAB宿主完成对IAB节点的认证，则IAB宿主向IAB节点发送EAP request change cipher spec，finished消息，该EAP request change cipher spec，finished消息用于指示IAB宿主完成对IAB节点的认证，同时，该消息中还携带了IAB宿主指定IAB节点使用的加密算法等信息。
1216、IAB节点向IAB宿主发送EAP响应消息(response)。
该EAP response消息用于对EAP request change cipher spec，finished消息接收的响应。
1217、响应于EAP response，IAB宿主向IAB节点发送EAP成功消息(success)。
该EAP success消息用于指示完成EAP-TLS认证流程。
通过上述步骤1211至步骤1217，IAB节点和IAB宿主完成了双向认证和密钥协商。在此之后，IAB宿主可以获取IAB节点的能力。示例性地，IAB宿主获取IAB节点的能力的具体流程如下：
1218、IAB宿主向IAB节点发送能力查询消息(capability enquiry)。
该capability enquiry消息用于指示IAB节能上报其支持的空口能力信息。
1219、响应于capability enquiry，IAB节点向IAB宿主发送能力信息(capability information)。
该capability information消息包括了IAB节点的各种能力信息，例如：IAB节点是否支持多输入多输出(multi-input multi-output，MIMO)能力、是否支持双连接功能、IAB节点支持的安全算法等。
在IAB宿主获取了IAB节点的能力之后，可以激活IAB宿主和IAB节点之间的安全模式。示例性地，IAB宿主和IAB节点之间的安全模式激活的具体流程如下：
1220、IAB宿主向IAB节点发送安全模式命令消息(security mode command)。
该security mode command消息用于指示IAB节点空口使用的安全算法，包括：加密算法和完整性保护算法。
1221、响应于security mode command，IAB节点向IAB宿主发送安全模式完成消息(security mode complete)。
该security mode complete消息用于对security mode command消息接收的确认。
在IAB宿主和IAB节点之间的密钥和算法协商完成之后，IAB节点可以建立SRB2和数据无线承载(data radio bearer，DRB)。示例性地，IAB节点建立SRB2和DRB的具体流程可以如下：
1222、IAB宿主向IAB节点发送RRC重配置消息(reconfiguration)。
该RRC reconfiguration消息用于指示IAB节点根据IAB宿主的配置信息建立对应的SRB2和DRB。
其中，SRB2可以用于传输非接入层(non-access stratum，NAS)消息，比SRB1具有更低的优先级，并且总是在安全模式激活之后才配置SRB2。DRB可以用于传输用户面数据。
1223、响应于RRC reconfiguration，IAB节点向IAB宿主发送RRC重配置完成消息(reconfiguration complete)。
该RRC reconfiguration complete消息用于指示RRC重配置完成，已经建立了SRB2和DRB。
根据前述可知，在步骤1108建立了SRB1，上述申请运营商证书流程以及双向认证和密钥协商流程发生在SRB1建立之后，SRB2和DRB建立之前。由于SRB1主要用于传输RRC消息，而上述申请运营商证书流程以及双向认证和密钥协商流程中的消息是应用层消息，并非RRC消息，因此，申请运营商证书流程以及双向认证和密钥协商流程中的消息如何在IAB节点和IAB宿主之间传输需要考虑。
在一种可能的实现方式中，上述申请运营商证书流程以及双向认证和密钥协商流程中的所有消息，在IAB节点和IAB宿主之间的空口上都承载在SRB1上传输。
在另一种可能的实现方式中，上述申请运营商证书流程以及双向认证和密钥协商流程中的所有消息可以在默认DRB或者预配置的DRB上传输。该默认DRB或者预配置的DRB是在申请运营商证书流程之前预先建立的。例如，IAB宿主可以在MSG4中携带默认DRB的配置信息，在建立RRC连接时根据该配置信息预先建立一个初始DRB。由于该默认DRB或者预配置的DRB在步骤1220至步骤1221所示的安全模式激活流程之前建立，因此，该默认DRB或者预配置的DRB无安全保护，仅用于传输上述申请运营商证书流程以及双向认证和密钥协商流程中的消息。
在图12所示的实施例中，通过从运营商CA处获取运营商CA颁布的证书来实现接入过程中的异厂商设备之间的双向认证，无需IAB节点配置USIM卡，节省了IAB节点的成本。
根据上述可知，为了方便起见，图4至图12所示的实施例均以IAB宿主为IAB节点的父节点的单跳场景为例进行说明，而本发明提供的认证方法还可以用于IAB节点通过其他IAB节点与IAB宿主连接的多跳场景中。在多跳场景中，与单跳场景类似， 由IAB宿主完成对IAB节点的认证，IAB节点完成对IAB宿主的认证。IAB节点与IAB宿主之间的其他IAB节点仅用于信令的路由转发。
综上，因此，本申请实施例公开了一种认证方法，应用于IAB宿主，如图13所示，该方法可以包括如下步骤1301-步骤1303：
1301、IAB宿主接收来自IAB节点的第一消息，第一消息包括第一指示信息，第一指示信息用于指示IAB节点支持的认证方式，IAB节点支持的认证方式包括证书认证。
1302、IAB宿主根据第一指示信息，确定IAB节点使用证书认证。
1303、IAB宿主向IAB节点发送第二消息，第二消息包括用于指示IAB节点使用证书认证的第二指示信息。
其中，IAB宿主可以为IAB节点的父节点；或者，IAB节点可以通过一个或多个其他IAB节点与IAB宿主连接。
在上述认证方法中，例如，IAB宿主的操作可参考图4所示的实施例中IAB宿主的操作及上述相关文字说明，在此不再赘述。
此外，本申请实施例还公开了一种认证方法，应用于IAB节点，如图14所示，该方法包括如下步骤1401-步骤1402：
1401、IAB节点向IAB宿主发送第一消息，第一消息包括第一指示信息，第一指示信息用于指示IAB节点支持的认证方式，IAB节点支持的认证方式包括证书认证。
1402、IAB节点接收来自IAB宿主的第二消息，第二消息包括用于指示IAB节点使用证书认证的第二指示信息。
其中，IAB宿主可以为IAB节点的父节点；或者，IAB节点通过一个或多个其他IAB节点与IAB宿主连接。
在上述认证方法中，例如，IAB节点的操作可参考图4所示的实施例中IAB节点的操作及上述相关文字说明，在此不再赘述。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述IAB节点或IAB宿主为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对IAB节点或IAB宿主进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
比如，以采用集成的方式划分各个功能模块的情况下，图15示出了上述实施例中涉及的IAB节点1500的一种可能的组成示意图，如图15所示，该IAB节点1500可以包括处理单元1501和收发单元1502。
其中，处理单元1501可以用于支持IAB节点1500执行上述步骤505等，和/或用于本文所描述的技术的其他过程。
收发单元1502可以用于支持IAB节点1500执行步骤401、步骤403、步骤501、步骤502、步骤504等，和/或用于本文所描述的技术的其他过程。
比如，以采用集成的方式划分各个功能模块的情况下，图16示出了上述实施例中涉及的IAB宿主1600的一种可能的组成示意图，如图16所示，该IAB宿主1600可以包括处理单元1601和收发单元1602。
其中，处理单元1601可以用于支持IAB宿主1600执行上述步骤402、步骤503等，和/或用于本文所描述的技术的其他过程。
收发单元1602可以用于支持IAB宿主1600执行步骤401、步骤403、步骤501、步骤502、步骤504等，和/或用于本文所描述的技术的其他过程。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
可选的，本申请实施例还提供了一种认证装置(例如，该认证装置可以是芯片或芯片***)，该认证装置包括处理器，用于实现上述任一方法实施例中的方法。在一种可能的设计中，该认证装置还包括存储器。该存储器，用于保存必要的程序指令和数据，处理器可以调用存储器中存储的程序代码以指令该认证装置执行上述任一方法实施例中的方法。当然，存储器也可以不在该认证装置中。该认证装置是芯片***时，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。本申请实施例中，计算机可以包括前面所述的装置。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本申请过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (20)

  1. 一种认证方法，其特征在于，包括：
    宿主节点从中继节点接收第一消息，所述第一消息包括第一指示信息，所述第一指示信息用于指示所述中继节点支持的认证方式，所述中继节点支持的认证方式包括证书认证；
    所述宿主节点向所述中继节点发送第二消息，所述第二消息包括用于指示所述中继节点使用证书认证的第二指示信息；
    其中，所述中继节点与所述宿主节点连接。
  2. 根据权利要求1所述的方法，其特征在于，在所述宿主节点从所述中继节点接收所述第一消息之前，所述方法还包括：
    所述宿主节点发送***广播消息，所述***广播消息包括第三指示信息，所述第三指示信息用于指示所述宿主节点支持证书认证方式。
  3. 根据权利要求1或2所述的方法，其特征在于，所述中继节点支持的认证方式还包括以下认证方式中的至少一种：5G-认证和密钥协商AKA、可扩展认证协议EAP-AKA’或EAP-传输层安全TLS。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述方法还包括：
    所述宿主节点从所述中继节点接收第三消息；
    所述宿主节点根据所述第三消息，对所述中继节点进行认证；
    其中，所述第三消息中携带以下至少一种信息：
    所述中继节点的电子序列号ESN、所述中继节点的证书或所述中继节点对所述第三消息的签名。
  5. 根据权利要求4所述的方法，其特征在于，所述第三消息包括所述中继节点的证书，所述中继节点的证书来自证书颁发服务器CA；所述中继节点的证书包括CA签名，所述宿主节点具有来自所述CA的CA公钥；
    所述宿主节点根据所述第三消息，对所述中继节点进行认证，包括：
    所述宿主节点使用所述CA公钥对所述CA签名进行校验。
  6. 根据权利要求5所述的方法，其特征在于，所述第三消息包括所述中继节点对所述第三消息的签名，所述中继节点的证书还包括所述中继节点的公钥；
    所述宿主节点根据所述第三消息，对所述中继节点进行认证，还包括：
    若所述宿主节点使用所述CA公钥对所述CA签名的校验通过，则所述宿主节点从所述中继节点的证书中获取所述中继节点的公钥，并使用所述中继节点的公钥对所述第三消息的签名进行校验。
  7. 根据权利要求6所述的方法，其特征在于，所述第三消息还包括所述中继节点的ESN，所述宿主节点具有来自操作管理和维护服务器OAM的ESN白名单；
    所述宿主节点根据所述第三消息，对所述中继节点进行认证，还包括：
    若所述宿主节点使用所述中继节点的公钥对所述第三消息的签名校验通过，则所述宿主节点校验所述中继节点的ESN与所述中继节点的证书中包括的ESN的一致性；或者，
    若所述宿主节点使用所述中继节点的公钥对所述第三消息的签名校验通过，则所 述宿主节点使用所述ESN白名单校验所述中继节点的ESN。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，
    所述第一消息为无线资源控制RRC连接建立请求消息；或者，
    所述第一消息为RRC连接建立完成消息。
  9. 一种认证方法，其特征在于，包括：
    接入回传一体化中继节点向宿主节点发送第一消息，所述第一消息包括第一指示信息，所述第一指示信息用于指示所述中继节点支持的认证方式，所述中继节点支持的认证方式包括证书认证；
    所述中继节点接收来自所述宿主节点的第二消息，所述第二消息包括用于指示所述中继节点使用证书认证的第二指示信息；
    其中，所述宿主节点为所述中继节点的父节点；或者，所述中继节点通过一个或多个其他中继节点与所述宿主节点连接。
  10. 根据权利要求9所述的方法，其特征在于，在所述中继节点向所述宿主节点发送所述第一消息之前，所述方法还包括：
    所述中继节点接收来自所述宿主节点的***广播消息，所述***广播消息包括第三指示信息，所述第三指示信息用于指示所述宿主节点支持证书认证方式。
  11. 根据权利要求9或10所述的方法，其特征在于，所述中继节点支持的认证方式还包括以下认证方式中的至少一种：5G-认证和密钥协商AKA、可扩展认证协议EAP-AKA’或EAP-可扩展认证协议TLS。
  12. 根据权利要求9-11任一项所述的方法，其特征在于，
    在所述中继节点接收来自所述宿主节点的第二消息之后，所述方法还包括：
    所述中继节点向所述宿主节点发送第三消息，所述第三消息中携带以下至少一种信息：
    所述中继节点的电子序列号ESN、所述中继节点的证书、所述中继节点对所述第三消息的签名。
  13. 根据权利要求9-12任一项所述的方法，其特征在于，
    所述第一消息为无线资源控制RRC连接建立请求消息；或者，
    所述第一消息为RRC连接建立完成消息。
  14. 一种通信装置，其特征在于，包括：处理器和存储器；所述存储器用于存储计算机指令，当所述处理器执行所述计算机指令时，使所述通信装置执行如权利要求1-8中任一项所述的方法。
  15. 一种通信装置，其特征在于，包括：处理器和存储器；所述存储器用于存储计算机指令，当所述处理器执行所述计算机指令时，使所述通信装置执行如权利要求9-13中任一项所述的方法。
  16. 一种通信装置，其特征在于，包括用于执行如权利要求1-8中任一项所述的方法的单元。
  17. 一种通信装置，其特征在于，包括用于执行如权利要求9-13中任一项所述的方法的单元。
  18. 一种通信***，其特征在于，包括宿主节点和中继节点，所述中继节点与所 述宿主节点连接，所述宿主节点用于执行如权利要求1-8中任一项所述的方法，所述中继节点用于执行如权利要求9-13中任一项所述的方法。
  19. 一种计算机可读存储介质，其特征在于，包括指令，当所述指令在计算机上运行时，使得所述计算机执行如权利要求1-8中任一项所述的方法，或者，使得所述计算机执行如权利要求9-13中任一项所述的方法。
  20. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得所述计算机执行如权利要求1-8中任一项所述的方法，或者，使得所述计算机执行如权利要求9-13中任一项所述的方法。
PCT/CN2019/130983 2019-12-31 2019-12-31 认证方法、装置及*** WO2021134724A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2019/130983 WO2021134724A1 (zh) 2019-12-31 2019-12-31 认证方法、装置及***
CN201980103050.3A CN114830705A (zh) 2019-12-31 2019-12-31 认证方法、装置及***

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/130983 WO2021134724A1 (zh) 2019-12-31 2019-12-31 认证方法、装置及***

Publications (1)

Publication Number Publication Date
WO2021134724A1 true WO2021134724A1 (zh) 2021-07-08

Family

ID=76686347

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/130983 WO2021134724A1 (zh) 2019-12-31 2019-12-31 认证方法、装置及***

Country Status (2)

Country Link
CN (1) CN114830705A (zh)
WO (1) WO2021134724A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101754211A (zh) * 2008-12-15 2010-06-23 华为技术有限公司 认证协商方法及***、安全网关、家庭无线接入点
CN107079007A (zh) * 2014-09-23 2017-08-18 高通股份有限公司 基于证书的认证
US20190159277A1 (en) * 2018-01-23 2019-05-23 Intel Corporation Enhancing f1 application protocol (f1-ap) interfaces in a multi-hop relay network with centralized unit (cu) and distributed unit (du)

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101640886B (zh) * 2008-07-29 2012-04-25 上海华为技术有限公司 鉴权方法、重认证方法和通信装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101754211A (zh) * 2008-12-15 2010-06-23 华为技术有限公司 认证协商方法及***、安全网关、家庭无线接入点
CN107079007A (zh) * 2014-09-23 2017-08-18 高通股份有限公司 基于证书的认证
US20190159277A1 (en) * 2018-01-23 2019-05-23 Intel Corporation Enhancing f1 application protocol (f1-ap) interfaces in a multi-hop relay network with centralized unit (cu) and distributed unit (du)

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
SAMSUNG, QUALCOMM INCORPORATED, ERICSSON, NOKIA, NOKIA SHANGHAI BELL: "Updates to Solution #2.1 on MT functionality", 3GPP DRAFT; S3-194364, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. Reno,US,; 20191118 - 20191122, 11 November 2019 (2019-11-11), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP051824675 *

Also Published As

Publication number Publication date
CN114830705A (zh) 2022-07-29

Similar Documents

Publication Publication Date Title
US11272365B2 (en) Network authentication method, and related device and system
US11546755B2 (en) Centralized configurator server for DPP provisioning of enrollees in a network
TWI303531B (en) Method and system to support fast hand-over of mobile subscriber stations in broadband wireless networks
US8392712B1 (en) System and method for provisioning a unique device credential
US9204301B2 (en) Deploying wireless docking as a service
EP3713372A1 (en) Method and device for creating user group
WO2022057736A1 (zh) 授权方法及装置
CN112105021B (zh) 一种认证方法、装置及***
JP6800994B2 (ja) 通信ネットワークを介してデータを中継するシステム及び方法
CN111818516B (zh) 认证方法、装置及设备
CN111182546B (zh) 接入无线网络的方法、设备及***
WO2021227866A1 (zh) 网络认证方法及装置、***
JP7255949B2 (ja) 通信方法および装置
CN114071452B (zh) 用户签约数据的获取方法及装置
US10390217B2 (en) Wireless configuration of wireless distribution system (WDS) Wi-Fi range extenders using non-Wi-Fi-wireless communication channels
WO2021031055A1 (zh) 通信方法及装置
CN113965334A (zh) 在线签约方法、装置及***
US11979401B2 (en) Automatic security device network
WO2022067831A1 (zh) 一种建立安全通信方法及装置
WO2020220862A1 (zh) 一种通信方法及装置
WO2021134724A1 (zh) 认证方法、装置及***
US20220201473A1 (en) Device provisioning
WO2021195816A1 (zh) 一种通信方法、装置及***
CN105340353A (zh) 设备到设备通信安全
US20240073690A1 (en) Transmission of network access information for wireless device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19958331

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19958331

Country of ref document: EP

Kind code of ref document: A1