WO2022067831A1 - 一种建立安全通信方法及装置 - Google Patents

一种建立安全通信方法及装置 Download PDF

Info

Publication number
WO2022067831A1
WO2022067831A1 PCT/CN2020/119764 CN2020119764W WO2022067831A1 WO 2022067831 A1 WO2022067831 A1 WO 2022067831A1 CN 2020119764 W CN2020119764 W CN 2020119764W WO 2022067831 A1 WO2022067831 A1 WO 2022067831A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication mechanism
network element
terminal device
message
authentication
Prior art date
Application number
PCT/CN2020/119764
Other languages
English (en)
French (fr)
Inventor
吴义壮
李�赫
雷骜
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to AU2020470364A priority Critical patent/AU2020470364B2/en
Priority to PCT/CN2020/119764 priority patent/WO2022067831A1/zh
Priority to CN202080105604.6A priority patent/CN116325843A/zh
Priority to EP20955851.9A priority patent/EP4207676A4/en
Publication of WO2022067831A1 publication Critical patent/WO2022067831A1/zh
Priority to US18/191,942 priority patent/US20230232228A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/50—Service provisioning or reconfiguring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method and apparatus for establishing secure communication.
  • Multi-access edge computing can use the wireless access network to provide telecom users with information technology (IT) services and cloud technology functions nearby, thereby creating a high-performance,
  • IT information technology
  • cloud technology functions nearby, thereby creating a high-performance.
  • the low-latency and high-bandwidth carrier-class service environment accelerates the rapid download of various contents, services and applications in the network, allowing users to enjoy uninterrupted high-quality network experience.
  • One or more edge enabler servers (EES) and one or more edge application servers (EAS) are dynamically deployed on an edge data network (EDN).
  • EAS edge application servers
  • a user equipment (UE) includes an application client (AC) and an edge enabler client (EEC).
  • the MEC architecture Independent of user equipment and EDN, the MEC architecture also includes one or more edge configuration servers (ECS).
  • ECS edge configuration servers
  • common authentication mechanisms include authentication and key management for applications (AKMA) mechanisms, generic bootstrapping architecture (GBA) mechanisms, and certificate-based authentication mechanisms.
  • AKMA authentication and key management for applications
  • GAA generic bootstrapping architecture
  • certificate-based authentication mechanisms include certificate-based authentication mechanisms.
  • the UE cannot know the authentication mechanisms supported by these dynamically deployed EES, EAS and ECS. Further, the UE cannot accurately use the corresponding authentication mechanism to initiate a connection establishment request with the EES, EAS or ECS.
  • the present application provides a method and apparatus for establishing a secure communication, which is used to solve the problem that the authentication mechanism supported by the server cannot be known in advance in order to establish a secure communication connection under the MEC architecture.
  • a first aspect provides a method for establishing secure communication, the method comprising: a terminal device receiving a first message from a first network element, the first message including an identifier of the second network element and first indication information, the The first indication information is used to indicate a candidate authentication mechanism associated with the second network element; the terminal device establishes a communication connection with the second network element based on the candidate authentication mechanism.
  • the terminal device can obtain the candidate authentication mechanism of the dynamically deployed second network element; and establish a communication connection with the second network element based on the candidate authentication mechanism.
  • the second network element may be an ECS, EES, or EAS, etc., which can meet the requirements of the MEC architecture.
  • the method further includes: the terminal device sends a second message to the first network element, where the first message is a response message to the second message.
  • the terminal device can first send the second message to the first network element, and then the first network element sends a response message of the second message, that is, the first message, to the terminal device. That is, when the terminal device needs to acquire the candidate authentication mechanism corresponding to the second network element, it can directly request the first network element, so that the terminal device can acquire the candidate authentication mechanism of the dynamically deployed second network element.
  • the candidate authentication mechanism is at least one first authentication mechanism used when establishing a communication connection between the terminal device and the second network element; the second message includes at least one authentication mechanism supported by the terminal device The second authentication mechanism.
  • the second network element when the second network element receives the second message, it can directly obtain at least one authentication mechanism supported by the terminal device in the second message; the second network element can obtain at least one authentication mechanism supported by the terminal device according to the at least one authentication mechanism and For at least one authentication mechanism supported by the second network element, a candidate authentication mechanism is determined, so as to ensure that the candidate authentication mechanism is supported by both the terminal device and the second network element.
  • the terminal device when the terminal device receives the candidate authentication mechanism, it can directly use the candidate authentication mechanism to establish a communication connection, and the terminal device does not need to perform further processing, which reduces the processing complexity of the terminal device and saves power.
  • the above-mentioned second message includes the network type used by the terminal device to access the second network element.
  • the network type used by the terminal device to access the second network element may also be considered, so as to ensure that the selected candidate authentication mechanism is also supported by the network.
  • This design is mainly to consider that some authentication mechanisms need network support. For example, for the AKMA authentication mechanism, the support of the 5G network is required; for the GBA authentication mechanism, the support of the 4G network is required.
  • the above-mentioned second message further includes priority information in at least one second authentication mechanism.
  • the second network element may also consider the priorities of the authentication mechanisms supported by the terminal device and the second network element, and preferentially select a high-priority authentication mechanism supported by both to establish a communication connection.
  • establishing a communication connection between the terminal device and the second network element based on the candidate authentication mechanism includes: the terminal device determining a target authentication mechanism from the at least one first authentication mechanism; The terminal device generates a first key and a first key identifier corresponding to the target authentication mechanism; the terminal device sends a communication connection establishment request to the second network element, where the communication connection establishment request includes the The first key identifier.
  • the first key identifier may be used to identify the terminal device.
  • the first key and the first key identifier corresponding to the target authentication mechanism may have been generated and stored in the terminal device in advance.
  • the target authentication mechanism is obtained between the terminal devices.
  • the first key identifier corresponding to the mechanism is sufficient. That is, establishing a communication connection between the terminal device and the second network element based on the candidate authentication mechanism includes: the terminal device determines a target authentication mechanism from the at least one first authentication mechanism; the terminal device determines a target authentication mechanism from the at least one first authentication mechanism; Obtain a first key identifier corresponding to the target authentication mechanism; the terminal device sends a communication connection establishment request to the second network element, where the communication connection establishment request includes the first key identifier.
  • the terminal device can obtain the authentication mechanism of the dynamically deployed second network element based on the candidate authentication mechanism, the terminal device can directly carry the key identifier corresponding to the candidate authentication mechanism in the above communication connection establishment request, and directly Establish a communication connection.
  • the terminal device cannot obtain the authentication mechanism of the dynamically deployed second network element, and needs to first send a communication connection establishment request to the second network element, and then the second network element indicates the authentication mechanism supported by the second network element; The second network element sends a communication connection establishment request, and the request carries the key identifier of the authentication mechanism supported by the second network element, which can reduce signaling overhead and connection delay.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the second network element.
  • the second network element directly sends the authentication mechanism supported by the second network element to the terminal device, and the terminal device selects the target authentication based on the authentication mechanism supported by the second network element and the authentication mechanism supported by the terminal device. mechanism to establish a communication connection.
  • the second network element side does not need to make further judgment, and the workload of the second network element is reduced.
  • establishing a communication connection between the terminal device and the second network element based on the candidate authentication mechanism includes: the terminal device determining a target authentication based on the at least one third authentication mechanism and auxiliary information mechanism, the auxiliary information includes at least one of the following: at least one second authentication mechanism supported by the terminal device, and a network type used by the terminal device to access the second network element; the terminal device generating a first key and a first key identifier corresponding to the target authentication mechanism; the terminal device sends a communication connection establishment request to the second network element, where the communication connection establishment request includes the first key logo.
  • the terminal device can directly carry the key corresponding to the target authentication mechanism in the communication connection establishment request, and can successfully establish the communication connection between the two by sending the communication connection establishment request once. Compared with the scheme that needs to send the communication connection establishment request multiple times, signaling overhead and connection delay can be reduced.
  • the terminal device may also consider priority information, such as priority information of the at least one second authentication mechanism and priority information of the at least one third authentication mechanism, etc., to determine candidate authentication mechanisms. In this way, it can be ensured that the authentication mechanism with a higher priority is preferentially selected to establish a communication connection.
  • the above-mentioned first message may further include: priority information in at least one authentication mechanism supported by the second network element, and the like.
  • the above target authentication mechanism is an authentication mechanism corresponding to the network type.
  • the target authentication mechanism may be the AKMA mechanism.
  • the target authentication mechanism may be a GBA mechanism or the like.
  • it may further include: the terminal device generates a second key according to the first key and the identifier of the second network element; the terminal device uses the first key The second key performs security protection on the communication connection establishment request to generate a first message authentication code MAC; wherein the communication connection establishment request further includes the first MAC.
  • the second network element after receiving the communication connection establishment request, can obtain the first key identifier in the communication connection establishment request, and obtain the second key according to the first key identifier; Second MAC; if the first MAC and the second MAC are the same, the verification is passed, and a communication connection can be established between the two. Subsequently, the second key may also be used for other security protection between the terminal device and the second network element, which is not limited, so as to ensure the establishment of a secure communication connection between the two.
  • the method further includes: receiving, by the terminal device, a communication connection establishment response sent by the second network element.
  • the communication connection establishment response is secured using the second key.
  • the communication connection establishment response includes the third MAC.
  • the third MAC is calculated by the second network element based on the second key to some or all of the information in the connection establishment response.
  • the terminal device also verifies the third MAC based on the second key to determine that the communication connection establishment response has not been tampered with, and indirectly verifies that the second network element is a legitimate network element. Yuan.
  • the first network element is an edge configuration server ECS
  • the second network element is an edge enabling server EES
  • the terminal device can obtain the candidate authentication mechanism corresponding to the EES through the ECS
  • the first network element is EES
  • the second network element is the edge application server EAS
  • the terminal device can obtain the candidate authentication mechanism corresponding to the EAS through the EES
  • the first network element is the access and mobility management function AMF or the session management function SMF
  • the second network element is the ECS
  • the terminal device can obtain the candidate authentication mechanism corresponding to the ECS through the AMF or the SMF.
  • the above-mentioned first message may be a non-access stratum NAS message.
  • the first message is a response message for the terminal device to request registration, or a response message for the terminal device to request to establish a protocol data unit PDU session, etc., which is not limited.
  • the terminal device can obtain the candidate authentication mechanism of the dynamically deployed EES, EAS or ECS, so as to meet the requirements of the MEC architecture.
  • the candidate authentication mechanism includes at least one of the following: application authentication and password management AKMA service, general bootstrapping architecture GBA service, certificate mechanism or other mechanisms for authentication between the terminal device and the second network element, and the like.
  • the terminal device can obtain the candidate authentication mechanism corresponding to the dynamically deployed second network element, which is flexible in implementation and has a wide application range.
  • a method for establishing a secure communication including: a first network element determines a candidate authentication mechanism; the first network element sends a first message to a terminal device, where the first message includes an identifier of the second network element and first indication information, where the first indication information is used to indicate the candidate authentication mechanism associated with the second network element, and the candidate authentication mechanism is used for establishing a communication connection between the terminal device and the second network element.
  • the first network element can indicate the candidate authentication mechanism corresponding to the second network element to the terminal device.
  • the above-mentioned second network element may be dynamically deployed, such as ECS, EES or EAS in the MEC architecture, so that the terminal device can dynamically obtain the candidate authentication mechanism of the second network element to meet the requirements of the MEC architecture.
  • the above method further includes: receiving, by the first network element, a second message from the terminal device, where the first message is a response message to the second message.
  • the terminal device can first send the second message to the first network element, and then the first network element sends a response message of the second message, that is, the first message, to the terminal device. That is, when the terminal device needs to acquire the candidate authentication mechanism corresponding to the second network element, it can directly request the first network element, so that the terminal device can acquire the candidate authentication mechanism of the dynamically deployed second network element.
  • the candidate authentication mechanism is at least one first authentication mechanism used when establishing a communication connection between the terminal device and the second network element
  • the first network element determines the candidate authentication mechanism mechanism, including: the first network element determines a candidate authentication mechanism according to at least one third authentication mechanism supported by the second network element and auxiliary information, where the auxiliary information includes at least one of the following: at least one second authentication mechanism, and a network type used by the terminal device to access the second network element.
  • the first network element can directly indicate to the terminal equipment the authentication mechanism used when establishing the communication connection between the terminal equipment and the second network element, and the terminal equipment does not need to make further judgments, thereby reducing the processing complexity on the terminal equipment side. Save power.
  • the second network element may also consider the network type used by the terminal device to access the second network element, so that the selected candidate authentication mechanism can be supported by the access network.
  • the above-mentioned second message includes at least one second authentication mechanism supported by the terminal device.
  • the second network element may also consider priority information, for example, the priority information of the second authentication mechanism supported by the terminal device and the priority information of the third authentication mechanism supported by the second network element. priority information, etc., so that the selected candidate authentication mechanism has a higher priority.
  • the above-mentioned second message may further include priority information of at least one second authentication mechanism supported by the terminal device.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the second network element.
  • the first network element directly indicates the authentication mechanism supported by the second network element to the terminal device without additional processing, and the terminal device does not need to notify the first network element of the authentication mechanism supported by itself, reducing the reduction of the first network element. side processing, saving signaling overhead.
  • the terminal device determines the final target authentication mechanism between the two according to the authentication mechanism supported by the second network element.
  • the terminal device may also consider the priority information of the two authentication mechanisms. Therefore, the first network element needs to notify the terminal device of the priority information of the authentication mechanism supported by itself.
  • the above-mentioned first message also includes priority information of at least one third authentication mechanism supported by the terminal device.
  • the first network element is the edge configuration server ECS
  • the second network element is the edge enabling server EES
  • the terminal device can obtain the candidate authentication mechanism corresponding to the EES through the ECS
  • the first network element is the EES
  • the second network element is the edge application server EAS
  • the terminal device can obtain the candidate authentication mechanism corresponding to the EAS through the EES
  • the first network element is the access and mobility management function AMF or session management Function SMF
  • the second network element is the edge configuration server ECS
  • the terminal device can obtain the candidate authentication mechanism corresponding to the ECS through the AMF or the SMF.
  • the above-mentioned first message may be a non-access stratum NAS message.
  • the first message is a response message for the terminal device to request registration, or a response message for the terminal device to request to establish a protocol data unit PDU session, etc., which is not limited.
  • the terminal device can obtain the candidate authentication mechanism of the dynamically deployed EES, EAS or ECS, so as to meet the requirements of the MEC architecture.
  • the candidate authentication mechanism includes at least one of the following: application authentication and password management AKMA service, general bootstrapping architecture GBA service, certificate mechanism or other mechanisms for authentication between the terminal device and the second network element, and the like.
  • the terminal device can obtain the candidate authentication mechanism corresponding to the dynamically deployed second network element, which is flexible in implementation and has a wide application range.
  • an embodiment of the present application further provides an apparatus, and the communication apparatus is applied to a terminal device.
  • the device has the function of implementing the behavior in the method embodiment of the first aspect. This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions.
  • the structure of the apparatus includes a communication unit and a processing unit, and these units can perform the corresponding functions in the method example of the first aspect. For details, refer to the detailed description in the method embodiment, which will not be repeated here.
  • an embodiment of the present application further provides an apparatus, the communication apparatus is applied to the first network element, and the beneficial effects can be found in the description of the second aspect, and will not be repeated here.
  • the apparatus has the function of implementing the behavior in the method example of the second aspect above. This function can be implemented by hardware or by executing corresponding software by hardware.
  • the hardware or software includes one or more units corresponding to the above-mentioned functions.
  • the structure of the apparatus includes a communication unit and a processing unit, and these units can perform the corresponding functions in the method example of the second aspect. For details, please refer to the detailed description in the method example, which will not be repeated here.
  • an embodiment of the present application further provides an apparatus, where the communication apparatus is applied to a terminal device, and the beneficial effects can be referred to the description of the first aspect and will not be repeated here.
  • the structure of the communication apparatus includes a processor and a memory, and the processor is configured to support the terminal device to perform the corresponding functions in the method of the first aspect.
  • the memory is coupled to the processor and holds program instructions and data necessary for the communication device.
  • the structure of the communication device also includes a communication interface for communicating with other devices.
  • an embodiment of the present application further provides an apparatus, where the communication apparatus is applied to the first network element, and the beneficial effects can be referred to the description of the second aspect and will not be repeated here.
  • the structure of the communication device includes a processor and a memory, and the processor is configured to support the first network element to perform the corresponding functions in the method of the second aspect.
  • the memory is coupled to the processor and holds program instructions and data necessary for the communication device.
  • the structure of the communication device also includes a communication interface for communicating with other devices.
  • the present application further provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer is made to execute the method of the first aspect, or to execute the second aspect. Methods.
  • the present application further provides a computer program product comprising instructions, which, when run on a computer, cause the computer to perform the method of the first aspect or the method of the second aspect.
  • the present application further provides a computer chip, the chip is connected to a memory, and the chip is used to read and execute a software program stored in the memory, execute the method of the first aspect, or execute the method of the second aspect.
  • FIG. 1 is a schematic diagram of an MEC architecture provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a communication process in an MEC architecture provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a 3GPP network provided by an embodiment of the present application.
  • FIG. 5 is a flowchart of the ECS obtaining at least one authentication mechanism supported by the EES according to the embodiment of the present application;
  • FIG. 6 is a flowchart of a communication method provided by an embodiment of the present application.
  • FIG. 7 is a flowchart of the EES obtaining at least one authentication mechanism information supported by the EAS provided by the embodiment of the present application;
  • FIG. 8 is another flowchart of the communication method provided by the embodiment of the present application.
  • FIG. 9 is another flowchart of the communication method provided by the embodiment of the present application.
  • FIG. 10 is a flowchart of the AKMA authentication provided by the embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of an apparatus provided by an embodiment of the present application.
  • FIG. 12 is another schematic structural diagram of an apparatus provided by an embodiment of the present application.
  • At least one item(s) below” or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s).
  • at least one (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple .
  • words such as “first” and “second” are used to distinguish the same or similar items with basically the same function and effect. Those skilled in the art can understand that the words “first”, “second” and the like do not limit the quantity and execution order, and the words “first”, “second” and the like are not necessarily different.
  • the network architecture and service scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute limitations on the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • the embodiment of the present application provides a multi-access edge computing (multi-access edge computing, MEC) enabled edge application architecture, as shown in FIG. 1 , at least including the following functional network elements:
  • An edge application server is an application server deployed in the EDN. Among them, the application provider can dynamically instantiate EAS in different EDN networks as needed.
  • the application client is the peer entity of the EAS on the terminal device side.
  • the AC is used by an application user (user) to obtain application services from an application server.
  • the AC is a client program applied in the terminal device.
  • the AC can connect to the application server on the cloud to obtain application services, or connect to the EAS deployed and run in one or more EDNs to obtain application services.
  • the AC can be a Tencent client installed on a terminal device, an iQiyi client, a vehicle to everything (V2X) client, or a mission critical (MC) client, etc.
  • the edge enabler server can provide enabling capabilities for the EAS deployed in the EDN.
  • the EES can provide management capabilities for the EAS, and can support the registration of the edge application server EAS, so as to obtain the identification of the EAS and the authentication mechanism supported by the EAS, and optionally, also obtain the priority of the authentication mechanism supported by the EAS.
  • the EES can also provide the terminal equipment with information related to the identification and authentication of the available EAS. The authentication-related information is used for the authentication process between the terminal device and the EAS. Further, the EES can also support sending the identifier of the EAS to the ECS. EES is deployed in EDN.
  • an EAS is registered with an EES, or the information of an EAS is configured on an EES through a management system, the EES is called the EES associated with the EAS, and the EES can control, manage, register or configure the EES associated with the EES.
  • the edge enabler client is the peer entity of the EES on the terminal device side.
  • EEC is used to register EEC information and AC information with EES, perform security authentication and authentication, obtain EAS identification from EES, provide edge computing enabling capabilities to AC, such as EAS discovery service, return EAS identification to AC, etc. .
  • the edge configuration server (ECS) is responsible for EDN configuration management, such as providing EES information to terminal devices.
  • the application user may sign a service agreement with the application provider, so as to obtain the service provided by the application provider's server.
  • the application user can log in to the AC on the terminal device and communicate with the EAS through the AC connection to use the service provided by the application provider's server.
  • the enabling client eg, EEC
  • EEC can be a middleware layer, generally located in the operating system, or located between the AC and the operating system, and can also be implemented inside the AC.
  • the AC can obtain the edge-enabled service from the enabling client through an application programming interface (application program interface, API).
  • the edge service provider dynamically deploys the EDN network as required, deploys the EES in the EDN network, and dynamically instantiates the specific EAS according to the needs of the application provider.
  • EAS sends the registration process to EES in order to provide EAS information to EES.
  • EAS identity For example, EAS identity, port information (such as fully qualified domain name (FQDN), IP address or uniform resource identifier (URI), etc.), and application client identifier (application client identifier, AC ID) )Wait.
  • the EAS information enables the EES to provide available EAS to the EEC according to the EEC's request.
  • the EES in the EDN network initiates a registration process to the ECS, so as to provide the ECS with EES information, the EES information enables the ECS to provide available EES to the EEC according to the request of the EEC. Further, the EES may also provide the ECS with the information of the EAS registered on the EES during the registration process.
  • the EEC may first request the ECS to provide the edge service, so as to obtain the available EES information through the ECS.
  • the ECS may send the information of the available EES to the EEC according to the request of the EEC.
  • the EEC determines the EES for communication according to the EES information obtained from the ECS, and establishes a connection with the determined EES.
  • the EEC obtains specific EAS information for providing edge application services from the connected EES.
  • the EEC sends the EAS information corresponding to the AC to the AC according to the obtained EAS information.
  • the AC establishes a connection with the EAS to obtain services according to the EAS information obtained from the EEC.
  • An embodiment of the present application further provides a network architecture, as shown in FIG. 3 , including at least one of the following: a terminal device, an access network, a core network, and a data network (DN).
  • a network architecture including at least one of the following: a terminal device, an access network, a core network, and a data network (DN).
  • Different access network devices can be connected through the Xn interface, and the access network device and the core network device can be connected through the NG interface.
  • Terminal equipment which can be referred to as terminal for short, is a device with wireless transceiver functions. Terminal equipment can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on water (such as ships, etc.); In the air (eg on airplanes, balloons and satellites, etc.).
  • the terminal device may be a mobile phone, a tablet computer, a computer with a wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, and a wireless terminal in industrial control (industrial control).
  • the terminal device may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a wireless communication functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in future fifth generation (5G) networks or future evolved public land mobile communication networks ( Terminal equipment in public land mobile network, PLMN), etc.
  • Terminal equipment may also sometimes be referred to as user equipment (UE), access terminal equipment, in-vehicle terminal equipment, industrial control terminal equipment, UE unit, UE station, mobile station, mobile station, remote station, remote terminal equipment, mobile equipment, wireless communication equipment, UE proxy or UE device, etc.
  • Terminal devices can also be stationary or mobile. This embodiment of the present application does not limit this.
  • the access network is used to implement functions related to wireless access.
  • the access network can provide network access functions for terminal equipment in a specific area, including radio access network (RAN) equipment and access network (AN) equipment.
  • RAN devices are mainly wireless network devices defined in 3GPP networks
  • AN devices are mainly access network devices not defined by 3GPP.
  • RAN equipment can provide functions such as radio resource management, quality of service management, data encryption and compression for terminal equipment.
  • the core network is mainly used to manage the terminal equipment and provide the function of communicating with the external network.
  • Core network equipment may include one or more of the following network elements:
  • Access and mobility management function (access and mobility management function, AMF) network element: mainly responsible for the mobility management in the mobile network, such as user location update, user registration network, user switching and so on.
  • Session management function (SMF) network element It is mainly used for session management, IP address allocation and management of terminal equipment, selection of user plane functions, termination point of policy control or charging function interface, and downlink data notification, etc.
  • SMF Session management function
  • UPF network element mainly responsible for forwarding and receiving user data.
  • the UPF network element can receive user data from the data network (DN) and transmit it to the terminal equipment through the access network equipment; in the uplink transmission, the UPF network element can receive the user data from the terminal equipment through the access network equipment User data, forward the user data to the DN.
  • the transmission resources and scheduling functions in the UPF network element that provide services for the terminal equipment may be managed and controlled by the SMF network element.
  • Authentication service function authentication server function, AUSF
  • AUSF authentication server function
  • Network exposure function (NEF) network element It is mainly used to support the opening of capabilities and events, such as securely opening services and capabilities provided by 3GPP network functions to the outside world.
  • Network storage function network function, NF, repository function, NRF
  • network element used to store the description information of network function entities and the services they provide, support service discovery, and network element entity discovery, etc.
  • PCF Policy control function
  • Unified data management (UDM) network element used to generate authentication credentials, user identification processing (such as storing and managing user permanent identities, etc.), access authorization control and contract data management, etc.
  • NSSAAF Network slice specific authentication and authorization function
  • the above-mentioned core network may also include network elements such as NSSF, AF, and SCP, which will not be introduced one by one. It should be noted that, in different communication systems, the network elements in the above-mentioned core network may have different names.
  • the fifth-generation mobile communication system is used as an example for description, which is not intended to limit the present application.
  • a DN may be a network that provides data transmission services to users.
  • the DN may be an IP multimedia service (IP multi-media service) network or an Internet network, or the like.
  • Multiple application servers can be included in the DN.
  • the terminal device may establish a protocol data unit (protocol data unit, PDU) session from the terminal device to the DN to access the DN.
  • PDU protocol data unit
  • a data network may have one or more local data networks (local data network, Local DN), and these local data networks are data network access points (access points) close to the user's point of attachment (point of attachment).
  • the EES and EAS in the architecture shown in FIG. 1 may be configured in one or more EDNs.
  • the remote DN or central DN corresponds to the EDN
  • the application server deployed in the EDN is called EAS
  • the server deployed in the remote DN or central DN is the remote server or central server.
  • Each EAS can provide application services for users nearby, and the central server or remote server can provide application services for all users.
  • the EDN network can be dynamically deployed according to demand, for example, when a large-scale event is held in Shanghai area A with a large flow of people, an EDN network can be deployed in this place for access by nearby personnel. After the subsequent large-scale event is over, the EDN network deployed in Region A can also be withdrawn.
  • the EES and EAS in each EDN network can also be dynamically deployed. For example, a new game is launched, and a large number of young people of the game are gathered in region B, and the game can be instantiated and provided in the EDN network of region B. EAS of service. It can be seen that in the MEC architecture, EES, EAS, and even ECS are dynamically deployed, and terminal devices cannot learn the authentication mechanisms supported by dynamically deployed EES, EAS, and ECS through pre-configuration.
  • the terminal device since the terminal device does not know the authentication mechanism supported by the server (such as EES, EAS or ECS), the terminal device directly sends a communication connection establishment request to the server, and the communication connection establishment request may not carry any Certification Information. Since the communication connection establishment request does not carry any authentication information, the server will instruct the terminal device to send the communication connection establishment request by using an authentication mechanism supported by itself. For example, the server will send a communication establishment connection response to the terminal device, and the communication establishment connection response may instruct the terminal device to use the authentication mechanism supported by the server to initiate a communication connection establishment request, etc. The terminal device receives the communication connection establishment response, and initiates the communication connection establishment request again according to the indication of the communication establishment connection response. The difference is that the communication connection establishment request carries the authentication information corresponding to the authentication mechanism supported by the server. When the server receives the re-initiated communication connection establishment request, it establishes the communication connection between the two.
  • the server receives the re-initiated communication connection establishment request, it establishes the communication connection
  • an embodiment of the present application provides a method for establishing a secure communication, by which a terminal device can learn at least one authentication mechanism supported by a dynamically deployed EES, EAS, or ECS, and is applicable to the MEC architecture, so that the client and the server can communicate with each other.
  • the method includes: the terminal device receives a first message from a first network element, the first message includes an identifier of the second network element and first indication information, and the first indication information is used to indicate The candidate authentication mechanism associated with the second network element; optionally, the identifier of the second network element and the first indication information may be transmitted to the terminal device through the same message, for example, the first message may also be transmitted through different messages
  • the terminal equipment there is no limitation.
  • the identifier of the above-mentioned second network element may be a uniform resource identifier (uniform resource identifier, URI) of the second network element, a fully qualified domain name (fully qualified domain name, FQDN), or an internet protocol (Internet Protocol, IP) address, etc.
  • the terminal device establishes a communication connection with the second network element according to the candidate authentication mechanism.
  • the second network element may be EES, EAS or ECS, etc.
  • the candidate authentication mechanism may be an authentication mechanism supported by the second network element, or an authentication mechanism used for establishing a communication connection between the second network element and the terminal device etc., without limitation.
  • the process of establishing a communication connection between the terminal device and the second network element based on the candidate authentication mechanism may be: based on the candidate authentication mechanism, the terminal device sends a communication connection establishment request to the second network element, and the communication connection establishment request is in the It carries the authentication information corresponding to the above-mentioned candidate authentication mechanism (for example, the key identifier of Kakma in the following).
  • the second network element After the second network element receives the communication connection establishment request, it verifies the terminal device according to the authentication information. After the verification is passed, the key used for the secure communication between the terminal device and the second network element can be obtained, so that the terminal device can communicate with the second network element.
  • a secure communication connection is established between network elements.
  • the above authentication information may be a key identifier
  • the second network element may send the key identifier to the 3GPP network element when receiving the communication connection establishment request.
  • mutual authentication is performed between the 3GPP network element and the second network element, and the authentication is passed.
  • the 3GPP network element obtains the key of the second network element according to the key identifier, and sends the key to the second network element.
  • the second network element obtains the same key shared with the UE. Further, further authentication can be performed between the second network element and the UE based on the shared key and a communication connection can be established.
  • the method in this embodiment of the present application may further include: the terminal device sends a second message to the first network element, where the first message is a response message to the second message.
  • the first network element in this embodiment of the present application may be a network element that can provide identifiers of other network elements and candidate authentication mechanisms corresponding to the other network elements.
  • the second network element is also not limited to ECS, ESS, EAS, etc.
  • the second network element may be a network element that enables the first network element to obtain its identity and corresponding candidate authentication mechanisms.
  • the authentication mechanism involved in the implementation of this application may include at least one of the following: authentication and key management for applications (AKMA) service, generic bootstrapping architecture (GBA) service, certificate mechanism, EES Credentials or other mechanisms for authentication between the terminal device and the second network element.
  • AKMA authentication and key management for applications
  • GBA generic bootstrapping architecture
  • certificate mechanism certificate mechanism
  • EES Credentials or other mechanisms for authentication between the terminal device and the second network element.
  • the terminal device is UE, the UE includes AC and EEC, the first network element is ECS, the second network element is EES, the second message is provisioning request message, and the first message is provisioning response (provisioning response) message as an example to illustrate.
  • a flow of a communication method including:
  • step 400 the ECS acquires at least one authentication mechanism supported by the EES.
  • the ECS may also acquire priority information of one or more authentication mechanisms in at least one authentication mechanism supported by the EES.
  • the ECS may acquire at least one authentication mechanism supported by the EES and its corresponding priority information in a pre-configured manner.
  • the ECS can obtain at least one authentication mechanism supported by the EES and its corresponding priority information by interacting with the EES.
  • An authentication mechanism and its corresponding priority information are sent to ECS etc. This embodiment of the present application does not limit the specific manner in which the ECS obtains the information of the EES.
  • Step 401 The EEC sends a provision request message to the ECS, where the provision request message includes the UE identifier and the application client configuration text information.
  • the EEC may send a provision request message to the ECS according to the preconfigured ECS address or the discovered ECS address or the ECS address from the AC.
  • the UE identifier is used to uniquely identify the UE in the public land mobile network (PLMN) network, and may be, for example, a generic public subscription identifier (GPSI), and the embodiment of the present application does not limit the UE The specific implementation form of the identification.
  • the application client configuration text information includes information for determining services and service characteristics required by the application client AC in the UE, and the like.
  • the application client configuration text can include AC ID, application client type, whether business continuity must be supported, etc.
  • the AC ID is used to identify a specific application on the terminal device, and the application client type can be a V2X type, etc.
  • Step 402 The ECS receives the offer request message.
  • the ECS checks whether the EEC is authorized to obtain the information of the edge server.
  • the ECS stores the information of the legal EEC authorized by the ECS, and only the legal EEC authorized by the ECS can obtain the information of the edge server.
  • the ECS can specifically determine whether the EEC that sends the provision request message is included in the list of legal EECs stored in the ECS, and if so, the authorization check for the EEC passes, otherwise the authorization check for the EEC fails. pass.
  • the authorization check for the EEC passes, otherwise the authorization check for the EEC fails. pass.
  • Specifically how to determine whether the EEC is authorized to obtain the information of the edge server is not limited in this embodiment.
  • Step 403 The ECS sends an offer response message to the EEC.
  • the above-mentioned provision response message may include the identifier of the EES and first indication information, where the first indication information is used to indicate a candidate authentication mechanism associated with the EES.
  • the authorization check of the above-mentioned EEC fails, the above-mentioned provision response message may carry second indication information, and the second indication information is used to indicate that the authorization check of the EEC fails, etc.
  • the ECS can determine the corresponding EDN configuration information according to the application client configuration text information carried in the above-mentioned provision request message; the provision response message sent by the ECS to the EEC It may carry the above EDN configuration information.
  • the EDN configuration information includes EES information, EDN connection information, and the like.
  • the EES information includes an EES identifier, and the EES identifier may be the EES's FQDN, URL, or IP address, etc., which is not limited.
  • the EDN connection information is used to establish a PDU session between the UE and the EDN.
  • the EDN connection information may include a data network name (DNN), an access point name (APN), and the like.
  • the above-mentioned EDN configuration information may further include single network slice selection assistance information (single network slice selection assistance information, S-NSSAI), EDN service area, and the like.
  • the EDN configuration information may further include first indication information for indicating candidate authentication mechanisms associated with the EES, and the like.
  • the indication information of the authentication mechanism carried in a certain message/information can also be described as carrying the authentication mechanism in a certain message/information, the two are not distinguished and can be replaced with each other. Unless otherwise specified, in the following description, it is uniformly expressed as carrying an authentication mechanism in a certain message/information.
  • Step 404 The EEC establishes a communication connection with the EES according to the candidate authentication mechanism.
  • the authentication mechanism used for communication between the UE and the EES determined by the ECS is called the first authentication mechanism; the authentication mechanism supported by the UE can be called the first authentication mechanism.
  • the second authentication mechanism; the authentication mechanism supported by the EES may be called the third authentication mechanism.
  • the authentication mechanism supported by the UE since the UE includes the AC or the EEC, in the following description of the embodiments of this application, the authentication mechanism supported by the UE may sometimes be described as the authentication mechanism supported by the EEC or the AC.
  • the establishment of a communication connection between the EEC or the AC and the second network element can also be described as establishing a communication connection between the UE and the second network element.
  • the second network element includes, but is not limited to, ECS, EES, or EAS.
  • the above candidate authentication mechanism is at least one third authentication mechanism supported by the EES.
  • the above-mentioned provision response message carries at least one third authentication mechanism supported by the EES.
  • the offer response message may further carry priority information of at least one third authentication mechanism supported by the EES.
  • the EEC determines a target authentication mechanism according to at least one third authentication mechanism supported by the EES and auxiliary information, where the auxiliary information includes at least one of the following: at least one second authentication mechanism supported by the UE, and the UE's access to the EES. network type, etc.
  • the above auxiliary information may further include: priority information of at least one second authentication mechanism supported by the UE, and priority information of at least one third authentication mechanism supported by the EES.
  • the EEC may determine the authentication mechanism supported by both the UE and the EES as the target authentication mechanism.
  • the at least one authentication mechanism supported by the EES includes A, B, and C
  • the at least one authentication mechanism supported by the UE includes C, D, and E
  • the target authentication mechanism includes C.
  • the target authentication mechanism may be an authentication mechanism corresponding to the network type.
  • the authentication mechanisms supported by EES include AKMA and GBA
  • the AKMA mechanism is an authentication mechanism based on a 5G network
  • the GBA mechanism is an authentication mechanism based on a 4G network.
  • the target authentication mechanism is AKMA; or, if the current access network of the UE is a 4G network, the UE determines that the target authentication mechanism is GBA.
  • the EEC may also consider priority information of different authentication mechanisms, and preferentially select an authentication mechanism with a higher priority.
  • the auxiliary information includes priority information of at least one third authentication mechanism supported by the EES
  • the UE may preferentially select an authentication mechanism with a higher priority as the target authentication mechanism.
  • the EEC generates a first key and a first key identifier corresponding to the target authentication mechanism.
  • the EEC may also request the bottom layer of the terminal device for information corresponding to the target authentication mechanism, and the bottom layer of the terminal device generates the first key and the identifier of the first key according to the information corresponding to the target authentication mechanism , the bottom layer of the terminal device sends the first key identifier and the like to the EEC; the EEC sends a communication connection establishment request to the EES, and the communication connection establishment request includes the first key identifier.
  • the bottom layer of the terminal device can also generate a second key according to the first key and the identifier of the EES, and send the second key to the EEC; the EEC uses the second key to secure the communication connection establishment request, such as A first message authentication code (message authentication code, MAC) is generated according to the second key and all or part of the information in the communication connection establishment request; wherein the communication connection establishment request includes the first MAC.
  • a first message authentication code messages authentication code, MAC
  • the EES When the EES receives the communication connection establishment request, it can obtain the first key identifier in the communication connection establishment request; the EES obtains the second key according to the first key identifier, for example, the EES can send the first key identifier to the
  • the 3GPP network element can obtain the first key corresponding to the first key identifier according to the corresponding relationship between the key identifier and the key, and according to the first key and the EES , generate a second key, and return the second key to the EES; EES generates a second MAC according to the second key; compares the generated second MAC with the first MAC carried in the above-mentioned communication connection establishment request.
  • the passing of the verification of the UE by the EES may indicate meaning: the EES may consider that the information received from the UE has not been tampered with by an attacker, and the UE is a legitimate UE verified by a 3GPP network element. Further, the UE and the EES can further negotiate the security context used for subsequent communication according to the second key, and the security context includes an encryption key and/or an integrity protection key, etc., a corresponding encryption algorithm, and an integrity protection algorithms, etc. In one example, the EES may send the first key identifier and the like to the 3GPP network element for supporting the target authentication mechanism through the NEF. Further, in the process of obtaining the second key by the EES, two-way authentication may be performed between the 3GPP network element and the EES, and only the EES that has passed the authentication legally can obtain the second key corresponding to the first key identifier.
  • the candidate authentication mechanism is at least one first authentication mechanism used when establishing a communication connection between the EEC and the EES.
  • the implementation process of the method may be as follows: the above-mentioned provision request message may carry at least one second authentication mechanism supported by the UE.
  • the provision request message may further carry at least one of the following items: priority information of at least one third authentication mechanism supported by the UE, network type used by the UE to access the EES, and the like.
  • the ECS determines candidate authentication mechanisms according to at least one third authentication mechanism supported by the ECS and auxiliary information, where the auxiliary information at least includes at least one third authentication mechanism supported by the UE and the network type used by the UE to access the EES.
  • the auxiliary information may further include at least one of the following: priority information of at least one second authentication mechanism supported by the UE, priority information of at least one third authentication mechanism supported by the EES, and the like.
  • the above-mentioned offer response message may carry the above-mentioned candidate authentication mechanism.
  • the EEC receives the offer response message from the ECS, and obtains the candidate authentication mechanism in the offer response message; it can be understood that, if only one third authentication mechanism is included in the above candidate authentication mechanism, the EEC can directly Establishing a communication connection with the EES, the third authentication mechanism can be considered as the target authentication mechanism; or, when the above candidate authentication mechanisms include multiple authentication mechanisms, the EEC can select an authentication mechanism among the above multiple authentication mechanisms, After establishing a communication connection, the selected authentication mechanism is the target authentication mechanism.
  • the process of establishing a communication connection between the EEC and the EES reference may be made to the above description, and details are not repeated here.
  • the EEC determines the target authentication machine according to the candidate authentication mechanism as an example for description, which is not intended to limit the present application.
  • Other modules in the UE may also perform the process of determining the target authentication mechanism according to the candidate authentication mechanisms.
  • priority information of at least one authentication mechanism supported by UE and priority information of at least one authentication mechanism supported by EES are mainly involved.
  • the priority information can be displayed in the form of indication, for example, the multiple authentication mechanisms supported by the EES are respectively authentication mechanism A, authentication mechanism B and authentication mechanism C.
  • the priority information of the multiple authentication mechanisms supported by the EES may be the priority information 0 of the authentication mechanism A, the priority information 1 of the authentication mechanism B, and the priority information 2 of the authentication mechanism C, respectively.
  • the smaller the value of the priority information the higher the corresponding priority.
  • the priority information may also be in the form of an implicit indication, and the priority information may also be referred to as a priority rule.
  • the above three authentication mechanisms may be sorted according to priority rules.
  • the subsequent UE may determine the priorities of the multiple authentication mechanisms supported by the EES according to the above priority sorting rules. For example, the UE and the EES may negotiate in advance, and the higher the priority, the higher the arrangement position. It is assumed that the order of the three authentication mechanisms supported by the EES is: authentication mechanism C, authentication mechanism A, and authentication mechanism B.
  • the UE may determine the priorities of the three authentication mechanisms according to the receiving order of the above three authentication mechanisms, respectively: authentication mechanism C, authentication mechanism A, and authentication mechanism B, etc.
  • the three authentication mechanisms supported by EES may include recommended authentication mechanisms.
  • the priority information may be: authentication mechanism C (recommended), authentication mechanism A, and authentication mechanism B, indicating that authentication mechanism C has the highest priority. , the priority of authentication mechanism A and authentication mechanism B are second, and both have the same priority.
  • priority information are only for convenience of description, and in practical applications, the above examples of priority information may be combined with each other to form various flexible priority rules.
  • This application does not limit this. For example, only the authentication mechanisms with specified high (or low) priorities can be displayed, and the priorities of other authentication mechanisms are determined according to the ordering.
  • the priority information in this application can reflect the priority difference of different authentication mechanisms in at least one authentication mechanism supported by the EES or the UE.
  • the EEC can obtain the candidate authentication mechanism corresponding to the EES by interacting with the ECS, and a communication connection can be established between the EEC and the EES based on the candidate authentication mechanism, which reduces signaling overhead, reduces the delay in establishing communication, and improves communication experience.
  • a flow of a communication method is provided, and the flow can be used for the interaction between ECS and EES to obtain at least one authentication mechanism supported by EES, including:
  • Step 501 EES sends an edge enabler server registration or update request (edge enabler server registration/update request) message to ECS, the registration or update request message includes EES identifier (such as URI, FQDN, IP address, etc.), EAS configuration, etc. .
  • EES identifier such as URI, FQDN, IP address, etc.
  • the above registration or update request message further includes at least one authentication mechanism supported by the EES, or an EES provider identifier.
  • the above registration or update request message may further include priority information of at least one authentication mechanism supported by the EES.
  • the at least one authentication mechanism supported by the above-mentioned EES may be set by the user as required, or a preconfigured default value, etc., which are not limited.
  • the at least one authentication mechanism supported by the EAS or the EC can also be set as required by the user, or a preconfigured default value, etc., which will not be described later.
  • Step 502 After receiving the EES registration or update request message, the ECS verifies whether the EES is authorized. If authorized, the information in the above registration or update request message is stored.
  • the ECS directly stores the at least one authentication mechanism supported by the EES.
  • the ECS may also store priority information of the at least one authentication mechanism.
  • the ECS may determine at least one authentication mechanism supported by the EES according to the EES provider identifier.
  • the ECS stores at least one authentication mechanism corresponding to the EES provider, and optionally may also store priority information and the like of the at least one authentication mechanism corresponding to the EES provider.
  • the ECS may determine at least one authentication mechanism supported by the EES according to the stored correspondence between the EES provider and the authentication mechanism, and optionally, may also determine priority information of the at least one authentication mechanism.
  • Step 503 The ECS sends an edge-enabled service registration or update response message to the EES, where the response message includes indication information of registration/update success or failure.
  • the response message may further include an expiration time, which is used to indicate the expiration time of the registration or update.
  • the response message may further include a registration ID.
  • the ECS can obtain at least one authentication mechanism supported by the EES and its corresponding priority information by interacting with the EEC.
  • the terminal device is the UE, the UE includes the AC and the EEC, the first edge server is the EES, the second edge server is the EAS, and the second message is the edge enabler client registration request (edge enabler client registration request). ) message, the first message is an edge enabler client registration response message as an example to illustrate.
  • a flow of a communication method including:
  • step 600 the EES acquires at least one authentication mechanism supported by the EAS.
  • the EES may also acquire priority information of at least one authentication mechanism supported by the EAS.
  • the EES may obtain at least one authentication mechanism supported by the EAS and its corresponding priority information in a pre-configured manner, or the EES may also obtain at least one authentication mechanism supported by the EAS and its corresponding priority information by interacting with the EAS. Corresponding priority information. For example, after the EAS is successfully instantiated, it can send at least one authentication mechanism supported by itself and its corresponding priority information to the EES by means of active registration. This embodiment of the present application does not limit the manner in which the EES obtains the EAS information.
  • Step 601 The EEC sends an edge-enabled client registration request message to the EES, where the request message includes the EEC ID and the application client configuration file.
  • the EEC may send an edge-enabled client registration request message to the EES according to the EES information obtained from the ECS.
  • the application client configuration file may include AC ID, EAS ID (used to identify the EAS requesting discovery), and edge server provider, etc.
  • the EEC ID is used to uniquely identify an EEC.
  • the EAS ID is used to identify a specific application.
  • the above-mentioned edge-enabled client registration request message may also include at least one of the following: UE ID, context ID (context ID), EES ID (also called source EES ID) for assigning context IDs, and EAS ID (used to identify discovered EAS), etc.
  • the context ID is used to identify the context of the last EEC registration, and so on.
  • Step 602 The EES receives the edge client registration request message.
  • the EES may perform an authorization check, that is, the EES checks whether the EEC is authorized to request the discovery of the EAS.
  • the edge-enabled client registration response message in the following step 804 may carry the EAS ID of the authorization discovery and the first indication information indicating the candidate authentication mechanism associated with the EAS of the authorization discovery. Otherwise, the edge-enabled client registration response message in the following step 804 may carry the second indication information that the request fails, and the like.
  • step 603 after the EEC authorization check is passed, if the edge-enabled client registration request message in the foregoing step 801 contains the context ID and the source EES ID, the EES obtains the registration context from the source EES. If the request message does not include the context ID and source EES ID, skip this step. EES obtains the registration context according to the normal process.
  • the above step 603 is mainly designed for mobile scenarios. For example, if a user moves from Shanghai to Beijing, the EDN network in Shanghai originally provides services for the user, and the EDN network in Beijing needs to provide services for the user in the future. For the EDN network in Beijing, you can go to the EDN network in Shanghai to obtain relevant information.
  • Step 604 The EES sends an edge-enabled client registration response message to the EEC.
  • the edge-enabled client registration response message may include an EAS information list.
  • the EES may determine the EAS information list indicated by the client configuration file according to the registration context.
  • the EAS information list includes the EAS ID, etc.
  • the EASID is used by the AC to send a request to the EAS.
  • the EAS information list may further include the identifier of the EAS provider, the storage available for the EAS, and the like.
  • the EAS information list may further include a candidate authentication mechanism corresponding to the EAS.
  • the authentication mechanism used for the communication between the UE and the EAS determined by the EES is called the first authentication mechanism; the authentication mechanism supported by the UE can be called the first authentication mechanism.
  • the second authentication mechanism; the authentication mechanism supported by the EAS can be called the third authentication mechanism.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the EAS.
  • the edge-enabled client registration response message includes at least one third authentication mechanism supported by the EAS.
  • the edge-enabled client registration response message may further include priority information of at least one third authentication mechanism supported by the EAS.
  • the EEC receives the edge-enabled client registration response message, and obtains at least one third authentication mechanism supported by the EAS in the edge-enabled client registration response message.
  • priority information of at least one third authentication mechanism supported by the EAS may also be acquired.
  • the EEC determines a target authentication mechanism according to at least one authentication mechanism supported by the EAS and auxiliary information, where the auxiliary information at least includes at least one of the following: at least one second authentication mechanism supported by the UE, and an authentication mechanism used by the UE to access the EAS.
  • Network Type the auxiliary information may further include at least one of the following: priority information of at least one authentication mechanism supported by the UE, and priority information of at least one authentication mechanism supported by the EAS.
  • the EEC may obtain priority information in at least one authentication mechanism supported by the UE, or the network type used by the UE to access the EAS, from a non-access stratum (NAS) layer or other layers.
  • NAS non-access stratum
  • the EEC sends an EAS information provision message to the AC, where the EAS information provision message includes a candidate authentication mechanism, the AC establishes a communication connection with the EAS according to the target authentication mechanism, and the target authentication mechanism is included in the at least one third authentication mechanism. in an authentication mechanism.
  • the process of establishing the communication connection between the AC and the EAS is similar to the process of establishing the communication connection between the EEC and the EES, and can refer to each other.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the EAS.
  • the edge-enabled client registration response message includes at least one third authentication mechanism supported by the EAS.
  • the edge-enabled client registration response message may further include priority information of at least one third authentication mechanism supported by the EAS.
  • the EEC receives the edge-enabled client registration response message, and obtains at least one third authentication mechanism supported by the EAS in the edge-enabled client registration response message.
  • priority information of at least one authentication mechanism supported by the EAS may also be acquired.
  • the EEC sends the AC at least one third authentication mechanism supported by the EAS.
  • the EEC may also send priority information of at least one authentication mechanism supported by the EAS to the AC.
  • the AC determines the target authentication mechanism according to the at least one third authentication mechanism supported by the EAS and auxiliary information, where the auxiliary information includes at least one of the following: at least one second authentication mechanism supported by the UE, and a second authentication mechanism used by the UE to access the EAS. network type.
  • the auxiliary information may further include at least one of the following: priority information of at least one second authentication mechanism supported by the UE, and priority information of at least one third authentication mechanism supported by the EAS.
  • the AC may acquire, from the NAS layer or other layers, priority information of at least one second authentication mechanism supported by the UE, and/or the network type used by the UE to access the EAS, and the like.
  • the AC establishes a communication connection with the EAS according to the target authentication mechanism.
  • the process of establishing the communication connection between the AC and the EAS is similar to the process of establishing the communication connection between the EEC and the EES, and can refer to each other.
  • the candidate authentication mechanism is at least one first authentication mechanism used when establishing a communication connection between the AC and the EAS.
  • the edge-enabled client registration request message includes capability information of the UE, and the capability information of the UE includes at least one second authentication mechanism supported by the UE.
  • the capability information of the UE may further include: a network type used by the UE to access the EAS, and priority information of at least one authentication mechanism supported by the UE.
  • the EES determines candidate authentication mechanisms according to at least one third authentication mechanism supported by the EAS and auxiliary information, and the auxiliary information includes at least one of the following: at least one second authentication mechanism supported by the UE, and at least one third authentication mechanism supported by the EAS Authentication mechanism.
  • the auxiliary information may further include at least one of the following: priority information of at least one second authentication mechanism supported by the UE, and priority information of at least one third authentication mechanism supported by the EAS.
  • the EES sends an edge client registration response message to the EEC, where the edge client registration response message includes the above-mentioned candidate authentication mechanism. If an authentication mechanism is included in the above candidate authentication mechanisms, the authentication mechanism is used as the target authentication mechanism. Alternatively, if the above-mentioned candidate authentication mechanisms include multiple authentication mechanisms, one authentication mechanism may be selected from the above-mentioned multiple authentication mechanisms as the target authentication mechanism or the like.
  • the EEC may send an EAS information providing message to the AC, where the EAS information providing message includes the target authentication mechanism; the AC establishes a communication connection with the EAS according to the target authentication mechanism.
  • the EEC may directly send the candidate authentication mechanism to the AC; the AC determines the target authentication mechanism according to the candidate authentication mechanism, which is not limited.
  • the EEC or AC determines the target authentication mechanism according to the candidate authentication mechanism as an example for description, which is not a limitation of the embodiments of the present application.
  • the above process of determining the target mechanism according to the candidate authentication mechanism may also be performed for other modules in the UE. The difference is that the other modules above need to finally notify the AC of the target authentication mechanism.
  • Step 605 The EEC sends an EAS information providing message to the AC, where the EAS information providing message includes the target authentication mechanism of the EAS corresponding to the AC, or includes the candidate authentication mechanism of the EAS corresponding to the AC.
  • Step 606 When the AC initiates a request to the EAS, the AC establishes a communication connection with the EAS according to the candidate authentication mechanism or target authentication mechanism corresponding to the EAS received from the EEC.
  • the UE can obtain the candidate authentication mechanism corresponding to the EAS by interacting with the EES.
  • the negotiation process of authentication between the EEC and the EAS is no longer required, which reduces the signaling overhead, reduces the delay in establishing communication, and improves the communication experience.
  • a flow of a communication method is provided, and the flow can be used for the interaction between EES and EAS to obtain at least one authentication mechanism supported by EAS, and the flow includes:
  • step 701 The EAS determines that it needs to be registered with the EES.
  • Step 702 The EAS sends an edge application server registration or update request (edge application server registration/update request) message to the EES.
  • the registration or update request message includes at least one of the following: an EAS identifier and an EAS configuration.
  • the registration or update request message may further include an EAS service area, an EAS type, and the like.
  • the above registration or update request message includes at least one authentication mechanism supported by the EAS.
  • the EAS provider ID is included in the above registration or update request message.
  • the registration or update request message may further include priority information of at least one authentication mechanism supported by the EAS.
  • Step 703 After receiving the registration or update request message of the EAS, the EES performs an authorization check on the EAS to verify whether the EAS is authorized. If authorized, the information in the above registration or update request message is stored.
  • the EES directly stores the at least one authentication mechanism supported by the EAS.
  • the EES provider ID is included in the above registration or update request message, the EES may determine at least one authentication mechanism corresponding to the above EAS provider ID according to the correspondence between the provider and the authentication mechanism, which provides The at least one authentication mechanism corresponding to the merchant ID may be considered to be at least one authentication mechanism supported by the EAS.
  • Step 704 The EES sends an edge application service registration or update response message to the EAS, where the response message includes an indication of registration/update success or failure.
  • the response message may further include an expiration time, where the expiration time is used to indicate the expiration time of the registration or update.
  • the response message may also include a registration ID.
  • the EES may also store priority information of at least one authentication mechanism supported by the EAS.
  • the EES can acquire at least one authentication mechanism supported by the EAS and its corresponding priority information by interacting with the EAS.
  • the implementation of this application is introduced by taking the terminal device as UE, the first network element as AMF, the second message as the registration request message of the terminal device, and the first message as the response message of the registration request of the terminal device as an example. program in .
  • a flow of a communication method is provided, which at least includes the following steps:
  • step 800 for a UE subscribed to use edge services, the access and mobility management user subscription information of the UDM includes ECS information that the UE can use, and the ECS information includes at least one of the following: an ECS identifier and an ECS supported by the ECS. at least one authentication mechanism.
  • the ECS information may further include priority information of at least one authentication mechanism supported by the ECS.
  • Step 801 The UE sends a registration request message to the AMF through the access network node, where the registration request message includes the UE identifier.
  • the registration request message may also include at least one of the following: at least one authentication mechanism supported by the UE, indication information of whether the UE supports edge-enabled clients, and priority information of at least one authentication mechanism supported by the UE .
  • the above-mentioned registration request message includes the UE identity and the UE capability
  • the UE's identity may be a user concealed identifier (subscription concealed identifier, SUCI) or a globally unique temporary identity (globally unique temporary identity, 5G-GUTI) or mapped 5G-GUTI, etc.
  • the UE capability includes at least one of the following: at least one authentication mechanism supported by the UE, indication information of whether the UE supports an edge-enabled client, and priority information of the at least one authentication mechanism supported by the UE.
  • Step 802 After receiving the registration request message of the UE, when the AMF needs to acquire the subscription information, the AMF can send a subscription data management acquisition request (Nudm_subscriber data management get, Nudm_SDM_Get) request message to the UDM, and the request message contains the identifier of the UE.
  • the request message may further include capability information of the UE.
  • the identifier of the UE is determined according to the identifier of the UE in step 801, and may be a subscription permanent identifier (SUPI).
  • Step 803 The UDM obtains the subscription information of the UE according to the identifier of the UE included in the Nudm_SDM_Get request message, and sends a Nudm_SDM_Get response message to the AMF, the response message includes ECS information, and the ECS information includes at least one of the following: ECS identification Candidate certification information associated with ECS. How the UDM obtains the candidate authentication information corresponding to the ECS will be described in detail in the following embodiments.
  • Step 804 The AMF receives the Nudm_SDM_Get response message sent by the UDM, obtains the ECS information in the response message, and sends the ECS information to the UE.
  • the AMF may send the ECS information to the UE through a registration response message, as shown in step 804a; alternatively, the AMF may send the ECS information to the UE through a UE configuration update (UE configuration update, UCU) process, which is an independent configuration process , see step 804b.
  • UE configuration update UE configuration update, UCU
  • Step 805 The NAS layer of the UE sends the received ECS information to the corresponding EEC.
  • the NAS layer can directly send the received ECS information to the EEC, or indirectly send the ECS information to the EEC through the upper layer.
  • Step 806 The EEC establishes a communication connection with the ECS according to the candidate authentication mechanism included in the ECS information.
  • the authentication mechanism used in the communication between the UE and the ECS determined by the AMF is called the first authentication mechanism; the authentication mechanism supported by the UE can be called the first authentication mechanism.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the ECS.
  • the Nudm_SDM_Get response message includes at least one third authentication mechanism supported by the ECS.
  • the Nudm_SDM_Get response message may further include priority information of at least one third authentication mechanism supported by the ECS.
  • the AMF obtains at least one third authentication mechanism supported by the ECS.
  • the AMF may also acquire priority information of at least one third authentication mechanism supported by the ECS.
  • the AMF sends a registration response message or a UCU process to the UE, where the registration response message or the UCU process carries at least one third authentication mechanism supported by the ECS.
  • the response message or the UCU process may further include priority information in at least one third authentication mechanism supported by the ECS.
  • the UE determines a target authentication mechanism according to at least one third authentication mechanism supported by the ECS and auxiliary information, where the auxiliary information at least includes: at least one second authentication mechanism supported by the UE and a network type used by the UE to access the ECS.
  • the auxiliary information may further include at least one of the following items: priority information of at least one authentication mechanism supported by the UE, and priority information of at least one authentication mechanism supported by the ECS.
  • the UE establishes a communication connection with the ECS according to the target authentication mechanism.
  • the process of establishing a communication connection between the UE and the ECS is similar to the process of establishing a communication process between the EEC and the EES, and can refer to each other.
  • the foregoing establishment of a communication connection between the UE and the ECS may also be described as establishing a communication connection between the EEC and the ECS.
  • the NAS layer in the UE can perform the above process of "determining the target authentication mechanism according to at least one authentication mechanism and auxiliary information supported by the ECS", and then the NAS layer sends the above target authentication mechanism to the EEC, and the EEC uses the target authentication mechanism according to the target authentication mechanism. Establish a communication connection with the ECS.
  • the candidate authentication mechanism is at least one first authentication mechanism used when the EEC communicates with the ECS.
  • the above registration request message may carry the capability information of the UE, and the capability information of the UE includes at least one second authentication mechanism supported by the UE, the network type used by the UE to access the ECS, and the priority information of the at least one second authentication mechanism supported by the UE. .
  • the AMF receives the registration request message and obtains the capabilities of the UE. When the AMF needs to obtain the subscription information, it sends a Nudm_SDM_Get request message to the UDM.
  • the AMF receives a Nudm_SDM_Get response message from the UDM, where the Nudm_SDM_Get response message includes at least one third authentication mechanism supported by the ECS.
  • the response message may further include priority information of at least one third authentication mechanism supported by the ECS.
  • the AMF determines a candidate authentication mechanism according to at least one third authentication mechanism supported by the ECS and auxiliary information.
  • the auxiliary information includes at least one of the following: at least one second authentication mechanism supported by the UE, and a network type used by the UE to access the ECS.
  • the above auxiliary information may further include: priority information of at least one second authentication mechanism supported and used by the UE, and priority information of at least one authentication mechanism supported and used by the ECS.
  • the AMF sends a registration response message or UCU process to the UE, and the registration response message or UCU process includes a candidate authentication mechanism.
  • the UE obtains the registration response message or the candidate authentication mechanism in the UCU process, and determines the target authentication mechanism according to the candidate authentication mechanism.
  • the candidate authentication mechanisms may include multiple first authentication mechanisms, and the UE may select one authentication mechanism as the target authentication mechanism.
  • the NAS layer of the UE may send the target authentication mechanism to the EEC, and the EEC establishes a communication connection with the ECS according to the target authentication mechanism.
  • the UE may directly send the candidate authentication mechanism to the EEC, and the EEC determines the target authentication mechanism according to the candidate authentication mechanism.
  • the candidate authentication mechanism is at least one fourth authentication mechanism used when the EEC communicates with the ECS.
  • the above registration request message may carry the capability information of the UE, and the capability information of the UE includes at least one second authentication mechanism supported by the UE, the network type used by the UE to access the ECS, and the priority information of the at least one second authentication mechanism supported by the UE. .
  • the AMF receives the registration request message and obtains the capabilities of the UE. When the AMF needs to acquire subscription information, it sends a Nudm_SDM_Get request message to the UDM, and the UDM sends a Nudm_SDM_Get request message that carries the capability information of the UE.
  • the UDM determines candidate authentication mechanisms according to at least one authentication mechanism supported by the ECS and auxiliary information, where the auxiliary information at least includes at least one second authentication mechanism supported by the UE and the network type used by the UE to access the ECS.
  • the auxiliary information may further include at least one of the following: priority information of at least one authentication mechanism supported by the UE, priority information of at least one authentication mechanism supported by the ECS, and the like.
  • the UDM sends a Nudm_SDM_Get response message to the AMF, and the response message includes a candidate authentication mechanism. Subsequent AMF sends the candidate authentication mechanism to the UE through the registration response message or the UCU process. The process is similar to the above solution and will not be repeated here.
  • the UE interacts with the AMF to obtain the candidate authentication mechanism corresponding to the ECS.
  • the AMF performs the authentication negotiation process between the UE and the ECS, which reduces signaling overhead, reduces the delay in establishing communication, and improves communication experience.
  • the solution in the embodiment of the present application is introduced by taking the terminal device as the UE, the first network element as the SMF, the second message as the PDU session request message, and the first message as the PDU session response message as an example.
  • a flow of a communication method which at least includes the following steps:
  • step 900 for a UE supporting the use of edge services, the session management user subscription information of the UDM includes ECS information that the UE can use, and the ECS information includes at least one of the following: an ECS identifier and at least one authentication supported by the ECS. mechanism, etc.
  • the ECS information may further include: priority information of at least one authentication mechanism supported by the ECS.
  • Step 901 When the UE determines to establish a PDU session, the UE sends a PDU session request message to the SMF through the radio access network node and the AMF node, and the message includes the PDU session ID.
  • the message may further include at least one of the following: indication information of whether the UE supports edge-enabled clients, at least one authentication mechanism supported by the UE, and priority information of the at least one authentication mechanism supported by the UE.
  • the above-mentioned PDU session request message may include the capabilities of the UE.
  • the capabilities of the UE include at least one of the following: at least one authentication mechanism supported by the UE, indication information of whether the UE supports edge-enabled clients, and priority information of the at least one authentication mechanism supported by the UE.
  • the capability of the above UE may be sent separately, that is, the UE sends the PDU session request message and the capability of the UE to the SMF through the radio access network node and the AMF node.
  • Step 902 After the SMF receives the PDU session request message sent by the UE, when it needs to obtain the subscription information of the UE, the SMF sends a Nudm_SDM_Get request message to the UDM, where the request message includes the identifier of the UE.
  • the identifier of the UE may be SUPI.
  • Step 903 The UDM obtains the subscription information of the UE according to the identifier of the UE contained in the above request message, and sends a Nudm_SDM_Get response message to the AMF, where the response message includes the ECS information.
  • the ECS information includes at least one of the following: an ECS identifier and a candidate authentication mechanism corresponding to the ECS.
  • Step 904 The SMF receives the Nudm_SDM_Get response message sent by the UDM, and sends a PDU session response message to the UE, where the PDU session response message includes ECS information.
  • the above-mentioned ECS information may be included in a protocol configuration option (protocol configuration option, PCO) of the PDU session response message.
  • PCO protocol configuration option
  • Step 905 The NAS layer of the UE sends the received ECS information to the corresponding EEC.
  • the NAS layer may directly send the received ECS information to the EEC, or indirectly send the ECS information to the EEC through the upper layer.
  • Step 906 The EEC establishes a communication connection with the ECS according to the candidate authentication mechanism included in the received ECS information.
  • the authentication mechanism used for communication between the UE and the ECS determined by the SMF is called the first authentication mechanism; the authentication mechanism supported by the UE can be called the first authentication mechanism.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the ECS.
  • the ECS information in the Nudm_SDM_Get response message includes at least one third authentication mechanism supported by the ECS.
  • the message further includes priority information of at least one third authentication mechanism supported by the ECS.
  • the SMF receives the Nudm_SDM_Get response message, and obtains at least one third authentication mechanism supported by the ECS contained in the Nudm_SDM_Get response message.
  • the SMF may also acquire priority information in at least one third authentication mechanism supported by the ECS contained in the response message.
  • the SMF sends a PDU session response message to the UE, where the PDU session response message includes at least one third authentication mechanism supported by the ECS.
  • the PDU session response message may further include priority information of at least one third authentication mechanism supported by the ECS.
  • the UE determines a target authentication mechanism according to at least one third authentication mechanism supported by the ECS and auxiliary information, where the auxiliary information at least includes at least one second authentication mechanism supported by the UE and the network type used by the UE to access the ECS.
  • the auxiliary information may further include: priority information of at least one authentication mechanism supported by the UE, priority information of at least one authentication mechanism supported by the ECS, and the like.
  • the NAS layer of the UE sends the target authentication mechanism to the EEC, and the EEC establishes a communication connection with the ECS according to the target authentication mechanism.
  • the process of establishing a communication connection between the EEC and the ECS is similar to the process of establishing a communication connection between the EES and the EES, and can refer to each other.
  • the NAS layer in the UE can specifically perform the above-mentioned process of “determining the target authentication mechanism according to at least one third authentication mechanism and auxiliary information supported by the ECS”, and then the NAS layer uses the above-mentioned target authentication mechanism It is sent to the EEC, and the EEC establishes a communication connection with the ECS according to the target authentication mechanism.
  • the candidate authentication mechanism is at least one fourth authentication mechanism used when the UE communicates with the ECS.
  • the above-mentioned PDU session request carries the capability information of the UE, and the capability information of the UE includes at least one of the following: at least one second authentication mechanism supported by the UE, the network type used by the UE to access the ECS, and at least one supported by the UE. Priority information of the second authentication mechanism.
  • the SMF needs to acquire the subscription information of the UE, the SMF sends a Nudm_SDM_Get request message to the UDM, where the request message includes the UE identifier.
  • the above Nudm_SDM_Get request message includes the capabilities of the UE, and the UDM determines a candidate authentication mechanism according to at least one third authentication mechanism supported by the ECS and auxiliary information.
  • the auxiliary information may include at least one of the following: at least one second authentication mechanism supported by the UE and a network type used by the ECS accessed by the UE.
  • the auxiliary information may further include at least one of the following items: priority information of at least one authentication mechanism supported by the UE, and priority information of at least one authentication mechanism supported by the ECS.
  • the UDM sends a Nudm_SDM_Get response message to the SMF, and the response message includes a candidate authentication mechanism.
  • the SMF sends a PDU session response message to the UE, and the PDU session response message includes the candidate authentication mechanism; the UE obtains the candidate authentication mechanism in the PDU session response message, and the NAS layer of the UE sends the candidate authentication mechanism to the EEC; the EEC, according to the candidate authentication mechanism, Establish a communication connection with the ECS, etc.
  • the candidate authentication mechanism is at least one fourth authentication mechanism used when the UE communicates with the ECS.
  • the above-mentioned PDU session request carries the capability information of the UE.
  • the SMF needs to acquire the subscription information of the UE, the SMF sends a Nudm_SDM_Get request message to the UDM, where the request message includes the UE identifier.
  • the above Nudm_SDM_Get response message includes at least one third authentication mechanism supported by the ECS.
  • the SMF determines a candidate authentication mechanism according to at least one third authentication mechanism supported by the ECS and auxiliary information.
  • the SMF sends a PDU Session Response message to the UE, and the PDU Session Response message includes a candidate authentication mechanism.
  • the NAS layer of the UE sends the candidate authentication mechanism to the EEC.
  • the EEC establishes a communication connection with the ECS according to the candidate authentication mechanism.
  • the UE interacts with the SMF to obtain the candidate authentication mechanism corresponding to the ECS, and the authentication negotiation process between the UE and the ECS is no longer required, which reduces signaling overhead, reduces the delay in establishing communication, and improves communication experience.
  • the process of establishing a communication connection between the terminal device and the first network element using the AKMA authentication mechanism is introduced. As shown in FIG. 10 , the process at least includes:
  • Step 1000a The UE registers with the operator's network, and performs the main authentication process.
  • an authentication key K AUSF is generated between the UE and the AUSF, respectively. If the UE can use the AKMA authentication mechanism (for example, the AUSF can determine that the UE can use the AKMA authentication mechanism according to the AKMA indication received from the UDM), then the AUSF generates an AKMA key (K AKMA ) and the identifier A-KID corresponding to the AKMA key.
  • Step 1000b After generating the AKMA key, the AUSF sends an AKMA authentication key registration request to the AAnF, where the request includes the UE's permanent identity SUPI, A-KID and K AKMA.
  • Step 1001 At any moment after the UE accesses the network, when the UE needs to obtain the edge service, the UE sends a first message to the first network element.
  • Step 1002 The first network element sends a second message to the UE according to the first message sent by the UE, where the second message includes the identifier of the second network element and the AKMA capability.
  • the AKMA capability indicates that the second network element supports the use of the AMKA authentication mechanism.
  • Step 1003 when the UE determines to communicate with the second network element, if the UE supports AKMA and the second network element also supports AKMA (optionally, it can be determined whether the second network element supports AKMA according to the instruction in the above step 2), Then the UE deduces the AKMA key and the A-KID according to the definition in TS33.535, and further deduces the K AF corresponding to the second network element according to the AKMA key.
  • the described deduction refers to the deduction method of K AF in TS33.535. It should be noted that the subscript AF of the above K AF represents the second network element, and if the above-mentioned second network element is EES, the above K AF represents K EES and so on.
  • the derivation of the AKMA key and the A-KID can be performed at any time after the main authentication process and before determining to use AKMA with the second network element.
  • Another possible implementation manner is: before determining to communicate with the second network element, the UE has deduced the AKMA key and the A-KID. At this time, the UE obtains the locally stored A-KID according to the second network element supporting the AKMA authentication mechanism, and includes the A-KID in step 1004 . Further, the K AF corresponding to the second network element is generated according to the locally stored AKMA key.
  • Step 1004 The UE uses the K AF and all or part of the information in the communication connection establishment request message to generate a MAC-I, and sends the MAC-I carried in the communication connection establishment request message to the second network element including the A-KID and MAC -I communication connection establishment request.
  • Step 1005 After the second network element receives the communication connection establishment request, the second network element discovers an AKMA Anchor Function (AKMA Anchor Function, AAnF) or NEF.
  • AKMA Anchor Function AAnF
  • NEF AKMA Anchor Function
  • Step 1006 The second network element obtains the K AF key corresponding to the UE.
  • the second network element sends an AKMA authentication key acquisition request to the AAnF, and the AAnF sends an AKMA authentication key acquisition response to the second network element, where the response includes the K AF key Wait.
  • Step 1007 If the UE is authorized to perform the operation, the second network element verifies the MAC-I using the K AF ; the second network element sends a response message of the communication connection establishment request to the UE.
  • the above method further includes: the second network element receives the communication connection establishment request, obtains the A-KID and the MAC-I therein, the second network element sends the A-KID to the AAnF, and if the K AF can be obtained, then It is illustrated that the second network element determines that the UE is legal, that is, the second network element completes the authentication of the UE.
  • the above method further includes: the response message of the communication connection establishment request returned by the second network element to the UE may also include a second MAC; the second MAC is generated by using K AF or using a key generated based on K AF .
  • the UE receives the response message of the communication connection establishment request, obtains the second MAC, and verifies the second MAC. After the verification is successful, the UE confirms that the second network element is legal, that is, the UE completes the authentication of the second network element.
  • the second MAC is generated using K AF or a key generated based on K AF and some or all of the information in the response message.
  • the first network element may be an ECS
  • the second network element may be an EES
  • the first network element may be an EES
  • the second network element may be an EES
  • the element may be EAS, or, in the third embodiment, the first network element is AMF, and the second network element is ECS, or, in the fourth embodiment, the first network element may be SMF, and the second network element Can be ECS.
  • the embodiments of the present application further provide an apparatus for executing the method executed by the terminal device in the foregoing method embodiments.
  • the apparatus may include a communication unit 1101 and a processing unit 1102:
  • the communication unit 1101 is configured to receive a first message from a first network element, where the first message includes an identifier of the second network element and first indication information, where the first indication information is used to indicate that the second network element is associated with A candidate authentication mechanism; the processing unit 1102 is configured to establish a communication connection with the second network element based on the candidate authentication mechanism.
  • the communication unit 1101 is further configured to send a second message to the first network element, where the first message is a response message of the second message.
  • the candidate authentication mechanism is at least one first authentication mechanism used when establishing a communication connection between the terminal device and the second network element.
  • the second message includes a network type used by the terminal device to access the second network element; wherein the at least one first authentication mechanism is an authentication mechanism corresponding to the network type.
  • the second message includes at least one second authentication mechanism supported by the terminal device; wherein, the at least one first authentication mechanism is included in the at least one second authentication mechanism.
  • the second message further includes priority information in at least one second authentication mechanism; the at least one second authentication mechanism is used for the selection of the at least one first authentication mechanism.
  • establishing a communication connection with the second network element based on the candidate authentication mechanism includes:
  • the target authentication mechanism is one of the at least one authentication mechanism; sending a communication connection establishment request to the second network element , the first key identifier is included in the communication connection establishment request.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the second network element.
  • the establishing a communication connection with the second network element based on the candidate authentication mechanism includes: determining a target authentication mechanism based on the at least one third authentication mechanism and auxiliary information, the auxiliary information including at least one of the following: at least one second authentication mechanism supported by the terminal device, and the network type used by the terminal device to access the second network element; generating a first authentication mechanism corresponding to the target authentication mechanism a key and a first key identifier; sending a communication connection establishment request to the second network element, where the communication connection establishment request includes the first key identifier.
  • the auxiliary information further includes at least one of the following items: priority information in the at least one second authentication mechanism, and priority information in the at least one third authentication mechanism.
  • the first message further includes priority information in the at least one third authentication mechanism.
  • processing unit 1102 is further configured to: generate a second key according to the first key and the identifier of the second network element.
  • the processing unit 1102 is further configured to: use the second key to perform security protection on the communication connection establishment request to generate a first message authentication code MAC; wherein the communication connection establishment request further includes the Describe the first MAC.
  • the first network element is an edge configuration server ECS
  • the second network element is an edge enabling server EES, or the first network element is an EES, and the second network element is an edge Application Server EAS.
  • the first network element is an access and mobility management function AMF or a session management function SMF
  • the second network element is an edge configuration server ECS.
  • the first message is a non-access stratum NAS message.
  • the first message is a response message for requesting registration by the terminal device, or a response message for requesting establishment of a protocol data unit PDU session by the terminal device.
  • the candidate authentication mechanism includes at least one of the following: an application authentication and password management AKMA service, a general bootstrap architecture GBA service, and a certificate mechanism.
  • the embodiments of the present application further provide an apparatus for executing the method performed by the first network element in the foregoing method embodiments.
  • the apparatus includes a communication unit 1101 and a processing unit 1102:
  • the processing unit 1102 is configured to determine a candidate authentication mechanism; the communication unit 1101 is configured to send a first message to the terminal device, where the first message includes the identifier of the second network element and first indication information, the first indication information
  • the candidate authentication mechanism used to indicate the association of the second network element, where the candidate authentication mechanism is used for establishing a communication connection between the terminal device and the second network element.
  • the communication unit 1101 is further configured to receive a second message from the terminal device, where the first message is a response message to the second message.
  • the candidate authentication mechanism is at least one first authentication mechanism used when establishing a communication connection between the terminal device and the second network element, and the determining the candidate authentication mechanism includes:
  • a candidate authentication mechanism is determined according to at least one third authentication mechanism supported by the second network element and auxiliary information, where the auxiliary information includes at least one of the following: at least one second authentication mechanism supported by the terminal device, and The network type used by the terminal device to access the second network element.
  • the second message includes a network type used by the terminal device to access the second network element.
  • the second message includes at least one second authentication mechanism supported by the terminal device.
  • the auxiliary information further includes at least one of the following items: priority information in the at least one second authentication mechanism, and priority information in the at least one third authentication mechanism.
  • the second message further includes priority information in at least one second authentication mechanism.
  • the candidate authentication mechanism is at least one third authentication mechanism supported by the second network element.
  • the first message further includes priority information in the at least one third authentication mechanism.
  • the first network element is an ECS and the second network element is an EES, or the first network element is an EES and the second network element is an EAS.
  • the first network element is an AMF or SMF
  • the second network element is an ECS
  • the first message is a NAS message.
  • the first message is a response message for requesting registration by the terminal device, or a response message for requesting establishment of a PDU session by the terminal device.
  • the candidate authentication mechanism includes at least one of the following: AKMA service, GBA service, and certificate mechanism.
  • the division of units in the embodiments of the present application is schematic, and is only a logical function division. In actual implementation, there may be other division methods.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit. In the device, it can also exist physically alone, or two or more units can be integrated into one module.
  • the above-mentioned integrated units can be implemented in the form of hardware, or can be implemented in the form of software function modules.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions to make a terminal device (which may be a personal computer, a mobile phone, or a network device, etc.) or a processor (processor) to execute all or part of the steps of the method in each embodiment of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .
  • both the base station and the terminal device may be presented in the form of dividing each functional module in an integrated manner.
  • Module herein may refer to a specific ASIC, circuit, processor and memory executing one or more software or firmware programs, integrated logic circuit, and/or other device that may provide the functions described above.
  • the terminal device and the first network element may take the form shown in FIG. 12 .
  • the communication apparatus 1200 shown in FIG. 12 includes at least one processor 1201 , a memory 1202 , and optionally, a communication interface 1203 .
  • the memory 1202 can be volatile memory, such as random access memory; the memory can also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD) or solid-state drive (solid-state drive, SSD), or memory 1202 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the memory 1202 may be a combination of the foregoing memories.
  • the specific connection medium between the above-mentioned processor 1201 and the memory 1202 is not limited in this embodiment of the present application.
  • the memory 1202 and the processor 1201 are connected through a bus 1204 in the figure, and the bus 1204 is represented by a thick line in the figure. limited.
  • the bus 1204 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 12, but it does not mean that there is only one bus or one type of bus.
  • the processor 1201 may have a data transceiver function and be able to communicate with other devices.
  • an independent data transceiver module such as a communication interface 1203, can also be set to send and receive data; the processor 1201 is communicating with other devices. During communication, data transmission can be performed through the communication interface 1203 .
  • the processor 1201 in FIG. 12 can execute the instructions by calling the computer stored in the memory 1202 , so that the terminal device can perform the functions of the terminal device described in any of the above method embodiments.
  • the processor 1201 in FIG. 12 can execute the instructions by calling the computer stored in the memory 1202, so that the first network element can execute any of the above method embodiments. Describe the function of the first network element.
  • the function/implementation of the communication unit 1101 and the processing unit 1102 in FIG. 11 may be implemented by the processor 1201 in FIG. 12 calling computer program instructions stored in the memory 1202 .
  • the function/implementation process of the processing unit 1102 in FIG. 11 can be implemented by the processor 1201 in FIG. 12 calling the computer-executed instructions stored in the memory 1202, and the function/implementation of the communication unit 1101 in FIG. It is implemented by the communication interface 1203 in .
  • the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Communication Control (AREA)

Abstract

一种建立安全通信方法及装置，该方法包括：终端设备接收来自第一网元的第一消息，所述第一消息包括第二网元的标识以及第一指示信息，所述第一指示信息用于指示与所述第二网元关联的候选认证机制；所述终端设备基于所述候选认证机制，与所述第二网元之间建立通信连接。采用本申请实施例的方法及装置，终端设备可以获取动态配置的第二网元的认证机制，以满足MEC架构下通过认证以建立安全的通信连接的需求。

Description

一种建立安全通信方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及一种建立安全通信方法及装置。
背景技术
多接入边缘计算(multi-access edge computing，MEC)，可利用无线接入网络就近为电信用户提供信息技术(information technology，IT)所需服务和云端技术功能，从而创造出一个具备高性能、低延迟与高带宽的电信级服务环境，加速网络中各项内容、服务及应用的快速下载，让用户享有不间断的高质量网络体验。
其中，在第三代合作伙伴计划(3rd generation partnership project，3GPP)的SA6的MEC研究中，如图1所示，定义了如下结构模型。
边缘数据网络(edge data network，EDN)上动态的部署有一个或者多个边缘使能服务器(edge enabler server，EES)和一个或者多个边缘应用服务器(edge application server，EAS)。用户设备(user equipment，UE)中包括应用客户端(application client，AC)和边缘使能客户端(edge enabler client，EEC)。独立于用户设备和EDN之外，MEC架构中还包括一个或者多个边缘配置服务器(edge configuration server，ECS)。
为了保护客户端与服务器间(如AC与EAS之间、EEC与ECS之间或EEC和EES之间)的通信安全，通常在客户端与服务器间进行应用层数据传输前，客户端与服务器之间需要进行认证。
目前，常见的认证机制包括用于应用的认证和密钥管理(authentication and key management for applications，AKMA)机制、通用引导架构(generic bootstrapping architecture，GBA)机制以及基于证书的认证机制等。
在MEC架构下，由于EES、EAS和ECS都是动态部署的，所以UE无法获知这些动态部署的EES、EAS和ECS所支持的认证机制。进而UE无法准确的使用相应的认证机制发起与EES、EAS或者ECS之间的连接建立请求。
因此，当前亟需一种能够适用于MEC架构下，在客户端与服务器之间通过认证以建立安全的通信连接的方法。
发明内容
本申请提供一种建立安全通信方法及装置，用以解决MEC架构下，无法预先获知服务器支持的认证机制，以建立安全的通信连接的问题。
第一方面，提供一种建立安全通信方法，该方法包括：终端设备接收来自第一网元的第一消息，所述第一消息中包括第二网元的标识以及第一指示信息，所述第一指示信息用于指示第二网元关联的候选认证机制；终端设备基于候选认证机制，与第二网元之间建立通信连接。
通过上述方法，终端设备可以获取动态部署的第二网元的候选认证机制；且基于上述候选认证机制与第二网元之间建立通信连接。可选的，第二网元可以为ECS，EES或EAS等，可满足MEC架构的需求。
可选的，该方法还包括：终端设备向第一网元发送第二消息，第一消息为第二消息的响应消息。
通过上述方法，终端设备可先向第一网元发送第二消息，之后第一网元向终端设备发送第二消息的响应消息，即第一消息。也就是，终端设备在需要获取第二网元对应的候选认证机制时，可直接向第一网元请求，从而使得终端设备可以获取动态部署的第二网元的候选认证机制。
在一种设计中，所述候选认证机制为终端设备与第二网元之间建立通信连接时使用的至少一个第一认证机制；所述第二消息中包括所述终端设备所支持的至少一个第二认证机制。
通过上述方法，第二网元在接收到第二消息时，可直接获取该第二消息中终端设备所支持的至少一个认证机制；第二网元根据该终端设备所支持的至少一个认证机制和第二网元所支持的至少一个认证机制，确定候选认证机制，从而保证所述候选认证机制是终端设备和第二网元都支持的。同时，终端设备在接收到候选认证机制时，可直接利用该候选认证机制建立通信连接即可，终端设备无需再做进一步处理，减少了终端设备的处理复杂度，节省电量。
可选的，上述所述第二消息中包括所述终端设备接入所述第二网元所使用的网络类型。如此，上述第二网元确定候选认证机制时，还可以考虑终端设备接入所述第二网元所使用的网络类型，从而保证所选择的候选认证机制是网络也支持的。如此设计，主要是考虑，有些认证机制是需要网络支持的，比如，对于AKMA认证机制，需要5G网络的支持；而对于GBA认证机制，需要4G网络的支持。
可选的，上述第二消息中还包括至少一个第二认证机制中的优先级信息。第二网元在确定候选认证机制时，还可以考虑终端设备和第二网元所支持的认证机制的优先级，优先选择两者都支持的高优先级的认证机制建立通信连接。
可选的，所述终端设备基于所述候选认证机制，与所述第二网元之间建立通信连接，包括：所述终端设备从所述至少一个第一认证机制中确定目标认证机制；所述终端设备生成与所述目标认证机制对应的第一密钥以及第一密钥标识；所述终端设备向所述第二网元发送通信连接建立请求，所述通信连接建立请求中包括所述第一密钥标识。可选的，所述第一密钥标识可以用于标识所述终端设备。
一种可能的涉及中，所述目标认证机制对应的第一密钥以及第一密钥标识可能事先已经生成并保存在终端设备中，则这种情况下，终端设备之间获取所述目标认证机制对应的第一密钥标识符即可。即所述终端设备基于所述候选认证机制，与所述第二网元之间建立通信连接，包括：所述终端设备从所述至少一个第一认证机制中确定目标认证机制；所述终端设备获取与所述目标认证机制对应的第一密钥标识；所述终端设备向所述第二网元发送通信连接建立请求，所述通信连接建立请求中包括所述第一密钥标识。
通过上述方法，由于终端设备基于候选认证机制，可以获取动态部署的第二网元的认证机制，从而使得终端设备在上述通信连接建立请求中，可以直接携带候选认证机制对应的密钥标识，直接建立通信连接。相对于，终端设备不能获取动态部署的第二网元的认证机制，需要先向第二网元发送通信连接建立请求，然后第二网元指示第二网元支持的认证机制；终端设备再向第二网元发送通信连接建立请求，该请求中再携带第二网元所支持认证机制的密钥标识的过程，可减少信令开销，降低连接时延等。
在另一种设计中，所述候选认证机制为所述第二网元所支持的至少一个第三认证机制。
通过上述方法，第二网元直接将第二网元所支持的认证机制发送给终端设备，终端设备基于该第二网元所支持的认证机制与终端设备所支持的认证机制，再选择目标认证机制建立通信连接。这样，第二网元侧无需进一步判断，减少第二网元的工作量。进一步，在上述两者通信的过程中，无需再传输终端设备所支持的认证机制，减少了信令开销。
可选的，所述终端设备基于所述候选认证机制，与所述第二网元之间建立通信连接，包括：所述终端设备基于所述至少一个第三认证机制和辅助信息，确定目标认证机制，所述辅助信息中包括以下至少一项：所述终端设备所支持的至少一个第二认证机制，和所述终端设备接入所述第二网元所使用的网络类型；所述终端设备生成与所述目标认证机制对应的第一密钥以及第一密钥标识；所述终端设备向所述第二网元发送通信连接建立请求，所述通信连接建立请求包括所述第一密钥标识。
通过上述方法，终端设备在通信连接建立请求中可直接携带目标认证机制对应的密钥，发送一次通信连接建立请求，即可成功建立两者间的通信连接。相对比需要多次发送通信连接建立请求的方案，可减少信令开销，降低连接时延等。
可选的，终端设备还可以考虑优先级信息，比如所述至少一个第二认证机制的优先级信息和所述至少一个第三认证机制的优先级信息等，确定候选认证机制。如此，可保证优先选择优先级高的认证机制，建立通信连接。可选的，在此设计中，上述第一消息还可以包括：第二网元所支持的至少一个认证机制中的优先级信息等。
可选的，在上述两种设计中，上述目标认证机制是与网络类型对应的认证机制。比如，终端设备当前接入的网络为5G网络，则目标认证机制可以为AKMA机制。或者，终端设备当前接入的网络为4G网络，则目标认证机制可以为GBA机制等。
可选的，在上述两种设计中，还可以包括：所述终端设备根据所述第一密钥以及所述第二网元的标识，生成第二密钥；所述终端设备使用所述第二密钥对所述通信连接建立请求进行安全保护，以生成第一消息认证码MAC；其中，所述通信连接建立请求还包括所述第一MAC。
在上述方法中，第二网元在接收到通信连接建立请求后，可获取通信连接建立请求中的第一密钥标识，根据第一密钥标识获取第二密钥；根据第二密钥生成第二MAC；若第一MAC和第二MAC相同，则验证通过，两者间可建立通信连接。后续，终端设备与第二网元间也可以采用第二密钥进行其它安全保护，不作限定，从而保证两者间建立安全的通信连接。
可选的，所述方法还包含：所述终端设备接收第二网元发送的通信连接建立响应。所述通信连接建立响应使用所述第二密钥进行安全保护。例如，所述通信连接建立响应中包括第三MAC。所述第三MAC是所述第二网元基于所述第二密钥对所述连接建立响应中的部分或者全部信息计算得到的。相应地，所述终端设备还基于所述第二密钥对所述第三MAC进行校验，以确定通信连接建立响应没有被篡改，间接地也验证了所述第二网元为合法的网元。
可选的，所述第一网元为边缘配置服务器ECS，所述第二网元为边缘使能服务器EES，终端设备可以通过ECS获取EES对应的候选认证机制；或者，所述第一网元为EES，所述第二网元为边缘应用服务器EAS，终端设备可以通过EES获取EAS对应的候选认证机 制；或者，所述第一网元为接入和移动性管理功能AMF或者会话管理功能SMF，所述第二网元为ECS，终端设备可以通过AMF或SMF获取ECS对应的候选认证机制。在该设计中，上述第一消息可以为非接入层NAS消息。比如，所述第一消息为所述终端设备请求注册的响应消息，或者所述终端设备请求建立协议数据单元PDU会话的响应消息等，不作限定。
通过上述方法，可实现终端设备获取动态部署的EES、EAS或ECS的候选认证机制，满足MEC架构的需求。
可选的，所述候选认证机制包括以下至少一项：应用的认证和密码管理AKMA服务，通用引导架构GBA服务，证书机制或其它用于终端设备与第二网元间进行认证的机制等。
通过上述方法，在不同的认证机制下，终端设备均可以获取动态部署的第二网元对应的候选认证机制，实现灵活，适用范围广。
第二方面，提供一种建立安全通信方法，包括：第一网元确定候选认证机制；所述第一网元向终端设备发送第一消息，所述第一消息中包括第二网元的标识以及第一指示信息，所述第一指示信息用于指示第二网元关联的所述候选认证机制，所述候选认证机制用于所述终端设备与所述第二网元间建立通信连接。
通过上述方法，第一网元可以将第二网元对应的候选认证机制指示给终端设备。上述第二网元可以为动态部署的，比如MEC架构中的ECS，EES或EAS等，从而使得终端设备可以动态获取第二网元的候选认证机制，满足MEC架构的需求。
可选的，上述方法还包括：所述第一网元接收来自所述终端设备的第二消息，所述第一消息为所述第二消息的响应消息。
通过上述方法，终端设备可先向第一网元发送第二消息，之后第一网元向终端设备发送第二消息的响应消息，即第一消息。也就是，终端设备在需要获取第二网元对应的候选认证机制时，可直接向第一网元请求，从而使得终端设备可以获取动态部署的第二网元的候选认证机制。
在一种可能的实现方式中，所述候选认证机制为所述终端设备与所述第二网元之间建立通信连接时使用的至少一个第一认证机制，所述第一网元确定候选认证机制，包括：所述第一网元根据所述第二网元所支持的至少一个第三认证机制和辅助信息，确定候选认证机制，所述辅助信息包括以下至少一项：终端设备所支持的至少一个第二认证机制，和所述终端设备接入所述第二网元所使用的网络类型。
通过上述方法，第一网元可以将终端设备和第二网元间建立通信连接时所使用的认证机制直接指示给终端设备，终端设备无需再进一步做判断，降低终端设备侧的处理复杂度，节省电量。
可选的，第二网元在确定候选认证机制时，还可以考虑终端设备接入所述第二网元所使用的网络类型，从而使得选择的候选认证机制可以得到接入网的支持。相应的，上述第二消息中包括所述终端设备支持的至少一个第二认证机制。可选的，第二网元在确定候选认证机制时，还可以考虑优先级信息，比如，终端设备所支持的第二认证机制的优先级信息和第二网元所支持的第三认证机制的优先级信息等，从而使得所选择的候选认证机制是优先级较高的。此时，上述第二消息中还可以包括终端设备所支持的至少一个第二认证机制的优先级信息。
在另一种设计中，所述候选认证机制为所述第二网元所支持的至少一个第三认证机制。
通过上述方法，第一网元直接把第二网元支持的认证机制指示给终端设备，无需做额外处理，且终端设备也无需将自己支持的认证机制通知第一网元，降低第一网元侧的处理过程，节省信令开销。
可选的，在上述方法中，由终端设备根据第二网元支持的认证机制，确定两者间最终的目标认证机制。可选的，终端设备还可以考虑两者认证机制的优先级信息，因此，第一网元需要将自己所支持的认证机制的优先级信息通知终端设备。比如，上述第一消息中还包括所述终端设备所支持的至少一个第三认证机制的优先级信息。
针对上述两种设计，所述第一网元为边缘配置服务器ECS，所述第二网元为边缘使能服务器EES，终端设备可以通过ECS获取EES对应的候选认证机制；或者，所述第一网元为EES，所述第二网元为边缘应用服务器EAS，终端设备可以通过EES获取EAS对应的候选认证机制；或者，所述第一网元为接入和移动性管理功能AMF或者会话管理功能SMF，所述第二网元为边缘配置服务器ECS，终端设备可以通过AMF或SMF获取ECS对应的候选认证机制。在该设计中，上述第一消息可以为非接入层NAS消息。比如，所述第一消息为所述终端设备请求注册的响应消息，或者所述终端设备请求建立协议数据单元PDU会话的响应消息等，不作限定。
通过上述方法，可实现终端设备获取动态部署的EES、EAS或ECS的候选认证机制，满足MEC架构的需求。
可选的，所述候选认证机制包括以下至少一项：应用的认证和密码管理AKMA服务，通用引导架构GBA服务，证书机制或其它用于终端设备与第二网元间进行认证的机制等。
通过上述方法，在不同的认证机制下，终端设备均可以获取动态部署的第二网元对应的候选认证机制，实现灵活，适用范围广。
第三方面，本申请实施例还提供一种装置，该通信装置应用于终端设备，有益效果可参见第一方面的描述此处不再赘述。该装置具有实现上述第一方面的方法实施例中行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的单元。在一种可能的设计中，装置的结构中包括通信单元和处理单元，这些单元可以执行上述第一方面方法示例中的相应功能，具体参见方法实施例中的详细描述，此处不再赘述。
第四方面，本申请实施例还提供一种装置，该通信装置应用于第一网元，有益效果可参见第二方面的描述此处不作赘述。该装置具有实现上述第二方面的方法实例中行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的单元。在一个可能的设计中，装置的结构中包括通信单元和处理单元，这些单元可以执行上述第二方面方法示例中的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第五方面，本申请实施例还提供一种装置，通信装置应用于终端设备，有益效果可以参见第一方面的描述此处不再赘述。通信装置的结构中包括处理器和存储器，处理器被配置为支持终端设备执行上述第一方面方法中相应的功能。存储器与处理器耦合，其保存通信装置必要的程序指令和数据。通信装置的结构中还包括通信接口，用于与其他设备进行通信。
第六方面，本申请实施例还提供一种装置，通信装置应用于第一网元，有益效果可以参见第二方面的描述此处不再赘述。通信装置的结构中包括处理器和存储器，处理器被配 置为支持第一网元执行上述第二方面方法中相应的功能。存储器与处理器耦合，其保存通信装置必要的程序指令和数据。通信装置的结构中还包括通信接口，用于与其他设备进行通信。
第七方面，本申请还提供一种计算机可读存储介质，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面的方法，或执行上述第二方面的方法。
第八方面，本申请还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面的方法，或执行上述第二方面的方法。
第九方面，本申请还提供一种计算机芯片，芯片与存储器相连，芯片用于读取并执行存储器中存储的软件程序，执行上述第一方面的方法，或执行上述第二方面的方法。
附图说明
图1为本申请实施例提供的MEC架构的一示意图；
图2为本申请实施例提供的MEC架构中通信过程的一示意图；
图3为本申请实施例提供的3GPP网络的一示意图；
图4为本申请实施例提供的通信方法的一流程图；
图5为本申请实施例提供的ECS获取EES所支持的至少一个认证机制的流程图；
图6为本申请实施例提供的通信方法的一流程图；
图7为本申请实施例提供的EES获取EAS所支持的至少一个认证机制信息的流程图；
图8为本申请实施例提供的通信方法的另一流程图；
图9为本申请实施例提供的通信方法的又一流程图；
图10为本申请实施例提供的AKMA认证的一流程图；
图11为本申请实施例提供的装置的一结构示意图；
图12为本申请实施例提供的装置的另一结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A，B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施 例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请实施例提供一种多接入边缘计算(multi-access edge computing，MEC)的使能边缘应用架构，如图1所示，至少包含以下功能网元：
边缘应用服务器(edge application server，EAS)，是部署在EDN中的应用服务器。其中，应用提供商可以根据需要在不同的EDN网络中动态实例化EAS。
应用客户端(application client，AC)，是EAS在终端设备侧的对等实体。AC用于应用用户(user)从应用服务器获取应用业务。AC是应用在终端设备中的客户端程序，AC可以连接到云上的应用服务器获取应用业务，也可以连接到部署运行在一个或多个EDN中的EAS以获取应用业务。比如，AC可以为安装在终端设备上的腾讯客户端，爱奇艺客户端，车联网(vehicle to everything，V2X)客户端，或关键任务(mission critical，MC)客户端等。
边缘使能服务器(edge enabler server，EES)，可以为部署在EDN中的EAS提供使能能力。例如，EES可以为EAS提供管理能力，可以支持边缘应用服务器EAS的注册，以获取EAS的标识和EAS支持的认证机制，可选的，还获取EAS支持的认证机制的优先级。EES还可以为终端设备提供可用的EAS的标识和认证相关的信息等。其中，所述认证相关的信息用于终端设备和EAS之间的认证流程。进一步的，EES还可支持将EAS的标识发送给ECS。EES部署在EDN中。一般情况下，EAS注册到一个EES上，或者，通过管理***将一个EAS的信息配置在一个EES上，该EES称为该EAS关联的EES，EES可以控制、管理、注册或配置该EES关联的EAS等。
边缘使能客户端(edge enabler client，EEC)，是EES在终端设备侧的对等实体。EEC用于向EES注册EEC的信息及AC的信息、执行安全认证和鉴权、从EES获取EAS的标识、向AC提供边缘计算使能能力，如EAS发现服务，将EAS的标识返回给AC等。
边缘配置服务器(edge configuration server，ECS)，负责EDN的配置管理，如向终端设备提供EES的信息。
其中，应用用户可以与应用的提供商签订服务协议，从而获得应用提供商的服务器提供的服务。应用用户可以通过登录终端设备上的AC，通过AC与EAS连接进行通信，以使用应用提供商的服务器提供的服务。使能客户端(例如，EEC)可以为中间件层，一般位于操作***中，或者位于AC与操作***中间，也可以实现在AC内部。AC可以通过应用编程接口(application program interface，API)的方式从使能客户端获取边缘使能服务。
在一种设计中，如图2所示，基于上述图1所示的MEC架构，AC获取能够通信的EAS的流程如下：
1、边缘服务提供商根据需要动态部署EDN网络，在EDN网络中部署EES，并根据应用提供商的需求动态实例化具体的EAS。EAS向EES发送注册流程，以便于向EES提供EAS信息。例如，EAS身份标识，端口信息(如全量域名(fully qualified domain name，FQDN)，IP地址或统一资源标识符(uniform resource identifier，URI)等)，和应用客户端的标识(application client identifier，AC ID)等。所述EAS信息使得EES能够根据EEC的请求提供可用的EAS给EEC。
2、EDN网络中的EES向ECS发起注册流程，以便于向ECS提供EES信息，所述EES 信息使得ECS能够根据EEC的请求提供可用的EES给EEC。进一步的，EES还可以在注册流程中向ECS提供注册在EES上的EAS的信息。
3、基于上述注册流程，为了获取边缘应用服务，EEC可首先向ECS请求提供边缘服务，以通过ECS获取可用的EES信息。ECS可以根据EEC的请求向EEC发送可用的EES的信息。
4、EEC根据从ECS获取的EES信息，确定通信的EES，并与确定的EES建立连接，EEC从连接的EES获取具体的提供边缘应用服务的EAS信息。
5、EEC根据获取的EAS信息向AC发送AC对应的EAS信息。
6、AC根据从EEC获取的EAS信息，与EAS建立连接以获取服务。
本申请实施例还提供一种网络架构，如图3所示，包括以下至少一项：终端设备，接入网，核心网，和数据网络(data network，DN)。不同接入网设备之间可通过Xn接口连接，接入网设备与核心网设备之间可通过NG接口连接。
终端设备可以简称为终端，是一种具有无线收发功能的设备，终端设备可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机、平板电脑、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端设备、无人驾驶中的无线终端设备、远程医疗中的无线终端设备、智能电网中的无线终端设备、运输安全中的无线终端设备、智慧城市中的无线终端设备、或智慧家庭中的无线终端设备等。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(seesion initiation protocol，SIP)电话、无线本地环路(wirelees local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来第五代(the 5th generation，5G)网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等。终端设备有时也可以称为用户设备(user equipment，UE)、接入终端设备、车载终端设备、工业控制终端设备、UE单元、UE站、移动站、移动台、远方站、远程终端设备、移动设备、无线通信设备、UE代理或UE装置等。终端设备也可以是固定的或者移动的。本申请实施例对此并不限定。
接入网用于实现无线接入有关的功能，接入网可以为特定区域的终端设备提供入网功能，包括无线接入网(radio access network，RAN)设备和接入网(access network，AN)设备。RAN设备主要是3GPP网络中定义的无线网络设备，AN设备主要是非3GPP定义的接入网设备。RAN设备可以为终端设备提供无线资源管理、服务质量管理、数据加密和压缩等功能。
核心网主要用于对终端设备进行管理，并提供与外网通信的功能。核心网设备可包括以下中的一个或多个网元：
接入和移动管理功能(accees and mobility management function，AMF)网元：主要负责移动网络中的移动性管理，如用户位置更新、用户注册网络、用户切换等。
会话管理功能(session management function，SMF)网元：主要用于会话管理、终端设备的IP地址分配和管理，选择用户平面功能，策略控制或收费功能接口的终结点以及下行数据通知等。
用户面功能(user plane function，UPF)网元：主要负责用户数据的转发和接收。在 下行传输中，UPF网元可以从数据网络(data network，DN)接收用户数据，通过接入网设备传输给终端设备；在上行传输中，UPF网元可以通过接入网设备从终端设备接收用户数据，向DN转发该用户数据。可选的，UPF网元中为终端设备提供服务的传输资源和调度功能可以由SMF网元管理控制。
认证服务功能(authentication server function，AUSF)网元：主要用于对用户鉴权等。
网络开放功能(network exposure function，NEF)网元：主要用于支持能力和事件的开放，如用于安全地向外部开放由3GPP网络功能提供的业务和能力等。
网络存储功能(network function，NF，repository function，NRF)网元：用于保存网络功能实体以及其提供服务的描述信息，支持服务发现，和网元实体发现等。
策略控制功能(policy control function，PCF)网元：用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF，SMF网元等)提供策略规则信息，负责获取与策略决策相关的用户签约信息等。
统一数据管理(unified data management，UDM)网元：用于生成认证信任状，用户标识处理(如存储和管理用户永久身份等)，接入授权控制和签约数据管理等。
网络切片特定认证和授权功能(network slice specific authentication and authorization function，NSSAAF)网元：用于支持切片认证和授权、重授权或授权撤销等相关的流程。
除此之外，上述核心网中还可能包括NSSF，AF，和SCP等网元，不再一一介绍。需要说明的是，在不同的通信***中，上述核心网中的网元可以有不同的名称。在上述图1所示的示意图中，是以第五代移动通信***为例进行说明的，并不作为对本申请的限定。
DN可以是为用户提供数据传输服务的网络。例如，DN可以是IP多媒体业务(IP multi-media service)网络或互联网络等。DN中可包括多个应用服务器。其中，终端设备可以建立从终端设备到DN的协议数据单元(protocol data unit，PDU)会话，来访问DN。其中，一个数据网络可以有一个或多个本地数据网络(local data network，Local DN)，这些本地数据网络为靠近用户附着点(point of attachment)的数据网络接入点(access point)。
在本申请实施例中，上述图1所示架构中的EES和EAS可以配置于上述一个或多个EDN中。与EDN对应的为远端DN或中心DN，EDN中部署的应用服务器称为EAS，远端DN或中心DN中部署的服务器为远端服务器或中心服务器。每个EAS可以就近为用户提供应用服务，中心服务器或远端服务器可以为所有用户提供应用服务。
由于EDN网络可以根据需求动态部署，比如上海地区A举行大型活动，人流较大，可以在该地方部署一个EDN网络，以供附近人员接入。后续该大型活动结束后，还可以撤销地区A部署的EDN网络。可选的，针对每个EDN网络中的EES和EAS也是可以动态部署的，比如新上市一款游戏，且地区B大量聚集该游戏的青年，可以在地区B的EDN网络中实例化提供该游戏服务的EAS。可见，在MEC架构中，EES，EAS甚至ECS都是动态部署的，终端设备无法通过预配置的方式获知动态部署的EES、EAS和ECS所支持的认证机制。
在一种可能的竞争方案中，由于终端设备不知道服务器(如EES、EAS或ECS)所支持的认证机制，终端设备直接向服务器发送通信连接建立请求，该通信连接建立请求中可以不携带任何认证信息。由于该通信连接建立请求中没有携带任何认证信息，服务器会指示终端设备采用自己支持的认证机制发送通信连接建立请求。例如，服务器会向终端设备发送通信建立连接响应，该信建立连接响应可指示终端设备采用服务器支持的认证机制发 起通信连接建立请求等。终端设备接收到该通信建立连接响应，根据该通信建立连接响应的指示，再次发起通信连接建立请求，不同的是该通信连接建立请求中此时携带有服务器所支持的认证机制对应的认证信息。服务器接收到该再次发起的通信连接建立请求时，建立两者的通信连接。
通过上述对比可以看出，该竞争方案虽然可以在客户端和服务器之间通过认证以建立安全的通信连接，但是会存在如下问题：1、对于终端设备来说发送了两次通信连接建立请求，并且需要处理两次通信连接建立响应，浪费了信令；2、在终端设备第一次发送了通信连接建立请求，并接收到对应的通信连接建立响应之后，终端设备需要根据对应的认证机制生成认证信息，并进一步的向服务器发送通信连接建立请求，从终端设备第一次发送通信连接建立请求到最终与服务器间建立安全的通信连接，时延较长，对用户的通信体验影响较大。特别是在MEC场景下，对通信时延敏感，这种影响在某些场景下可能是不可接受的。
基于上述，本申请实施例提供一种建立安全通信方法，利用该方法终端设备可以获知动态部署的EES、EAS或ECS所支持的至少一个认证机制，适用于MEC架构下，使得客户端与服务器之间执行认证建立安全的通信连接，该方法包括：终端设备接收来自第一网元的第一消息，第一消息中包括第二网元的标识以及第一指示信息，第一指示信息用于指示与第二网元关联的候选认证机制；可选的，上述第二网元的标识与第一指示信息可以通过同一个消息传输给终端设备，比如上述第一消息，还可以通过不同的消息传输给终端设备，不作限定。上述第二网元的标识可以为第二网元的统一资源标识符(uniform resource identifier，URI)，全量域名(fully qualified domain name，FQDN),或互联网协议(internet protocol，IP)地址等。终端设备根据候选认证机制，与第二网元之间建立通信连接。其中，上述第二网元可以为EES、EAS或ECS等，上述候选认证机制可以为第二网元所支持的认证机制，或者为第二网元与终端设备间建立通信连接所使用的认证机制等，不作限定。示例的，上述终端设备基于候选认证机制，与第二网元之间建立通信连接的过程可以为：终端设备基于候选认证机制，向第二网元发送通信连接建立请求，该通信连接建立请求中携带有上述候选认证机制对应的认证信息(例如下文中的Kakma的密钥标识)。第二网元接收到该通信连接建立请求后，根据认证信息对终端设备进行验证，验证通过后，可获取终端设备与第二网元间安全通信使用的密钥，从而使得终端设备与第二网元间建立安全的通信连接。在一种可能的实现方式中，上述认证信息可以为密钥标识，第二网元在接收到通信连接建立请求时，可向3GPP网元发送密钥标识。可选的，在发送密钥标识前，3GPP网元与第二网元之间执行相互认证，认证通过后。3GPP网元根据密钥标识获取第二网元的密钥，并向第二网元发送所述密钥。第二网元通过与3GPP网元的交互，第二网元获取与UE之间共享的同一个密钥。进一步的，第二网元与UE之间可以基于共享的密钥执行进一步的认证并建立通信连接。
可选的，本申请实施例中的方法，还可以包括：终端设备向第一网元发送第二消息，所述第一消息为第二消息的响应消息。需要说明的是，本申请实施例中的第一网元可以是能够提供其它网元的标识以及其它网元对应的候选认证机制的网元。第二网元也不限定为ECS，ESS或EAS等，比如第二网元可以是能够使得第一网元能够获取其标识和对应候选认证机制的网元。本申请实施所涉及的认证机制可以包括以下至少一项：应用的认证和密钥管理(authentication and key management for applications，AKMA)服务，通用引导架构 (generic bootstrapping architecture GBA)服务，证书机制，EES的信任状(credentials)或者其它用于终端设备与第二网元之间认证的机制。需要说明的是，若终端设备与第二网元之间使用证书认证，则以下实施例中的第二网元(例如，ECS，EES或EAS等)所支持的至少一个认证机制可替换为“用于认证第二网元证书的信息”，如证书颁发机构(certificate authority，CA)公钥等，终端设备所支持的至少一个认证机制可替换为“用于认证UE证书的信息”等。
实施例一
在实施例一中，以终端设备为UE，UE包括AC和EEC，第一网元为ECS，第二网元为EES，第二消息为提供请求(provisioning request)消息，第一消息为提供响应(provisioning response)消息为例，进行说明。
如图4所示，提供一种通信方法的流程，包括：
可选的，步骤400：ECS获取EES所支持的至少一个认证机制。可选的，ECS还可以获取EES所支持的至少一个认证机制中一个或者多个认证机制的优先级信息。
其中，ECS可以通过预配置的方式，获取EES所支持的至少一个认证机制和其对应的优先级信息。或者，ECS可以通过与EES交互的方式，获取EES所支持的至少一个认证机制和其对应的优先级信息等，例如当EES实例化成功之后，可以通过主动注册的方式，将自己所支持的至少一个认证机制和其对应的优先级信息发送给ECS等。本申请实施例对于ECS获取EES的信息的具体方式，不作限定。
步骤401：EEC向ECS发送提供请求消息，该提供请求消息中包括UE标识和应用客户端配置文本信息。
具体的，EEC可以根据预配置的ECS地址或发现的ECS地址或来自AC的ECS地址，向ECS发送提供请求消息等。
其中，UE标识用于在公共陆地移动网络(public land mobile network，PLMN)网络中唯一的标识UE，例如可以为通用公共用户标识(generic public subscription identifier，GPSI)，本申请实施例并不限定UE标识的具体实现形式。应用客户端配置文本信息中包含用于确定UE中应用程序客户端AC所需服务和服务特征的信息等。例如，应用客户端配置文本中可以包括AC ID，应用客户端类型，业务连续性是否必须支持等。其中，AC ID用于标识终端设备上的特定应用，应用客户端类型可以是V2X类型等。
步骤402：ECS接收提供请求消息。可选的，ECS检验EEC是否被授权获取边缘服务器的信息。
示例的，ECS中存储有其授权的合法EEC的信息，只有其授权的合法EEC才能获取边缘服务器的信息。在本申请实施例中，ECS可具体判断在其存储的合法EEC列表中，是否包含上述发送提供请求消息的EEC，若包含，则对该EEC的授权检查通过，否则对该EEC的授权检查不通过。具体如何判断EEC是否授权获取边缘服务器的信息，本实施例不限制。
步骤403：ECS向EEC发送提供响应消息。
其中，若上述EEC的授权检查通过，则上述提供响应消息中可以包括EES的标识和第一指示信息，第一指示信息用于指示与EES关联的候选认证机制。或者，若上述EEC的授权检查不通过，则上述提供响应消息中可携带第二指示信息，该第二指示信息用于指 示EEC的授权检查失败等。
在一种可能的实现方案中，在EEC授权检查通过后，ECS可根据上述提供请求消息中携带的应用客户端配置文本信息，确定其对应的EDN配置信息；ECS向EEC发送的提供响应消息中可携带有上述EDN配置信息。其中，EDN配置信息中包括EES信息，和EDN连接信息等。其中，EES信息中包括EES标识，EES标识可以为EES的FQDN，URL或IP地址等，不作限定。EDN连接信息用于UE与EDN间建立PDU会话，EDN连接信息中可包括数据网络名(data network name，DNN)，接入点名(access point name，APN)等。可选的，上述EDN配置信息中还可以包含单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)和EDN服务区等。在本申请实施例中，所述EDN配置信息中还可以包括用于指示EES关联的候选认证机制的第一指示信息等。
需要说明的是，为了便于描述，在某个消息/信息中携带有认证机制的指示信息，还可描述为在某个消息/信息中携带有认证机制，两者不作区分，可相互替换。如无额外说明，在下述描述中，统一表示为在某个消息/信息中携带有认证机制。
步骤404：EEC根据候选认证机制，与EES间建立通信连接。
为了便于区分不同的认证机制，在以下描述中，采用三种表示方式：ECS所确定的UE与EES间通信所使用的认证机制称为第一认证机制；UE所支持的认证机制可以称为第二认证机制；EES所支持的认证机制可称为第三认证机制。可以理解的是，由于UE中包括AC或EEC，所以在本申请实施例的以下描述，UE所支持的认制机制，有时也可以描述为EEC或AC支持的认证机制。EEC或AC与第二网元间建立通信连接，也可以描述为UE与第二网元间建立通信连接。当然，第二网元包括但不限于ECS，EES，或EAS等。
在一种设计中，上述候选认证机制为EES所支持的至少一个第三认证机制。上述提供响应消息中携带有EES所支持的至少一个第三认证机制。可选的，该提供响应消息中还可以携带EES所支持的至少一个第三认证机制的优先级信息。EEC根据EES所支持的至少一个第三认证机制和辅助信息，确定目标认证机制，所述辅助信息中包括以下至少一项：UE所支持的至少一个第二认证机制，和UE接入EES所使用的网络类型等。可选的，上述辅助信息中还可以包括：UE所支持的至少一个第二认证机制的优先级信息，和EES所支持的至少一个第三认证机制的优先级信息。
具体的，当所述辅助信息中包括UE所支持的至少一个第二认证机制时，EEC可以将UE和EES都支持的认证机制，确定为目标认证机制。比如，EES所支持的至少一个认证机制包括A，B和C，UE所支持的至少一个认证机制包括C、D和E，则目标认证机制包括C。
当所述辅助信息中包括UE接入EES所使用的网络类型时，所述目标认证机制可以为网络类型对应的认证机制。比如，EES支持的认证机制包含AKMA和GBA，且AKMA机制为基于5G网络的认证机制，GBA机制为基于4G网络的认证机制，此时如果UE当前接入网络为5G网络，则UE确定所述目标认证机制为AKMA；或者，如果UE的当前接入网络为4G网络，则UE确定所述目标认证机制为GBA。
可选的，EEC还可以考虑不同认证机制的优先级信息，优先选择优先级高的认证机制。例如，当所述辅助信息中包括所述EES所支持的至少一个第三认证机制的优先级信息时，则UE可以优先选择优先级高的认证机制作为目标认证机制。
之后，EEC生成与目标认证机制对应的第一密钥和第一密钥标识。在一种可能的实现 方式中，EEC还可向终端设备的底层请求目标认证机制对应的信息，终端设备底层的底层根据目标认证机制对应的信息，生成第一密钥和第一密钥的标识，终端设备底层向EEC发送第一密钥标识等；EEC向EES发送通信连接建立请求，该通信连接建立请求中包括第一密钥标识。可选的，终端设备底层还可以根据第一密钥和EES的标识，生成第二密钥，并向EEC发送第二密钥；EEC使用第二密钥对通信连接建立请求进行安全保护，比如根据第二密钥和通信连接建立请求中的全部信息或部分信息生成第一消息认证码(message authentication code，MAC)；其中，所述通信连接建立请求中包括第一MAC。EES在接收到通信连接建立请求时，可获取通信连接建立请求中的第一密钥标识；EES根据第一密钥标识，获取第二密钥，比如，EES可将第一密钥标识，发送给用于支持目标认证机制的3GPP网元，该3GPP网元可根据密钥标识与密钥的对应关系，获取第一密钥标识所对应的第一密钥，且根据第一密钥和EES的标识，生成第二密钥，将第二密钥返回给EES；EES根据第二密钥，生成第二MAC；比较生成的第二MAC与上述通信连接建立请求中携带的第一MAC是否相同；若相同，可认为验证通过，否则，认为验证不通过。其中，EES对UE的验证通过，可表示以含义：EES可以认为从UE接收到的信息没有被攻击者篡改，且UE为被3GPP网元验证过的合法UE等。进一步的，UE与EES之间可以根据第二密钥进一步协商后续通信所使用的安全上下文，所述安全上下文包含加密密钥和/或完整性保护密钥等，对应的加密算法，和完整性保护算法等。在一种示例中，EES可以通过NEF向用于支持目标认证机制的3GPP网元发送第一密钥标识等。进一步的，在EES获取第二密钥的过程中，3GPP网元与EES之间可以执行双向认证，只有合法的通过认证的EES才可以获取第一密钥标识对应的第二密钥。
在另一种设计中，所述候选认证机制为EEC与EES之间建立通信连接时使用的至少一个第一认证机制。该方法的实现过程可如下：上述提供请求消息中可携带有UE所支持的至少一个第二认证机制。可选的，该提供请求消息中还可以携带以下至少一项：UE所支持的至少一个第三认证机制的优先级信息，和UE接入EES使用的网络类型等。ECS根据ECS所支持的至少一个第三认证机制和辅助信息，确定候选认证机制，该辅助信息中至少包括UE所支持的至少一个第三认证机制，和UE接入EES使用的网络类型。可选的，该辅助信息中还可以包括以下至少一项：UE所支持的至少一个第二认证机制的优先级信息，和EES所支持的至少一个第三认证机制的优先级信息等。上述提供响应消息中可以携带有上述候选认证机制。EEC接收来自ECS的提供响应消息，获取该提供响应消息中的候选认证机制；可以理解的是，若上述候选认证机制中只包括一个第三认证机制，则EEC可直接根据该第三认证机制，与EES之间建立通信连接，该第三认证机制可以认为即为目标认证机制；或者，当上述候选认证机制中包括多个认证机制，EEC可以在上述多个认证机制中，选择一个认证机制，建立通信连接，所选择的认证机制即为目标认证机制。EEC与EES之间建立通信连接的过程，可参见上述描述，不再赘述。
可选的，在上述几种设计中，都是以EEC根据候选认证机制，确定目标认证机为例进行描述的，并不作限对本申请的限定。UE中的其它模块也可以执行根据候选认证机制，确定目标认证机制的过程。
需要说明的是，在本申请的描述中，主要涉及UE所支持的至少一个认证机制的优先级信息，和EES所支持的至少一个认证机制的优先级信息。所述优先级信息可以采用显示指示的方式，例如，EES所支持的多个认证机制分别为认证机制A，认证机制B和认证机 制C。则EES所支持的多个认证机制的优先级信息可分别为认证机制A的优先级信息0，认证机制B的优先级信息1，认证机制C的优先级信息2。其中，优先级信息的取值越小，代表其对应的优先级越高。或者，所述优先级信息也可以采用隐示指示的方式，所述优先级信息还可称为优先级规则。仍沿用上述举例，可将上述三个认证机制按优先级规则进行排序。后续UE可根据上述优先级排序规则，确定EES所支持的多个认证机制的优先级。比如，UE与EES间可预先协商，优先级越高的，排列位置越靠前。假设EES所支持的3个认证机制的排列顺序为：认证机制C，认证机制A，认证机制B。UE在接收到上述3个认证机制后，可根据上述3个认证机制的接收顺序，确定3个认证机制的优先级分别为：认证机制C，认证机制A，和认证机制B等。再例如，EES所支持的3个认证机制可以包括推荐的认证机制，比如优先级信息可以是：认证机制C(推荐)，认证机制A，和认证机制B，则表明认证机制C的优先级最高，认证机制A和认证机制B的优先级次之，且两者的优先级相同。
需要说明的是，上述各种优先级信息举例只是为了便于说明，实际应用中上述优先级信息的举例可以互相组合，以形成各种灵活的优先级规则。本申请对此不做限定。例如，可以只显示指定高(或低)优先级的认证机制，其他认证机制的优先级按照排序确定优先级高低。本申请中优先级信息能够体现EES或者UE支持的至少一个认证机制中不同认证机制的优先级差异。
根据上述方法，EEC通过与ECS交互，可以获取EES对应的候选认证机制，EEC与EES间可基于候选认证机制建立通信连接，减少信令开销，降低建立通信时延，提高通信体验。
如图5所示，提供一种通信方法的流程，该流程可用于ECS与EES交互，以获取EES所支持的至少一个认证机制，包括：
步骤501：EES向ECS发送边缘使能服务注册或更新请求(edge enabler server registration/update request)消息，该注册或更新请求消息中包括EES标识(如URI，FQDN，IP地址等)，EAS配置等。
在本申请实施例中，上述注册或更新请求消息中还包括EES所支持的至少一个认证机制，或者，EES提供商标识。可选的，上述注册或更新请求消息中还可以包括EES所支持的至少一个认证机制的优先级信息。其中，上述EES所支持的至少一个认证机制可以为用户按需设置的，或者预配置的默认值等，不作限定。下述实施例中的，EAS或EC所支持的至少一个认证机制，同样可以为用户按需设置，或预配置的默认值等，后续不再说明。
步骤502：接收到EES的注册或更新请求消息后，ECS验证EES是否被授权。若被授权，则存储上述注册或更新请求消息中的信息。
在一种设计中，若上述注册或更新请求消息中包括EES所支持的至少一个认证机制，则ECS直接存储EES所支持的至少一个认证机制。可选的，ECS还可以存储所述至少一个认证机制的优先级信息。在另一种设计中，若上述注册或更新请求消息中包括EES提供商标识，则ECS可根据上述EES提供商标识，确定EES所支持的至少一个认证机制。例如，ECS存储该EES提供商所对应的至少一个认证机制，可选的还可以存储该EES提供商所对应的至少一个认证机制的优先级信息等。后续，ECS可根据存储的EES提供商与认证机制的对应关系，确定所述EES所支持的至少一个认证机制，可选的，还可以确定至少一个认证机制的优先级信息。
步骤503：ECS向EES发送边缘使能服务注册或更新响应消息，该响应消息中包括注册/更新成功或失败的指示信息。可选的，该响应消息中还可以包括失效时间，用于指示注册或更新失效的时间。可选的，针对注册请求，响应消息中还可以包含注册ID。
通过上述方案，ECS通过与EEC交互，可获取EES所支持的至少一个认证机制和其对应的优先级信息等。
实施例二
在该实施例二中，以终端设备为UE，UE包括AC和EEC，第一边缘服务器为EES，第二边缘服务器为EAS，第二消息为边缘使能客户端注册请求(edge enabler client registration request)消息，第一消息为边缘使能客户端注册响应(edge enabler client registration response)消息为例，进行说明。
如图6所示，提供一种通信方法的流程，包括：
可选的，步骤600：EES获取EAS所支持的至少一个认证机制。可选的，EES还可以获取EAS所支持的至少一个认证机制的优先级信息。
示例的，EES可以通过预配置的方式，获取EAS所支持的至少一个认证机制与其所对应的优先级信息，或者EES还可以通过与EAS交互的方式，获取EAS所支持的至少一个认证机制与其所对应的优先级信息。例如，当EAS实例化成功之后，可以通过主动注册的方式，将自己所支持的至少一个认证机制和其对应的优先级信息发送级EES。本申请实施例对于EES获取EAS信息的方式不作限定。
步骤601：EEC向EES发送边缘使能客户端注册请求消息，该请求消息中包含EEC ID和应用客户端配置文件。
具体的，EEC可根据从ECS获取的EES信息，向EES发送边缘使能客户端注册请求消息等。
其中，应用客户端配置文件中可包括AC ID，EAS ID(用于标识请求发现的EAS)，和边缘服务器提供商等。其中，EEC ID用于唯一标识一个EEC。EAS ID用于标识一个特定的应用。可选的，上述边缘使能客户端注册请求消息中还可以包括以下至少一项：UE ID，上下文ID(context ID)，分配上下文ID的EES ID(又称为源EES ID)，和EAS ID(用于标识已发现的EAS)等。其中，上下文ID用于标识上一次EEC注册的上下文等。
步骤602：EES接收边缘客户端注册请求消息。可选的，EES可执行授权检查，即EES检查EEC是否被授权请求发现的EAS。
示例的，若EEC的授权检查通过，则在下述步骤804中的边缘使能客户端注册响应消息中可以携带授权发现的EAS ID和指示授权发现的EAS关联的候选认证机制的第一指示信息。否则，在下述步骤804中的边缘使能客户端注册响应消息中可以携带请求失败的第二指示信息等。
可选的，步骤603：EEC授权检查通过后，如果上述步骤801中的边缘使能客户端注册请求消息中包含上下文ID和源EES ID，则EES从源EES中获取注册上下文。若请求消息中不包括上下文ID和源EES ID，则跳过该步骤。EES按照正常流程，获取注册上下文。
上述步骤603主要是针对移动场景所设计的。比如用户在上海移动到北京，则原来由上海的EDN网络为用户提供服务，后续需要由北京的EDN网络为用户提供服务。北京的EDN网络，可以去上海的EDN网络中获取相关的信息。
步骤604：EES向EEC发送边缘使能客户端注册响应消息。
在一种可能的实现方案中，若EEC授权检查通过，则所述边缘使能客户端注册响应消息中可包括EAS信息列表。比如，EEC授权检查通过后，EES可根据注册上下文，确定客户端配置文件指示的EAS信息列表。EAS信息列表中包含EAS ID等，EASID用于AC向EAS发送请求。可选的，EAS信息列表中还可以包含EAS提供商标识，EAS可用的存储等。在本申请实施例中，所述EAS信息列表中还可以包括EAS对应的候选认证机制。
为了便于区分不同的认证机制，在以下描述中，采用三种表示方式：EES所确定的UE与EAS间通信所使用的认证机制称为第一认证机制；UE所支持的认证机制可以称为第二认证机制；EAS所支持的认证机制可称为第三认证机制。
在一种设计中，所述候选认证机制为EAS所支持的至少一个第三认证机制。所述边缘使能客户端注册响应消息中包括EAS所支持的至少一个第三认证机制。可选的，该边缘使能客户端注册响应消息中还可以包括EAS所支持的至少一个第三认证机制的优先级信息。EEC接收边缘使能客户端注册响应消息，获取该边缘使能客户端注册响应消息中的EAS所支持的至少一个第三认证机制。可选的，还可以获取EAS所支持的至少一个第三认证机制的优先级信息。EEC根据EAS所支持的至少一个认证机制和辅助信息，确定目标认证机制，所述辅助信息中至少包括以下至少一项：UE所支持的至少一个第二认证机制，和UE接入EAS所使用的网络类型。可选的，辅助信息中还可以包括以下至少一项：UE所支持的至少一个认证机制的优先级信息，和EAS所支持的至少一个认证机制的优先级信息。可选的，EEC可从非接入层(non-access stratum，NAS)层或其它层获取UE所支持的至少一个认证机制中的优先级信息，或UE接入EAS使用的网络类型等。之后，EEC向AC发送EAS信息提供消息，该EAS信息提供消息中包括候选认证机制，AC根据目标认证机制，与EAS间建立通信连接，上述目标认证机制包括在上述至少一个第三认证机制中的一个认证机制中。关于AC与EAS间建立通信连接的过程，与EEC与EES间建立通信连接的过程相似，可相互参见。
在另一种设计中，所述候选认证机制为EAS所支持的至少一个第三认证机制。所述边缘使能客户端注册响应消息中包括EAS所支持的至少一个第三认证机制。可选的，该边缘使能客户端注册响应消息中还可以包括EAS所支持的至少一个第三认证机制的优先级信息。EEC接收边缘使能客户端注册响应消息，获取该边缘使能客户端注册响应消息中的EAS所支持的至少一个第三认证机制。可选的，还可以获取EAS所支持的至少一个认证机制的优先级信息。EEC向AC发送EAS所支持的至少一个第三认证机制。可选的，EEC还可以向AC发送EAS所支持的至少一个认证机制的优先级信息。AC根据EAS所支持的至少一个第三认证机制和辅助信息，确定目标认证机制，所述辅助信息中包括以下至少一项：UE所支持的至少一个第二认证机制，和UE接入EAS所使用的网络类型。可选的，辅助信息中还可以包括以下至少一项：UE所支持的至少一个第二认证机制的优先级信息，和EAS所支持的至少一个第三认证机制的优先级信息。示例的，AC可以从NAS层或其它层获取UE所支持的至少一个第二认证机制的优先级信息，和/或UE接入EAS使用的网络类型等。之后，AC根据目标认证机制，与EAS间建立通信连接。关于AC与EAS间建立通信连接的过程，与EEC与EES间建立通信连接的过程相似，可相互参见。
在另一种设计中，所述候选认证机制为AC与EAS之间建立通信连接时所使用的至少一个第一认证机制。所述边缘使能客户端注册请求消息中包括UE的能力信息，UE的能力 信息包括UE所支持的至少一个第二认证机制。可选的，UE的能力信息中还可以包括：UE接入EAS所使用的网络类型，和UE所支持的至少一个认证机制的优先级信息。EES根据EAS所支持的至少一个第三认证机制和辅助信息，确定候选认证机制，辅助信息中包括以下至少一项：UE所支持的至少一个第二认证机制，和EAS所支持的至少一个第三认证机制。可选的，辅助信息中还可以包括以下至少一项：UE所支持的至少一个第二认证机制的优先级信息，和EAS所支持的至少一个第三认证机制的优先级信息。EES向EEC发送边缘客户端注册响应消息，该边缘客户端注册响应消息中包括上述候选认证机制。如果上述候选认证机制中包括一个认证机制，则该认证机制作为目标认证机制。或者，如果上述候选认证机制中包括多个认证机制，则可以在上述多个认证机制中选择一个认证机制，作为目标认证机制等。之后，EEC可向AC发送EAS信息提供消息，该EAS信息提供消息中包括目标认证机制；AC根据目标认证机制，与EAS之间建立通信连接。或者，EEC可将候选认证机制直接发送给AC；AC根据候选认证机制，确定目标认证机制等，不作限定。
需要说明的是，在上述几种设计中，分别是以EEC或AC根据候选认证机制，确定目标认证机制为例进行说明的，并不作为本申请实施例的限定。比如，在本申请实施例中，还可以为UE中的其它模块执行上述根据候选认证机制，确定目标机制的过程。不同的是，上述其它模块需要把目标认证机制最终通知AC。
步骤605：EEC向AC发送EAS信息提供消息，该EAS信息提供消息中包含AC对应的EAS的目标认证机制，或者，包括AC对应的EAS的候选认证机制。
步骤606：AC在向EAS发起请求时，根据从EEC接收的EAS对应的候选认证机制或目标认证机制，与EAS间建立通信连接。
通过上述可以看出，UE通过与EES交互，可获取EAS对应的候选认证机制，EEC与EAS之间无需再进行认证的协商流程，减少了信令开销，降低建立通信时延，提高通信体验。
如图7所示，提供一种通信方法的流程，该流程可以用于EES与EAS交互获取EAS所支持的至少一个认证机制，该流程包括：
可选的，步骤701：EAS确定需要注册到EES。
步骤702：EAS向EES发送边缘应用服务注册或更新请求(edge application server registration/update request)消息。该注册或更新请求消息中包含以下至少一项：EAS标识和EAS配置。可选的，该注册或更新请求消息中还可以包含EAS服务区，和EAS类型等。
在一种设计中，上述注册或更新请求消息中包含EAS所支持的至少一个认证机制。在另一种设计中，上述注册或更新请求消息中包括EAS提供商ID。可选的，该注册或更新请求消息中还可以包括EAS所支持的至少一个认证机制的优先级信息。
步骤703：接收到EAS的注册或更新请求消息后，EES对EAS进行授权检查，验证EAS是否被授权。如果被授权，则存储上述注册或更新请求消息中的信息。
在一种设计中，若上述注册请求或更新请求消息中包括EAS所支持的至少一个认证机制，则EES直接存储EAS所支持的至少一个认证机制。在另一种设计中，若上述注册或更新请求消息中包括EAS提供商ID，则EES可根据提供商与认证机制的对应关系，确定上述EAS提供商ID所对应的至少一个认证机制，该提供商ID所对应的至少一个认证机 制可以认为是EAS所支持的至少一个认证机制。
步骤704：EES向EAS发送边缘应用服务注册或更新响应消息，该响应消息中包含注册/更新成功或失败的指示。可选的，该响应消息中还可以包含失效时间，该失效时间用于指示注册或更新失效的时间。针对注册请求，该响应消息中还可以包含注册ID。可选的，EES还可以存储EAS所支持的至少一个认证机制的优先级信息。
通过上述方案，EES通过与EAS交互，可以获取EAS所支持的至少一个认证机制和其对应的优先级信息。
实施例三
在该实施例三中，以终端设备为UE，第一网元为AMF，第二消息为终端设备的注册请求消息，第一消息为终端设备的注册请求的响应消息为例，介绍本申请实施中的方案。
如图8所示，提供一种通信方法的流程，至少包括以下步骤：
可选的，步骤800：对于签约使用边缘服务的UE，UDM的接入和移动性管理用户签约信息中包含UE能够使用的ECS信息，ECS信息中包含以下至少一项：ECS标识和ECS所支持的至少一个认证机制。可选的，所述ECS信息中还可以包含ECS所支持的至少一个认证机制的优先级信息。
步骤801：UE通过接入网节点向AMF发送注册请求消息，该注册请求消息中包含UE标识。可选的，该注册请求消息中还可以包含以下至少一项：UE所支持的至少一个认证机制，UE是否支持边缘使能客户端的指示信息，和UE所支持的至少一个认证机制的优先级信息。
例如，在一种可能的实现方式中，上述注册请求消息中包含UE标识和UE能力，该UE的标识可以为用户隐藏标识(subscription concealed identifier，SUCI)或全球唯一临时标识(globally unique temporary identity，5G-GUTI)或映射的5G-GUTI等。UE能力中包含以下至少一项：UE支持的至少一个认证机制，UE是否支持边缘使能客户端的指示信息，和UE所支持的至少一个认证机制的优先级信息。
步骤802：接收到UE的注册请求消息之后，当AMF需要获取签约信息时，AMF可向UDM发送签约数据管理获取请求(Nudm_subscriber data management get,Nudm_SDM_Get)请求消息，该请求消息中包含UE的标识。可选的，该请求消息中还以包含UE的能力信息。该UE的标识为根据步骤801中的UE标识确定的，可以为用户永久标识(subscription permanent identifier,SUPI)。
步骤803：UDM根据Nudm_SDM_Get请求消息中包含的UE的标识，获取UE的签约信息，并向AMF发送Nudm_SDM_Get响应消息，该响应消息中包含ECS信息，所述ECS信息中包含以下至少一项：ECS标识和ECS关联的候选认证信息。关于UDM如何获取ECS对应的候选认证信息将在下述实施例中详细介绍。
步骤804：AMF接收到UDM发送的Nudm_SDM_Get响应消息，获取响应消息中的ECS信息，且向UE发送ECS信息。在一种设计中，AMF可以通过注册响应消息向UE发送ECS信息，可参见步骤804a所示；或者，AMF可以通过独立的配置流程UE配置更新(UE configuration update，UCU)流程向UE发送ECS信息，可参见步骤804b所示。
步骤805：UE的NAS层向对应的EEC发送接收到的ECS信息。NAS层可以直接向EEC发送接收到的ECS信息，或者间接的通过上层向EEC发送ECS信息。
步骤806：EEC根据ECS信息中所包括的候选认证机制，与ECS之间建立通信连接。
为了便于区分不同的认证机制，在以下描述中，采用四种表示方式：AMF所确定的UE与ECS间通信所使用的认证机制称为第一认证机制；UE所支持的认证机制可以称为第二认证机制；ECS所支持的认证机制可称为第三认证机制；将UDM确定的UE与ECS间通信所使用的认证机制作为第四认证机制。
在一种设计中，所述候选认证机制为所述ECS所支持的至少一个第三认证机制。Nudm_SDM_Get响应消息中包括ECS所支持的至少一个第三认证机制。可选的，Nudm_SDM_Get响应消息还可以包括ECS所支持的至少一个第三认证机制的优先级信息。AMF在接收到Nudm_SDM_Get响应消息时，获取ECS所支持的至少一个第三认证机制。可选的，AMF还可以获取ECS所支持的至少一个第三认证机制的优先级信息。AMF向UE发送注册响应消息，或UCU流程，该注册响应消息或UCU流程中携带有ECS所支持的至少一个第三认证机制。可选的，该响应消息或UCU流程中还可包括ECS所支持的至少一个第三认证机制中的优先级信息。UE根据ECS所支持的至少一个第三认证机制与辅助信息，确定目标认证机制，所述辅助信息中至少包括：UE所支持的至少一个第二认证机制，和UE接入ECS使用的网络类型。可选的，辅助信息中还可以包括以下至少一项：UE所支持的至少一个认证机制的优先级信息，和ECS所支持的至少一个认证机制的优先级信息。后续，UE根据目标认证机制与ECS之间，建立通信连接。其中，UE与ECS之间建立通信连接的过程，与EEC与EES之间建立通信过程的过程相似，可相互参见。
可选的，上述UE与ECS之间建立通信连接，还可以描述为EEC与ECS之间建立通信连接。可具体由UE中的NAS层执行上述“根据ECS所支持的至少一个认证机制和辅助信息，确定目标认证机制”的过程，之后NAS层将上述目标认证机制发送给EEC，EEC根据该目标认证机制与ECS之间建立通信连接。
在另一种设计中，所述候选认证机制为所述EEC与ECS通信时所使用的至少一个第一认证机制。上述注册请求消息中可携带UE的能力信息，UE的能力信息中包括UE支持的至少一个第二认证机制，UE接入ECS使用的网络类型，UE支持的至少一个第二认证机制的优先级信息。AMF接收注册请求消息，获取UE的能力。当AMF需要获取签约信息，向UDM发送Nudm_SDM_Get请求消息。AMF接收来自UDM的Nudm_SDM_Get响应消息，该Nudm_SDM_Get响应消息中包括ECS所支持的至少一个第三认证机制。可选的，该响应消息中还可以包括ECS所支持的至少一个第三认证机制的优先级信息。AMF根据ECS所支持的至少一个第三认证机制和辅助信息，确定候选认证机制。可选的，辅助信息中至少包括以下至少一项：UE支持的至少一个第二认证机制，和UE接入ECS所使用的网络类型。可选的，上述辅助信息中还可以包括：UE支持使用的至少一个第二认证机制的优先级信息，和ECS支持使用的至少一个认证机制的优先级信息。AMF向UE发送注册响应消息，或UCU流程，该注册响应消息或UCU流程中包括候选认证机制。UE获取该注册响应消息或UCU流程中的候选认证机制，根据该候选认证机制，确定目标认证机制。例如，所述候选认证机制中可能包括多个第一认证机制，UE可以选择其中一个认证机制，作为目标认证机制。后续，UE的NAS层可以向EEC发送目标认证机制，EEC根据该目标认证机制，与ECS之间建立通信连接。或者，UE在接收到上述候选认证机制时，可直接将该候选认证机制发送给EEC，EEC根据该候选认证机制，确定目标认证机制。
在又一种设计中，所述候选认证机制为所述EEC与ECS通信时所使用的至少一个第 四认证机制。上述注册请求消息中可携带UE的能力信息，UE的能力信息中包括UE支持的至少一个第二认证机制，UE接入ECS使用的网络类型，UE支持的至少一个第二认证机制的优先级信息。AMF接收注册请求消息，获取UE的能力。当AMF需要获取签约信息时，向UDM发送Nudm_SDM_Get请求消息，该UDM发送Nudm_SDM_Get请求消息中携带有UE的能力信息。UDM根据ECS所支持的至少一个认证机制和辅助信息，确定候选认证机制，所述辅助信息中至少包括UE所支持的至少一个第二认证机制，和UE接入ECS所使用的网络类型。可选的，所述辅助信息中还可以包括以下至少一项：UE所支持的至少一个认证机制中的优先级信息，和ECS所支持的至少一个认证机制的优先级信息等。UDM向AMF发送Nudm_SDM_Get响应消息，该响应消息中包括候选认证机制。后续AMF通过注册响应消息，或UCU流程将候选认证机制发送给UE，过程与上述方案相似，不再赘述。
在本申请实施例中，UE与AMF交互可获取ECS所对应的候选认证机制，UE与ECS间，无需再进行认证的协商流程，减少了信令开销，降低建立通信时延，提高通信体验。
实施例四
在该实施例四中，以终端设备为UE，第一网元为SMF，第二消息为PDU会话请求消息，第一消息为PDU会话响应消息为例，介绍本申请实施例中的方案。
如图9所示，提供一种通信方法的流程，至少包括以下步骤：
可选的，步骤900：对于支持使用边缘服务的UE，UDM的会话管理用户签约信息中包含UE能够使用的ECS信息，ECS信息中包含以下至少一项：ECS标识和ECS所支持的至少一个认证机制等。可选的，该ECS信息中还可以包含：ECS所支持的至少一个认证机制的优先级信息。
步骤901：UE确定建立PDU会话时，UE通过无线接入网节点和AMF节点向SMF发送PDU会话请求消息，该消息中包含PDU会话ID。可选的，该消息中还可以包含以下至少一项：UE是否支持边缘使能客户端的指示信息，UE所支持的至少一个认证机制，和UE所支持的至少一个认证机制的优先级信息。
例如，在一种可能的实现方案中，上述PDU会话请求消息中可以包含UE的能力。UE的能力中包括以下至少一项：UE所支持的至少一个认证机制，UE是否支持边缘使能客户端的指示信息，和UE所支持的至少一个认证机制的优先级信息。或者，上述UE的能力可以单独发送，即UE通过无线接入网节点和AMF节点，向SMF发送PDU会话请求消息和UE的能力。
步骤902：SMF接收到UE发送的PDU会话请求消息之后，当需要获取UE的签约信息时，SMF向UDM发送Nudm_SDM_Get请求消息，该请求消息中包含UE的标识。所述UE的标识可以为SUPI。
步骤903：UDM根据上述请求消息中包含的UE的标识，获取UE的签约信息，并向AMF发送Nudm_SDM_Get响应消息，该响应消息中包含ECS信息。该ECS信息中包含以下至少一项：ECS标识和ECS对应的候选认证机制。
步骤904：SMF接收UDM发送的Nudm_SDM_Get响应消息，向UE发送PDU会话响应消息，该PDU会话响应消息中包含ECS信息。一种可能的方案中，上述ECS信息中可包含在PDU会话响应消息的协议配置选项(protocol configuration option,PCO)中。
步骤905：UE的NAS层向对应的EEC发送接收到的ECS信息。可选的，NAS层可以直接向EEC发送接收到的ECS信息，或者间接的通过上层向EEC发送ECS信息等。
步骤906：EEC根据接收到的ECS信息中包含的候选认证机制，与ECS之间建立通信连接。
为了便于区分不同的认证机制，在以下描述中，采用四种表示方式：SMF所确定的UE与ECS间通信所使用的认证机制称为第一认证机制；UE所支持的认证机制可以称为第二认证机制；ECS所支持的认证机制可称为第三认证机制；将UDM确定的UE与ECS间通信所使用的认证机制作为第四认证机制。
在一种设计中，所述候选认证机制为ECS所支持的至少一个第三认证机制。上述Nudm_SDM_Get响应消息中的ECS信息中包括ECS所支持的至少一个第三认证机制。可选的，该消息中还包括ECS所支持的至少一个第三认证机制的优先级信息。SMF接收到上述Nudm_SDM_Get响应消息，获取其中包含的ECS所支持的至少一个第三认证机制。可选的，SMF还可以获取上述响应消息中包含的ECS所支持的至少一个第三认证机制中的优先级信息。SMF向UE发送PDU会话响应消息，该PDU会话响应消息中包括ECS所支持的至少一个第三认证机制。可选的，该PDU会话响应消息中还可以包括ECS所支持的至少一个第三认证机制的优先级信息。UE根据该ECS所支持的至少一个第三认证机制和辅助信息，确定目标认证机制，辅助信息中至少包括UE所支持的至少一个第二认证机制，和UE接入ECS所使用的网络类型。可选的，该辅助信息中还可以包括：UE所支持的至少一个认证机制的优先级信息，ECS所支持的至少一个认证机制中的优先级信息等。后续，UE的NAS层向EEC发送目标认证机制，EEC根据目标认证机制，与ECS之间建立通信连接。EEC与ECS建立通信连接的过程，与EES与EES间建立通信连接的过程相似，可相互参见。在一种可能的方案中，可具体由UE中的NAS层执行上述“根据ECS所支持的至少一个第三认证机制和辅助信息，确定目标认证机制”的过程，之后NAS层将上述目标认证机制发送给EEC，EEC根据该目标认证机制与ECS之间建立通信连接。
在另一种设计中，所述候选认证机制为UE与ECS通信时所使用的至少一个第四认证机制。上述PDU会话请求中携带有UE的能力信息，UE的能力信息中包括以下至少一项：UE所支持的至少一个第二认证机制，UE接入ECS使用的网络类型，和UE所支持的至少一个第二认证机制的优先级信息。当SMF需要获取UE的签约信息时，SMF向UDM发送Nudm_SDM_Get请求消息，该请求消息中包括UE标识。在一种可能的方案中，上述Nudm_SDM_Get请求消息中包含UE的能力，UDM根据ECS所支持的至少一个第三认证机制和辅助信息，确定候选认证机制。所述辅助信息中可以包括以下至少一项：UE所支持的至少一个第二认证机制和UE所接入ECS所使用的网络类型。可选的，该辅助信息中还可以包括以下至少一项：UE所支持的至少一个认证机制的优先级信息，和ECS所支持的至少一个认证机制的优先级信息。UDM向SMF发送Nudm_SDM_Get响应消息，该响应消息中包括候选认证机制。SMF向UE发送PDU会话响应消息，该PDU会话响应消息中包括候选认证机制；UE获取该PDU会话响应消息中的候选认证机制，UE的NAS层向EEC发送候选认证机制；EEC根据候选认证机制，与ECS间建立通信连接等。
在另一种设计中，所述候选认证机制为UE与ECS通信时所使用的至少一个第四认证机制。上述PDU会话请求中携带有UE的能力信息。当SMF需要获取UE的签约信息时，SMF向UDM发送Nudm_SDM_Get请求消息，该请求消息中包括UE标识。上述 Nudm_SDM_Get响应消息包括ECS所支持的至少一个第三认证机制。SMF根据ECS所支持的至少一个第三认证机制和辅助信息，确定候选认证机制。SMF向UE发送PDU会话响应消息，该PDU会话响应消息中包括候选认证机制。UE的NAS层向EEC发送候选认证机制。EEC根据候选认证机制，与ECS之间建立通信连接。
在本申请实施例中，UE与SMF交互可获取ECS所对应的候选认证机制，UE与ECS间，无需再进行认证的协商流程，减少了信令开销，降低建立通信时延，提高通信体验。
实施例五
在该实施例中，以终端设备为UE为例，介绍终端设备与第一网元间采用AKMA认证机制，建立通信连接的过程，如图10所示，该流程至少包括：
步骤1000a：UE注册到运营商网络，并执行主认证流程，在主认证流程过程中，UE和AUSF间分别生成鉴权密钥K AUSF。如果UE能够使用AKMA认证机制(例如AUSF可以根据从UDM接收到AKMA指示确定UE能够使用AKMA认证机制)，则AUSF在主身份验证过程成功后，根据TS33.535中的定义生成AKMA密钥(K AKMA)和所述AKMA密钥对应的标识A-KID。
步骤1000b.在生成所述AKMA密钥后，AUSF向AAnF发送AKMA认证密钥注册请求，该请求中包括UE的永久身份标识SUPI、A-KID和K AKMA。
步骤1001：UE接入网络后的任一时刻，当UE需要获取边缘服务时，UE向第一网元发送第一消息。
步骤1002：第一网元根据UE发送的第一消息向UE发送第二消息，该第二消息中包括第二网元的标识和AKMA能力。AKMA能力指示第二网元支持使用AMKA认证机制。
步骤1003：当UE确定与第二网元通信时，若UE支持AKMA，且第二网元也支持AKMA(可选的，可根据上述步骤2中的指示确定第二网元是否支持AKMA)，则UE根据TS33.535中的定义推演AKMA密钥和A-KID，进一步的根据AKMA密钥推演第二网元对应的K AF。所述的推演参考TS33.535中的K AF的推演方法。需要说明的是，上述K AF的下标AF表示第二网元，若上述第二网元为EES，则上述K AF代表K EES等。同理，若第二网元为ECS，或EAS等，则需要将上述K AF中的下标由“AF”更换为“ECA或EAS”等。对于支持AKMA的UE，AKMA密钥和A-KID的推演可以在主认证流程之后，到确定与第二网元使用AKMA之前的任意时间执行。另一种可能的实现方式为：在确定与第二网元通信前，UE已经推演了AKMA密钥和A-KID。此时UE根据第二网元支持AKMA认证机制，获取本地存储的A-KID，并在步骤1004中包含A-KID。进一步的，根据本地存储的AKMA密钥生成第二网元对应的K AF。
步骤1004：UE使用K AF和通信连接建立请求消息的所有信息或部分信息生成MAC-I，并在通信连接建立请求消息中携带的MAC-I，向第二网元发送包括A-KID和MAC-I的通信连接建立请求。
步骤1005：第二网元接收到通信连接建立请求后，第二网元发现AKMA锚点功能(AKMA Anchor Function，AAnF)或者NEF。
步骤1006：第二网元获取与UE对应的K AF密钥。在一种可能的实现方式中，可参见步骤1006a，第二网元向AAnF发送AKMA认证密钥获取请求，AAnF向第二网元发送AKMA认证密钥获取响应，该响应中包括K AF密钥等。
步骤1007：如果UE被授权执行操作，则第二网元使用K AF验证MAC-I；第二网元向UE发送通信连接建立请求的响应消息。
可选的，上述方法还包括：第二网元接收到通信连接建立请求，获取其中的A-KID和MAC-I，第二网元向AAnF发送A-KID，如果能够获取到K AF，则说明第二网元确定UE是合法的，即第二网元完成对UE的认证。
可选的，上述方法还包括：第二网元给UE返回的通信连接建立请求的响应消息中还可以包括第二MAC；第二MAC是使用K AF或者使用基于K AF生成的密钥生成的；UE接收通信连接建立请求的响应消息，获取其中的第二MAC，对第二MAC验证，验证成功之后，UE确认第二网元是合法的，即UE完成对第二网元的认证。进一步可选的，第二MAC使用K AF或者使用基于K AF生成的密钥和响应消息中的部分或全部信息生成的。
可以理解的是，在上述实施例一中，上述第一网元可以为ECS，第二网元为EES，或者，在上述实施例二中，上述第一网元可以为EES，上述第二网元可以为EAS，或者，在上述实施例三中，上述第一网元为AMF，第二网元为ECS，或者，在上述实施例四中，第一网元可以为SMF，第二网元可以为ECS。
通过上述可以看出，第一网元与第二网元间可进行双认证，使得两者间建立安全的通信连接。
基于与上述方法实施例同一发明构思，本申请实施例还提供一种装置，用于执行上述方法实施例中终端设备执行的方法。相关特征可参见上述方法实施例，此处不再赘述。如图11所示，该装置可以包括通信单元1101和处理单元1102：
通信单元1101，用于接收来自第一网元的第一消息，所述第一消息包括第二网元的标识以及第一指示信息，所述第一指示信息用于指示第二网元关联的候选认证机制；处理单元1102，用于基于所述候选认证机制，与所述第二网元之间建立通信连接。
可选的，通信单元1101，还用于向所述第一网元发送第二消息，所述第一消息为所述第二消息的响应消息。
在一种可能的设计中，所述候选认证机制为所述终端设备与所述第二网元之间建立通信连接时使用的至少一个第一认证机制。
可选的，所述第二消息中包括所述终端设备接入所述第二网元所使用的网络类型；其中，所述至少一个第一认证机制是与所述网络类型对应的认证机制。
可选的，所述第二消息中包括所述终端设备所支持的至少一个第二认证机制；其中，所述至少一个第一认证机制包括在所述至少一个第二认证机制中。
可选的，所述第二消息中还包括至少一个第二认证机制中的优先级信息；所述至少一个第二认证机制用于所述至少一个第一认证机制的选择。
可选的，所述基于所述候选认证机制，与所述第二网元之间建立通信连接，包括：
生成与所述目标认证机制对应的第一密钥以及第一密钥标识；其中，所述目标认证机制为所述至少一个认证机制中的一个；向所述第二网元发送通信连接建立请求，所述通信连接建立请求中包括所述第一密钥标识。
在另一种设计中，所述候选认证机制为所述第二网元所支持的至少一个第三认证机制。
可选的，所述基于所述候选认证机制，与所述第二网元之间建立通信连接，包括：基于所述至少一个第三认证机制和辅助信息，确定目标认证机制，所述辅助信息中包括以下至少一项：所述终端设备所支持的至少一个第二认证机制，和所述终端设备接入所述第二 网元所使用的网络类型；生成与所述目标认证机制对应的第一密钥以及第一密钥标识；向所述第二网元发送通信连接建立请求，所述通信连接建立请求包括所述第一密钥标识。
可选的，所述辅助信息还包括以下至少一项：所述至少一个第二认证机制中的优先级信息，和所述至少一个第三认证机制中的优先级信息。
可选的，所述第一消息中还包括所述至少一个第三认证机制中的优先级信息。
可选的，处理单元1102还用于：根据所述第一密钥以及所述第二网元的标识，生成第二密钥。
可选的，处理单元1102，还用于：使用所述第二密钥对所述通信连接建立请求进行安全保护，以生成第一消息认证码MAC；其中，所述通信连接建立请求还包括所述第一MAC。
在一种设计中，所述第一网元为边缘配置服务器ECS，所述第二网元为边缘使能服务器EES，或者，所述第一网元为EES，所述第二网元为边缘应用服务器EAS。
在另一种设计中，所述第一网元为接入和移动性管理功能AMF或者会话管理功能SMF，所述第二网元为边缘配置服务器ECS。
可选的，所述第一消息为非接入层NAS消息。
可选的，所述第一消息为所述终端设备请求注册的响应消息，或者所述终端设备请求建立协议数据单元PDU会话的响应消息。
可选的，所述候选认证机制包括以下至少一项：应用的认证和密码管理AKMA服务，通用引导架构GBA服务，和证书机制。
基于与上述方法实施例同一发明构思，本申请实施例还提供一种装置，用于执行上述方法实施例中第一网元执行的方法。相关特征可参见上述方法实施例，此处不再赘述。仍可参照图11所示，该装置包括通信单元1101和处理单元1102：
处理单元1102，用于确定候选认证机制；通信单元1101，用于向终端设备发送第一消息，所述第一消息中包括第二网元的标识以及第一指示信息，所述第一指示信息用于指示第二网元关联的所述候选认证机制，所述候选认证机制用于所述终端设备与所述第二网元间建立通信连接。
可选的，通信单元1101，还用于接收来自所述终设备的第二消息，所述第一消息为所述第二消息的响应消息。
可选的，所述候选认证机制为所述终端设备与所述第二网元之间建立通信连接时使用的至少一个第一认证机制，所述确定候选认证机制，包括：
根据所述第二网元所支持的至少一个第三认证机制和辅助信息，确定候选认证机制，所述辅助信息包括以下到少一项：终端设备所支持的至少一个第二认证机制，和所述终端设备接入所述第二网元所使用的网络类型。
可选的，所述第二消息中包括所述终端设备接入所述第二网元所使用的网络类型。
可选的，所述第二消息中包括所述终端设备支持的至少一个第二认证机制。
可选的，所述辅助信息还包括以下至少一项：所述至少一个第二认证机制中的优先级信息，和所述至少一个第三认证机制中的优先级信息。
可选的，所述第二消息中还包括至少一个第二认证机制中的优先级信息。
可选的，所述候选认证机制为所述第二网元所支持的至少一个第三认证机制。
可选的，所述第一消息中还包括所述至少一个第三认证机制中的优先级信息。
在一种设计中，所述第一网元为ECS，所述第二网元为EES，或者，所述第一网元为 EES，所述第二网元为EAS。
在另一种设计中，所述第一网元为AMF或SMF，所述第二网元为ECS。
可选的，所述第一消息为NAS消息。
可选的，所述第一消息为所述终端设备请求注册的响应消息，或者所述终端设备请求建立PDU会话的响应消息。
可选的，所述候选认证机制包括以下至少一项：AKMA服务，GBA服务，和证书机制。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
该集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台终端设备(可以是个人计算机，手机，或者网络设备等)或处理器(processor)执行本申请各个实施例该方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
在本申请实施例中，所述基站和所述终端设备均可以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。
在一个简单的实施例中，本领域的技术人员可以想到所述终端设备和第一网元可以采用图12所示的形式。
如图12所示的通信装置1200，包括至少一个处理器1201、存储器1202，可选的，还可以包括通信接口1203。
存储器1202可以是易失性存储器，例如随机存取存储器；存储器也可以是非易失性存储器，例如只读存储器，快闪存储器，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)、或者存储器1202是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1202可以是上述存储器的组合。
本申请实施例中不限定上述处理器1201以及存储器1202之间的具体连接介质。本申请实施例在图中以存储器1202和处理器1201之间通过总线1204连接，总线1204在图中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。该总线1204可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器1201可以具有数据收发功能，能够与其他设备进行通信，在如图12装置中，也可以设置独立的数据收发模块，例如通信接口1203，用于收发数据；处理器1201在与其他设备进行通信时，可以通过通信接口1203进行数据传输。
当终端设备采用图12所示的形式时，图12中的处理器1201可以通过调用存储器1202 中存储的计算机执行指令，使得终端设备可以执行上述任一方法实施例中所述终端设备的功能。或者，当第一网元采用图12所示的形式时，图12中的处理器1201可以通过调用存储器1202中存储的计算机执行指令，使得第一网元可以执行上述任一方法实施例中所述第一网元的功能。
具体的，图11中的通信单元1101和处理单元1102的功能/实现可以通过图12中的处理器1201调用存储器1202中存储的计算机程序指令来实现。或者，图11中的处理单元1102的功能/实现过程可以通过图12中的处理器1201调用存储器1202中存储的计算机执行指令来实现，图11中的通信单元1101的功能/实现可以通过图12中的通信接口1203来实现。
本领域内的技术人员应明白，本申请的实施例可提供为方法、***、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (35)

  1. 一种建立安全通信方法，其特征在于，包括：
    终端设备接收来自第一网元的第一消息，所述第一消息包括第二网元的标识以及第一指示信息，所述第一指示信息用于指示与所述第二网元关联的候选认证机制；
    所述终端设备基于所述候选认证机制，与所述第二网元之间建立通信连接。
  2. 如权利要求1所述的方法，其特征在于，还包括：
    所述终端设备向所述第一网元发送第二消息，所述第一消息为所述第二消息的响应消息。
  3. 如权利要求1或2所述的方法，其特征在于，所述候选认证机制为所述终端设备与所述第二网元之间建立通信连接时使用的至少一个第一认证机制。
  4. 如权利要求3所述的方法，其特征在于，所述第二消息中包括所述终端设备接入所述第二网元所使用的网络类型；其中，所述至少一个第一认证机制是与所述网络类型对应的认证机制。
  5. 如权利要求3或4所述的方法，其特征在于，所述第二消息中包括所述终端设备所支持的至少一个第二认证机制；其中，所述至少一个第一认证机制包括在所述至少一个第二认证机制中。
  6. 如权利要求5所述的方法，其特征在于，所述第二消息中还包括至少一个第二认证机制的优先级信息；所述至少一个第二认证机制用于所述至少一个第一认证机制的选择。
  7. 如权利要求3至6中任一项所述的方法，其特征在于，所述终端设备基于所述候选认证机制，与所述第二网元之间建立通信连接，包括：
    所述终端设备生成与目标认证机制对应的第一密钥以及第一密钥标识；其中，所述目标认证机制为所述至少一个第一认证机制中的一个；
    所述终端设备向所述第二网元发送通信连接建立请求，所述通信连接建立请求中包括所述第一密钥标识。
  8. 如权利要求1或2所述的方法，其特征在于，所述候选认证机制为所述第二网元所支持的至少一个第三认证机制。
  9. 如权利要求8所述的方法，其特征在于，所述终端设备基于所述候选认证机制，与所述第二网元之间建立通信连接，包括：
    所述终端设备基于所述至少一个第三认证机制和辅助信息，确定目标认证机制，所述辅助信息中包括以下至少一项：所述终端设备所支持的至少一个第二认证机制，和所述终端设备接入所述第二网元所使用的网络类型；
    所述终端设备生成与所述目标认证机制对应的第一密钥以及第一密钥标识；
    所述终端设备向所述第二网元发送通信连接建立请求，所述通信连接建立请求包括所述第一密钥标识。
  10. 如权利要求9所述的方法，其特征在于，所述辅助信息还包括以下至少一项：所述至少一个第二认证机制的优先级信息，和所述至少一个第三认证机制的优先级信息。
  11. 如权利要求10所述的方法，其特征在于，所述第一消息中还包括所述至少一个第三认证机制的优先级信息。
  12. 如权利要求7或9所述的方法，其特征在于，所述方法还包括：
    所述终端设备根据所述第一密钥以及所述第二网元的标识，生成第二密钥。
  13. 如权利要求12所述的方法，其特征在于，所述方法还包括：
    所述终端设备使用所述第二密钥对所述通信连接建立请求进行安全保护，以生成第一消息认证码MAC；其中，所述通信连接建立请求还包括所述第一MAC。
  14. 如权利要求1至13中任一项所述的方法，其特征在于，所述第一网元为边缘配置服务器ECS，所述第二网元为边缘使能服务器EES，或者，所述第一网元为EES，所述第二网元为边缘应用服务器EAS。
  15. 如权利要求1至13中任一项所述的方法，其特征在于，所述第一网元为接入和移动性管理功能AMF或者会话管理功能SMF，所述第二网元为边缘配置服务器ECS。
  16. 如权利要求15所述的方法，其特征在于，所述第一消息为非接入层NAS消息。
  17. 如权利要求16所述的方法，其特征在于，所述第一消息为所述终端设备请求注册的响应消息，或者所述终端设备请求建立协议数据单元PDU会话的响应消息。
  18. 如权利要求1至17中任一项所述的方法，其特征在于，所述候选认证机制包括以下至少一项：应用的认证和密码管理AKMA服务，通用引导架构GBA服务，和证书机制。
  19. 一种建立安全通信方法，其特征在于，包括：
    第一网元确定候选认证机制；
    所述第一网元向终端设备发送第一消息，所述第一消息中包括第二网元的标识以及第一指示信息，所述第一指示信息用于指示与所述第二网元关联的候选认证机制，所述候选认证机制用于所述终端设备与所述第二网元间建立通信连接。
  20. 如权利要求19所述的方法，其特征在于，还包括：
    所述第一网元接收来自所述终设备的第二消息，所述第一消息为所述第二消息的响应消息。
  21. 如权利要求19或20所述的方法，其特征在于，所述候选认证机制为所述终端设备与所述第二网元之间建立通信连接时使用的至少一个第一认证机制，所述第一网元确定候选认证机制，包括：
    所述第一网元根据所述第二网元所支持的至少一个第三认证机制和辅助信息，确定候选认证机制，所述辅助信息包括以下至少一项：终端设备所支持的至少一个第二认证机制，和所述终端设备接入所述第二网元所使用的网络类型。
  22. 如权利要求21所述的方法，其特征在于，所述第二消息中包括所述终端设备接入所述第二网元所使用的网络类型；其中，所述至少一个第一认证机制是与所述网络类型对应的认证机制。
  23. 如权利要求21或22所述的方法，其特征在于，所述第二消息中包括所述终端设备所支持的至少一个第二认证机制；；其中，所述至少一个第一认证机制包括在所述至少一个第二认证机制中。
  24. 如权利要求21至23中任一项所述的方法，其特征在于，所述辅助信息还包括以下至少一项：所述至少一个第二认证机制的优先级信息，和所述至少一个第三认证机制的优先级信息；所述至少一个第二认证机制用于所述至少一个第一认证机制的选择。
  25. 如权利要求24所述的方法，其特征在于，所述第二消息中还包括至少一个第二认证机制的优先级信息。
  26. 如权利要求19或20所述的方法，其特征在于，所述候选认证机制为所述第二网元所支持的至少一个第三认证机制。
  27. 如权利要求26所述的方法，其特征在于，所述第一消息中还包括所述至少一个第三认证机制的优先级信息。
  28. 如权利要求19至27中任一项所述的方法，其特征在于，所述第一网元为ECS，所述第二网元为EES，或者，所述第一网元为EES，所述第二网元为EAS。
  29. 如权利要求19至27中任一项所述的方法，其特征在于，所述第一网元为AMF或SMF，所述第二网元为ECS。
  30. 如权利要求29所述的方法，其特征在于，所述第一消息为NAS消息。
  31. 如权利要求30所述的方法，其特征在于，所述第一消息为所述终端设备请求注册的响应消息，或者所述终端设备请求建立PDU会话的响应消息。
  32. 如权利要求19至31中任一项所述的方法，其特征在于，所述候选认证机制包括以下至少一项：AKMA服务，GBA服务，和证书机制。
  33. 一种装置，其特征在于，包括用于实现权利要求1至18中任一项所述的方法的单元，或者包括用于实现权利要求19至32中任一项所述的方法的单元。
  34. 一种装置，其特征在于，包括处理器和存储器，所述存储器中存储有指令，所述处理器执行所述指令时，使得所述通信装置执行权利要求1至18中任一项所述的方法，或者使得通信装置执行权利要求19至32中任一项所述的方法。
  35. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行权利要求1至18中任一项所述的方法，或者使得计算机执行权利要求19至32中任一项所述的方法。
PCT/CN2020/119764 2020-09-30 2020-09-30 一种建立安全通信方法及装置 WO2022067831A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
AU2020470364A AU2020470364B2 (en) 2020-09-30 Method and apparatus for establishing secure communication
PCT/CN2020/119764 WO2022067831A1 (zh) 2020-09-30 2020-09-30 一种建立安全通信方法及装置
CN202080105604.6A CN116325843A (zh) 2020-09-30 2020-09-30 一种建立安全通信方法及装置
EP20955851.9A EP4207676A4 (en) 2020-09-30 2020-09-30 METHOD AND APPARATUS FOR ESTABLISHING SECURE COMMUNICATION
US18/191,942 US20230232228A1 (en) 2020-09-30 2023-03-29 Method and apparatus for establishing secure communication

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/119764 WO2022067831A1 (zh) 2020-09-30 2020-09-30 一种建立安全通信方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/191,942 Continuation US20230232228A1 (en) 2020-09-30 2023-03-29 Method and apparatus for establishing secure communication

Publications (1)

Publication Number Publication Date
WO2022067831A1 true WO2022067831A1 (zh) 2022-04-07

Family

ID=80951173

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/119764 WO2022067831A1 (zh) 2020-09-30 2020-09-30 一种建立安全通信方法及装置

Country Status (4)

Country Link
US (1) US20230232228A1 (zh)
EP (1) EP4207676A4 (zh)
CN (1) CN116325843A (zh)
WO (1) WO2022067831A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023216934A1 (zh) * 2022-05-09 2023-11-16 华为技术有限公司 通信方法及装置
WO2024098194A1 (en) * 2022-11-07 2024-05-16 Apple Inc. Mec-service subscription synchronisation in roaming architecture

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101753533A (zh) * 2008-12-04 2010-06-23 华为终端有限公司 协商认证方式的方法、装置和***
CN107820242A (zh) * 2016-09-14 2018-03-20 ***通信有限公司研究院 一种认证机制的协商方法及装置
CN109964453A (zh) * 2016-09-18 2019-07-02 上海诺基亚贝尔股份有限公司 统一安全性架构
WO2019222604A1 (en) * 2018-05-18 2019-11-21 Convida Wireless, Llc Identity layer for iot devices

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101753533A (zh) * 2008-12-04 2010-06-23 华为终端有限公司 协商认证方式的方法、装置和***
CN107820242A (zh) * 2016-09-14 2018-03-20 ***通信有限公司研究院 一种认证机制的协商方法及装置
CN109964453A (zh) * 2016-09-18 2019-07-02 上海诺基亚贝尔股份有限公司 统一安全性架构
WO2019222604A1 (en) * 2018-05-18 2019-11-21 Convida Wireless, Llc Identity layer for iot devices

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on Security Aspects of Enhancement of Support for Edge Computing in 5GC (Release 17)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 33.839, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V0.1.0, 29 August 2020 (2020-08-29), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , pages 1 - 24, XP051925933 *
SAMSUNG: "EEC authentication and authorization", 3GPP DRAFT; S6-200731, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG6, no. Online Meeting ;20200514 - 20200526, 8 May 2020 (2020-05-08), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051882217 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023216934A1 (zh) * 2022-05-09 2023-11-16 华为技术有限公司 通信方法及装置
WO2024098194A1 (en) * 2022-11-07 2024-05-16 Apple Inc. Mec-service subscription synchronisation in roaming architecture

Also Published As

Publication number Publication date
US20230232228A1 (en) 2023-07-20
EP4207676A4 (en) 2023-11-01
CN116325843A (zh) 2023-06-23
EP4207676A1 (en) 2023-07-05
AU2020470364A1 (en) 2023-05-04

Similar Documents

Publication Publication Date Title
US11451950B2 (en) Indirect registration method and apparatus
KR102224248B1 (ko) 통신 시스템에서 PDU(Protocol Data Unit) 세션을 설립하는 방법
US11812496B2 (en) User group session management method and apparatus
US20200128614A1 (en) Session processing method and device
US20200296142A1 (en) User Group Establishment Method and Apparatus
WO2022012310A1 (zh) 一种通信方法及装置
WO2021037175A1 (zh) 一种网络切片的管理方法及相关装置
JP7412593B2 (ja) マルチキャストブロードキャストサービスの通信方法、装置、電子機器及びコンピュータプログラム
WO2020029729A1 (zh) 一种通信方法和装置
WO2020020096A1 (zh) 一种群组创建方法、装置及***
US20230232228A1 (en) Method and apparatus for establishing secure communication
WO2018045983A1 (zh) 信息处理方法、装置以及网络***
EP2534889A1 (en) Method and apparatus for redirecting data traffic
WO2022002244A1 (zh) 在线签约方法、装置及***
US20230396602A1 (en) Service authorization method and system, and communication apparatus
WO2019144719A1 (zh) 一种远端设备的动态接入方法及装置
WO2019196963A1 (zh) 接入网络切片的方法及装置、存储介质、电子装置
JP2023527193A (ja) サービス取得方法、装置、通信機器及び可読記憶媒体
WO2023016255A1 (zh) 一种网络功能服务授权方法及装置
WO2022032692A1 (zh) 通信方法、装置及***
AU2020470364B2 (en) Method and apparatus for establishing secure communication
KR20230156685A (ko) 무선 네트워크에서의 코어 네트워크 디바이스 재할당을 위한 방법, 디바이스 및 시스템
CN114629627A (zh) 一种认证方法及装置
WO2024032554A1 (zh) 终端设备认证方法、***及相关设备
WO2024037215A1 (zh) 通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20955851

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020955851

Country of ref document: EP

Effective date: 20230331

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020470364

Country of ref document: AU

Date of ref document: 20200930

Kind code of ref document: A