[go: up one dir, main page]

WO2018120150A1 - Procédé et appareil de connexion entre des entités de réseau - Google Patents

Procédé et appareil de connexion entre des entités de réseau Download PDF

Info

Publication number
WO2018120150A1
WO2018120150A1 PCT/CN2016/113796 CN2016113796W WO2018120150A1 WO 2018120150 A1 WO2018120150 A1 WO 2018120150A1 CN 2016113796 W CN2016113796 W CN 2016113796W WO 2018120150 A1 WO2018120150 A1 WO 2018120150A1
Authority
WO
WIPO (PCT)
Prior art keywords
entity
identifier
security information
communication connection
storage function
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/113796
Other languages
English (en)
Chinese (zh)
Inventor
马景旺
陈璟
王江胜
李�赫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to PCT/CN2016/113796 priority Critical patent/WO2018120150A1/fr
Publication of WO2018120150A1 publication Critical patent/WO2018120150A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of wireless communications, and in particular, to a method and apparatus for connecting between network functional entities.
  • a network element (NE) architecture is adopted in an evolved packet core (EPC).
  • the typical NE included in the architecture includes: a mobility management entity (MME) and a service.
  • Current EPC network functions eg, mobility management, bearer management, location management, etc.
  • PCRF policy and charging rules function
  • HSS home subscriber server
  • NF network function
  • the NF service provided by the EPC is solidified and distributed among the various NEs. Therefore, if a new NF needs to be introduced to support the user's needs, the EPC needs to redefine and design the NE's processing logic and process interaction. Such redesign means that the development cycle is long and costly for the equipment manufacturer, which means that the network operator cannot release the new network service in time.
  • the general NF management method is as follows: the core network part can adopt a service oriented architecture.
  • the NE for example, MME or S-GW
  • the NE in the original network architecture is defined as different NF components according to the functional category, for example: Authentication and security functions (AuF), session management function (SM NF), mobility management and mobility management function (MM NF), policy control function (PCF) And so on, these functions are implemented by the corresponding NF components, each of which provides services to other NF components or functions through a defined service interface.
  • AuF Authentication and security functions
  • SM NF session management function
  • MM NF mobility management and mobility management function
  • PCF policy control function
  • the MM NF sends the SM message to the SMNF after receiving the message of the SM category sent by the user equipment (UE), and is performed by the SMNF. The processing of the session.
  • UE user equipment
  • the NF When establishing communication between the NFs, the NF first obtains the network address of the peer NF, and then establishes a communication connection with the peer NF, and further sends a message such as a service request to the peer NF for processing.
  • a security problem exists: due to an exception or NF itself, it will send an incorrect service request message to other NFs. For example, the authentication and security functions do not need to send the user's session request message to the packet data session management function according to the business logic.
  • the session request message includes the establishment, update, and deletion of the session, but when an abnormality or an attack occurs between the authentication and security functions, the request message for deleting the data session connection of the user is sent to the packet data session management function, and the packet data is After the session management function agrees to the service request and performs the corresponding session connection deletion operation, the affected user terminal cannot receive and send data, which causes the service to be abnormal. Therefore, communication security issues between NFs need to be addressed to avoid unauthorized access between NFs.
  • the embodiments of the present application provide a connection method and device between network function entities to solve the communication security problem between network function entities.
  • the application provides a network function entity connection method, which is applied to a network function NF entity that receives a communication connection request, the method includes: the second network function NF entity receives a communication connection request from the first network function NF entity, The communication connection request includes an identifier of the first NF entity and a security information identifier; obtaining security information corresponding to the security information identifier from the NF storage function entity; if the security information includes an identifier of the first NF entity And the second NF entity establishes a communication connection with the first NF entity.
  • the NF storage function module pre-stores the identifiers of the respective NF entities, and when accessing one of the NF entities, for example, the second NF entity, the NF storage function entity controls the NF connection access to obtain security information, and Providing the security information to the second NF entity, so that the second NF entity can verify the authenticity and security of the requesting connection identity according to the security information, thereby implementing a secure connection between the NFs and avoiding the NF between the NFs. Authorized access.
  • the security information includes the identifier of the first NF entity
  • establishing a communication connection with the first NF entity includes: the security information includes at least one NF entity And the identifier, if the at least one identifier of the security information is the same as the identifier of the first NF entity in the communication connection request, the second NF entity establishes a communication connection with the first NF entity.
  • the communication connection request further includes a first challenge random number
  • the second NF entity establishing a communication connection with the first NF entity includes: the second NF entity Obtaining a first key from the NF storage function entity, and a first encrypted ciphertext from the first NF entity, using the first key to decrypt the first encrypted ciphertext to generate a second Challenge a random number; if at least one of the security information is the same as an identifier of the first NF entity in the communication connection request, and the first challenge random number is the same as the second challenge random number, then The first NF entity establishes a communication connection.
  • the method further includes: if the second NF entity establishes a communication connection with the first NF entity, the second NF entity generates a third challenge random number, where The third challenge random number and the first key generate a second encrypted ciphertext, and send the second encrypted ciphertext and the third challenge random number to the first NF entity.
  • the security information further includes an effective time of the security information, and is used to check whether the security information is valid.
  • the present application provides a network function entity connection method, which is applied to an NF entity that initiates a communication connection request, where the method includes: the first NF entity sends the identifier of the first NF entity and the requested NF to the NF storage function entity. Type information; receiving a security information identifier from the NF storage function entity and an identifier of a second NF entity corresponding to the NF type; sending a communication connection request to the second NF entity, where the communication connection request includes An identifier of the NF entity and the security information identifier.
  • the method further includes: the first NF entity receiving a communication connection response from the second NF entity, the communication connection response being used to indicate the second NF Whether the entity allows a communication connection to be established with the first NF entity.
  • the method further includes: the first NF entity receiving a first key from the NF storage function entity; and the first NF entity acquiring a first challenge random number Generating a first encrypted ciphertext according to the first challenge random number and the first key, and sending the first encrypted ciphertext and the first challenge random number to the second NF entity.
  • the method further includes: if the communication connection response indicates that a communication connection is allowed to be established, the first NF entity receives a second encryption key from the second NF entity And a third challenge random number; the first NF entity decrypts the second encrypted ciphertext using the first key, and generates a fourth challenge random number, if the fourth challenge random number and the The third challenge random number is the same, and a session connection is established with the second NF entity.
  • the method further includes: receiving, by the first NF entity At least one piece of security information sent from the NF storage function entity, wherein each of the security information includes an identifier of the first NF entity and an identifier of an NF entity that satisfies the NF type condition; the first The NF entity selects one of the at least one security information as the second NF entity.
  • the present application provides a security information sending method, where the method is applied to an NF storage function entity, the method comprising: the NF storage function entity receiving an identifier of a first NF entity from a first NF entity and a requested NF type Obtaining, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type; and the security information identifier and the second NF entity The identity is sent to the first NF entity. Further, the step of obtaining includes internally generating the NF storage function entity or acquiring from other entities.
  • the NF storage function entity obtains the security information identifier and the identifier of the second NF entity corresponding to the NF type, including: the NF storage function entity according to the first Determining, by the identifier of the NF entity and the NF type information, at least one NF entity that satisfies the NF type condition, and generating at least one security information, wherein the security information includes an identifier of the first NF entity and satisfies the NF The identity of an NF entity of the type condition.
  • the NF storage function entity receives the identifier of the first NF entity from the first NF entity and the requested NF type information, including: the NF storage function entity receives the first NF storage The identity of the first NF entity from the first NF entity forwarded by the functional entity and the requested NF type information.
  • the NF storage function entity acquires a security information identifier and a second NF entity corresponding to the NF type.
  • the first NF storage function entity determines the second NF storage function entity according to the identifier of the deployed PLMN, and sends the identifier of the first NF entity and the requested NF type information to the a second NF storage function entity; receiving at least one security information returned from the second NF storage function entity, where the security information includes an identifier of the first NF entity and an NF entity that satisfies an NF type condition Logo.
  • the second NF entity is configured to obtain, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type, and the security
  • the information identifier and the identifier of the second NF entity are sent to the first NF storage function entity.
  • the first NF storage function entity and the first NF entity belong to the first PLMN
  • the second NF storage function entity and the second NF entity belong to the second PLMN.
  • the first NF storage function entity in the first PLMN interacts with the second NF storage function entity in the second PLMN, and the second NF storage function entity in the second PLMN performs the second NF entity
  • the information and corresponding security information and keys are provided to the second NF entity, thereby enabling control of communication between NF entities located in different PLMNs, and secure communication connections between NF entities.
  • the method further includes: sending, by the NF storage function entity, the security information and the identifier of the second NF entity to the second NF by using any one of the following manners: Entity; the NF storage function entity actively sends the security information and the identifier of the second NF entity; or, after the NF storage function entity receives the security information identifier from the second NF entity, to the The second NF entity sends.
  • the method further includes: the NF storage function entity to the first NF entity and The second NF entity sends a first key, where the first key is used to decrypt the first encrypted ciphertext obtained by the second NF entity from the first NF entity.
  • the method further includes: the NF storage function entity detecting whether The first NF entity is allowed to initiate a communication connection request to the second NF entity.
  • the NF storage function entity stores an NF type list of the first NF entity, and the NF storage function entity detects whether to allow a communication connection request to be initiated, including: determining a location Whether the NF type corresponding to the identifier of the second NF entity is in the NF type list of the first NF entity; if yes, the communication connection request is allowed to be initiated; otherwise, the communication connection request is not allowed to be sent.
  • the method provided by the present invention controls the NF entity discovery by the NF storage function module, and provides the security information and the key information to the peer NF entity discovered by the NF, so that the NF entity can verify the other party according to the security information and the key.
  • the authenticity of the identity and the establishment of a communication connection thereby achieving the security and reliability of inter-NF access and avoiding unauthorized access between NFs.
  • the present application further provides a network function NF entity, configured to receive a request for a communication connection initiated by a requester, for example, applied to a second network function NF entity, including: a transceiver unit, configured to receive from the first network a communication connection request of the function NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier; and is further configured to acquire security information corresponding to the security information identifier from the NF storage function entity; Used to determine that if the security information includes an identifier of the first NF entity, The second NF entity establishes a communication connection with the first NF entity.
  • the transceiver unit and the processing unit are also used to implement the method steps of the various implementations of the aforementioned first aspect.
  • the present application further provides another network function NF entity, configured to initiate a communication connection request, for example, applied to a first network function NF entity, and a transceiver unit, configured to send a first NF entity to the NF storage function entity.
  • the identifier and the requested NF type information and is further configured to receive the security information identifier from the NF storage function entity and the identifier of the second NF entity corresponding to the NF type; and is further configured to send to the second NF entity
  • a communication connection request where the communication connection request includes an identifier of the first NF entity and the security information identifier.
  • the NF entity may further comprise a processing unit, the transceiver unit and the processing unit being further for implementing the method steps of the various implementations of the aforementioned second aspect.
  • the application further provides a security information sending apparatus, configured to control the discovery of the NF, for example, to the NF storage function entity, including: a transceiver unit, configured to receive the first from the first NF entity An identifier of the NF entity and the requested NF type information; the processing unit, configured to acquire, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type The transceiver unit is further configured to send the security information identifier and the identifier of the second NF entity to the first NF entity. Furthermore, the transceiver unit and the processing unit are also used to implement the method steps of the various implementations of the aforementioned third aspect.
  • the present application further provides an NF entity device, including a transceiver and a processor for performing the method steps in the implementations of the first aspect or the fourth aspect.
  • the transceiver may be implemented by a transceiver unit in the NF entity device, or may be implemented by the processor to control the transceiver.
  • the present application further provides an NF entity device, including a transceiver and a processor for performing the method steps in the implementations of the second aspect or the fifth aspect.
  • the transceiver may be implemented by a transceiver unit in the NF entity device, or may be implemented by the processor to control the transceiver.
  • the present application further provides an NF storage function entity device, including a transceiver and a processor for performing the method steps in the implementation manners of the third aspect or the sixth aspect.
  • the transceiver may be implemented by a transceiver unit in the NF storage function module device, or may be implemented by the processor to control the transceiver.
  • the present application further provides an NF entity connection system, including the NF entity device described in the foregoing seventh aspect and the eighth aspect implementation manner, and the NF storage function entity device described in the ninth aspect implementation manner.
  • the present application further provides a computer storage medium, wherein the computer storage medium can store a program, and when the program is executed, the present application can provide a network function entity connection method and a security information transmission method. Some or all of the steps in the way.
  • FIG. 1 is a schematic structural diagram of a network including an EPC network element provided by the present application.
  • FIG. 2 is a schematic structural diagram of a network including NF provided by the present application.
  • FIG. 3 is a schematic flowchart of a method for connecting an NF entity according to an embodiment of the present application
  • FIG. 4 is a schematic flowchart of another NF entity connection method according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic flowchart of still another NF entity connection method according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a second NF entity according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a first NF entity according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of an NF storage function entity according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of an NF entity according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an NF storage function entity according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of another NF storage function entity according to an embodiment of the present disclosure.
  • the method provided by each embodiment of the present application splits N network slices on a common network infrastructure of the core network, and the network slice may also be referred to as a private network, a dedicated network.
  • a service oriented architecture may be adopted in the network slice.
  • the NE for example, MME or S-GW
  • the NE in the original network architecture is defined as different NF according to the type of the function, for example, authentication and security.
  • Functions, packet data session management functions, mobility management functions and access control functions, policy control functions, etc. are implemented by corresponding NF components, each of which provides services to other NF components or functions through a defined service interface.
  • Multiple network slices (sliceA, sliceB, and sliceC) of the same carrier use the same public land mobile network (PLMN) and can be deployed in the carrier's infrastructure through cloud technologies and virtualization technologies.
  • PLMN public land mobile network
  • the operator's technical facilities include the operator's cloud computing and transmission infrastructure.
  • the NF entities in various embodiments of the present application include, but are not limited to, an authentication and security function entity, a packet data session management function entity, a mobility management function entity, an access control function entity, a policy control function entity, etc., and the NF entities are corresponding NF component implementations, each NF component serving other NF components or functions through a defined service interface.
  • the NFs need to interact with each other to complete related network services. For example, the MM NF sends the SM message to the SM NF for processing by the SM NF.
  • NF should verify whether the communication connection between NFs is permitted, and verify the authenticity of the other party's identity, and avoid unauthorized access between NFs.
  • identity verification and secure connection between NFs The embodiment of the application provides a network function entity connection method and device, and the method provided by the present application is described in detail below:
  • the two NF entities are respectively a first NF entity and a second NF entity, wherein the first NF entity sends a communication connection request to the second NF entity to make it and the second NF.
  • the entity establishes a communication connection.
  • the NF storage function (English: NF repository function) entity is configured to store an identifier of the NF entity in the network, and provide information such as security information and a key to the communication connection request sender. .
  • the network function entity connection method includes the following steps:
  • Step 301 When the first NF entity needs to access the second NF entity, the first NF entity sends the identifier of the first NF entity and the requested NF type information to the NF storage function entity.
  • the identifier of the first NF entity and the requested NF type information may be sent by using an NF discovery request, where the NF type information is used to indicate that the first NF entity requests the NF type that needs to provide the service.
  • the NF type includes an authentication and security function (AuF), a packet data management function (SM NF), a mobility management, and a mobility management function (MM NF), a policy. Control function (PCF), etc.
  • AuF authentication and security function
  • SM NF packet data management function
  • MM NF mobility management function
  • PCF policy. Control function
  • the identifier of the NF entity is used to identify an NF entity, for example, may include a PLMN ID, a combination of an NF type and a sequence number, a network address of the NF entity, or any other form of information that can identify the NF entity.
  • Step 302 After receiving the NF discovery request from the first NF entity, the NF storage function entity determines at least one NF entity that satisfies the condition according to the identifier of the first NF entity and the NF type, and generates at least one security information and An identifier of the second NF entity corresponding to the NF type; the corresponding information in the security information includes A security information identifier for an NF entity.
  • the security information may be a security token or a security evidence.
  • the security information identifier may be a security token ID or a security evidence identifier.
  • the NF storage function entity searches for the NF entity having the NF type according to the request, and the NF storage function entity searches for the NF with the PCF type in the pre-stored NF entity.
  • An entity may find an NF entity or multiple NF entities with PCF functionality. For example, suppose the first NF entity is a session management function (SMF NF) entity, the SMF NF entity needs to discover the PCF NF entity, and if the NF storage function entity finds that two PCF NF entities meet the requirements, the NF storage The functional entity generates two pieces of security information.
  • the first security information includes the SMF NF entity identifier and the PCF_1 NF entity identifier.
  • the second security information includes the SMF NF entity identifier and the PCF_2 NF entity identifier, and the two security information are sent.
  • the SMF NF entity is sent, and the first security information is sent to the PCF_1 NF entity, and the second security information is sent to the PCF_2 NF entity.
  • the security information is used to verify the authenticity of the identity of the first NF entity and the NF entity to be connected, and each security information further includes an identifier of the NF entity to be connected.
  • the security information includes: an identifier of the first NF entity, and an identifier of the (second) NF entity to be connected, for example, the NF type of the first NF entity located in a certain PLMN network is a packet data session management function.
  • the SM NF, the identifier of the first NF entity may be a combination of a PLMN ID, an NF type, and a sequence number: PLMN ID.SMF.001, so that the NF entity may be uniquely identified, and optionally, a network of the NF entity may also be used.
  • the address is the identifier of the NF entity.
  • the NF storage function entity also generates an NF discovery response.
  • Step 303 The NF storage function entity sends the identifier of the at least one security information that meets the NF type and the identifier of the second NF entity that is corresponding to the NF type to the first NF entity by using the NF discovery response.
  • the method further includes:
  • the NF storage function entity detects whether the first NF entity is allowed to initiate a communication connection request, or detects whether the NF discovery request allows access. By setting a detection mechanism, the NF function entity may be discovered as early as possible to achieve access.
  • the access between the NF entities is controlled to reduce the load of the accessed NF entity and enhance the security of access between the NF entities.
  • the process of the NF storage function entity detecting whether the communication connection request is allowed to be established includes: storing, by the NF storage function entity, a list of NF types accessible by the first NF entity, and the NF storage function entity may determine, according to the service logic, for example, It is determined whether the NF type corresponding to the NF entity to be connected is in the NF type list accessible by the first NF entity. If it is determined that the NF type corresponding to the NF entity to be connected is in the first NF In the list of NF types that the entity can access, access is allowed; if not in the list of NF types, the access connection is denied.
  • Step 304 The first NF entity receives the security information identifier (or security information) sent by the NF storage function entity and the identifier of the second NF entity corresponding to the NF type.
  • the first NF entity sends the response through the NF discovery.
  • the first NF entity selects one of the security information identifiers, and identifies the selected NF entity as the second NF entity, and establishes a session connection.
  • the NF storage function module can send the security information (partial or all) satisfying the NF type condition to the first NF entity, so that the first NF entity can select a preferred NF entity as the second NF entity, and the second
  • the NF entity establishes a communication connection, thereby providing multiple possibilities for the first NF entity to select a good quality second NF entity, further improving the reliability and security of the communication connection; of course, the NF storage function module is also the first NF.
  • the entity selects a preferred NF entity as the second NF entity, and sends the security information of the second NF entity to the first NF entity.
  • Step 305 The first NF entity generates a communication connection request, and sends the identifier of the first NF entity and the security information identifier to the second NF entity by using the communication connection request.
  • the security information identifies a piece of security information that can uniquely correspond.
  • Step 306 The second NF entity receives a communication connection request from the first NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier, and sends the verification that carries the security information identifier to the NF storage function entity. request.
  • Step 307 The NF storage function entity receives the verification request sent by the second NF entity, and determines the corresponding security information according to the security information identifier of the first NF entity, where the security information includes the identifier of the first NF entity.
  • Step 308 The NF storage function entity sends the security information to the second NF entity by using a verification response.
  • Step 309 The second NF entity acquires security information sent by the NF storage function entity, and determines, according to the security information, whether a communication connection is established with the first NF entity.
  • the second NF entity determines whether the identifier of the first NF entity in the security information is the same as the identifier of the first NF entity in the communication connection request, or determines the first of the converted security information. Whether the identifier of the NF entity is the same as the identifier of the first NF entity in the communication connection request, for example, determining whether the information such as the PLMN ID, SMF.001, etc. sent by the NF storage function entity is converted into an IP address, etc., is sent with the first NF. The IP address is the same. If the same, the first NF entity is allowed to access the second NF entity, ie The second NF entity establishes a communication connection with the first NF entity; if not, the access is denied.
  • the communication connection request of step 305 further includes a first challenge random number (English: challenge) and a first encrypted ciphertext (English: encrypted text).
  • the NF storage function entity generates at least one piece of security information, and also generates a first key (English: key) and a valid time of each of the security information, the first key being used to decrypt the
  • the first encrypted ciphertext obtained by the second NF entity from the first NF entity, and the valid time of the security information is a set period of time for checking whether the security information is valid. If the time when the second NF entity verifies the identity of the first NF entity exceeds the valid time of the security information, the security information is invalid, and the connection access is denied; if it is valid, access is allowed.
  • the method further includes, in step 308, the NF storage function entity transmitting the first key and the valid time of the security information to the second NF entity.
  • the second NF entity determines whether to establish a communication connection with the first NF entity according to the security information, and further includes: the second NF entity acquiring the first key from the NF storage function entity, And a first encrypted ciphertext from the first NF entity; the second NF entity decrypting the first encrypted ciphertext using the first key to generate the second challenge random number.
  • the second NF entity establishes a communication connection with the first NF entity; if at least one of them is different, the connection is refused.
  • the NF storage function entity further includes the first key in an NF discovery response sent by the first NF entity.
  • the method further includes:
  • Step 310 The second NF entity generates a third challenge random number, generates a second encrypted ciphertext by using the third challenge random number and the first key, and uses the second encrypted ciphertext and the third A challenge random number is sent to the first NF entity.
  • the second encrypted ciphertext and the third challenge random number may or may not be carried in the communication connection response.
  • the second NF entity may further send the second encrypted ciphertext and the third challenge random number by using a data packet.
  • Step 311 If the communication connection response indicates that the communication connection is allowed to be established, the first NF entity obtains the second encrypted ciphertext and the third challenge random number sent by the second NF entity by using the communication connection response; The NF entity decrypts the second encrypted ciphertext to generate a fourth challenge random number. And judge the fourth pick Whether the battle random number is the same as the third challenge random number, and if they are the same, establish a session connection with the second NF entity.
  • the second key for decrypting the second encrypted ciphertext may be obtained by the NF storage function entity.
  • the NF storage function entity sends the first key by using the NF discovery response. Give the first NF entity. If the second key decrypting the second encrypted ciphertext is the same as the first key, the generated fourth challenge random number is the same as the third challenge random number if the second key is not from the And the first NF entity refuses to establish a connection with the second NF entity, if the NF storage function entity is different from the first key, and the first NF entity cannot decrypt the second encrypted ciphertext.
  • the first NF entity initiates a communication connection request to the second NF entity
  • the NF storage function entity performs NF discovery control, and identifies the security information corresponding to the security information of the first NF entity.
  • the second NF entity Provided to the second NF entity to be connected, so that the second NF entity can verify the authenticity and security of the access requester, the identity of the first NF entity according to the security information, and avoid unauthorized access between the NFs.
  • the NF storage function entity stores the identity of the NF entity in the network, generates security information, and sends a key to both ends of the NF entity requesting the communication connection, providing a basis and credentials for the access connection between the NF entities.
  • the second NF entity verifies the first NF entity identity security of the sending the communication connection request, sending the second encrypted ciphertext and the third challenge random number to the first NF entity, so that the first NF entity can be based on the NF
  • the key provided by the storage function entity verifies the security of the second NF entity, further enhancing the security of the communication data between the NF entities.
  • This embodiment is the same as the application scenario of the first embodiment, and is a process for describing the first NF entity to discover and access the second NF entity.
  • the difference from the first embodiment is that the NF storage function entity detects that the first NF entity is allowed to be the second. After the NF entity accesses, at least one security information and a key are actively sent to the second NF entity. Specifically, as shown in FIG.
  • steps 401 to 404 reference may be made to steps 301 to 304 in the first embodiment, and details are not described herein.
  • Step 405 The NF storage function module actively sends the generated at least one security information to an NF entity that satisfies the NF type condition, where the security information includes an identifier of the first NF entity.
  • the NF storage function entity finds that two PCF NF entities meet the connection requirement, the NF storage function entity generates two security information, where the first security information includes the SMF NF entity identifier and the PCF_1 NF entity identifier, and the second The security information includes the SMF NF entity identifier and the PCF_2 NF entity identifier, and The first security information is sent to the PCF_1 NF entity, and the second security information is sent to the PCF_2 NF entity.
  • the first NF entity receives the SMF NF entity identifier sent by the NF storage function entity, the PCF_1 NF entity identifier and the PCF_2 NF entity identifier, and selects one of the PCF_NF entities as the second NF entity, for example, selecting the PCF_1 NF entity as the connection object, A communication connection request is sent to the PCF_1 NF entity.
  • Step 406 The first NF entity sends a communication connection request to the selected second NF entity, where the communication connection request includes a security information identifier and an identifier of the first NF entity.
  • the communication connection request further includes The first challenge random number and the first encrypted ciphertext.
  • the execution order of the step 405 and the step 406 is not in a sequential relationship, that is, the second NF entity may first obtain the communication connection request sent by the first NF entity, and then obtain the security information sent by the NF storage function entity. Alternatively, the second NF entity simultaneously acquires the security information and the communication connection request.
  • Step 407 Receive an NF entity (second NF entity) of the communication connection request sent by the first NF entity, and determine, according to the security information and the identifier of the first NF entity, whether the first NF entity is Establish a communication connection.
  • the steps 407 to 409 are the same as the steps 309 to 311 of the embodiment, and are not described again.
  • the NF storage function module sends the security information, the key, and the like to the second NF entity, thereby preventing the second NF entity from sending a separate request to the NF storage function module to obtain the corresponding security.
  • Information saves the verification process and improves the efficiency of verification between NFs.
  • a connection method between NF entities provided in this embodiment is applied to a system of two or more PLMNs, where the system includes: a first NF entity, a second NF entity, and a first NF storage function entity, and a second The NF storage function entity, wherein the first NF entity and the first NF storage function entity are deployed in a first mobile network, configured as a first PLMN or a local PLMN (local PLMN), and the second NF entity and the second NF storage The function entity is deployed in the second mobile network, and is configured as a second PLMN or a remote PLMN.
  • the process of establishing a communication connection specifically includes the following steps:
  • step 501 The first NF entity sends an NF discovery request to the first NF storage function entity, where the NF discovery request includes an identifier of the first NF entity, and an NF type of the NF entity to be accessed (NF type , the type of network function) and the information such as the deployed PLMN identity.
  • the NF discovery request includes an identifier of the first NF entity, and an NF type of the NF entity to be accessed (NF type , the type of network function) and the information such as the deployed PLMN identity.
  • Step 502 The first NF storage function entity receives the NF discovery request, determines a second NF storage function entity in the second PLMN according to the PLMN identifier in the NF discovery request, and stores the functional entity to the second NF. Send the NF request.
  • Step 503 The second NF storage function entity receives the NF discovery request, and determines at least one NF entity that satisfies the condition according to the identifier of the first NF entity and the NF type, and generates at least one security information, where each One of the security information corresponds to an identifier of an NF entity.
  • the second NF storage function entity detects whether to allow access to the first NF entity to access other NF entities, and the process of detecting is the same as that in Embodiment 1, and is no longer Narration. If access is allowed, security information and keys with at least one NF entity are generated.
  • Step 504 The second NF storage function entity sends the generated at least one security information and the key to the first NF storage function entity by using the NF discovery response.
  • Step 505 The first NF storage function entity receives the NF discovery response sent by the second NF storage function entity, and sends the NF discovery response to the first NF entity, where the NF discovery response includes at least one NF to be connected.
  • the security information of the entity or it may also include the key. Some or all of the security information includes: an identifier of the first NF entity, an identifier of the NF entity to be connected to the second, and a valid time of the security information.
  • the first NF entity receives the NF discovery response sent by the first NF storage function entity, and selects an NF entity as the second NF entity according to the content in the NF discovery response.
  • the first NF storage function entity determines the second NF storage function entity according to the identifier of the deployed PLMN in the NF discovery request, and sends the NF discovery request to the second NF storage function entity.
  • Step 507 The first NF entity sends a communication connection request to the determined second NF entity, where the communication connection request includes an identifier of the first NF entity, a first challenge random number, and a first encrypted ciphertext encrypted by the key.
  • Step 508 The second NF entity receives the communication connection request sent by the first NF entity, and sends the security information identifier in the communication connection request to the second NF storage function entity.
  • Step 509 The second NF storage function entity receives the security information identifier, searches for the security information corresponding thereto, and the key, and sends the security information and the key to the second NF entity, or the second NF storage function entity. After receiving the NF discovery request forwarded by the first NF storage function entity, the security information and the key are actively sent to the second NF entity.
  • Step 510 The second NF entity receives the communication connection request sent by the first NF entity and the security information and the key sent by the second NF storage function entity, and determines the identifier and the communication connection request of the first NF entity in the security information. Whether the identifiers of the first NF entities are the same, and whether the first challenge random number is the same as the second challenge random number generated after decrypting the first encrypted ciphertext, and if the identifiers are the same and the challenge random numbers are also the same, Determine the identity is true, establish a communication connection with the first NF entity.
  • step 511 if the first NF entity is allowed to establish a communication connection, the second NF entity sends a communication connection response to the first NF entity, where the communication connection response includes a third challenge random number and a second encrypted ciphertext. .
  • Step 512 The first NF entity receives the communication connection response, and a second key from the second NF storage function entity, and decrypts the second encrypted ciphertext by using the second key to generate a fourth challenge random number. And determining, if the fourth challenge random number is the same as the acquired third challenge random number, establishing a communication connection with the second NF entity.
  • the embodiment provides a connection method and system, where a first NF storage function entity in a first PLMN interacts with a second NF storage function entity in a second PLMN, and a second NF storage function entity in the second PLMN
  • the two NF entity information and the corresponding security information and the key are provided to the second NF entity, thereby implementing control of communication between the NF entities located in different PLMNs, and secure communication connections between the NF entities.
  • the embodiment of the present application further provides a second NF entity, a first NF entity, and an NF storage function entity device.
  • a schematic structural diagram of an NF entity is applied to a second NF entity for receiving a communication connection request from a transmitting end. Further, the entity includes: a transceiver unit 601 and a processing unit 602.
  • the transceiver unit 601 is configured to receive a communication connection request from the first network function NF entity, where the communication connection request includes an identifier of the first NF entity and a security information identifier, and the security information identifier is obtained from the NF storage function entity. Corresponding security information;
  • the processing unit 602 is configured to determine, if the security information includes the identifier of the first NF entity, establish a communication connection with the first NF entity.
  • the security information includes an identifier of the first NF entity
  • the processing unit 602 is further configured to determine, if the at least one identifier in the security information is the first NF entity in the communication connection request. If the identifiers are the same, a communication connection is established with the first NF entity.
  • the communication connection request further includes a first challenge random number
  • the transceiver unit 601 is further configured to acquire a first key from the NF storage function entity, and a first from the first NF entity.
  • the processing unit 602 is further configured to: decrypt the first encrypted ciphertext by using the first key to generate a second challenge random number, and further configured to determine, if the at least one identifier in the security information is connected to the communication The identifier of the first NF entity in the request is the same, and the first challenge random number is the same as the second challenge random number, and a communication connection is established with the first NF entity.
  • the processing unit 602 is further configured to: if a communication connection is established with the first NF entity, generate a third challenge random number, and generate a second using the third challenge random number and the first key Encrypting the ciphertext; the transceiver unit 601 is further configured to send the second encrypted ciphertext and the third challenge random number to the first NF entity.
  • the security information further includes an effective time of the security information, and the effective time of the security information is used to check whether the security information is valid.
  • transceiver unit 601 and the processor 602 are further configured to perform the steps of performing part or all of the functions of the first NF entity in steps 301 to 311 in FIG. 3; and executing the first NF in steps 401 to 409 in FIG. The steps of some or all of the functions of the entity; and the steps of some or all of the functions of the first NF entity in steps 501 through 512 of FIG.
  • FIG. 7 a schematic structural diagram of another NF entity is applied to a first NF entity for a communication connection request initiated by a second NF entity, the entity including: a transceiver unit 701 and a processing unit 702.
  • the transceiver unit 701 is configured to send, to the NF storage function entity, the identifier of the first NF entity and the requested NF type information, and receive the security information identifier from the NF storage function entity and the second NF corresponding to the NF type. The identity of the entity.
  • the transceiver unit 701 is further configured to send a communication connection request to the second NF entity, where the communication connection request includes an identifier of the first NF entity and the security information identifier.
  • the transceiver unit 701 is further configured to receive a communication connection response from the second NF entity, where the communication connection response is used to indicate whether the second NF entity is allowed to establish a communication connection with the second NF entity.
  • the entity further includes a processing unit 702, the transceiver unit 701 is further configured to receive a first key from the NF storage function entity, and obtain a first challenge random number, and a processing unit 702, configured to The first challenge random number and the first key generate a first encrypted ciphertext; the transceiver unit 701 is further configured to send the first encrypted ciphertext and the first challenge random number to the second NF entity.
  • a processing unit 702 the transceiver unit 701 is further configured to receive a first key from the NF storage function entity, and obtain a first challenge random number, and a processing unit 702, configured to The first challenge random number and the first key generate a first encrypted ciphertext; the transceiver unit 701 is further configured to send the first encrypted ciphertext and the first challenge random number to the second NF entity.
  • the transceiver unit 701 is further configured to: if the communication connection response indication indicates that the communication connection is allowed to be established, receive the second encrypted ciphertext and the third challenge random number from the second NF entity; and the processing unit 702, And is further configured to decrypt the second encrypted ciphertext by using the first key, and generate a fourth challenge random number, and determine that if the fourth challenge random number is the same as the third challenge random number, The second NF entity establishes a session connection.
  • transceiver unit 701 and the processor 702 are further configured to perform the steps of performing part or all of the functions of the second NF entity in steps 301 to 311 in FIG. 3; and performing the second step 401 to 409 in FIG. The steps of some or all of the functions of the NF entity, and the steps of some or all of the functions of the second NF entity in steps 501 through 512 of FIG.
  • the NF entity in this embodiment can serve as a transmitting end, for example, a first NF entity, and has a request for initiating a communication connection and a function, and can also serve as a receiving end, for example, a second NF entity, and receive a communication connection from the sending end. Request and verify the identity of the sender.
  • FIG. 8 a schematic structural diagram of an NF storage function entity for controlling discovery of an NF entity and generating security information and a key is shown.
  • the entity includes: a transceiver unit 801 and a processing unit 802.
  • the transceiver unit 801 is configured to receive the identifier of the first NF entity from the first NF entity and the requested NF type information.
  • the processing unit 802 is configured to obtain, according to the identifier of the first NF entity and the NF type information, a security information identifier and an identifier of a second NF entity corresponding to the NF type.
  • the transceiver unit 801 is further configured to send the security information identifier and the identifier of the second NF entity to the first NF entity.
  • the processing unit 802 is further configured to determine, according to the identifier of the first NF entity and the NF type information, at least one NF entity that satisfies an NF type condition, and generate at least one security information, where the security The information includes an identifier of the first NF entity and an identifier of an NF entity that satisfies the NF type condition.
  • the transceiver unit 801 is further configured to receive the identifier of the first NF entity from the first NF entity forwarded by the first NF storage function entity and the requested NF type information.
  • the transceiver unit 801 is further configured to: send the security information and the identifier of the second NF entity to the second NF entity, and actively send the security information and the second The identifier of the NF entity, or sent after receiving the security information identifier from the second NF entity.
  • the transceiver unit 801 is further configured to send, to the first NF entity and the second NF entity, a first key, where the first key is used to decrypt the second NF entity from the first The first encrypted ciphertext obtained by an NF entity.
  • the processing unit 802 is further configured to detect whether the first NF entity is allowed to initiate a communication connection request to the second NF entity. Further, the processing unit 802 is further configured to determine whether the NF type corresponding to the identifier of the second NF entity is in the NF type list of the first NF entity, and if yes, allow the communication connection request to be initiated, Otherwise, the communication connection request is not allowed to be sent.
  • transceiver unit 801 and the processor 802 are further configured to perform the steps of performing part or all of the functions of the NF storage function entity in steps 301 to 311 in FIG. 3; and performing the NF storage function in steps 401 to 409 in FIG. The steps of some or all of the functions of the entity.
  • the first NF storage function entity and the second NF storage function entity are included, and the first NF storage function entity and the first NF entity belong to the first mobile network,
  • the second NF storage function entity and the second NF entity belong to the second mobile network
  • the transceiver unit 801 includes a first transceiver unit 8011 and a second transceiver unit 8012
  • the processing unit 802 includes a first processing unit 8021 and a second processing unit. 8022.
  • the first transceiver unit 8011 and the first processing unit 8021 are both located in the first NF storage function entity
  • the second transceiver unit 8012 and the second processing unit 8022 are both located in the second NF storage function entity.
  • the first transceiver unit 8011 is configured to receive an NF discovery request sent by the first NF entity, where the NF discovery request includes an identifier of the deployed PLMN.
  • the first processing unit 8021 is configured to receive the identifier of the deployed PLMN sent by the first transceiver unit 8011, determine the second NF storage function entity according to the identifier of the deployed PLMN, and pass the NF discovery request
  • the first transceiver unit 8011 is sent to the second transceiver unit 8012;
  • the second transceiver unit 8012 is configured to receive the NF discovery request sent by the first transceiver unit 8011.
  • the second processing unit 8022 is configured to determine, according to the identifier of the first NF entity and the NF type in the NF discovery request, at least one NF entity that satisfies the condition, and generate at least one security information;
  • the second transceiver unit 8012 is further configured to send the at least one security information to the first transceiver unit 8011;
  • the first transceiver unit 8011 is further configured to receive the at least one security information, and send the at least one security information to the first NF entity.
  • first NF storage function entity and the second NF storage function entity are configured to perform the steps of performing some or all of the functions of the NF storage function entity in steps 301 to 311 of FIG. 3; and performing steps 401 to 141 in FIG.
  • the step of 409 storing some or all of the functions of the functional entity in 409.
  • the NF storage function entity controls the discovery of the NF entity, and provides the security information and the key information to the peer NF entity discovered by the NF, so that the NF entity can verify the other party according to the security information and the key.
  • the authenticity of the identity and the establishment of a secure connection enable secure authentication of inter-NF access and avoid unauthorized access to the NF entity.
  • the present application further provides a network function NF entity and an NF storage function entity.
  • the NF entity and the NF storage function entity may be software deployed on a general-purpose computing platform or may be separate hardware devices.
  • the NF entity may be an NF entity in any of the foregoing embodiments for implementing the method steps in the foregoing embodiments.
  • the NF entity device includes a transceiver 901, a processor 902, and a memory 903.
  • the transceiver 901 includes at least one communication interface and an I/O interface for implementing data transmission and reception with different NF entities and NF storage function entities.
  • the transceiver 901 can include components such as a receiver, a transmitter, and an antenna.
  • the NF entity may also include more or fewer components, or a combination of certain components, or different component arrangements, which is not limited in this application.
  • the processor 902 is a control center of the NF entity for implementing the various method step functions in the foregoing embodiments, connecting various parts of the entire device by using various interfaces and lines, by running or executing a software program stored in the memory 903 and/or Or module, and recalling data stored in the memory to perform various functions of the terminal device and/or process data.
  • the processor 903 may be composed of an integrated circuit (IC), for example, may be composed of a single packaged IC, or may be composed of a plurality of packaged ICs that have the same function or different functions.
  • IC integrated circuit
  • the processor 903 may include only a central processing unit (CPU), or may be a GPU, a digital signal processor (DSP), and a control chip (for example, a baseband chip) in the transceiver module. combination.
  • the CPU may be a single operation core, and may also include a multi-operation core.
  • various transceiver modules in the transceiver 901 are generally in the form of integrated circuit chips, and can be selectively combined without including all transceiver modules and corresponding antenna groups.
  • the transceiver module can include only a baseband chip, a radio frequency chip, and a corresponding antenna to provide communication functionality in a cellular communication system.
  • the terminal device can be connected to a cellular network or the internet via a wireless communication connection established by the transceiver module, such as wireless local area network access or WCDMA access.
  • a communication module such as a baseband module, in the transceiver module may be integrated into the processor, typically an APQ+MDM series platform such as that provided by Qualcomm.
  • the radio frequency circuit is used for receiving and transmitting signals during information transmission and reception or during a call.
  • the radio frequency circuit includes well-known circuits for performing these functions, including but not limited to an antenna system, a radio frequency transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a codec. (codec) chipset, Subscriber Identity Module (SIM) card, memory, etc.
  • the RF circuit can communicate with the network and other devices through wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to global system of mobile communication (GSM), general packet radio service (gprs), code division multiple access (code) Division multiple Access, CDMA), wideband code division multiple access (WCDMA), high speed uplink packet access (HSUPA), long term evolution (LTE), electronic Mail, short message service (SMS), etc.
  • GSM global system of mobile communication
  • gprs general packet radio service
  • code division multiple access code division multiple Access
  • CDMA code division multiple Access
  • WCDMA wideband code division multiple access
  • HSUPA high speed uplink packet access
  • LTE long term evolution
  • SMS short message service
  • Processor 902 also performs the processes of FIGS. 3 through 5 relating to the first NF entity and second NF entity processing and/or for the techniques described herein.
  • the processor/controller 902 is configured to support the first NF entity and/or the second NF entity to perform step 301 to step 311 in FIG. 3, step 401 to step 409 in FIG. 4, step 501 in FIG. Step 512, and/or other processes for the techniques described herein.
  • the function to be implemented by the transceiver 901 may be implemented by the transceiver unit 601 or the transceiver unit 701, or may be implemented by the processor 902 to control the transceiver 901; the function to be implemented by the processor 902 may be performed by the processing unit. 602 or processing unit 702 is implemented.
  • FIG. 10 it is a schematic structural diagram of an NF storage function entity according to the present application.
  • the NF storage function entity may be the security information generating device in any of the foregoing embodiments for implementing the method steps in the foregoing embodiments.
  • the NF storage function entity may be composed of a transceiver 1001, a processor 1002, a memory 1003, and the like.
  • the transceiver 1001 includes at least one communication interface and an I/O interface.
  • the processor 1002 is a control center of the NF storage function entity, which connects various parts of the entire device by using various interfaces and lines, by running or executing software programs and/or modules stored in the memory, and calling data stored in the memory, To perform various functions and/or process data of the NF storage function module.
  • the processor may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP.
  • the processor may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the processor 1002 also performs other processes in FIG. 3 through FIG. 5 that relate to the NF storage functional entity process and/or for the techniques described herein.
  • the processor/controller 1002 is configured to support the NF storage function entity to perform step 301 to step 311 in FIG. 3, step 401 to step 409 in FIG. 4, step 501 to step 512 in FIG. 5, and/or Other processes of the techniques described herein.
  • the memory 1003 may include a volatile memory, such as a random access memory (RAM), and may also include a non-volatile memory, such as a flash memory.
  • RAM random access memory
  • non-volatile memory such as a flash memory.
  • HDD hard disk drive
  • SSD solid state drive
  • a program or code may be stored in the memory, and the processor in the network element may implement the function of the NF storage function module by executing the program or code.
  • the transceiver 1001 can be configured to receive or transmit data, and the transceiver can transmit data to the first NF physical device or other NF physical device under the control of the processor.
  • the transceiver may be used to implement the method steps of receiving the discovery request, sending the discovery response, and receiving the security information identifier and the feedback security information sent by the second NF entity in the foregoing embodiment.
  • the functions to be implemented by the receiver 1001 may be implemented by the transceiver unit of the NF storage function entity, or by the processor 1002 to control the transceiver 1001; the functions to be implemented by the processor 1002 may be implemented by the processing unit 802.
  • the present application further provides a computer storage medium, wherein the computer storage medium may store a program, where the program may include a part of each embodiment of a connection method between network function entities provided by the application. Or all steps.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).
  • the technology in the embodiments of the present application can be implemented by means of software plus a necessary general hardware platform.
  • the technical solution in the embodiments of the present application may be embodied in the form of a software product in essence or in the form of a software product, and the computer software product may be stored in a storage medium such as a ROM/RAM. , a diskette, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application or portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé et un dispositif de connexion entre des entités de réseau. Le procédé comprend les étapes consistant à : recevoir, par une seconde entité de fonction de réseau (NF), une requête de connexion de communication provenant d'une première entité de fonction de réseau (NF), la requête de connexion de communication comprenant un identifiant de la première entité de NF et un identifiant d'informations de sécurité ; obtenir des informations de sécurité correspondant à l'identifiant d'informations de sécurité à partir d'une entité de stockage de NF ; et si les informations de sécurité comprennent l'identifiant de la première entité de NF, la seconde entité de NF établit une connexion de communication avec la première entité de NF. Dans le procédé, l'entité de stockage de NF commande la découverte d'une entité de NF et fournit des informations de sécurité à une entité de NF d'extrémité homologue découverte par la NF, de telle sorte que l'entité de NF peut vérifier l'authenticité de l'identité de la partie d'extrémité opposée et établit une connexion sécurisée, et par conséquent, la sécurité et la fiabilité d'accès entre les NF sont obtenues, et un accès non autorisé entre les NF est évité.
PCT/CN2016/113796 2016-12-30 2016-12-30 Procédé et appareil de connexion entre des entités de réseau Ceased WO2018120150A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/113796 WO2018120150A1 (fr) 2016-12-30 2016-12-30 Procédé et appareil de connexion entre des entités de réseau

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/113796 WO2018120150A1 (fr) 2016-12-30 2016-12-30 Procédé et appareil de connexion entre des entités de réseau

Publications (1)

Publication Number Publication Date
WO2018120150A1 true WO2018120150A1 (fr) 2018-07-05

Family

ID=62706816

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/113796 Ceased WO2018120150A1 (fr) 2016-12-30 2016-12-30 Procédé et appareil de connexion entre des entités de réseau

Country Status (1)

Country Link
WO (1) WO2018120150A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112995090A (zh) * 2019-12-02 2021-06-18 中国电信股份有限公司 终端应用的认证方法、装置、系统和计算机可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101977378A (zh) * 2010-09-30 2011-02-16 中兴通讯股份有限公司 信息传输方法、网络侧及中继节点
CN103441989A (zh) * 2013-08-05 2013-12-11 大唐移动通信设备有限公司 一种鉴权、信息处理方法及装置
WO2015050892A1 (fr) * 2013-10-01 2015-04-09 Ruckus Wireless, Inc. Accès à un réseau sécurisé à l'aide de justificatifs d'identité
CN104579889A (zh) * 2013-10-16 2015-04-29 华为技术有限公司 一种用于调用网络功能的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101977378A (zh) * 2010-09-30 2011-02-16 中兴通讯股份有限公司 信息传输方法、网络侧及中继节点
CN103441989A (zh) * 2013-08-05 2013-12-11 大唐移动通信设备有限公司 一种鉴权、信息处理方法及装置
WO2015050892A1 (fr) * 2013-10-01 2015-04-09 Ruckus Wireless, Inc. Accès à un réseau sécurisé à l'aide de justificatifs d'identité
CN104579889A (zh) * 2013-10-16 2015-04-29 华为技术有限公司 一种用于调用网络功能的方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112995090A (zh) * 2019-12-02 2021-06-18 中国电信股份有限公司 终端应用的认证方法、装置、系统和计算机可读存储介质
CN112995090B (zh) * 2019-12-02 2022-11-08 中国电信股份有限公司 终端应用的认证方法、装置、系统和计算机可读存储介质

Similar Documents

Publication Publication Date Title
CN113993143B (zh) 会话管理方法、装置和系统
CN111865597B (zh) 通信方法和通信设备
US11503469B2 (en) User authentication method and apparatus
US11510052B2 (en) Identity information processing method, device, and system
CN110798833A (zh) 一种鉴权过程中验证用户设备标识的方法及装置
WO2018232570A1 (fr) Procédés d'enregistrement et d'établissement de session, terminal, et entité amf
CN113541925A (zh) 通信系统、方法及装置
CN113055879B (zh) 一种用户标识接入方法及通信装置
CN110366204B (zh) 通信方法和通信装置
CN109246769B (zh) 一种pdu会话建立方法及装置
WO2019158093A1 (fr) Procédé et dispositif de détermination de mode ssc
US20210127265A1 (en) Communication system
CN115942305A (zh) 一种会话建立方法和相关装置
WO2021047403A1 (fr) Procédé et dispositif d'autorisation dans une pluralité de scénarios de nrf
JP2013513986A (ja) サーバにおけるスマートカード・セキュリティ機能プロファイル
CN115412911A (zh) 一种鉴权方法、通信装置和系统
CN112449377B (zh) 一种网络数据的上报方法及装置
CN114880657B (zh) 一种api拓扑隐藏方法、设备及系统
WO2018120150A1 (fr) Procédé et appareil de connexion entre des entités de réseau
CN113055342A (zh) 一种信息处理方法及通信装置
EP4131847A1 (fr) Appareil, procédé et programme informatique
WO2020215272A1 (fr) Procédé de communication, appareil de communication et système de communication
CN115884187A (zh) 消息传输方法及通信装置
CN113678127A (zh) 访问控制方法、服务器、访问设备及存储介质
US20240356742A1 (en) Verification of service based architecture parameters

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16925089

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16925089

Country of ref document: EP

Kind code of ref document: A1