Nothing Special   »   [go: up one dir, main page]

WO2024165058A1 - 通信方法及装置 - Google Patents

通信方法及装置 Download PDF

Info

Publication number
WO2024165058A1
WO2024165058A1 PCT/CN2024/076820 CN2024076820W WO2024165058A1 WO 2024165058 A1 WO2024165058 A1 WO 2024165058A1 CN 2024076820 W CN2024076820 W CN 2024076820W WO 2024165058 A1 WO2024165058 A1 WO 2024165058A1
Authority
WO
WIPO (PCT)
Prior art keywords
tngf
verification parameter
key
tnap
unonce
Prior art date
Application number
PCT/CN2024/076820
Other languages
English (en)
French (fr)
Inventor
刘文峰
李�赫
吴�荣
郭燕飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024165058A1 publication Critical patent/WO2024165058A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/08—Reselecting an access point
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/19—Connection re-establishment

Definitions

  • the present application relates to the field of communications, and in particular to a communication method and device.
  • the trusted non-3GPP gateway function can identify the identity of the UE through the user equipment (UE) authentication identifier to achieve the purpose of switching the UE from the source TNAP to the target TNAP.
  • UE user equipment
  • the UE authentication identifier cannot be securely protected when it is transmitted between the UE and the target TNAP. In this way, an attacker can impersonate the UE to initiate the TNAP switching process, which will cause communication security issues.
  • the embodiments of the present application provide a communication method and device, which can prevent attackers from impersonating UE to initiate TNAP switching, thereby improving communication security.
  • a communication method includes: in a process in which a user device UE accesses a trusted non-third generation partnership project gateway function TNGF through a source trusted non-third generation partnership project 3GPP access point TNAP, the UE obtains a UE authentication identifier and generates a TNGF key.
  • the TNGF key is a key shared between the TNGF and the UE.
  • the UE switches from the source TNAP to the target TNAP, the UE sends a first message to the TNGF through the target TNAP.
  • the first message includes the UE authentication identifier and a first verification parameter.
  • the first verification parameter is generated by the UE based on the UE authentication identifier and the TNGF key.
  • the UE when the UE switches from the source TNAP to the target TNAP, the UE can send a first verification parameter when sending the UE authentication identifier to the target TNAP.
  • the first verification parameter is generated according to the TNGF key and the UE authentication identifier.
  • the TNGF can authenticate the integrity of the UE authentication identifier and the identity of the UE according to the received UE authentication identifier and the first verification parameter, so that when the attacker impersonates the UE to initiate TNAP switching, the UE impersonated by the attacker can be identified to prevent the UE impersonated by the attacker from accessing the target TNAP, thereby improving communication security.
  • the UE obtaining the UE authentication identifier may include: the UE receiving the UE authentication identifier from the TNGF through the source TNAP.
  • the method provided in the first aspect may also include: the UE accesses the TNGF through the source TNAP.
  • the first message is an identity response message.
  • the method provided in the first aspect may also include: the UE determines to switch from the source TNAP to the target TNAP. A layer 2 connection is established between the UE and the target TNAP. The UE receives an identity request message from the target TNAP, and the identity request message is used to trigger the UE to send the first message.
  • the method provided in the first aspect in a possible design scheme may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the TNGF key and TNonce.
  • the UE generates a third verification parameter according to the TNGF key and TNonce.
  • the UE obtains the UE authentication identifier, which may include: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier according to the TNGF key, TNonce and the UE's random number UNonce. UNonce is generated by the UE.
  • the method provided in the first aspect may further include: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the method provided in the first aspect may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the intermediate key and TNonce.
  • the intermediate key is generated by the TNGF according to the TNGF key.
  • the UE generates the intermediate key according to the TNGF key.
  • the UE generates a third verification parameter according to the intermediate key and TNonce.
  • the UE obtains the UE authentication identifier, which may include: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier according to the intermediate key, TNonce and the UE's random number UNonce. UNonce is generated by the UE.
  • the method provided in the first aspect further includes: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • the method provided in the first aspect may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the address of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce and the address of the TNGF.
  • the UE generates a third verification parameter according to the TNGF key, TNonce and the address of the TNGF.
  • the UE obtains the UE authentication identifier, including: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier according to the TNGF key, TNonce and the UE's random number UNonce.
  • the method provided in the first aspect may further include: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the method provided in the first aspect may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the address of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF based on the intermediate key, the random number TNonce of the TNGF and the address of the TNGF.
  • the intermediate key is generated by the TNGF based on the TNGF key.
  • the UE generates an intermediate key based on the TNGF key; the UE generates a third verification parameter based on the intermediate key, TNonce and the address of the TNGF.
  • the UE obtains the UE authentication identifier, including: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier based on the intermediate key, TNonce, the UE's random number UNonce and the TNGF address. UNonce is generated by the UE.
  • the method provided in the first aspect may further include: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • the method provided in the first aspect may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the identifier of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce and the identifier of the TNGF.
  • the UE generates a third verification parameter according to the TNGF key, TNonce and the identifier of the TNGF.
  • the UE obtains the UE authentication identifier, which may include: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier according to the TNGF key, at least TNonce and the random number UNonce of the UE. UNonce is generated by the UE.
  • the method provided in the first aspect may further include: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the method provided in the first aspect may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the identifier of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the intermediate key, TNonce and the identifier of the TNGF.
  • the intermediate key is generated by the TNGF according to the TNGF key.
  • the UE generates the intermediate key according to the TNGF key.
  • the UE generates a third verification parameter according to the intermediate key, TNonce and the identifier of the TNGF.
  • the UE obtains the UE authentication identifier, which may include: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier according to the intermediate key, at least TNonce and the UE's random number UNonce. UNonce is generated by the UE.
  • the method provided in the first aspect may further include: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • the method provided in the first aspect may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes a random number TNonce of the TNGF, an address of the TNGF, an identifier of the TNGF, and a second verification parameter.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce, the address of the TNGF, and the identifier of the TNGF.
  • the UE generates a third verification parameter according to the TNGF key, TNonce, the address of the TNGF, and the identifier of the TNGF.
  • the UE obtains the UE authentication identifier, which may include: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier according to the TNGF key, at least TNonce, and the UE's random number UNonce. UNonce is generated by the UE.
  • the method provided in the first aspect may further include: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the method provided in the first aspect may also include: the UE receives a notification request message from the TNGF through the source TNAP.
  • the notification request message includes TNonce, the address of the TNGF, the identifier of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the intermediate key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the intermediate key is generated by the TNGF according to the TNGF key.
  • the UE generates the intermediate key according to the TNGF key.
  • the UE generates a third verification parameter according to the intermediate key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the UE obtains the UE authentication identifier, including: when the second verification parameter matches the third verification parameter, the UE generates the UE authentication identifier according to the intermediate key, at least TNonce and the UE's random number UNonce. UNonce is generated by the UE.
  • the method provided in the first aspect may further include: when the second verification parameter matches the third verification parameter, the UE sends a notification response message to the TNGF through the source TNAP, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • the method provided in the first aspect may further include: the UE generates a UNonce.
  • the method provided in the first aspect may also include: the UE generates a first verification parameter according to the TNGF key and the UE authentication identifier.
  • the UE generates the first verification parameter according to the TNGF key and the UE authentication identifier, which may include: the UE calculates the first message authentication code according to the TNGF key, the UE authentication identifier and a preconfigured function to obtain the first verification parameter.
  • the UE generating the first verification parameter according to the TNGF key and the UE authentication identifier may include: the UE generating an intermediate key according to the TNGF key.
  • the UE calculates the first message authentication code according to the intermediate key, the UE authentication identifier and a preconfigured function to obtain the first verification parameter.
  • TNGF keys are generated based on long-term keys.
  • a communication method includes: in a process in which a user device UE accesses a trusted non-third generation partnership project gateway function TNGF through a source trusted non-third generation partnership project 3GPP access point TNAP, TNGF obtains a UE authentication identifier and a TNGF key.
  • the TNGF key is a key shared between TNGF and UE.
  • TNGF receives a first message from UE through a target TNAP.
  • the first message includes a UE authentication identifier and a first verification parameter.
  • the first verification parameter is generated by TNGF based on the UE authentication identifier and the TNGF key.
  • TNGF When the first verification parameter is successfully verified, TNGF generates a target key based on the TNGF key.
  • the target key is used to protect the communication security between UE and the target TNAP.
  • the TNGF can receive a first message, wherein the first message includes a UE authentication identifier and a first verification parameter.
  • the first verification parameter is generated based on the TNGF key and at least the UE authentication identifier.
  • the TNGF can authenticate the integrity of the UE authentication identifier and the UE identity based on the received UE authentication identifier and the first verification parameter, so that when the attacker impersonates the UE to initiate a TNAP switch, the attacker's impersonated UE can be identified to prevent the attacker's impersonated UE from accessing the target TNAP, thereby improving communication security.
  • the TNGF obtains the UE authentication identifier, which may include: the TNGF generates the UE authentication identifier.
  • the method provided in the second aspect may further include: the TNGF sends the UE authentication identifier to the UE through the source TNAP.
  • the method provided in the second aspect may also include: TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes the random number TNonce of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the TNGF key and TNonce.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and the random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the TNGF key and UNonce.
  • TNGF generates a fifth verification parameter based on the TNGF key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the fourth verification parameter matches the fifth verification parameter, TNGF generates the UE authentication identifier according to the TNGF key, TNonce and UNonce.
  • the method provided in the second aspect may further include: TNGF generates an intermediate key according to the TNGF key.
  • TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF and the second Verification parameter.
  • the second verification parameter is generated by TNGF according to the intermediate key and TNonce.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the intermediate key and UNonce.
  • TNGF generates a fifth verification parameter according to the intermediate key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the fourth verification parameter matches the fifth verification parameter, TNGF generates a UE authentication identifier according to the intermediate key, TNonce and UNonce.
  • the method provided in the second aspect may also include: TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes the random number TNonce of TNGF, the address of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the TNGF key, TNonce and the address of TNGF.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and the random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the TNGF key and UNonce.
  • TNGF generates a fifth verification parameter based on the TNGF key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the four verification parameters match the fifth verification parameter, TNGF generates the UE authentication identifier based on the TNGF key, at least TNonce and UNonce.
  • the method provided by the second aspect may also include: TNGF generates an intermediate key based on the TNGF key.
  • TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes the random number TNonce of TNGF, the address of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the intermediate key, TNonce and the address of TNGF.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and the random number UNonce of the UE. Among them, the fourth verification parameter is generated by the UE according to the intermediate key and UNonce.
  • TNGF generates a fifth verification parameter based on the intermediate key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the four verification parameters match the fifth verification parameter, TNGF generates the UE authentication identifier based on the intermediate key, at least TNonce and UNonce.
  • the method provided in the second aspect may also include: TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes the random number TNonce of TNGF, the identifier of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the TNGF key, TNonce and the identifier of TNGF.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and the random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the TNGF key and UNonce.
  • TNGF generates a fifth verification parameter according to the TNGF key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the four verification parameters match the fifth verification parameter, TNGF generates the UE authentication identifier according to the TNGF key, at least TNonce and UNonce.
  • the method provided in the second aspect may also include: TNGF generates an intermediate key based on the TNGF key.
  • TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce, the identifier of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the intermediate key, TNonce and the identifier of TNGF.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE. Among them, the fourth verification parameter is generated by the UE according to the intermediate key and UNonce.
  • TNGF generates a fifth verification parameter based on the intermediate key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the four verification parameters match the fifth verification parameter, TNGF generates the UE authentication identifier based on the intermediate key, at least TNonce and UNonce.
  • the method provided in the second aspect may also include: TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes the random number TNonce of TNGF, the address of TNGF, the identifier of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the TNGF key, TNonce and the address of TNGF, and the identifier of TNGF.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and the random number UNonce of the UE. Among them, the fourth verification parameter is generated by the UE according to the TNGF key and UNonce.
  • TNGF generates a fifth verification parameter according to the TNGF key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the four verification parameters match the fifth verification parameter, TNGF generates the UE authentication identifier according to the TNGF key, at least TNonce and UNonce.
  • the method provided in the second aspect may also include: TNGF generates an intermediate key based on the TNGF key.
  • TNGF sends a notification request message to the UE through the source TNAP.
  • the notification request message includes the random number TNonce of TNGF, the address of TNGF, the identifier of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the intermediate key, TNonce, the address of TNGF and the identifier of TNGF.
  • TNGF receives a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and the random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the intermediate key and UNonce.
  • TNGF generates a fifth verification parameter based on the intermediate key and UNonce.
  • TNGF obtains the UE authentication identifier, which may include: when the four verification parameters match the fifth verification parameter, TNGF generates the UE authentication identifier based on the intermediate key, at least TNonce and UNonce.
  • the method provided by the second aspect may further include: TNGF generates a sixth verification parameter according to the UE authentication identifier and the TNGF key.
  • TNGF generates a target key according to the TNGF key, including: when the first verification parameter matches the sixth verification parameter, TNGF generates a target key according to the TNGF key.
  • the TNGF key is generated by the AMF based on the long-term key.
  • a communication method is provided.
  • the communication method is applied to the process of a user device UE accessing a trusted non-third generation partnership project gateway function TNGF for the first time.
  • the communication method includes: the UE receives a notification request message from the TNGF through a source trusted non-third generation partnership project 3GPP access point TNAP.
  • the notification request message includes a second verification parameter and at least a random number TNonce of the TNGF.
  • the second verification parameter is generated according to the TNGF key and at least TNonce.
  • the TNGF key is a shared key between the UE and the TNGF.
  • the UE generates a third verification parameter according to the TNGF key and at least TNonce.
  • the UE sends a notification response message to the TNGF through the source TNAP.
  • the notification response message includes the UE's random number UNonce and a fourth verification parameter.
  • the fourth verification parameter is generated by the UE according to UNonce and the TNGF key.
  • the UE can receive a second verification parameter and at least TNonce from the TNGF, wherein the second verification parameter is generated according to the TNGF key and at least TNonce.
  • the UE generates a third verification parameter according to the TNGF key and at least TNonce. In this way, the second verification parameter can be verified to achieve integrity protection of at least TNonce.
  • the UE sends UNonce and a fourth verification parameter to the TNGF.
  • the TNGF can verify the third verification parameter, thereby achieving integrity protection of UNonce.
  • integrity protection between the TNGF and the UE can be achieved, thereby improving communication security.
  • the UE generates a third verification parameter based on the TNGF key and at least TNonce, including: the UE generates an intermediate key based on the TNGF key. The UE generates the third verification parameter based on the intermediate key and TNonce.
  • the notification request message also includes an address of the TNGF.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce, and the address of the TNGF.
  • the UE generates a third verification parameter according to the TNGF key and at least TNonce, including: the UE generates the third verification parameter according to the TNGF key, TNonce, and the address of the TNGF.
  • the notification request message also includes an address of the TNGF.
  • the second verification parameter is generated by the TNGF based on the intermediate key, TNonce, and the address of the TNGF.
  • the intermediate key is generated by the TNGF based on the TNGF key.
  • the UE generates a third verification parameter based on the TNGF key and at least TNonce, including: the UE generates the third verification parameter based on the intermediate key, TNonce, and the address of the TNGF.
  • the notification request message also includes an identifier of the TNGF.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce, and the identifier of the TNGF.
  • the UE generates a third verification parameter according to the TNGF key and at least TNonce, including: the UE generates the third verification parameter according to the TNGF key, TNonce, and the identifier of the TNGF.
  • the notification request message also includes an identifier of TNGF.
  • the second verification parameter is generated by TNGF based on the intermediate key, TNonce and the identifier of TNGF.
  • the intermediate key is generated by TNGF based on the TNGF key.
  • the UE generates a third verification parameter based on the TNGF key and at least TNonce, including: the UE generates an intermediate key based on the TNGF key.
  • the UE generates the third verification parameter based on the intermediate key, TNonce and the identifier of TNGF.
  • the notification request message also includes an address of the TNGF and an identifier of the TNGF.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the UE generates a third verification parameter according to the TNGF key and at least TNonce, including: the UE generates the third verification parameter according to the TNGF key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the notification request message also includes the address of TNGF and the identifier of TNGF.
  • the second verification parameter is generated by TNGF based on the intermediate key, TNonce, the address of TNGF and the identifier of TNGF.
  • the intermediate key is generated by TNGF based on the TNGF key.
  • the UE generates a third verification parameter based on the TNGF key and at least TNonce, including: the UE generates the intermediate key based on the TNGF key.
  • the UE generates the third verification parameter based on the intermediate key, TNonce, the address of TNGF and the identifier of TNGF.
  • the method provided in the third aspect also includes: the UE generates a UE authentication identifier based on the TNGF key, at least TNonce and UNonce.
  • a communication method includes: when a trusted non-third generation partnership project gateway function TNGF receives an initial context establishment request from an access and mobility management network element AMF, the TNGF sends a notification request message to a user device UE through a first trusted non-third generation partnership project 3GPP access point TNAP.
  • the notification request message includes a random number TNonce of the TNGF and a second verification parameter.
  • the second verification parameter is generated according to the TNonce and the TNGF key.
  • the TNGF key It is a shared key between the UE and the TNGF.
  • the TNGF generates a fifth verification parameter based on the TNGF key and UNonce.
  • the TNGF receives a notification response message from the UE.
  • the notification response message includes the UE's random number UNonce and the fourth verification parameter.
  • the fourth verification parameter is generated based on UNonce and the root key for the TNGF.
  • the TNGF sends the source key to the source TNAP.
  • the source key is used to protect the communication security between the source TNAP and the UE.
  • TNGF sends a second verification parameter and at least TNonce to the UE, wherein the second verification parameter is generated according to the TNGF key and at least TNonce, so that the UE can verify the second verification parameter and implement integrity protection of at least TNonce.
  • TNGF receives UNonce and a fourth verification parameter from the UE and TNGF. And generates a fifth verification parameter according to the TNGF key and UNonce, and sends the source key to TNAP when the fourth verification parameter matches the fifth verification parameter. In this way, integrity protection of UNonce can be implemented. In summary, integrity protection between TNGF and UE can be implemented, thereby improving communication security.
  • the source key is generated according to the TNGF key.
  • a processing module is specifically used to
  • TNGF generates the fifth verification parameter according to the TNGF key and UNonce, including: TNGF generates an intermediate key according to the TNGF key. TNGF generates the fifth verification parameter according to the intermediate key and UNonce.
  • the method provided in the fourth aspect may also include: TNGF generates a UE authentication identifier based on TNonce, UNonce and TNGF key.
  • a communication device which is used to execute the communication method described in any one of the implementation modes of the first aspect to the fourth aspect.
  • the communication device described in the fifth aspect may be the communication device described in the first aspect or any one of the third aspects or the TNGF described in the second aspect or any one of the fourth aspects, or a chip (system) or other parts or components that may be set in the communication device or TNGF, or a device that includes the communication device or TNGF.
  • the communication device described in the fifth aspect includes a module, unit, or means corresponding to the communication method described in any one of the first to fourth aspects, and the module, unit, or means can be implemented by hardware, software, or by hardware executing the corresponding software.
  • the hardware or software includes one or more modules or units for performing the functions involved in the above-mentioned communication method.
  • the technical effects of the communication device described in the fifth aspect can refer to the technical effects of the communication method described in any one of the first to fourth aspects, and will not be repeated here.
  • a communication device including: a processor, the processor being configured to execute the communication method described in any possible implementation manner in the first aspect to the fourth aspect.
  • the communication device described in the sixth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver may be used for the communication device described in the sixth aspect to communicate with other communication devices.
  • the communication device described in the sixth aspect may also include a memory.
  • the memory may be integrated with the processor or may be separately provided.
  • the memory may be used to store the computer program and/or data involved in the communication method described in any one of the first to fourth aspects.
  • the communication device described in the sixth aspect may be the communication device described in the first aspect or any one of the third aspects or the TNGF described in the second aspect or any one of the fourth aspects, or a chip (system) or other parts or components that may be set in the communication device or TNGF, or a device that includes the communication device or TNGF.
  • a communication device comprising: a processor coupled to a memory, the processor being configured to execute a computer program stored in the memory, so that the communication device executes the communication method described in any possible implementation manner in the first to fourth aspects.
  • the communication device described in the seventh aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver may be used for the communication device described in the seventh aspect to communicate with other communication devices.
  • the communication device described in the seventh aspect may be the communication device described in the first aspect or any one of the third aspects or the TNGF described in the second aspect or any one of the fourth aspects, or a chip (system) or other parts or components that may be set in the communication device or TNGF, or a device that includes the communication device or TNGF.
  • a communication device comprising: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the communication device executes the communication method described in any one of the implementation methods of the first to fourth aspects.
  • the communication device described in the eighth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit.
  • the transceiver can be used for the communication device described in the eighth aspect to communicate with other communication devices.
  • the communication device described in the eighth aspect may be the communication device described in the first aspect or any one of the third aspects or the TNGF described in the second aspect or any one of the fourth aspects, or a chip (system) or other parts or components that may be set in the communication device or TNGF, or a device that includes the communication device or TNGF.
  • a communication device comprising: a processor; the processor is used to couple with a memory, and after reading a computer program in the memory, execute a communication method as described in any one of the implementation methods in the first to fourth aspects according to the computer program.
  • the communication device described in the ninth aspect may further include a transceiver.
  • the transceiver may be a transceiver circuit or an interface circuit.
  • the transceiver may be used for the communication device described in the ninth aspect to communicate with other communication devices.
  • the communication device described in the eighth aspect may be the communication device described in the first aspect or any one of the third aspects or the TNGF described in the second aspect or any one of the fourth aspects, or a chip (system) or other parts or components that may be set in the communication device or TNGF, or a device that includes the communication device or TNGF.
  • a processor is provided, wherein the processor is used to execute the communication method described in any possible implementation manner of the first aspect to the fourth aspect.
  • a communication system which includes one or more terminal devices and one or more network devices.
  • a computer-readable storage medium comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer executes the communication method described in any possible implementation manner in the first to fourth aspects.
  • a computer program product comprising a computer program or instructions, which, when executed on a computer, enables the computer to execute the communication method described in any possible implementation of the first to fourth aspects.
  • FIG1 is a schematic diagram of the architecture of a core network provided in an embodiment of the present application.
  • FIG2 is a schematic diagram of the trusted non-3GPP registration, authentication and PDU session establishment process
  • FIG3 is a schematic diagram of a TNAP switching process
  • FIG4 is a second schematic diagram of the TNAP switching process
  • FIG5 is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application.
  • FIG6 is a flow chart of a communication method according to an embodiment of the present application.
  • FIG7 is a second flow chart of a communication method provided in an embodiment of the present application.
  • FIG8 is a first structural diagram of a communication device provided in an embodiment of the present application.
  • FIG. 9 is a second schematic diagram of the structure of the communication device provided in an embodiment of the present application.
  • 5G system 5G system, 5GS
  • FIG 1 is a schematic diagram of the 5GS architecture.
  • 5GS includes: access network (AN) and core network (CN), and may also include: user equipment (UE).
  • AN access network
  • CN core network
  • UE user equipment
  • CN may include user plane function (UPF) network element (referred to as user plane network element), core access and mobility management function (AMF) network element, session management function (SMF) network element (referred to as session management network element), authentication server function (AUSF) network element, trusted non-3GPP access point (TNAP), trusted non-3GPP gateway function (TNGF) network element, network data analysis function (NWDAF) network element (referred to as network data analysis network element), network exposure function (NEF) network element, network function storage function (NRF) network element, policy control function (PCF) network element (referred to as policy control network element), unified data management (UDM) network element (referred to as data management network element), application function (AF) network element or service communication agent (service communication agent). proxy, SCP) Network elements, etc.
  • UPF user plane function
  • AMF core access and mobility management function
  • SMF session management function
  • AUSF authentication server function
  • TNAP trusted non-3GPP access point
  • TNGF trusted non-3GPP gateway function
  • NWDAF
  • Figure 1 only exemplifies some examples of network elements or entities in a 5G network.
  • the 5G network may also include a unified data repository (UDR) network element, a network slice selection function (NSSF) network element, a charging function (CHF) network element, and other network elements or entities not shown in Figure 1, and the embodiments of the present application do not make specific limitations on this.
  • UDR unified data repository
  • NSSF network slice selection function
  • CHF charging function
  • the user device accesses the 5G network through the AN device, and the user device communicates with the AMF network element through the N1 interface (referred to as N1); the RAN device communicates with the AMF network element through the N2 interface (referred to as N2); the user device communicates with the TNAP through the Yt interface, and the TNAP communicates with the TNGF network element through the Ta interface; the TNGF network element communicates with the AMF network element through the N2 interface; the TNGF network element also communicates with the UPF network element through the N3 interface; the RAN device communicates with the UPF network element through the N3 interface (referred to as N3); the SMF network element communicates with the UPF network element through the N4 interface (referred to as N4), and the UPF network element accesses the data network (DN) through the N6 interface (referred to as N6).
  • control plane functions such as the AUSF network element, AMF network element, SMF network element, NEF network element, NRF network element, PCF network element, UDM network element, UDR network element, AF network element, NWDAF network element or SCP network element shown in FIG1 use service-oriented interfaces for interaction.
  • the service-oriented interface provided by the AUSF network element is Nausf; the service-oriented interface provided by the AMF network element is Namf; the service-oriented interface provided by the SMF network element is Nsmf; the service-oriented interface provided by the NEF network element is Nnef; the service-oriented interface provided by the NRF network element is Nnrf; the service-oriented interface provided by the PCF network element is Npcf; the service-oriented interface provided by the UDM network element is Nudm; and the service-oriented interface provided by the AF network element is Naf.
  • the service-oriented interface provided by the UDR network element is Nudr; the service-oriented interface provided by the NSSF network element is Nnssf; and the service-oriented interface provided by the CHF network element is Nchf.
  • the service-oriented interface provided by the UDR network element is Nudr; the service-oriented interface provided by the NSSF network element is Nnssf; and the service-oriented interface provided by the CHF network element is Nchf.
  • a terminal may be a terminal with transceiver functions, or a chip or chip system that can be set in the terminal.
  • the terminal may also be called a user equipment (UE), an access terminal, a subscriber unit, a user station, a mobile station (MS), a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent or a user device.
  • UE user equipment
  • MS mobile station
  • remote station a remote terminal
  • the terminal in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handheld device (handset), a laptop computer, a machine type communication (MTC) terminal, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, a vehicle-mounted terminal, a road side unit (RSU) with terminal function, etc.
  • the terminal of the present application may also be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into the vehicle as one or more components or units.
  • the AN network element is used to implement access-related functions. It can provide network access functions for authorized terminals in a specific area and can use transmission tunnels of different qualities according to the terminal level, business requirements, etc. AN forwards control signals and user data between the network element terminal and the CN.
  • the AN network element in this application can be a radio access network (RAN) network element.
  • the RAN network element can manage wireless resources, provide access services for user devices, and then complete the forwarding of control signals and terminal data between the terminal and the core network.
  • the RAN network element can also be understood as a base station in a traditional network. For example, it can be responsible for wireless resource management, quality of service (QoS) management, data compression and encryption, etc. on the air interface side.
  • QoS quality of service
  • a RAN network element may be a device in a wireless network.
  • a RAN network element may also be referred to as a wireless RAN network element or a network device or a wireless network node.
  • some examples of RAN network elements are: the Next Generation Node B (gNB) in a 5G system, a transmission reception point (TRP), an evolved Node B (eNB) in a long term evolution (LTE) system, a radio network controller (RNC), a Node B (NB), a base station controller (BSC), a base transceiver station (BTS), a home base station (e.g., home evolved NodeB, or home Node B, HNB), a base band unit (BBU), or a wireless fidelity (Wifi) access point (AP), etc.
  • gNB Next Generation Node B
  • TRP transmission reception point
  • eNB evolved Node B
  • LTE long term evolution
  • RNC radio network controller
  • NB Node B
  • BSC base station controller
  • a network device may include a centralized unit (CU) node, a distributed unit (DU) node, or a RAN network element including a CU node and a DU node.
  • RAN network elements can also be wireless backhaul equipment, vehicle-mounted equipment, wearable devices, and future 5G networks.
  • 3G third generation
  • the mobility management network element belongs to the core network element and is mainly responsible for the signaling processing part, such as access control, mobility management, attachment and detachment, and gateway selection.
  • the mobility management network element When the mobility management network element provides services for the terminal session, it will provide control plane storage resources for the session to store the session identifier, the SMF network element identifier associated with the session identifier, etc.
  • the mobility management network element can be an access and mobility management function (AMF) network element.
  • AMF access and mobility management function
  • the mobility management network element can still be an AMF network element, or it can have other names, which are not limited in this application.
  • Session management network element used for session management in mobile networks, such as user plane network element selection, user plane network element redirection, Internet protocol (IP) address allocation, bearer establishment, modification and release, and QoS control. Session management, terminal IP address allocation and management, selection of endpoints for manageable user plane functions, policy control and charging function interfaces, and downlink data notification.
  • the session management network element may be an SMF network element.
  • the session management network element may still be an SMF network element, or it may have other names, which are not limited in this application.
  • the user plane network element is used for packet routing and forwarding, quality of service (QoS) processing of user plane data, etc.
  • the network element or entity corresponding to the user plane network element may be a user plane function (UPF) network element in the 5G network architecture.
  • the user plane network element may still be a UPF network element, or the user plane network element may have other names, which is not limited in the embodiments of the present application.
  • the authentication server function network element mainly provides authentication functions and supports authentication of the third generation partnership project (3GPP) access and non-3GPP access.
  • 3GPP third generation partnership project
  • the authentication server function network element can be an authentication server function (AUSF) network element.
  • the authentication server function network element can still be an AUSF network element, or the authentication server function network element has other names, which is not limited in the embodiments of the present application.
  • TNAP used to provide UE access function.
  • TNGF network element is used as the gateway of the trusted non-3GPP access network.
  • Data management network element which is used to process user identification, access authentication, registration, or mobility management.
  • the network element or entity corresponding to the data management network element can be a unified data management (UDM) network element in the 5G network architecture, where Nudm is a service-based interface provided by the UDM network element.
  • the UDM network element can communicate with other network functions through Nudm.
  • the data management network element can still be a UDM network element, or the data management network element can have other names, which is not limited in the embodiments of the present application.
  • Network exposure function network element which mainly provides services to enable the 3rd generation partnership project (3GPP) network to safely provide network service capabilities to the third-party service provider application function network element 207.
  • the network exposure function network element may be a (network exposure function, NEF) network element, Nnef is a service-based interface provided by the NEF network element, and the NEF network element may communicate with other network functions through Nnef.
  • the network exposure function network element may still be a NEF network element, or have other names, which is not limited in the embodiments of the present application.
  • Policy control network element including user subscription data management function, policy control function, charging policy control function, QoS control, etc., is used to guide the unified policy framework of network behavior and provide policy rule information for control plane function network elements (such as AMF network elements, etc.).
  • control plane function network elements such as AMF network elements, etc.
  • the policy control network element can be a PCF network element.
  • the policy control function network element can still be a PCF network element, or have other names, which is not limited in the embodiments of the present application.
  • the application function network element 207 can be an application function (AF) network element.
  • Naf is a service-based interface provided by the AF network element.
  • the AF network element can communicate with other network functions through Naf.
  • the application function network element can still be an AF network element, or have other names, which is not limited in the embodiments of the present application.
  • the AF network element may include a services capability server (SCS) or an application server (AS).
  • Data network refers to the network that provides data transmission services to terminals, such as IMS (IP Multi-media Service) and the Internet.
  • IMS IP Multi-media Service
  • the terminal accesses the data network by establishing a PDD session between the terminal and the RAN network element, the UPF network element, and the DN network element.
  • Network data analysis function network element which is used to provide network data collection and analysis functions based on technologies such as big data and artificial intelligence.
  • the network data analysis function network element can be the NWDAF network element.
  • the network element can still be an NWDAF network element, or it can have other names, which is not limited in this application.
  • a slice selection function network element is used to select a network slice for a terminal.
  • the slice selection function network element may be an NSSF network element.
  • the network slice selection function network element may still be an NSSF network element, or may have other names, which is not limited in the embodiments of the present application.
  • Unified data storage network element mainly responsible for storing structured data, including contract data and policy data, structured data exposed to the outside and application-related data.
  • the unified data storage network element can be a UDR network element.
  • the unified data storage network element can still be a UDR network element, or it can have other names, which are not limited in this application.
  • TNGF network elements are referred to as TNGF
  • AMF network elements are referred to as AMF
  • AUSF network elements are referred to as AUSF
  • UPF network elements are referred to as UPF
  • user devices are referred to as UE, which will not be repeated later.
  • UE can register to the core network through the 3rd generation partner project (3GPP) access network or trusted non-3GPP access network (TNAN), and complete authentication and protocol data unit (PDU) session establishment.
  • 3GPP 3rd generation partner project
  • TNAN trusted non-3GPP access network
  • PDU protocol data unit
  • TNAN includes TNAP and TNGF.
  • Fig. 2 is a schematic diagram of the process of registration, authentication and PDU session establishment of a trusted non-3GPP. As shown in Fig. 2, the process of registration, authentication and PDU session establishment of a trusted non-3GPP includes S200 to S213.
  • PLMN public land mobile network
  • the UE selects a PLMN and a TNAN to connect to the PLMN by using the trusted non-3GPP access network selection procedure defined in TS 23.501. It is understood that the TNAN selected by the UE supports the PLMN for trusted connection.
  • a layer 2 (layer 1, L2) connection is established between the UE and the TNAP.
  • TNAP sends an identity request (EAP-Req/Identity) message to UE.
  • UE receives the identity request message from TNAP.
  • the identity request message can be an extensible authentication protocol (EAP) identity request message.
  • EAP extensible authentication protocol
  • the EAP identity request message may be encapsulated in a data packet in the Institute of electrical and electronics engineers (IEEE) 802.3/8802.1x protocol format, or in a data packet in the IEEE 802.11/8802.1x protocol format, or in a data packet in the point-to-point protocol (PPP) protocol format.
  • IEEE Institute of electrical and electronics engineers
  • PPP point-to-point protocol
  • the UE sends an identity response message to the TNGF via TNAP.
  • the TNGF receives the identity response message from the UE via TNAP.
  • S203 may include TNAP: UE sends an identity response message to TNAP.
  • TNAP receives the identity response message from the UE.
  • the identity response message sent by the UE to TNAP contains the UE's identity information in NAI (network access identifier) format, for example, the UE's identity information is in the format of "username@realm”.
  • NAI network access identifier
  • the UE's identity information in NAI format is used to trigger TNAP to send an identity response message to TNGF.
  • TNAP after receiving the identity response information from TNAP, TNAP sends an identity response message to TNGF.
  • TNGF receives the identity response message from TNAP.
  • the identity response message sent by UE to TNAP can be encapsulated in an L2 message.
  • the identity response message sent by TNAP to TNGF can be encapsulated in an AAA message.
  • the identity response message may be an EAP identity response message (EAP-Res/Identity).
  • TNGF sends an authentication start request message to UE via TNAP.
  • UE receives the authentication start request message from TNGF via TNAP.
  • Authentication start request message Authentication start request message.
  • TNGF sends an authentication start request message to TNAP, and accordingly, TNAP receives the authentication start request from TNGF.
  • TNAP sends an authentication start request to UE, and accordingly, UE receives the authentication start request from UE.
  • the authentication start request message is used to notify the UE to initiate a non-access stratum (NAS) session, that is, to start sending non-access stratum (NAS) messages encapsulated in data packets, such as EAP-5G messages.
  • NAS non-access stratum
  • the authentication start request message may be an authentication start request (EAP-Req/5G-Start) message.
  • the UE sends an authentication start response message to the TNGF via TNAP.
  • the TNGF receives the authentication start response message from the UE via TNAP.
  • the UE sends an authentication start response message to the TNAP, and accordingly, the TNAP receives the authentication start response message from the UE.
  • the TNAP After receiving the authentication start response message from the UE, the TNAP sends an authentication start response message to the TNGF. Accordingly, the TNGF receives the authentication start response message from the TNAP.
  • the authentication start response message may be an EAP-5G authentication start response (EAP-Res/5G-Start) message.
  • the authentication start response message includes access network parameters (AN-Parameter) and NAS-PDU parameters.
  • the access network parameters include single network slice selection assistance information (S-NSSAI) and 5G globally unique temporary identifier (5G-GUTI).
  • NAS-PDU parameters include a registration request (Regisitration Request) message, which can also be said that the registration request message can be encapsulated through the NAS protocol.
  • the registration request message includes the UE's security capabilities and the user's hidden identifier (SUCI).
  • the UE performs integrity protection on the registration request message and carries 5G-GUTI in the access parameters (that is, the 5G-GUTI in the access network parameters is replaced with SUCI). If the UE has registered with the same AMF through 3GPP access, and if this is the first time the UE connects to 5GC through non-3GPP access, the value of the uplink NAS counter (uplink NAS count, UL NAS COUNT) used for integrity protection is 0; otherwise, it can use the existing non-3GPP specific UL NAS COUNT for integrity protection.
  • uplink NAS counter uplink NAS count, UL NAS COUNT
  • access network parameters are only used as examples. In actual implementation, the access network parameters may also include other parameters, which will not be repeated here.
  • TNGF selects AMF.
  • S206a may include TNGF selecting AMF in accordance with Section 6.5.3 of TS 23.501.
  • step 6a For the specific implementation principle of S206a, please refer to the relevant introduction of step 6a in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • TNGF sends a registration request message to AMF.
  • AMF receives the registration request message from TNGF.
  • step 6b For the specific implementation principle of S206b, please refer to the relevant introduction of step 6b in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • the registration request message can be carried in the N2 message (N2 message, N2 Msg).
  • AMF obtains the identity information of the UE.
  • S207 may include: AMF sends an identity request message to TNGF through the N2 interface.
  • TNGF encapsulates the message through a NAS request message and sends it to TNAP.
  • TNAP sends the NAS request message to the UE.
  • the UE After receiving the identity request message encapsulated in the NAS request message, the UE sends an identity response message encapsulated in a NAS response message to TNAP.
  • TNAP forwards the message to TNGF.
  • TNGF sends the identity request message to AMF through the N2 interface.
  • the NAS request message may be an EAP-5G NAS request message.
  • the NAS response message may be an EAP-5G NAS response message.
  • AMF sends a Key Request message to AUSF.
  • AUSF receives the Key Request message from AMF.
  • the key request message includes a subscription permanent identifier (SUPI) and a subscription concealed identifier (SUCI).
  • SUPI subscription permanent identifier
  • SUCI subscription concealed identifier
  • the key request message can be encapsulated in an AAA message.
  • step 8a For the specific implementation principle of S208a, please refer to the relevant introduction of step 8a in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • S208b UE performs authentication and key agreement (AKA) process.
  • AKA authentication and key agreement
  • the authentication and key negotiation process can also be called the main authentication process.
  • the main authentication process please refer to the main authentication process defined in TS 33.501 version 17.7.0 section 6.1.3.
  • the above main authentication process can be EAP-AKA’ main authentication.
  • AUSF sends a key response message to AMF.
  • AMF receives the key response message from AUSF.
  • the key response message includes the security anchor function (SEAF) key (also called anchor key) and the EAP success message.
  • SEAF security anchor function
  • step 8c For the specific implementation principle of S208c, please refer to the relevant introduction of step 8c in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • AMF sends a security mode command request (SMC Request) message to TNGF.
  • SMC Request security mode command request
  • TNGF receives the SMC message from AMF.
  • the SMC message is carried in the N2 message.
  • the SMC message may carry an EAP success message.
  • the EAP success message is received by the AMF from the AUSF.
  • step 9a For the specific implementation principle of S209a, please refer to the relevant introduction of step 9a in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • TNGF sends an SMC message to the UE via TNAP, and correspondingly, the UE receives the SMC message from TNGF via TNAP.
  • the SMC message may be encapsulated in an EAP-5G NAS request message.
  • the SMC message may carry a TNGF address.
  • the SMC message may carry an EAP success message.
  • the UE sends an SMC completion message to the TNGF via TNAP.
  • the TNGF receives the SMC completion message from the UE via TNAP.
  • the UE sends an SMC completion message to the TNAP.
  • the TNAP receives the SMC completion message from the UE.
  • the TNAP sends an SMC completion message to the TNGF.
  • the TNGF receives the SMC completion message from the TNGF.
  • the TNAP sends the SMC completion message to the TNGF.
  • the SMC completion message is encapsulated in the EAP-5G NAS response message.
  • TNGF after receiving the SMC completion message, TNGF sends the SMC completion message to AMF.
  • AMF receives the SMC completion message from TNGF.
  • AMF sends an Initial Context Setup Request (Initial Ctx Setup Request) message to TNGF.
  • TNGF receives the Initial Context Setup Request message from AMF.
  • the initial context establishment request message may be encapsulated in the N2 message.
  • the initial context establishment request message may include the TNGF key.
  • the TNGF key can be used to derive the TNAP key, which is used to protect the communication security between the UE and the TNAP.
  • step 10a For the specific implementation principle of S210a, please refer to the relevant introduction of step 10a in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • TNGF sends a notification request message to UE via TNAP.
  • UE receives a notification request message from TNGF via TNAP. Notification request message.
  • the notification request message includes the address of the TNGF, such as an IP address.
  • the notification request message may be an EAP-5G notification request (EAP-Req/5G-Notification) message.
  • step 10b For the specific implementation principle of S210b, please refer to the relevant introduction of step 10b in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • the UE sends a notification response message to the TNGF via TNAP.
  • the TNGF receives the notification response message from the UE via TNAP.
  • the notification response message may be an EAP-5G notification response (EAP-Res/5G-Notification) message.
  • step 10c For the specific implementation principle of S210c, please refer to the relevant introduction of step 10c in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • TNGF sends a TNAP key and an EAP success message to TNAP.
  • TNAP receives the TNAP key and the EAP success message from TNGF.
  • the TNAP key is used to protect the communication security between TNAP and TNGF.
  • step 10d For the specific implementation principle of S210d, please refer to the relevant introduction of step 10d in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • TNAP sends an EAP success message to UE.
  • UE receives the EAP success message from TNAP.
  • step 10e For the specific implementation principle of S210e, please refer to the relevant introduction of step 10e in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0, which will not be repeated here.
  • the UE and TNAP establish a secure connection using the TNAP key.
  • the UE and the TNAP may use the TNAP key as a pairwise master key (PMK) and perform a four-way handshake based on the PMK to establish a secure connection.
  • PMK pairwise master key
  • step 11 in section 7.2A.1 of TS 33.501 version 17.7.0.
  • S212 UE receives IP configuration information from TNGF.
  • the IP configuration information is used to indicate the IP address for TNGF to communicate with UE.
  • step 12 in section 7.2A.1 of TS 33.501 version 17.7.0.
  • the above S200-S213 are the registration, authentication and PDU session establishment processes of the trusted non-3GPP.
  • the relative position between the UE and the TNAP may change.
  • the position of the UE may change, or the signal quality of different TNAPs may change, which may cause the TNAP that provides network services to the UE to change.
  • the UE needs to switch TNAP.
  • the identity of the UE can be identified by a UE authentication identifier, such as a re-authentication identifier (Re-authentication identity, Reauth ID).
  • the TNGF can identify whether the UE is a UE that switches TNAP under the TNGF through the UE authentication identifier.
  • the re-authentication process under the switching TNAP scenario can be executed to establish a secure connection between the UE and the target TNAP, thereby avoiding the execution of the complete authentication process shown in Figure 2 and improving service continuity.
  • the above UE authentication identifier can be allocated by the TNGF or generated by a random number.
  • Fig. 3 is a schematic diagram of the first process of TNAP switching. The method shown in Fig. 3 includes S301 to S311.
  • the UE establishes a secure connection with the source TNAP, and the TNGF sends a UE authentication identifier to the UE through the source TNAP.
  • the UE authentication identification consists of three parts: public land mobile network (PLMN) ID, TNGF ID, and temporary (Temp) ID.
  • the UE and the source TNAP can both generate a source key, that is, a TNAP key for the original TNAP.
  • the source key can be used to protect the communication security between the UE and the source TNAP.
  • the TNGF sending the UE authentication identifier to the UE through the source TNAP may include: after the UE establishes a secure connection with the source TNAP, the TNGF sending the UE authentication identifier to the UE through the source TNAP.
  • S302 The UE determines to switch from the source TNAP to the target TNAP.
  • the UE determines to switch from the source TNAP to the target TNAP. It is understandable that the scenario of the UE switching TNAP here is only used as an example. In actual implementation, there may be other scenarios for switching TNAP, which will not be repeated here.
  • S303 A layer 2 connection is established between the UE and the target TNAP.
  • the target TNAP sends an identity request message to the UE.
  • the UE receives the identity request message from the target TNAP.
  • the identity request message is used by the target TNAP to obtain the identity information of the UE.
  • the identity request message may be an EAP identity request message.
  • the UE sends an identity response message to the target TNAP.
  • the target TNAP receives the identity response message from the UE.
  • the identity response message includes a mobility switching indication (TNAP_Mobility_indication) and a UE authentication identifier.
  • the mobility switching indication is used to indicate that the UE is still in the registered state and does not need to send a registration request message to the AMF to trigger the main authentication process. It only needs to execute the EAP-5G registration process.
  • the target TNAP sends a mobility switching indication and a UE authentication identifier to the TNGF.
  • the mobility switching indication and UE authentication identifier can be carried in the authentication, authorization and accounting (AAA) message.
  • AAA authentication, authorization and accounting
  • TNGF determines the target key.
  • the TNGF identifies the UE based on the UE authentication identifier and retrieves the UE context, thereby determining the TNGF key.
  • the UE context includes the TNGF key.
  • TNGF sends a first notification request message (EAP-Req/5G-notification) to the target TNAP.
  • the target TNAP receives the first notification request message from TNGF.
  • the first EAP-5G notification request message includes one or more of the following: a target key, a first random number and a message authentication code (message authentication code, MAC) #0.
  • message authentication code #0 is used to protect the integrity of the random number.
  • the target key, the first random number and the message authentication code #0 may be carried in an AAA message.
  • the first notification request message may be an EAP-5G notification request message.
  • the target TNAP sends a second notification request message to the UE, and correspondingly, the UE receives the second notification request message from the target TNAP.
  • the second notification request message includes one or more of the following information: a start security mode message, a first random number, and a message authentication code #0.
  • the start security mode message is used to instruct the UE to generate a target key using a random number and a TNGF key.
  • the second notification request message may be an EAP-5G notification request message.
  • the UE verifies the message authentication code #0.
  • the UE generates a target key according to the received first random number.
  • the UE uses the TNGF key and the first random number as input, calculates the message authentication code #1, and compares the message authentication code #1 with the message authentication code #0. If the message authentication code #1 matches the message authentication code #0, the verification of the message authentication code #0 succeeds.
  • the UE and the target TNAP establish a secure connection using the target key.
  • the UE uses the target key as the PMK and performs a four-way handshake with the target TNAP to establish a secure connection between the UE and the target TNAP.
  • step 11 in section 7.2A.1 of TS 33.501 version 17.7.0, or the relevant introduction of S211 shown in Figure 2, which will not be repeated here.
  • the TNGF count value will increase each time the attacker initiates a switching process, but the count value of the UE that actually needs to access the TNAP will not change. This will cause the TNGF and UE counters to be inconsistent, resulting in the UE being unable to successfully access the TNAP.
  • Fig. 4 is a second schematic diagram of the TNAP switching process. The method shown in Fig. 4 includes S400a to S422.
  • AMF sends an initial context establishment request message to TNGF.
  • TNGF receives the initial context establishment request message from AMF.
  • the initial context establishment request message may be encapsulated in the N2 message.
  • the initial context establishment request message may include the TNGF key.
  • step 10a for the specific implementation principle of S400a, please refer to step 10a in chapter 7.2A.2.1 of protocol version TS 33.501 version 17.7.0 or the related introduction of S210a mentioned above, which will not be repeated here.
  • the method provided in FIG. 4 may also include S200 to S209d as shown in FIG. 2 .
  • S200 to S209d may also include S200 to S209d as shown in FIG. 2 .
  • TNGF sends a notification request message to UE via the source TNAP.
  • UE receives the notification request message from TNGF via the source TNAP.
  • the notification request message includes a TNGF address, a TNGF identifier (TNGF identifier, TNGF-ID), and a TNGF random number (TNGF Nnonce, TNonce).
  • the notification request message may be an EAP-5G notification request message.
  • the UE sends a notification response message to the TNGF via the source TNAP.
  • the TNGF receives the notification response message from the UE via the source TNAP.
  • the notification response message includes a random number of the UE (UE nonce, UNonce).
  • the notification response message may be an EAP-5G notification response message.
  • TNGF sends a source key and an EAP success message to the source TNAP.
  • the source TNAP receives a source key and an EAP success message from TNGF.
  • the source key is a TNAP key for the source TNAP generated based on the TNGF key, and the source key is used to protect the communication security between the source TNAP and the TNGF.
  • the source TNAP sends an EAP success message to the UE.
  • the UE receives the EAP success message from the source TNAP.
  • the UE and the source TNAP establish a secure connection using a source key.
  • the UE and the source TNAP may use the source key as the PMK, and perform a four-way handshake based on the PMK to establish a secure connection.
  • step 11 in section 7.2A.1 of TS 33.501 version 17.7.0 or the above S211.
  • UE receives IP configuration information from TNGF.
  • the IP configuration information is used to indicate the IP address for TNGF to communicate with UE.
  • step 12 in section 7.2A.1 of TS 33.501 version 17.7.0 or the above-mentioned S212, which will not be repeated here.
  • the UE determines to switch from the source TNAP to the target TNAP.
  • S405 A layer 2 connection is established between the UE and the target TNAP.
  • S405 may refer to the above S201 or S303, which will not be described in detail here.
  • the target TNAP sends an identity request message to the UE.
  • the UE receives the identity request message from the target TNAP.
  • the identity request message may be an EAP identity request message (EAP-Req/Identity).
  • the UE sends an identity response message to the target TNAP.
  • the target TNAP receives the identity response message from the UE.
  • the EAP identity response message includes the identity information of the UE.
  • the format of the identity information of the UE may be a network access identifier (NAI) format.
  • the identity information of the UE includes: a user name and a domain name.
  • the user name may be a UE authentication identifier.
  • the domain name may be "nai.5gc.tngf ⁇ tngf-ID>.mnc ⁇ mnc>.mcc ⁇ mcc>.3gppnetwork.org".
  • the target TNAP selects TNGF.
  • the target TNAP may select a TNGF based on the identity information of the UE.
  • the target TNAP may select a TNGF based on the ⁇ tngf-ID> field in the domain name of the identity information of the UE. That is, the TNGF indicated by the ⁇ tngf-ID> field in the domain name is the TNGF selected by the UE.
  • the target TNAP sends an identity response message to the TNGF.
  • the TNGF receives the identity response message from the target TNAP.
  • the identity response message includes the UE authentication identifier and the UE identity information in NAI format.
  • TNGF determines the context of the UE according to the UE authentication identifier in the identity response message.
  • TNGF sends a challenge request (EAP-Req/5G-challenge) message to UE via the target TNAP.
  • UE receives the challenge request message from TNGF via the target TNAP.
  • the challenge request message may include TNonce and message authentication code #2.
  • Message authentication code #2 is generated by TNGF according to the TNGF key and TNonce, and can be used to verify whether TNonce has been tampered with.
  • the challenge request message may be an EAP-5G challenge request message.
  • S412 can also be said to be the UE verifying the message authentication code #2.
  • the UE generates a message authentication code #3 according to the TNGF key and TNonce. If the message authentication code #3 matches the message authentication code #2, the TNGF authentication succeeds. If the message authentication code #3 does not match the message authentication code #2, the TNGF authentication fails.
  • the information verification code #4 is generated according to the TNGF key TNonce and UNonce, and can be used to protect the integrity of UNonce.
  • the UE sends a challenge response (EAP-Res/5G-challenge) message to the TNGF via the target TNAP.
  • the TNGF receives the challenge response message from the UE via the target TNAP.
  • the challenge response message includes TNonce, UNonce and message authentication code #4.
  • the challenge response message may be an EAP-5G challenge response message.
  • TNGF authenticates the UE.
  • TNGF verifies message authentication code #4.
  • TNGF generates message authentication code #5 according to TNGF key, TNonce and UNonce, and if message authentication code #5 matches message authentication code #4, UE authentication succeeds. If message authentication code #5 does not match message authentication code #4, UE authentication fails.
  • TNGF When the UE authentication is successful, TNGF generates a new UE authentication identifier for the UE based on TNGF-ID, TNonce, UNonce and TNGF key, and generates a target key based on TNGF-ID, TNonce, UNonce and TNGF key.
  • the new UE authentication identifier can be used to identify the UE when the UE switches from the target TNAP to a TNAP other than the target TNAP connected to the TNGF, or in other words, to identify whether the UE is accessing the TNGF for the first time.
  • TNGF sends an EAP success message and a target key to the target TNAP.
  • the target TNAP receives the EAP success message and the target key from TNGF.
  • the target TNAP sends an EAP success message to the UE.
  • the UE receives the EAP success message from the target TNAP.
  • the UE generates a new UE authentication identifier and target key.
  • the UE generates a new UE authentication identity by using the TNGF key, TNGF-ID, TNonce and UNonce stored in the UE, and generates a target key by using the TNGF-ID, TNonce and UNonce, and the TNGF key.
  • the new UE authentication identity derived independently in the UE and in the TNGF will be the same, and the target key will also be the same.
  • the UE and the target TNAP establish a secure connection using the source key.
  • the UE resumes communication with the TNGF through the target TNAP.
  • the transmission process of the parameters for generating the UE authentication identifier is when the UE first connects to the TNGF, such as when the UE performs the initial registration through the TNGF, that is, before the UE establishes a secure connection with the source TNAP, so that the parameters for generating If the parameters of the UE authentication identifier are not protected during transmission, the parameters used to generate the UE authentication identifier may be changed by an attacker or transmitted incorrectly, resulting in an inability to correctly identify whether the UE is a UE switching TNAP when the UE switches TNAP.
  • WiFi wireless fidelity
  • V2X vehicle to everything
  • D2D device-to-device
  • Internet of Vehicles communication systems 4th generation (4G) mobile communication systems such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, fifth generation (5G) mobile communication systems such as new radio (NR) systems, and future communication systems such as sixth generation (6G) mobile communication systems.
  • 4G 4th generation mobile communication systems such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems
  • 5G fifth generation
  • NR new radio
  • 6G sixth generation
  • the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application.
  • a person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • the communication system includes UE, 3GPP access network, trusted non-3GPP access network (TNAN) and AMF.
  • UE 3GPP access network
  • TNAN trusted non-3GPP access network
  • AMF AMF
  • the UE can perform 3GPP access through the 3GPP access network, and the UE can perform non-3GPP access through the TNAN.
  • the TNAN includes TNAP1, TNAP2 and TNGF.
  • the UE and TNAP1 can be connected to each other through the Yt interface, and the UE and TNGF can be connected to each other through the NWt interface.
  • the UE can also communicate with the AMF through the N1 interface.
  • the UE and TNAP2 can be connected to each other through the Yt interface, and the UE and TNGF can be connected to each other through the NWt interface.
  • the UE can also communicate with the AMF through the N1 interface.
  • TNGF is the management network element of TNAP1 and TNAP2.
  • TNGF is the management network element of TNAP, which means that TNGF has established a connection with the TNAP, and TNGF generates a key for establishing secure communication between the TNAP and the UE, and send
  • the communication system shown in FIG5 may also include SMF, UPF, and a data network.
  • SMF and AMF can communicate through the N11 interface
  • UPF and SMF can communicate through the N4 interface
  • UPF and TNGF can communicate through the N3 interface
  • the data network and UPF can communicate through the N6 interface.
  • the 3GPP access network can communicate with the AMF through the N2 interface.
  • the 3GPP access network may include the RAN.
  • the communication method provided in the embodiment of the present application can be applicable to the communication between the UE, TNAP1, TNAP2 and TNGF shown in Figure 5.
  • the specific implementation can refer to the following method embodiment, which will not be repeated here.
  • Figure 5 is only a simplified schematic diagram for ease of understanding, and the communication system may also include other network elements, such as AMF, AUSF, etc., which are not drawn in Figure 5.
  • the UE authentication identifier may be transmitted during the process of the UE switching from the source TNAP to the target TNAP.
  • Fig. 6 is a flow chart of a communication method according to an embodiment of the present application.
  • the communication method can be applied to the communication among the UE, TNAP and TNGF shown in Fig. 5 .
  • the communication method includes the following steps:
  • TNGF obtains UE authentication identifier and TNGF key.
  • the TNGF key is a key shared between the TNGF and the UE.
  • the TNGF key can be generated based on the long-term key.
  • the UE authentication identifier may be used by the TNGF to identify the UE when the UE switches to the TNAP.
  • the UE authentication identifier may be a re-authentication identity (Re-authentication identity, Reauth ID).
  • the UE authentication identifier is directly transmitted between the UE and the TNGF.
  • the process of the UE accessing the TNGF through the source TNAP may include: S200 to S213 shown in Figure 2, and the subsequent process of the UE and the TNGF transmitting data.
  • the communication method may also include one or more of S200 to S213.
  • TNGF obtains the UE authentication identifier in the process of transmitting data between UE and TNGF after S213.
  • the TNGF may obtain the TNGF key during the process of executing S210a shown in Figure 2.
  • the TNGF key may be carried in the initial context establishment request message in S210a.
  • the process of the UE accessing the TNGF through the source TNAP may include: S200 to S210e shown in Figure 2.
  • the communication method may also include one or more of S200 to S209d.
  • the step of TNGF acquiring the UE authentication identifier may be located between S210b and S210d.
  • the TNGF obtains the TNGF key, which may be implemented through S210a in FIG. 2 or S700 in FIG. 7 , that is, the TNGF key is carried in the initial context establishment request message.
  • the UE in the process of the UE accessing the TNGF through the source TNAP, the UE obtains the UE authentication identifier and generates a TNGF key.
  • the UE obtains the UE authentication identifier in the process of transmitting data between the UE and the TNGF after S213.
  • the UE obtains the UE authentication identifier, including: the UE receives the UE authentication identifier from the TNGF through the source TNAP.
  • the communication method shown in Figure 6 may further include: the UE accesses the TNGF through the source TNAP.
  • the specific implementation principle can be referred to S200 to S213, which will not be repeated here.
  • the UE obtains the TNGF key, which may be generated by the UE based on the long-term key, and will not be described in detail here.
  • At least part of the parameters used to generate the UE authentication identifier are transmitted between the UE and the TNGF.
  • the principle of the UE obtaining the UE authentication identifier can refer to the relevant introduction of S700 to S706 in Figure 7 below, which will not be repeated here.
  • the UE obtains the TNGF key, which may be generated by the UE based on the long-term key, and will not be described in detail here.
  • S603 The UE determines to switch from the source TNAP to the target TNAP.
  • the case where the UE switches from the source TNAP to the target TNAP may be that the UE detects that the signal quality of the source TNAP is lower than a first signal quality threshold, and the signal quality of the target TNAP is lower than a second signal quality threshold.
  • the implementation principle of S603 may refer to the implementation principle of S302 above, which will not be described in detail here.
  • a layer 2 connection is established between the UE and the target TNAP.
  • the implementation principle of S604 may refer to the implementation principle of S303 above, which will not be described in detail here.
  • the target TNAP sends an identity request message to the UE.
  • the UE receives the identity request message from the target TNAP.
  • the implementation principle of S605 may refer to the implementation principle of S304, which will not be described in detail here.
  • the UE sends a first message to the TNGF via the target TNAP.
  • the TNGF receives the first message from the UE via the target TNAP.
  • S606 may be executed when the UE switches from the source TNAP to the target TNAP.
  • the first message includes a UE authentication identifier and a first verification parameter.
  • the first verification parameter is generated by the UE according to the TNGF key and at least the UE authentication identifier.
  • the first message may also include a mobility switching indication.
  • the mobility switching indication may be used to indicate that the UE switches from the source TNAP to the target TNAP, that is, the UE has accessed other TNAPs under the same TNGF as the target TNAP before accessing the target TNAP.
  • the method provided in FIG6 may also include step a1.
  • Step a1 The UE generates a first verification parameter based on the TNGF key and at least the UE authentication identifier.
  • step a1 in conjunction with the method for generating the first verification parameter.
  • the first verification parameter may be based on the TNGF key and the UE authentication identifier.
  • the following is an explanation of the generation method 1.1 or 1.2.
  • Generation method 1.1 directly generating the first verification parameter based on the UE authentication identifier and the TNGF key.
  • step a1 may include: the UE calculates the first message authentication code according to the TNGF key, the UE authentication identifier and the preconfigured function to obtain the first authentication parameter.
  • the UE uses the UE authentication identifier as an input parameter and the TNGF key as an input key, and inputs the preconfigured function to calculate the first message authentication code, i.e., the first authentication parameter.
  • the preconfigured function can be implemented by one or more of the following: message-digest algorithm (MD5), secure hash algorithm-1 (SHA-1), SHA-256, which will not be repeated hereafter.
  • MD5 message-digest algorithm
  • SHA-1 secure hash algorithm-1
  • SHA-256 secure hash algorithm-2
  • the preconfigured function may also be referred to as a message authentication code generation function.
  • Generation method 1.2 first generate the intermediate key based on the TNGF key, and then generate the first verification parameter.
  • step a1 may include step a1.1 and step a1.2.
  • Step a1.1 UE generates an intermediate key based on the TNGF key.
  • the UE generates an intermediate key according to the TNGF key and a first type identifier (usage type distinguisher).
  • the UE may input the TNGF key and the first type identifier into a key derivation function (KDF), so as to obtain the intermediate key.
  • KDF key derivation function
  • the first type identifier is used to identify that the type of the generated key is an intermediate key.
  • the first type identifier may be 0x03.
  • the input parameters of the key generation function may also include a fixed code, such as 0x84.
  • the UE may generate an intermediate key based on the TNGF key, the first freshness parameter, and the second freshness parameter.
  • the first freshness parameter is a random number or a counter value generated by the UE
  • the second freshness parameter is a random number or a counter value generated by the UE, which is not specifically limited in this embodiment.
  • step a1.2 the UE calculates the first message authentication code according to the intermediate key, the UE authentication identifier and a preconfigured function to obtain the first authentication parameter.
  • the UE uses the UE authentication identifier as an input parameter and the intermediate key as an input key, and inputs the message authentication code generation function to thereby calculate and obtain a first message authentication code, namely, a first authentication parameter.
  • the first verification parameter may also be generated based on the following generation method 1.3 or generation method 1.4.
  • Generation method 1.3 directly generating the first verification parameter according to the mobility switching indication, the UE authentication identifier, and the TNGF key.
  • step a1 may include: the UE calculates a first message authentication code according to the TNGF key, the UE authentication identifier, the mobility switching indication and a preconfigured function to obtain the first authentication parameter.
  • the generation principle of the preconfiguration function can refer to the relevant introduction in the generation method 1.1.
  • the generation principle of the first verification parameter can refer to the relevant introduction in the generation method 1.1, the difference is that the input parameters of the preconfiguration function include the UE authentication identifier and the mobility switching indication.
  • Generation method 1.4 first generate the intermediate key according to the TNGF key, and then generate the first verification parameter.
  • step a1 may include step a1.3 and step a1.4.
  • Step a1.3 UE generates an intermediate key based on the TNGF key.
  • step a1.3 For the implementation principle of step a1.3, please refer to the relevant introduction of step a1.1 in generation method 1.2, which will not be repeated here.
  • step a1.4 the UE calculates a first message authentication code according to the intermediate key, the UE authentication identifier, the mobility switching indication and a preconfigured function to obtain the first authentication parameter.
  • the implementation principle of generation method 1.4 may refer to the relevant introduction of generation method 1.2, the difference being that the input preconfigured function input parameters include the UE authentication identifier and the mobility switching indication.
  • the UE receives an EAP identity request message from the target TNAP, such as an identity request message
  • the first message may be an identity response message, such as an EAP identity response message.
  • TNGF verifies the first verification parameter according to the TNGF key.
  • S607 may include step b1 and step b2.
  • Step b1 TNGF generates a sixth verification parameter based on the UE authentication identifier and the TNGF key.
  • Step b2 TNGF determines whether the first verification parameter matches the sixth verification parameter.
  • S607 may include steps b3 to b5.
  • Step b3 TNGF generates an intermediate key based on the TNGF key.
  • step b3 may refer to the above step a1.1, the difference being that the intermediate key of step b3 is generated by TNGF.
  • Step b4 TNGF generates a sixth verification parameter based on the intermediate key and the UE authentication identifier.
  • the generation principle of the sixth verification parameter may refer to the generation principle of the first verification parameter in the above generation method 1.2, which will not be repeated here.
  • Step b5 TNGF determines whether the first verification parameter matches the sixth verification parameter.
  • S607 may include step b6 and step b7.
  • Step b6 TNGF generates a sixth verification parameter according to the TNGF key, the UE authentication identifier and the mobility switching indication.
  • Step b7 TNGF determines whether the first verification parameter matches the sixth verification parameter.
  • S607 may include steps b8 to b10.
  • Step b8 TNGF generates an intermediate key based on the TNGF key.
  • step b8 may refer to the above step a1.1, the difference being that the intermediate key of step b8 is generated by TNGF.
  • Step b9 TNGF generates a sixth verification parameter according to the intermediate key, the UE authentication identifier and the mobility switching indication.
  • the generation principle of the sixth verification parameter may refer to the generation principle of the first verification parameter in the above generation method 1.4, which will not be repeated here.
  • Step b10 TNGF determines whether the first verification parameter matches the sixth verification parameter.
  • the first verification parameter matches the sixth verification parameter, that is, the first verification parameter verification succeeds.
  • the first verification parameter does not match the sixth verification parameter, that is, the first verification parameter verification fails.
  • the first verification parameter matches the sixth verification parameter, which may mean that the first verification parameter is the same as the sixth verification parameter.
  • the TNGF key stored in the UE and the TNGF key corresponding to the UE stored in the TNGF are the same. Since the keys for generating the first verification parameter and the second verification parameter are the TNGF key and TNonce, the TNGF can realize the authentication of the UE and the integrity check of the UE authentication identifier by executing S608. If the first verification parameter matches the sixth verification parameter, it can indicate that the UE authentication is successful, that is, the UE is the UE that actually performs TNAP switching, and the UE authentication identifier has not been tampered with. If the first verification parameter does not match the sixth verification parameter, it can indicate that the UE authentication has failed, that is, the UE is not the UE that actually performs TNAP switching, or the UE authentication identifier has been tampered with.
  • TNGF when the first verification parameter matches the sixth verification parameter, TNGF generates a target key.
  • the TNGF may directly generate the target key according to the TNGF key.
  • the TNGF generates the target key according to the TNGF key and the counting parameter.
  • the TNGF determines the target key according to the TNGF key, the second type identification code and the counting parameter.
  • the counting parameter may be a count value of a counter, which may be determined according to the number of times the UE switches the TNAP, such as the count value being the number of times the UE switches the TNAP.
  • the counting parameter may also be a random number, which is generated by the TNGF at each switch.
  • the TNGF may input the TNGF key, the second type identification code and the counting parameter into a key generation function, so as to obtain the target key.
  • the input parameters of the key generation function may also include a fixed code, such as 0x84.
  • the second type identification code may be 0x02.
  • S608 may include: TNGF generates a target key according to the TNGF key and the first freshness parameter and the second freshness parameter.
  • an intermediate key may be obtained according to the TNGF key, and then the target key may be generated according to the intermediate key.
  • S608 may include step c1 and step c2.
  • Step c1 TNGF generates an intermediate key based on the TNGF key.
  • step c1 For the implementation principle of step c1, reference may be made to the relevant introduction of step b3 or step b8, which will not be repeated here.
  • step c1 and step b3 can be the same step or different steps, or step c1 and step b8 can be the same step or different steps.
  • Step c2 TNGF generates a target key based on the intermediate key.
  • the TNGF determines the target key based on the intermediate key and the third type identification code, such as 0x02.
  • TNGF can input the intermediate key and the third type identification code into a key generation function, so as to obtain the target key.
  • the input parameters of the key generation function may also include a fixed code, such as 0x84.
  • TNGF sends a notification request message to the target TNAP.
  • the target TNAP receives the notification request message from TNGF.
  • the notification request message includes a target key, a first random number and a seventh verification parameter.
  • the target key is used to protect the communication security between the UE and the target TNAP.
  • the seventh verification parameter is generated according to the TNGF key and the first random number.
  • the first random number and the TNGF key may be used together to generate a target key.
  • the method provided in FIG. 6 may further include S610 and S613.
  • the target TNAP sends a notification request message to the UE.
  • the UE receives the notification request message from the target TNAP.
  • the notification request message includes the following information elements: start security mode message, the first random number, and the seventh verification parameter.
  • the UE verifies the seventh verification parameter.
  • S611 may include: the UE may generate an eighth verification parameter according to the received first random number and the TNGF key. The UE determines whether the seventh verification parameter is consistent with the eighth verification parameter.
  • the seventh verification parameter matches the eighth verification parameter, that is, the seventh verification parameter verification succeeds.
  • the seventh verification parameter does not match the eighth verification parameter, that is, the seventh verification parameter verification fails.
  • the notification response message includes a mobility switch complete message.
  • the mobility switch complete message is used to indicate that the UE has successfully generated the target key.
  • the notification response message may be an EAP-5G notification response message.
  • the generation principle of the first verification parameter is the same as that of the sixth verification parameter.
  • the generation principle of the seventh verification parameter is the same as that of the eighth verification parameter.
  • the intermediate key for generating the first verification parameter and the sixth verification parameter may be the same as or different from the intermediate key for generating the seventh verification parameter and the eighth verification parameter.
  • S613 The UE and the target TNAP establish a secure connection using the target key.
  • the UE when the UE switches from the source TNAP to the target TNAP, the UE can send a first verification parameter when sending the UE authentication identifier to the target TNAP.
  • the first verification parameter is generated based on the TNGF key and the UE authentication identifier for the TNGF.
  • the TNGF stores the TNGF key for the UE.
  • the TNGF can implement integrity authentication of the UE authentication identifier and the identity of the UE based on the received UE authentication identifier and TNGF key. Therefore, when the attacker impersonates the UE to initiate TNAP switching, the attacker can identify the UE impersonated by the attacker to prevent the UE impersonated by the attacker from accessing the target TNAP, thereby improving communication security.
  • the access target key forged by the attacker can be identified, thereby avoiding changing the count parameter of the counter in the TNGF so that the count parameter in the UE is consistent with the count parameter in the TNGF, thereby improving the UE access success rate.
  • the parameters for generating the UE authentication identifier may be transmitted in the process of the UE accessing the TNGF for the first time.
  • the parameters for generating the UE authentication identifier transmitted in the process of the UE accessing the TNGF for the first time may be integrity protected.
  • Fig. 7 is a second flow chart of the communication method provided in the embodiment of the present application. As shown in Fig. 7, the communication method includes S701 to S711.
  • TNGF receives the initial context establishment request message from AMF.
  • TNGF receives the initial context establishment request message from AMF and can determine that the UE is accessing TNGF for the first time.
  • the Initial Context Establishment Request message may include the TNGF key.
  • TNGF sends a notification request message to UE via source TNAP.
  • UE receives the notification request message from TNGF via source TNAP.
  • S701 is executed when TNGF receives an initial context establishment request message from AMF. It can also be said that it is executed when UE first accesses TNGF.
  • the notification request message includes TNonce and a second verification parameter.
  • TNonce is used as a part of input parameter for generating a UE authentication identifier.
  • the second verification parameter is generated based on the TNGF key and at least TNonce.
  • the notification request message may also include one or more of the following: TNGF address, or TNGF identifier (TNGF identifier, TNGF ID).
  • the notification request message may include TNonce, or the notification request message may include TNonce and a TNGF identifier, or the notification request message may include TNonce and a TNGF address, or the notification request message may include TNonce, a TNGF address, and a TNGF identifier.
  • the second verification parameter may also be generated based on the TNGF key, TNonce, and one or more of the following: TNGF address, or TNGF-ID.
  • the method provided in FIG. 7 may further include step d1 .
  • Step d1 TNGF generates a second verification parameter based on the TNGF key and at least TNonce.
  • the second verification parameter may be generated according to the following generation method 2.1 and generation method 2.2.
  • TNGF directly generates the second verification parameter based on the TNGF key.
  • step d1 may include: TNGF calculates the second message authentication code according to the TNGF key, TNonce and a preconfigured function to obtain the second authentication parameter.
  • TNGF uses TNonce as an input parameter and the TNGF key as an input key to input a preconfigured function, thereby calculating a second message authentication code, namely, a second authentication parameter.
  • TNGF first generates an intermediate key based on the TNGF key, and then uses the intermediate key to generate the second verification parameter.
  • step d1 may include steps d1.1 to d1.2.
  • Step d1.1 TNGF generates an intermediate key based on the TNGF key.
  • TNGF calculates a second message authentication code according to the intermediate key, TNonce and a preconfigured function to obtain the second authentication parameter.
  • generation method 2.2 The implementation principle of generation method 2.2 is similar to that of generation method 2.1, except that the input key is an intermediate key.
  • the second verification parameter may be generated according to the following generation method 2.3 and generation method 2.4.
  • TNGF directly uses the TNGF key to directly generate the second verification parameter.
  • the implementation principle of generation method 2.3 is similar to that of generation method 2.1, except that the input parameters include TNonce and TNGF-ID.
  • TNGF first generates an intermediate key based on the TNGF key, and then uses the intermediate key to generate the second verification parameter.
  • generation method 2.4 The implementation principle of generation method 2.4 is similar to that of generation method 2.2, except that the input parameters are TNonce and TNGF-ID.
  • the second verification parameter may be generated according to the following generation method 2.5 and generation method 2.6.
  • TNGF directly uses the TNGF key to directly generate the second verification parameter.
  • the implementation principle of generation method 2.5 is similar to that of generation method 2.1, except that the input parameters include TNonce and TNGF address.
  • TNGF first generates an intermediate key based on the TNGF key, and then uses the intermediate key to generate the second verification parameter.
  • generation method 2.6 is similar to that of generation method 2.2, except that the input parameters are TNonce and TNGF address.
  • the second verification parameter may be generated according to the following generation method 2.7 and generation method 2.8.
  • TNGF directly uses the TNGF key to directly generate the second verification parameter.
  • generation method 2.7 is similar to that of generation method 2.1, except that the input parameters include TNonce, TNGF-ID and TNGF address.
  • TNGF first generates an intermediate key based on the TNGF key, and then uses the intermediate key to generate the second verification parameter.
  • generation method 2.8 is similar to that of generation method 2.2, except that the input parameters are TNonce, TNGF-ID and TNGF address.
  • the notification request message may be an EAP-5G notification request message.
  • the UE verifies the second verification parameter according to the TNGF key.
  • Case 2.1 The second verification parameter is generated by generation method 2.1.
  • S702 may include step e1 and step e2.
  • Step e1 The UE generates a third verification parameter according to the TNGF key and TNonce.
  • the principle of generating the third verification parameter is similar to that in generation method 2.1 and will not be repeated here.
  • Step e2 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • Case 2.2 The second verification parameter is generated by generation method 2.2.
  • S702 may include steps e3 to e5.
  • Step e3 UE generates an intermediate key based on the TNGF key.
  • step e4 the UE generates a third verification parameter according to the intermediate key and TNonce.
  • the principle of generating the third verification parameter is similar to that in generation method 2.2 and will not be repeated here.
  • Step e5 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • Case 2.3 The second verification parameter is generated by generation method 2.3.
  • S702 may include step e6 and step e7.
  • Step e6 The UE generates a third verification parameter according to the TNGF key, TNonce and TNGF-ID.
  • the principle of generating the third verification parameter is similar to that in generation method 2.3 and will not be repeated here.
  • Step e7 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • Case 2.4 The second verification parameter is generated by generation method 2.4.
  • S702 may include steps e8 to e10.
  • Step e8 UE generates an intermediate key based on the TNGF key.
  • Step e9 The UE generates a third verification parameter according to the intermediate key TNonce and TNGF-ID.
  • the principle of generating the third verification parameter is similar to that in generation method 2.4 and will not be repeated here.
  • Step e10 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • Case 2.5 The second verification parameter is generated by generation method 2.5.
  • S702 may include step e11 and step e12.
  • Step e11 The UE generates a third verification parameter according to the TNGF key, TNonce and TNGF address.
  • the principle of generating the second verification parameter is similar to that in generation method 2.5 and will not be repeated here.
  • Step e12 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • Case 2.6 The second verification parameter is generated by generation method 2.6.
  • S702 may include steps e13 to e15.
  • Step e13 UE generates an intermediate key based on the TNGF key.
  • Step e14 The UE generates a third verification parameter according to the intermediate key, the TNGF address and the TNonce.
  • the principle of generating the third verification parameter is similar to that in generation method 2.6 and will not be repeated here.
  • Step e15 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • Case 2.7 The second verification parameter is generated by generation method 2.7.
  • S702 may include step e16 and step e17.
  • Step e16 The UE generates a third verification parameter according to the TNGF key, TNGF address, TNGF-ID and TNonce.
  • Step e17 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • the principle of generating the third verification parameter in step e17 is similar to that in the generation method 2.7, and will not be repeated here.
  • Case 2.8 The second verification parameter is generated by generation method 2.8.
  • S702 may include steps e18 to e20.
  • Step e18 UE generates an intermediate key based on the TNGF key.
  • Step e19 The UE generates a third verification parameter according to the intermediate key, the TNGF address, the TNGF-ID and the TNonce.
  • the principle of generating the third verification parameter is similar to that in generation method 2.8 and will not be repeated here.
  • Step e20 If the second verification parameter matches the third verification parameter, the second verification parameter verification is successful.
  • the principle of generating the intermediate key can refer to the relevant introduction of generating the intermediate key in the method provided in Figure 6, and will not be repeated here.
  • S702 can realize the authentication of TNGF. If the second verification parameter verification succeeds, the TNGF authentication succeeds. If the verification fails, the TNGF authentication fails.
  • the second verification parameter matches the third verification parameter, which means that the second verification parameter is the same as the third verification parameter. If the second verification parameter matches the third verification parameter, it means that the input parameter for generating the second verification parameter has not been tampered with. If the second verification parameter does not match the third verification parameter, it means that there are tampered parameters in the input parameter for generating the second verification parameter.
  • the method provided in FIG. 7 may also include S400a to S409 in FIG. 4, or include S200 to S209d in FIG. 2, which will not be described in detail here.
  • the UE generates a UE authentication identifier according to the TNGF key, at least UNonce and TNonce.
  • the UE sends a notification response message to the TNGF via the source TNAP.
  • the TNGF receives the notification response message from the UE via the source TNAP.
  • the notification response message includes UNonce and the fourth verification parameter.
  • the notification response message may be an EAP-5G notification response message.
  • the fourth verification parameter is generated based on the TNGF key and UNonce.
  • TNGF verifies the fourth verification parameter according to the TNGF key.
  • S705 may include step f1 and step f2.
  • Step f1 TNGF generates the fifth verification parameter based on the TNGF key and UNonce.
  • Step f2 TNGF determines whether the fourth verification parameter matches the fifth verification parameter.
  • S705 may include steps f3 to f5.
  • Step f3 TNGF generates an intermediate key based on the TNGF key.
  • Step f4 TNGF generates a fifth verification parameter based on the intermediate key and UNonce.
  • Step f5 TNGF determines whether the fourth verification parameter matches the fifth verification parameter.
  • the fourth verification parameter verification succeeds, in which case it can be shown that UNonce has not been tampered with. If the fifth verification parameter does not match the fourth verification parameter, the fourth verification parameter verification fails, in which case it can be shown that UNonce has been tampered with.
  • the second verification parameter is generated in the same principle as the third verification parameter.
  • the fourth verification parameter is generated in the same principle as the fifth verification parameter.
  • the intermediate key for generating the second verification parameter and the third verification parameter may be the same as or different from the intermediate key for generating the fourth verification parameter and the fifth verification parameter.
  • TNGF generates a UE authentication identifier according to the TNGF key, at least UNonce and TNonce.
  • TNGF sends a source key and an EAP success message for the source TNAP to the source TNAP.
  • the source key is used to protect the communication security between the UE and the source TNAP.
  • the source key is generated based on the TNGF key. The generation method of the source key is not described here.
  • S707 may refer to the above S210d or S400d, which will not be described in detail here.
  • the source TNAP sends an EAP success message to the UE.
  • the UE receives the EAP success message from the source TNAP.
  • S709 A secure connection is established between the UE and the source TNAP.
  • the method provided in FIG. 7 may further include S212 and S213 as shown in FIG. 2 .
  • S710 The UE determines to switch from a source TNAP to a target TNAP.
  • the UE performs an incomplete authentication process to establish a secure connection with the target TNAP.
  • TNGF when TNGF sends TNonce to UE, it may carry the second verification parameter for integrity protection.
  • UE may generate a third verification parameter, and send UNonce and a fourth verification parameter to TNGF when the second verification parameter matches the third verification parameter.
  • the second verification parameter is generated by TNGF according to the TNGF key and at least TNonce
  • the fourth verification parameter is generated by UE according to the TNGF key for UE and the indication UNonce.
  • TNGF then generates a third verification parameter according to UNonce and the TNGF key.
  • the message can be encapsulated through layer 2. Between the TNAP and the TNGF, the message can be encapsulated through AAA.
  • the identity request messages in different steps are located in different data packets, and the identity response messages in different steps are in different data packets.
  • the notification request messages in different steps are in different data packets, and the notification request messages in different steps are in different data packets.
  • Fig. 8 is a structural diagram 1 of a communication device 800 provided in an embodiment of the present application.
  • the communication device 800 includes: a processing module 801 and a transceiver module 802.
  • Fig. 8 only shows the main components of the communication device 800.
  • the communication device 800 may be applicable to the communication system shown in FIG. 5 , and perform the function of the UE in FIG. 6 .
  • the processing module 801 is used to obtain the UE authentication identifier and generate the TNGF key in the process of the communication device 800 accessing the TNGF through the source TNAP.
  • the TNGF key is a key shared between the TNGF and the communication device 800.
  • the transceiver module 802 is used to send a first message to the TNGF through the target TNAP when the communication device 800 switches from the source TNAP to the target TNAP.
  • the first message includes the UE authentication identifier and the first verification parameter.
  • the first verification parameter is generated by the communication device 800 according to the UE authentication identifier and the TNGF key.
  • the processing module 801 is specifically configured to receive a UE authentication identifier from the TNGF via a source TNAP.
  • the processing module 801 is further configured to access the TNGF through the source TNAP.
  • the first message is an identity response message
  • the processing module 801 is further used to determine the switch from the source TNAP to the target TNAP and establish a layer 2 connection with the target TNAP.
  • the identity request message from the target TNAP is received by the transceiver module 802, and the identity request message is used to trigger the communication device 800 to send the first message.
  • the transceiver module 802 can also be used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF based on the TNGF key and TNonce.
  • the processing module 801 is also used to generate a third verification parameter based on the TNGF key and TNonce.
  • the processing module 801 is also used to generate a UE authentication identifier based on the TNGF key, TNonce and the random number UNonce of the communication device 800 when the second verification parameter matches the third verification parameter. UNonce is generated by the communication device 800.
  • the sending module is further used to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the transceiver module 802 is also used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF based on the intermediate key and TNonce.
  • the intermediate key is generated by the TNGF based on the TNGF key.
  • the processing module 801 is specifically used to generate an intermediate key based on the TNGF key, and to generate a third verification parameter based on the intermediate key and TNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier based on the intermediate key, TNonce and the random number UNonce of the communication device 800 when the second verification parameter matches the third verification parameter. UNonce is generated by the communication device 800.
  • the transceiver module 802 is further configured to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • the transceiver module 802 is also used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the address of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF based on the TNGF key, TNonce and the address of the TNGF.
  • the processing module 801 is also used to generate a third verification parameter based on the TNGF key, TNonce and the address of the TNGF.
  • the transceiver module 802 is specifically used to generate a UE authentication identifier based on the TNGF key, TNonce and the random number UNonce of the communication device 800 when the second verification parameter matches the third verification parameter.
  • the transceiver module 802 is further configured to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the transceiver module 802 is further configured to receive a notification request message from the TNGF via the source TNAP.
  • the notification request message includes the random number TNonce of TNGF, the address of TNGF and the second verification parameter.
  • the second verification parameter is generated by TNGF according to the intermediate key, the random number TNonce of TNGF and the address of TNGF.
  • the intermediate key is generated by TNGF according to the TNGF key.
  • the processing module 801 is also used to generate the intermediate key according to the TNGF key, and to generate the third verification parameter according to the intermediate key, TNonce and the address of TNGF.
  • the processing module 801 is also used to generate the UE authentication identifier according to the intermediate key, TNonce, the random number UNonce of the communication device 800 and the TNGF key when the second verification parameter matches the third verification parameter. UNonce is generated by the communication device 800.
  • the transceiver module 802 is further configured to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • the transceiver module 802 is also used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the identifier of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce and the identifier of the TNGF.
  • the processing module 801 is also used to generate a third verification parameter according to the TNGF, TNonce and the identifier of the TNGF.
  • the processing module 801 is specifically used to generate a UE authentication identifier according to the TNGF key, at least TNonce and the random number UNonce of the communication device 800 when the second verification parameter matches the third verification parameter. UNonce is generated by the communication device 800.
  • the transceiver module 802 is further configured to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the transceiver module 802 is also used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the identifier of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF based on the intermediate key, TNonce and the identifier of the TNGF.
  • the intermediate key is generated by the TNGF based on the TNGF key.
  • the processing module 801 is also used to generate an intermediate key based on the TNGF key, and to generate a third verification parameter based on the intermediate key, TNonce and the identifier of the TNGF.
  • the processing module 801 is specifically used to generate a UE authentication identifier based on the intermediate key, at least TNonce and the random number UNonce of the communication device 800 when the second verification parameter matches the third verification parameter. UNonce is generated by the communication device 800.
  • the transceiver module 802 is further configured to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • the transceiver module 802 is also used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes the random number TNonce of the TNGF, the address of the TNGF, the identifier of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the processing module 801 is also used to generate a third verification parameter according to the TNGF key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the processing module 801 is specifically used to generate a UE authentication identifier according to the TNGF key, at least TNonce and the random number UNonce of the communication device 800 when the second verification parameter matches the third verification parameter. UNonce is generated by the communication device 800.
  • the transceiver module 802 is further configured to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the TNGF key and UNonce.
  • the transceiver module 802 is also used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes TNonce, the address of the TNGF, the identifier of the TNGF and the second verification parameter.
  • the second verification parameter is generated by the TNGF according to the intermediate key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the intermediate key is generated by the TNGF according to the TNGF key.
  • the processing module 801 is also used to generate an intermediate key based on the TNGF key, and to generate a third verification parameter based on the intermediate key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the processing module 801 is specifically used to generate a UE authentication identifier based on the intermediate key, at least TNonce and the random number UNonce of the communication device 800 when the second verification parameter matches the third verification parameter. UNonce is generated by the communication device 800.
  • the transceiver module 802 is further configured to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter, wherein the notification response message includes a fourth verification parameter and UNonce, and the fourth verification parameter is generated according to the intermediate key and UNonce.
  • processing module 801 is also used for the communication device 800 to generate UNonce.
  • the processing module 801 is further used to generate a first verification parameter according to the TNGF key and the authentication identifier of the communication device 800.
  • the processing module 801 is specifically configured to calculate a first message authentication code according to the TNGF key, an authentication identifier of the communication device 800 and a preconfigured function to obtain a first authentication parameter.
  • the processing module 801 is specifically configured to generate an intermediate key according to the TNGF key, and calculate a first message authentication code according to the intermediate key, the authentication identifier of the communication device 800 and a preconfigured function to obtain a first authentication parameter.
  • TNGF keys are generated based on long-term keys.
  • the transceiver module 802 may include a receiving module and a sending module (not shown in FIG8 ).
  • the transceiver module 802 is used to implement the sending function and the receiving function of the communication device 800 .
  • the communication device 800 may further include a storage module (not shown in FIG8 ), which stores a program or instruction.
  • the processing module 801 executes the program or instruction, the communication device 800 may perform the function of the UE in the communication method shown in FIG6 .
  • the processing module 801 involved in the communication device 800 can be implemented by a processor or a processor-related circuit component, which can be a processor or a processing unit;
  • the transceiver module 802 can be implemented by a transceiver or a transceiver-related circuit component, which can be a transceiver or a transceiver unit.
  • the communication device 800 can be a terminal device, or a chip (system) or other parts or components that can be set in the terminal device, or a device that includes a terminal device, which is not limited in this application.
  • the communication device 800 may be applicable to the communication system shown in FIG. 5 to perform the function of the TNGF in the communication method shown in FIG. 6 .
  • the processing module 801 is used for the communication device 800 to obtain the UE authentication identifier and the TNGF key in the process of the UE accessing the communication device 800 through the source TNAP.
  • the TNGF key is a key shared between the communication device 800 and the UE.
  • the transceiver module 802 is used to receive a first message from the UE through the target TNAP.
  • the first message includes the UE authentication identifier and the first verification parameter.
  • the first verification parameter is generated by the communication device 800 based on the UE authentication identifier and the TNGF key.
  • the processing module 801 is also used to generate a target key based on the TNGF key when the first verification parameter is successfully verified.
  • the target key is used to protect the communication security between the UE and the target TNAP.
  • the processing module 801 is specifically used to generate a UE authentication identifier.
  • the transceiver module 802 is further configured to send the UE authentication identifier to the UE via the source TNAP.
  • the transceiver module 802 is also used to send a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce and a second verification parameter.
  • the second verification parameter is generated by the communication device 800 according to the TNGF key and TNonce.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the TNGF key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter based on the TNGF key and UNonce.
  • the processing module 801 is specifically configured to generate a UE authentication identifier according to the TNGF key, TNonce and UNonce when the fourth verification parameter matches the fifth verification parameter.
  • the transceiver module 802 is also used to generate an intermediate key based on the TNGF key, and to send a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce and a second verification parameter.
  • the second verification parameter is generated by the communication device 800 based on the intermediate key and TNonce.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE based on the intermediate key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter based on the intermediate key and UNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier based on the intermediate key, TNonce and UNonce when the four verification parameters match the fifth verification parameter.
  • the transceiver module 802 is also used to send a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce, the address of the communication device 800 and the second verification parameter.
  • the second verification parameter is generated by the communication device 800 according to the TNGF key, TNonce and the address of the communication device 800.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE. Among them, the fourth verification parameter is generated by the UE according to the TNGF key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter according to the TNGF key and UNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier according to the TNGF key, at least TNonce and UNonce when the four verification parameters match the fifth verification parameter.
  • the transceiver module 802 is further configured to generate an intermediate key according to the TNGF key, and to A notification request message is sent to the UE.
  • the notification request message includes TNonce, the address of the communication device 800 and a second verification parameter.
  • the second verification parameter is generated by the communication device 800 according to the intermediate key, TNonce and the address of the communication device 800.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the intermediate key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter according to the intermediate key and UNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier according to the intermediate key, at least TNonce and UNonce when the four verification parameters match the fifth verification parameter.
  • the transceiver module 802 is also used to send a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce, an identifier of the communication device 800, and a second verification parameter.
  • the second verification parameter is generated by the communication device 800 based on the TNGF key, TNonce, and the identifier of the communication device 800.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE based on the TNGF key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter based on the TNGF key and UNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier based on the TNGF key, at least TNonce and UNonce when the four verification parameters match the fifth verification parameter.
  • the transceiver module 802 is also used to generate an intermediate key based on the TNGF key, and to send a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce, an identifier of the communication device 800, and a second verification parameter. Among them, the second verification parameter is generated by the communication device 800 based on the intermediate key, TNonce and the identifier of the communication device 800.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE. Among them, the fourth verification parameter is generated by the UE based on the intermediate key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter based on the intermediate key and UNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier based on the intermediate key, at least TNonce and UNonce when the four verification parameters match the fifth verification parameter.
  • the transceiver module 802 is also used to send a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce, the address of the communication device 800, the identifier of the communication device 800, and the second verification parameter.
  • the second verification parameter is generated by the communication device 800 according to the TNGF key, TNonce, the address of the communication device 800 and the identifier of the communication device 800.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE. Among them, the fourth verification parameter is generated by the UE according to the TNGF key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter according to the TNGF key and UNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier according to the TNGF key, at least TNonce and UNonce when the four verification parameters match the fifth verification parameter.
  • the transceiver module 802 is also used to generate an intermediate key based on the TNGF key, and to send a notification request message to the UE through the source TNAP.
  • the notification request message includes TNonce, the address of the communication device 800, the identifier of the communication device 800, and the second verification parameter.
  • the second verification parameter is generated by the communication device 800 according to the intermediate key, TNonce and the address of the communication device 800, and the identifier of the communication device 800.
  • the transceiver module 802 is also used to receive a notification response message from the UE through the source TNAP.
  • the notification response message includes a fourth verification parameter and a random number UNonce of the UE.
  • the fourth verification parameter is generated by the UE according to the intermediate key and UNonce.
  • the processing module 801 is also used to generate a fifth verification parameter based on the intermediate key and UNonce.
  • the processing module 801 is specifically used to generate a UE authentication identifier based on the intermediate key, at least TNonce and UNonce when the four verification parameters match the fifth verification parameter.
  • the processing module 801 is further configured to generate a sixth verification parameter according to the UE authentication identifier and the TNGF key.
  • the processing module 801 is specifically configured to generate a target key according to the TNGF key when the first verification parameter matches the sixth verification parameter.
  • the TNGF key is generated by the AMF based on the long-term key.
  • the transceiver module 802 may include a receiving module and a sending module (not shown in FIG8 ).
  • the transceiver module 802 is used to implement the sending function and the receiving function of the communication device 800 .
  • the communication device 800 may further include a storage module (not shown in FIG8 ) storing a program or instruction.
  • the processing module 801 executes the program or instruction, the communication device 800 may perform the TNGF function in the communication method shown in FIG6 .
  • the processing module 801 involved in the communication device 800 can be implemented by a processor or a processor-related circuit component, which can be a processor or a processing unit;
  • the transceiver module 802 can be implemented by a transceiver or a transceiver-related circuit component, which can be a transceiver or a transceiver unit.
  • the communication device 800 can be a network device, such as TNGF, or a chip (system) or other parts or components that can be set in the network device, or a device that includes a network device, which is not limited in this application.
  • a network device such as TNGF, or a chip (system) or other parts or components that can be set in the network device, or a device that includes a network device, which is not limited in this application.
  • the communication device 800 may be applicable to the communication system shown in FIG. 5 , and execute the function of the UE in the communication method shown in FIG. 7 .
  • the communication method is applied to the process of UE accessing TNGF for the first time.
  • the transceiver module 802 is used to receive a notification request message from the TNGF through the source TNAP.
  • the notification request message includes a second verification parameter and at least a random number TNonce of the TNGF.
  • the second verification parameter is generated based on the TNGF key and at least TNonce.
  • the TNGF key is a shared key between the communication device 800 and the TNGF.
  • the processing module 801 is used to generate a third verification parameter based on the TNGF key and at least TNonce.
  • the transceiver module 802 is also used to send a notification response message to the TNGF through the source TNAP when the second verification parameter matches the third verification parameter.
  • the notification response message includes the random number UNonce of the communication device 800 and the fourth verification parameter.
  • the fourth verification parameter is generated by the communication device 800 based on UNonce and the TNGF key.
  • the processing module 801 is specifically configured to generate an intermediate key according to the TNGF key.
  • the communication device 800 generates a third verification parameter according to the intermediate key and TNonce.
  • the notification request message also includes the address of TNGF.
  • the second verification parameter is generated by TNGF according to the TNGF key, TNonce and the address of TNGF.
  • Processing module 801 is specifically used to generate a third verification parameter according to the TNGF key, TNonce and the address of TNGF.
  • the notification request message also includes the address of TNGF.
  • the second verification parameter is generated by TNGF based on the intermediate key, TNonce and the address of TNGF.
  • the intermediate key is generated by the communication device 800 based on the TNGF key.
  • the processing module 801 is specifically used to generate the third verification parameter based on the intermediate key, TNonce and the address of TNGF.
  • the notification request message also includes an identifier of TNGF.
  • the second verification parameter is generated by TNGF according to the TNGF key, TNonce and the identifier of TNGF.
  • Processing module 801 is specifically configured to generate a third verification parameter according to the TNGF key, TNonce and the identifier of TNGF.
  • the notification request message also includes an identifier of TNGF.
  • the second verification parameter is generated by TNGF based on the intermediate key, TNonce and the identifier of TNGF.
  • the intermediate key is generated by the communication device 800 based on the TNGF key.
  • the processing module 801 is specifically used to generate a third verification parameter based on the intermediate key, TNonce and the identifier of TNGF.
  • the notification request message also includes the address of the TNGF and the identifier of the TNGF.
  • the second verification parameter is generated by the TNGF according to the TNGF key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the processing module 801 is specifically used to generate the third verification parameter according to the TNGF key, TNonce, the address of the TNGF and the identifier of the TNGF.
  • the notification request message also includes the address of TNGF and the identifier of TNGF.
  • the second verification parameter is generated by TNGF according to the intermediate key, TNonce, the address of TNGF and the identifier of TNGF.
  • the intermediate key is generated by the communication device 800 according to the TNGF key.
  • the processing module 801 is specifically used to generate the third verification parameter according to the intermediate key, TNonce, the address of TNGF and the identifier of TNGF.
  • the processing module 801 is further configured to generate a UE authentication identifier according to the TNGF key, at least TNonce and UNonce.
  • the transceiver module 802 may include a receiving module and a sending module (not shown in FIG8 ).
  • the transceiver module 802 is used to implement the sending function and the receiving function of the communication device 800 .
  • the communication device 800 may further include a storage module (not shown in FIG8 ), which stores a program or instruction.
  • the processing module 801 executes the program or instruction, the communication device 800 may perform the function of the UE in the communication method shown in FIG7 .
  • the processing module 801 involved in the communication device 800 can be implemented by a processor or a processor-related circuit component, which can be a processor or a processing unit;
  • the transceiver module 802 can be implemented by a transceiver or a transceiver-related circuit component, which can be a transceiver or a transceiver unit.
  • the communication device 800 can be a terminal device, or a chip (system) or other parts or components that can be set in the terminal device, or a device that includes a terminal device, which is not limited in this application.
  • the communication device 800 may be applicable to the communication system shown in FIG. 5 , and execute the function of the TNGF in the communication method shown in FIG. 7 .
  • the transceiver module 802 is used to send a notification request message to the UE through the source TNAP when the communication device 800 receives an initial context establishment request from the AMF.
  • the notification request message includes the random number TNonce of the communication device 800 and the second verification parameter.
  • the second verification parameter is generated according to TNonce and the TNGF key.
  • the TNGF key is a shared key between the UE and the communication device 800.
  • the processing module 801 is used to generate a fifth verification parameter according to the TNGF key and UNonce.
  • the transceiver module 802 is also used to receive a notification response message from the UE.
  • the notification response message includes the random number UNonce of the UE and the fourth verification parameter.
  • the fourth verification parameter is generated according to UNonce and the root key generation for the communication device 800.
  • the transceiver module 802 is further used to send the source key to the source TNAP when the fourth verification parameter matches the fifth verification parameter.
  • the source key is used to protect the communication security between the source TNAP and the UE.
  • the processing module 801 is specifically configured to generate an intermediate key according to the TNGF key.
  • the communication device 800 generates a fifth verification parameter according to the intermediate key and UNonce.
  • the processing module 801 is further configured to generate a UE authentication identifier according to the TNonce, UNonce and TNGF key.
  • the transceiver module 802 may include a receiving module and a sending module (not shown in FIG8 ).
  • the transceiver module 802 is used to implement the sending function and the receiving function of the communication device 800 .
  • the communication device 800 may further include a storage module (not shown in FIG8 ) storing a program or instruction.
  • the processing module 801 executes the program or instruction, the communication device 800 may perform the TNGF function in the communication method shown in FIG7 .
  • the processing module 801 involved in the communication device 800 can be implemented by a processor or a processor-related circuit component, which can be a processor or a processing unit;
  • the transceiver module 802 can be implemented by a transceiver or a transceiver-related circuit component, which can be a transceiver or a transceiver unit.
  • the communication device 800 can be a network device, such as TNGF, or a chip (system) or other parts or components that can be set in the network device, or a device that includes a network device, which is not limited in this application.
  • a network device such as TNGF, or a chip (system) or other parts or components that can be set in the network device, or a device that includes a network device, which is not limited in this application.
  • FIG9 is a second schematic diagram of the structure of a communication device provided in an embodiment of the present application.
  • the communication device may be a terminal device or a network device, or may be a chip (system) or other components or assemblies that can be provided in a terminal device or a network device.
  • a communication device 900 may include a processor 901.
  • the communication device 900 may further include a memory 902 and/or a transceiver 903.
  • the processor 901 is coupled to the memory 902 and the transceiver 903, such as by a communication bus.
  • the processor 901 is the control center of the communication device 900, which can be a processor or a general term for multiple processing elements.
  • the processor 901 is one or more central processing units (CPUs), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs).
  • CPUs central processing units
  • ASIC application specific integrated circuit
  • DSPs digital signal processors
  • FPGAs field programmable gate arrays
  • the processor 901 may perform various functions of the communication device 900 by running or executing a software program stored in the memory 902 and calling data stored in the memory 902 .
  • the processor 901 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 9 .
  • the communication device 900 may also include multiple processors, such as the processor 901 and the processor 904 shown in FIG9 .
  • processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).
  • the memory 902 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 901.
  • the specific implementation method can refer to the above method embodiment, which will not be repeated here.
  • the memory 902 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.
  • the memory 902 may be integrated with the processor 901, or may exist independently and be coupled to the processor 901 through an interface circuit (not shown in FIG. 9 ) of the communication device 900, which is not specifically limited in the embodiments of the present application.
  • the transceiver 903 is used for communication with other communication devices. For example, if the communication device 900 is a terminal device, the transceiver 903 can be used to communicate with a network device, or with another terminal device. For another example, if the communication device 900 is a network device, the transceiver 903 can be used to communicate with a terminal device, or with another network device.
  • the transceiver 903 may include a receiver and a transmitter (not shown separately in FIG. 9 ).
  • the receiver is used to implement receiving Function
  • the transmitter is used to implement the sending function.
  • the transceiver 903 may be integrated with the processor 901, or may exist independently and be coupled to the processor 901 via an interface circuit (not shown in FIG. 9 ) of the communication device 900 , which is not specifically limited in the embodiment of the present application.
  • the structure of the communication device 900 shown in FIG. 9 does not constitute a limitation on the communication device, and an actual communication device may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.
  • the technical effects of the communication device 900 can refer to the technical effects of the communication method described in the above method embodiment, and will not be repeated here.
  • processors in the embodiments of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • DSP digital signal processor
  • ASIC application-specific integrated circuits
  • FPGA field programmable gate arrays
  • a general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
  • the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.
  • the volatile memory may be a random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • SRAM static RAM
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • DDR SDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • SLDRAM synchronous link DRAM
  • DR RAM direct rambus RAM
  • the above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination.
  • the above embodiments can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets.
  • the available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium.
  • the semiconductor medium can be a solid-state hard disk.
  • At least one means one or more, and “more than one” means two or more.
  • At least one of the following” or similar expressions refers to any combination of these items, including any combination of single or plural items.
  • at least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple.
  • the size of the serial numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art.
  • the computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种通信方法及装置，能够在通信装置UE发起TNAP切换时，识别出攻击者仿冒的UE，避免攻击者仿冒的UE接入目标TNAP，从而提高通信安全，可应用于通信系统中。该方法包括：在UE通过源可信的非第三代合作伙伴计划3GPP接入点TNAP接入到可信的非第三代合作伙伴计划网关功能TNGF的流程中，UE获取UE认证标识，以及生成TNGF密钥。其中，TNGF密钥是TNGF和UE之间共享的密钥。在UE从源TNAP切换至目标TNAP的情况下，UE通过目标TNAP向TNGF发送第一消息。其中，第一消息包括UE认证标识和第一验证参数。第一验证参数由UE根据UE认证标识和TNGF密钥生成。

Description

通信方法及装置
本申请要求于2023年02月12日提交国家知识产权局、申请号为202310136707.4、申请名称为“通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种通信方法及装置。
背景技术
在UE从源可信的非第三代合作伙伴计划3GPP接入点(trusted non-3GPP access point，TNAP)切换至目标TNAP的过程中，可信非3GPP网关功能(trusted non-3GPP gateway function，TNGF)可以通过用户装置(user equipment，UE)认证标识识别UE的身份，以实现UE从源TNAP切换至目标TNAP的目的。在UE从源TNAP切换至目标TNAP之前，TNGF与目标TNAP之间并未建立安全连接，因此，UE认证标识在UE与目标TNAP之间传输时不能得到安全保护。这样，攻击者便可以仿冒UE发起TNAP切换流程，从而会导致通信安全性问题。
发明内容
本申请实施例提供一种通信方法及装置，能够避免攻击者仿冒UE发起TNAP切换，从而提高通信安全。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种通信方法。该通信方法包括：在用户装置UE通过源可信的非第三代合作伙伴计划3GPP接入点TNAP接入到可信的非第三代合作伙伴计划网关功能TNGF的流程中，UE获取UE认证标识，以及生成TNGF密钥。其中，TNGF密钥是TNGF和UE之间共享的密钥。在UE从源TNAP切换至目标TNAP的情况下，UE通过目标TNAP向TNGF发送第一消息。其中，第一消息包括UE认证标识和第一验证参数。第一验证参数由UE根据UE认证标识和TNGF密钥生成。
基于第一方面所提供的通信方法，在UE从源TNAP切换至目标TNAP的情况下，UE可以在向目标TNAP发送UE认证标识时，发送第一验证参数。其中，第一验证参数根据TNGF密钥和UE认证标识生成。如此，便使得TNGF可以根据接收到的UE认证标识和第一验证参数对UE认证标识的完整性认证进行认证，以及对UE的身份的认证，从而可以在攻击者仿冒UE发起TNAP切换时，识别出攻击者仿冒的UE，以避免攻击者仿冒的UE接入目标TNAP，从而提高通信安全性。
一种可能的设计方案中，UE获取UE认证标识，可以包括：UE通过源TNAP接收来自TNGF的UE认证标识。
一种可能的设计方案中，在UE获取UE认证标识之前，第一方面所提供的方法还可以包括：UE通过源TNAP接入到TNGF。
一种可能的设计方案中，第一消息为身份响应消息，在UE通过目标TNAP向TNGF发送第一消息之前，第一方面所提供的方法还可以包括：UE确定从源TNAP切换至目标TNAP。UE与目标TNAP之间建立层二连接。UE接收来自目标TNAP的身份请求消息，身份请求消息用于触发UE发送第一消息。
一种可能的设计方案中第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce和第二验证参数。第二验证参数由TNGF根据TNGF密钥和TNonce生成。UE根据TNGF密钥和TNonce生成第三验证参数。UE获取UE认证标识，可以包括：在第二验证参数与第三验证参数匹配的情况下，UE根据TNGF密钥、TNonce和UE的随机数UNonce生成UE认证标识。UNonce由UE生成。
可选地，第一方面所提供的方法还可以包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce和第二验证参数。第二验证参数由TNGF根据中间密钥和TNonce生成。中间密钥由TNGF根据TNGF密钥生成。UE根据TNGF密钥生成所述中间密钥。UE根据中间密钥和TNonce生成第三验证参数。UE获取UE认证标识，可以包括：在第二验证参数与第三验证参数匹配的情况下，UE根据中间密钥、TNonce和UE的随机数UNonce生成UE认证标识。UNonce由UE生成。
可选地，第一方面所提供的方法还包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
一种可能的设计方案中，第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的地址和第二验证参数。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的地址生成。UE根据TNGF密钥、TNonce和TNGF的地址生成第三验证参数。UE获取UE认证标识，包括：在第二验证参数与第三验证参数匹配的情况下，UE根据TNGF密钥、TNonce和UE的随机数UNonce生成UE认证标识。
可选地，第一方面所提供的方法还可以包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的地址和第二验证参数。第二验证参数由TNGF根据中间密钥、TNGF的随机数TNonce和TNGF的地址生成。中间密钥由TNGF根据TNGF密钥生成。UE根据TNGF密钥生成中间密钥；UE根据中间密钥、TNonce和TNGF的地址生成第三验证参数。UE获取UE认证标识，包括：在第二验证参数与第三验证参数匹配的情况下，UE根据中间密钥、TNonce、UE的随机数UNonce和TNGF地址生成UE认证标识。UNonce由UE生成。
可选地，第一方面所提供的方法还可以包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
一种可能的设计方案中，第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的标识和第二验证参数。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的标识生成。UE根据TNGF密钥、TNonce和TNGF的标识生成第三验证参数。UE获取UE认证标识，可以包括：在第二验证参数与第三验证参数匹配的情况下，UE根据TNGF密钥、至少TNonce和UE的随机数UNonce生成UE认证标识。UNonce由UE生成。
可选地，第一方面所提供的方法还可以包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据中间密钥、TNonce和TNGF的标识生成。中间密钥由TNGF根据TNGF密钥生成。UE根据TNGF密钥生成中间密钥。UE根据中间密钥、TNonce和TNGF的标识生成第三验证参数。UE获取UE认证标识，可以包括：在第二验证参数与第三验证参数匹配的情况下，UE根据中间密钥、至少TNonce和UE的随机数UNonce生成UE认证标识。UNonce由UE生成。
可选地，第一方面所提供的方法还可以包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
一种可能的设计方案中，第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的地址、TNGF的标识和第二验证参数。第二验证参数由TNGF根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成。 UE根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。UE获取UE认证标识，可以包括：在第二验证参数与第三验证参数匹配的情况下，UE根据TNGF密钥、至少TNonce和UE的随机数UNonce生成UE认证标识。UNonce由UE生成。
可选地，第一方面所提供的方法还可以包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，第一方面所提供的方法还可以包括：UE通过源TNAP接收来自TNGF的通知请求消息。通知请求消息包括TNonce、TNGF的地址、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成。中间密钥由TNGF根据TNGF密钥生成。UE根据TNGF密钥生成中间密钥。UE根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。UE获取UE认证标识，包括：在第二验证参数与第三验证参数匹配的情况下，UE根据中间密钥、至少TNonce和UE的随机数UNonce生成UE认证标识。UNonce由UE生成。
可选地，第一方面所提供的方法还可以包括：在第二验证参数与第三验证参数匹配的情况下，UE通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
可选地，在UE获取UE认证标识之前，第一方面所提供的方法还可以包括：UE生成UNonce。
一种可能的设计方案中，在UE通过目标TNAP向TNGF发送第一消息之前，第一方面所提供的方法还可以包括：UE根据TNGF密钥和UE认证标识生成第一验证参数。
可选地，UE根据TNGF密钥和UE认证标识生成第一验证参数，可以包括：UE根据TNGF密钥、UE认证标识和预配置的函数计算第一消息验证码，得到第一验证参数。
或者，可选地，UE根据TNGF密钥和UE认证标识生成第一验证参数，可以包括：UE根据TNGF密钥生成中间密钥。UE根据中间密钥、UE认证标识和预配置的函数计算第一消息验证码，得到第一验证参数。
一种可能的设计方案中，TNGF密钥根据长期密钥生成。
第二方面，提供一种通信方法。该通信方法包括：在用户装置UE通过源可信的非第三代合作伙伴计划3GPP接入点TNAP接入到可信的非第三代合作伙伴计划网关功能TNGF的流程中，TNGF获取UE认证标识，以及获取TNGF密钥。其中，TNGF密钥是TNGF和UE之间共享的密钥。TNGF通过目标TNAP接收来自UE的第一消息。其中，第一消息包括UE认证标识和第一验证参数。第一验证参数由TNGF根据UE认证标识和TNGF密钥生成。在第一验证参数校验成功的情况下，TNGF根据TNGF密钥生成目标密钥。其中，目标密钥用于保护UE与目标TNAP之间的通信安全。
基于第二方面所提供的通信方法，在UE从源TNAP切换至目标TNAP的情况下，TNGF可以接收第一消息，其中第一消息中包括UE认证标识和第一验证参数。其中，第一验证参数根据TNGF密钥和至少UE认证标识生成。如此，TNGF可以根据接收到的UE认证标识和第一验证参数对UE认证标识的完整性认证进行认证，以及对UE的身份的认证，从而可以在攻击者仿冒UE发起TNAP切换时，识别出攻击者仿冒的UE，以避免攻击者仿冒的UE接入目标TNAP，从而提高通信安全性。
一种可能的设计方案中，TNGF获取UE认证标识，可以包括：TNGF生成UE认证标识。
可选地，第二方面所提供的方法还可以包括：TNGF通过源TNAP向UE发送所述UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNGF的随机数TNonce和第二验证参数。其中，第二验证参数由TNGF根据TNGF密钥和TNonce生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。TNGF根据TNGF密钥和UNonce生成第五验证参数。
TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据TNGF密钥、TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF根据TNGF密钥生成中间密钥。TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNGF的随机数TNonce和第二 验证参数。其中，第二验证参数由TNGF根据中间密钥和TNonce生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。TNGF根据中间密钥和UNonce生成第五验证参数。TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据中间密钥、TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNGF的随机数TNonce、TNGF的地址和第二验证参数。其中，第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的地址生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。TNGF根据TNGF密钥和UNonce生成第五验证参数。TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据TNGF密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF根据TNGF密钥生成中间密钥。TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNGF的随机数TNonce、TNGF的地址和第二验证参数。其中，第二验证参数由TNGF根据中间密钥、TNonce和TNGF的地址生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。TNGF根据中间密钥和UNonce生成第五验证参数。TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据中间密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNGF的随机数TNonce、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的标识生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。TNGF根据TNGF密钥和UNonce生成第五验证参数。TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据TNGF密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF根据TNGF密钥生成中间密钥。TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据中间密钥、TNonce和TNGF的标识生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。TNGF根据中间密钥和UNonce生成第五验证参数。TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据中间密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNGF的随机数TNonce、TNGF的地址、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的地址、TNGF的标识生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。TNGF根据TNGF密钥和UNonce生成第五验证参数。TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据TNGF密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，第二方面所提供的方法还可以包括：TNGF根据TNGF密钥生成中间密钥。TNGF通过源TNAP向UE发送通知请求消息。通知请求消息包括TNGF的随机数TNonce、TNGF的地址、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成。TNGF通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。TNGF根据中间密钥和UNonce生成第五验证参数。TNGF获取UE认证标识，可以包括：在四验证参数与第五验证参数匹配的情况下，TNGF根据中间密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，在TNGF根据TNGF密钥生成目标密钥之前，第二方面所提供的方法还可以包括：TNGF根据UE认证标识和TNGF密钥生成第六验证参数。TNGF根据TNGF密钥生成目标密钥，包括：在第一验证参数与第六验证参数匹配的情况下，TNGF根据TNGF密钥生成目标密钥。
一种可能的设计方案中，TNGF密钥由AMF根据长期密钥生成。
第三方面，提供一种通信方法。该通信方法应用于用户装置UE首次接入可信的非第三代合作伙伴计划网关功能TNGF的流程中。该通信方法包括：UE通过源可信的非第三代合作伙伴计划3GPP接入点TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括第二验证参数和至少TNGF的随机数TNonce。第二验证参数根据TNGF密钥和至少TNonce生成。TNGF密钥为UE与TNGF之间的共享密钥。UE根据TNGF密钥和至少TNonce生成第三验证参数。UE在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息包括UE的随机数UNonce和第四验证参数。第四验证参数由UE根据UNonce和TNGF密钥生成。
基于第三方面提供的通信方法，UE可以接收来自TNGF的第二验证参数和至少TNonce，其中，第二验证参数根据TNGF密钥和至少TNonce生成。UE根据TNGF密钥和至少TNonce生成第三验证参数。如此，便可以第二验证参数进行校验，实现对至少TNonce的完整性保护。UE在第二验证参数与第三验证参数匹配的情况下，向TNGF发送UNonce和第四验证参数。如此，便可以使得TNGF可以对第三验证参数进行校验，从而实现UNonce的完整性保护，综上，便可以TNGF和UE之间的完整性保护，从而提高通信安全。
一种可能的设计方案中，UE根据TNGF密钥和至少TNonce生成第三验证参数，包括：UE根据TNGF密钥生成中间密钥。UE根据中间密钥和TNonce生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的地址生成。UE根据TNGF密钥和至少TNonce生成第三验证参数，包括：UE根据TNGF密钥、TNonce和TNGF的地址生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址。第二验证参数由TNGF根据中间密钥、TNonce和TNGF的地址生成。其中，中间密钥由TNGF根据TNGF密钥生成。UE根据TNGF密钥和至少TNonce生成第三验证参数，包括：UE根据中间密钥、TNonce和TNGF的地址生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的标识。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的标识生成。UE根据TNGF密钥和至少TNonce生成第三验证参数，包括：UE根据TNGF密钥、TNonce和TNGF的标识生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的标识。第二验证参数由TNGF根据中间密钥、TNonce和TNGF的标识生成。其中，中间密钥由TNGF根据TNGF密钥生成。UE根据TNGF密钥和至少TNonce生成第三验证参数，包括：UE根据TNGF密钥生成中间密钥。UE根据中间密钥、TNonce和TNGF的标识生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址、TNGF的标识。第二验证参数由TNGF根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成。UE根据TNGF密钥和至少TNonce生成第三验证参数，包括：UE根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址、TNGF的标识。第二验证参数由TNGF根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成。其中，中间密钥由TNGF根据TNGF密钥生成。UE根据TNGF密钥和至少TNonce生成第三验证参数，包括：UE根据TNGF密钥生成中间密钥。UE根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。
一种可能的设计方案中，第三方面所提供的方法还包括：UE根据TNGF密钥，至少TNonce和UNonce生成UE认证标识。
第四方面，提供一种通信方法。该通信方法包括：在可信的非第三代合作伙伴计划网关功能TNGF接收到来自接入和移动性管理网元AMF的初始上下文建立请求的情况下，TNGF通过第一可信的非第三代合作伙伴计划3GPP接入点TNAP向用户装置UE发送通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce和第二验证参数。第二验证参数根据TNonce和TNGF密钥生成。TNGF密钥 为UE与TNGF之间的共享密钥。TNGF根据TNGF密钥和UNonce生成第五验证参数。TNGF接收来自UE的通知响应消息。通知响应消息包括UE的随机数UNonce和第四验证参数。第四验证参数根据UNonce和针对TNGF的根密钥生成。在第四验证参数与第五验证参数匹配的情况下，TNGF向源TNAP发送源密钥。源密钥用于保护源TNAP与UE之间的通信安全。
基于第四方面提供的通信方法。TNGF向UE发送第二验证参数和至少TNonce，其中，第二验证参数根据TNGF密钥和至少TNonce生成，使得UE可以对第二验证参数进行校验，实现至少TNonce的完整性保护。TNGF接收来自UE和TNGF的UNonce和第四验证参数。并根据TNGF密钥和UNonce生成第五验证参数，并在第四验证参数与第五验证参数匹配的情况下，向TNAP发送源密钥。如此，便可以实现UNonce的完整性保护。综上，便可以TNGF和UE之间的完整性保护，从而提高通信安全。
示例性地，源密钥根据TNGF密钥生成。处理模块，具体用于
一种可能的设计方案中，TNGF根据TNGF密钥和UNonce生成第五验证参数，包括：TNGF根据TNGF密钥生成中间要。TNGF根据中间密钥和UNonce生成第五验证参数。
一种可能的设计方案中，第四方面所提供的方法还可以包括：TNGF根据TNonce、UNonce和TNGF密钥生成UE认证标识。
第五方面，提供一种通信装置。该通信装置用于执行第一方面至第四方面中任意一种实现方式所述的通信方法。
在本申请中，第五方面所述的通信装置可以为第一方面、或第三方面中任一方面所述的通信装置或第二方面、或第四方面中任一方面所述的TNGF，或者可设置于该通信装置或TNGF中的芯片(系统)或其他部件或组件，或者包含该通信装置或TNGF的装置。
应理解，第五方面所述的通信装置包括实现上述第一方面至第四方面中任一方面所述的通信方法相应的模块、单元、或手段(means)，该模块、单元、或手段可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个用于执行上述通信方法所涉及的功能的模块或单元。
此外，第五方面所述的通信装置的技术效果可以参考第一方面至第四方面中任一方面所述的通信方法的技术效果，此处不再赘述。
第六方面，提供一种通信装置。该通信装置包括：处理器，该处理器用于执行第一方面至第四方面中任意一种可能的实现方式所述的通信方法。
在一种可能的设计方案中，第六方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第六方面所述的通信装置与其他通信装置通信。
在一种可能的设计方案中，第六方面所述的通信装置还可以包括存储器。该存储器可以与处理器集成在一起，也可以分开设置。该存储器可以用于存储第一方面至第四方面中任一方面所述的通信方法所涉及的计算机程序和/或数据。
在本申请中，第六方面所述的通信装置可以为第一方面、或第三方面中任一方面所述的通信装置或第二方面、或第四方面中任一方面所述的TNGF，或者可设置于该通信装置或TNGF中的芯片(系统)或其他部件或组件，或者包含该通信装置或TNGF的装置。
第七方面，提供一种通信装置。该通信装置包括：处理器，该处理器与存储器耦合，该处理器用于执行存储器中存储的计算机程序，以使得该通信装置执行第一方面至第四方面中任意一种可能的实现方式所述的通信方法。
在一种可能的设计方案中，第七方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第七方面所述的通信装置与其他通信装置通信。
在本申请中，第七方面所述的通信装置可以为第一方面、或第三方面中任一方面所述的通信装置或第二方面、或第四方面中任一方面所述的TNGF，或者可设置于该通信装置或TNGF中的芯片(系统)或其他部件或组件，或者包含该通信装置或TNGF的装置。
第八方面，提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机程序，当该处理器执行该计算机程序时，以使该通信装置执行第一方面至第四方面中的任意一种实现方式所述的通信方法。
在一种可能的设计方案中，第八方面所述的通信装置还可以包括收发器。该收发器可以为收发电路 或接口电路。该收发器可以用于第八方面所述的通信装置与其他通信装置通信。
在本申请中，第八方面所述的通信装置可以为第一方面、或第三方面中任一方面所述的通信装置或第二方面、或第四方面中任一方面所述的TNGF，或者可设置于该通信装置或TNGF中的芯片(系统)或其他部件或组件，或者包含该通信装置或TNGF的装置。
第九方面，提供了一种通信装置，包括：处理器；所述处理器用于与存储器耦合，并读取存储器中的计算机程序之后，根据该计算机程序执行如第一方面至第四方面中的任意一种实现方式所述的通信方法。
在一种可能的设计方案中，第九方面所述的通信装置还可以包括收发器。该收发器可以为收发电路或接口电路。该收发器可以用于第九方面所述的通信装置与其他通信装置通信。
在本申请中，第八方面所述的通信装置可以为第一方面、或第三方面中任一方面所述的通信装置或第二方面、或第四方面中任一方面所述的TNGF，或者可设置于该通信装置或TNGF中的芯片(系统)或其他部件或组件，或者包含该通信装置或TNGF的装置。
第十方面，提供一种处理器。其中，处理器用于执行第一方面至第四方面中任意一种可能的实现方式所述的通信方法。
第十一方面，提供一种通信系统。该通信系统包括一个或多个终端设备，以及一个或多个网络设备。
第十二方面，提供一种计算机可读存储介质，包括：计算机程序或指令；当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第四方面中任意一种可能的实现方式所述的通信方法。
第十三方面，提供一种计算机程序产品，包括计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得该计算机执行第一方面至第四方面中任意一种可能的实现方式所述的通信方法。
此外，上述第五方面至第十三方面所述的通信装置的技术效果，可以参考上述第一方面至第四方面所述的通信方法的技术效果，此处不再赘述。
附图说明
图1为本申请实施例提供的核心网的架构示意图；
图2为可信非3GPP的注册、认证和PDU会话建立流程示意图；
图3为TNAP切换的流程示意图一；
图4为TNAP切换的流程示意图二；
图5为本申请实施例提供的通信系统的架构示意图；
图6为本申请实施例提供的通信方法的流程示意图一；
图7为本申请实施例提供的通信方法的流程示意图二；
图8为本申请实施例提供的通信装置的结构示意图一；
图9为本申请实施例提供的通信装置的结构示意图二。
具体实施方式
为便于理解，下面先介绍本申请实施例所涉及的技术术语。
1、第五代(5th generation，5G)移动通信系统(简称5G系统(5G system，5GS))：
图1为5GS的架构示意图。如图1所示，5GS包括：接入网(access network，AN)和核心网(core network，CN)，还可以包括：用户装置(user equipment，UE)。
其中，CN可以包括用户面功能(user plane function，UPF)网元(简称用户面网元)、接入和移动性管理功能(core access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元(简称为会话管理网元)、认证服务器功能(authentication server function，AUSF)网元、可信非3GPP接入点(trusted non-3GPP access point，TNAP)、可信非3GPP网关功能(trusted non-3GPP gateway function，TNGF)网元、网络数据分析功能(network data analytics function，NWDAF)网元(简称网络数据分析网元)、网络开放功能(network exposure function，NEF)网元、网络功能存储功能(network exposure function Repository Function，NRF)网元、策略控制功能(policy control function，PCF)网元(简称策略控制网元)、统一数据管理(unified data management，UDM)网元(简称数据管理网元)、应用功能(application function，AF)网元或者服务通信代理(service communication proxy，SCP) 网元等。
需要说明的是，图1仅是示例性给出了5G网络中网元或实体的一些举例，该5G网络还可以包括统一数据存储(unified data repository，UDR)网元、网络切片选择功能(network slice selection function，NSSF)网元、计费功能(charging function，CHF)网元等一些图1中未示意出的网元或实体，本申请实施例对此不做具体限定。
其中，如图1所示，用户装置通过AN设备接入5G网络，用户装置通过N1接口(简称N1)与AMF网元通信；RAN设备通过N2接口(简称N2)与AMF网元通信；用户装置通过Yt接口与TNAP通信，TNAP通过Ta接口与TNGF网元通信；TNGF网元通过N2接口与AMF网元通信；TNGF网元还通过N3接口与UPF网元通信；RAN设备通过N3接口(简称N3)与UPF网元通信；SMF网元通过N4接口(简称N4)与UPF网元通信，UPF网元通过N6接口(简称N6)接入数据网络(data network，DN)。此外，图1所示的AUSF网元、AMF网元、SMF网元、NEF网元、NRF网元、PCF网元、UDM网元、UDR网元、AF网元、NWDAF网元或者SCP网元等控制面功能采用服务化接口进行交互。比如，AUSF网元对外提供的服务化接口为Nausf；AMF网元对外提供的服务化接口为Namf；SMF网元对外提供的服务化接口为Nsmf；NEF网元对外提供的服务化接口为Nnef；NRF网元对外提供的服务化接口为Nnrf；PCF网元对外提供的服务化接口为Npcf；UDM网元对外提供的服务化接口为Nudm；AF网元对外提供的服务化接口为Naf。此外，UDR网元对外提供的服务化接口为Nudr；NSSF网元对外提供的服务化接口为Nnssf；CHF网元对外提供的服务化接口为Nchf；相关功能描述以及接口描述可以参考23501标准中的5G系统架构(5G system architecture)图，在此不予赘述。
下面对上述网络架构中涉及的各个部分或网元在5G网络中的功能示例性的分别进行说明。
(1)、终端可以为具有收发功能的终端，或为可设置于该终端的芯片或芯片系统。该终端也可以称为用户装置(uesr equipment，UE)、接入终端、用户单元(subscriber unit)、用户站、移动站(mobile station，MS)、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。本申请的实施例中的终端可以是手机(mobile phone)、蜂窝电话(cellular phone)、智能电话(smart phone)、平板电脑(Pad)、无线数据卡、个人数字助理电脑(personal digital assistant，PDA)、无线调制解调器(modem)、手持设备(handset)、膝上型电脑(laptop computer)、机器类型通信(machine type communication，MTC)终端、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、车载终端、具有终端功能的路边单元(road side unit，RSU)等。本申请的终端还可以是作为一个或多个部件或者单元而内置于车辆的车载模块、车载模组、车载部件、车载芯片或者车载单元。
(2)、AN网元用于实现接入有关的功能，可以为特定区域的授权终端提供入网功能，并能够根据终端的级别，业务的需求等使用不同质量的传输隧道。AN在网元终端与CN之间转发控制信号和用户数据。本申请中的AN网元，可以为无线接入网(radio access network，RAN)网元。RAN网元能够管理无线资源，为用户装置提供接入服务，进而完成控制信号和终端数据在终端和核心网之间的转发，RAN网元也可以理解为传统网络中的基站。例如，可以负责空口侧的无线资源管理、服务质量(quality of service，QoS)管理、数据压缩和加密等功能。
RAN网元可以是无线网络中的设备。RAN网元也可以称为无线RAN网元或者网络设备或者无线网络节点。目前，一些RAN网元的举例为：5G系统中的下一代节点B(The Next Generation Node B，gNB)、传输接收点(transmission reception point，TRP)、长期演进(long term evolution，LTE)系统中的演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(base band unit，BBU)，或无线保真(wireless fidelity，Wifi)接入点(access point，AP)等。在一种网络结构中，网络设备可以包括集中单元(centralized unit，CU)节点、或分布单元(distributed unit，DU)节点、或包括CU节点和DU节点的RAN网元。RAN网元还可以是无线回传设备，车载设备，可穿戴设备以及未来5G网络 中的网络设备或者未来演进的PLMN网络中的网络设备等。在第三代(3rd generation，3G)系统中，称为节点B(Node B)等。
(3)、移动管理网元，属于核心网网元，主要负责信令处理部分，例如：接入控制、移动性管理、附着与去附着以及网关选择等功能。移动管理网元为终端的会话提供服务的情况下，会为该会话提供控制面的存储资源，以存储会话标识、与会话标识关联的SMF网元标识等。在5G通信系统中，该移动管理网元可以是接入和移动性管理功能(access and mobility management function，AMF)网元。在未来通信系统中，移动管理网元仍可以是AMF网元，或者，还可以有其它的名称，本申请不做限定。
(4)、会话管理网元，用于移动网络中的会话管理，例如负责用户面网元选择，用户面网元重定向，因特网协议(internet protocol，IP)地址分配，承载的建立、修改和释放以及QoS控制。会话管理、终端的IP地址分配和管理、选择可管理用户平面功能、策略控制和收费功能接口的终结点以及下行数据通知等。在5G通信系统中，该会话管理网元可以是SMF网元。在未来通信系统中，会话管理网元仍可以是SMF网元，或者，还可以有其它的名称，本申请不做限定。
(5)、用户面网元用于分组路由和转发，用户面数据的服务质量(quality of service，QoS)处理等。在5G通信系统中，用户面网元所对应的网元或实体可以为5G网络架构中的用户平面功能(user plane function，UPF)网元，在未来通信系统中，用户面网元仍可以是UPF网元，或者用户面网元有其它名称，本申请实施例对此不作限定。
(6)、认证服务器功能网元，主要提供认证功能，支持第三代合作伙伴计划(3rd generation partnership project，3GPP)接入和Non-3GPP接入的认证，具体可参考3GPP TS 33.501。在5G通信系统中，认证服务器功能网元可以是认证服务器功能(authentication server function，AUSF)网元，在未来通信系统中，认证服务器功能网元仍可以是AUSF网元，或者认证服务器功能网元有其它名称，本申请实施例对此不作限定。
(7)、TNAP，用于提供UE接入功能。
(8)、TNGF网元，用于作为可信非3GPP接入网的网关。
(9)、数据管理网元，用于处理用户标识、接入鉴权、注册、或移动性管理等。在5G通信系统中，数据管理网元所对应的网元或者实体可以为5G网络架构中的统一数据管理(unified data management，UDM)网元，其中Nudm是UDM网元提供的基于服务的接口，UDM网元可以通过Nudm与其他的网络功能通信。在未来通信系统中，数据管理网元仍可以是UDM网元，或者数据管理网元有其它名称，本申请实施例对此不作限定。
(10)、网络开放功能网元，主要提供的服务使得第三代合作伙伴计划(3rd generation partnership project，3GPP)网络能够安全地向第三方的业务提供者应用功能网元207提供网络业务能力。在5G通信系统中，网络开放功能网元可以是(network exposure function，NEF)网元，Nnef是NEF网元提供的基于服务的接口，NEF网元可以通过Nnef与其他的网络功能通信，在未来通信系统中，网络开放功能网元仍可以是NEF网元，或者有其它名称，本申请实施例对此不作限定。
(11)、策略控制网元，包含用户签约数据管理功能、策略控制功能、计费策略控制功能、QoS控制等，用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF网元等)提供策略规则信息等。在5G通信系统中，策略控制网元可以是PCF网元。在未来通信系统中，策略控制功能网元仍可以是PCF网元，或者有其它名称，本申请实施例对此不作限定。
(12)、应用功能网元，主要用于向3GPP网络提供应用层信息。在5G通信系统中，应用功能网元207可以是应用功能(application function，AF)网元，Naf是AF网元提供的基于服务的接口，AF网元可以通过Naf与其他的网络功能通信，在未来通信系统中，应用功能网元仍可以是AF网元，或者有其它名称，本申请实施例对此不作限定。示例性的，AF网元例如可以包括业务能力服务器(services capability server，SCS)或者应用服务器(application server，AS)。
(13)、数据网络，指的是为终端提供数据传输服务的网络，如IMS(IP Multi-media Service，IP多媒体业务)、Internet等。
终端通过建立终端到RAN网元到UPF网元到DN网元之间的PDD会话，来访问数据网络。
(14)、网络数据分析功能网元，用于提供基于大数据和人工智能等技术的网络数据采集和分析功能。在5G系统中，网络数据分析功能网元可以是NWDAF网元。在未来通信系统中，网络数据分析功 能网元仍可以是NWDAF网元，或者，还可以有其它的名称，本申请不做限定。
(15)、切片选择功能网元，用于为终端选择网络切片等。在5G通信系统中，切片选择功能网元可以是NSSF网元。在未来通信系统中，网络切片选择功能网元仍可以是NSSF网元，或者有其它名称，本申请实施例对此不作限定。
(16)、统一数据存储网元，主要负责存储结构化数据，存储的内容包括签约数据和策略数据、对外暴露的结构化数据和应用相关的数据。在5G通信系统中，该统一数据存储网元可以是UDR网元。在未来通信系统中，统一数据存储网元仍可以是UDR网元，或者，还可以有其它的名称，本申请不做限定。
需要说明，下述实施例中，TNGF网元均简称为TNGF，AMF网元均简称为AMF，AUSF网元均简称为AUSF，UPF网元均简称为UPF，用户装置均称为UE，后续不再赘述。
UE可以通过第三代合作伙伴计划(the 3rd generation partner project，3GPP)接入网或者可信非3GPP接入网(trusted non-3GPP access network，TNAN)注册到核心网，并完成认证和协议数据单元(protocol，PDU)会话建立。其中，TNAN包括TNAP和TNGF。
为便于理解，以下结合图2说明UE通过TNAN注册到核心网，并完成认证和PDU会话建立的流程，以下简称为可信非3GPP的注册、认证和PDU会话建立流程。
图2为可信非3GPP的注册、认证和PDU会话建立流程示意图。如图2所示，可信非3GPP的注册、认证和PDU会话建立流程包括S200至S213。
S200，UE选择公共陆地移动网络(public land mobile network，PLMN)，并连接到所选择的PLMN。
示例性地，UE通过使用TS 23.501定义的可信非3GPP(trusted non-3GPP)接入网络选择程序，选择PLMN和TNAN，以连接到PLMN。可理解，UE选择的TNAN支持可信连接的PLMN。
关于S200的实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤0的相关介绍，此处不再赘述。
S201，UE与TNAP之间建立层二(layer1，L2)连接(connection)。
关于S201的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤1的相关介绍，此处不再赘述。
S202，TNAP向UE发送身份请求(EAP-Req/Identity)消息。相应地，UE接收来自TNAP的身份请求消息。
其中，身份请求消息可以是可扩展认证协议(extensible authentication protocol，EAP)身份请求消息。
示例性地，EAP身份请求消息可以封装在电气和电子工程师协会(institute of electrical and electronics engineers，IEEE)802.3/8802.1x协议格式的数据包中、或IEEE 802.11/8802.1x协议格式的数据包中、或点对点协议(point-to-point protocol，PPP)协议格式的数据包中。
关于S202的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤2的相关介绍，此处不再赘述。
S203，UE通过TNAP向TNGF发送身份响应消息。相应地，TNGF通过TNAP接收来自UE的身份响应消息。
S203可以包括TNAP：UE向TNAP发送身份响应消息。相应地，TNAP接收来自UE的身份响应消息。UE向TNAP发送的身份响应消息中包含NAI(network access identifier)格式的UE的身份信息，例如，UE的身份信息的格式为“username@realm”。其中，NAI格式的UE的身份信息用于触发TNAP向TNGF发送身份响应消息。
以及，在接收到来自TNAP的身份响应信息后，TNAP向TNGF发送身份响应消息。相应地，TNGF接收来自TNAP的身份响应消息。UE向TNAP发送的身份响应消息可以封装在L2消息中。TNAP向TNGF发送的身份响应消息可以封装在AAA消息中。
可理解，身份响应消息可以是EAP身份响应消息(EAP-Res/Identity)。
关于S203的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤3的相关介绍，此处不再赘述。
S204，TNGF通过TNAP向UE发送认证起始请求消息。相应地，UE通过TNAP接收来自TNGF 的认证起始请求消息。
示例性地，TNGF向TNAP发送认证起始请求消息，相应地，TNAP接收来自TNGF的认证起始请求。TNAP向UE发送认证起始请求，相应地，UE接收来自UE的认证起始请求。
其中，认证起始请求消息用于通知UE发起非接入层(non-access stratum，NAS)会话，即开始发送封装在数据包，如EAP-5G消息中的非接入层(non-access stratum，NAS)消息。
认证起始请求消息可以是认证起始请求(EAP-Req/5G-Start)消息。
关于S204的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤4的相关介绍，此处不再赘述。
S205，UE通过TNAP向TNGF发送认证起始响应消息。相应地，TNGF通过TNAP接收来自UE的认证起始响应消息。
示例性地，UE向TNAP发送认证起始响应消息，相应地，TNAP接收来自UE的认证起始响应消息。在接收到来自UE的认证起始响应消息后，TNAP向TNGF发送认证起始响应消息。相应地，TNGF接收来自TNAP的认证起始响应消息。认证起始响应消息可以是EAP-5G认证起始响应(EAP-Res/5G-Start)消息。
其中，认证起始响应消息包括接入网参数(access network parameter，AN-Parameter)和NAS-PDU参数。接入网参数包括单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)、5G全球唯一临时标识符(5G globally unique temporary identifier，5G-GUTI)。NAS-PDU参数包括注册请求(Regisitration Request)消息，也可以说，注册请求消息可以通过NAS协议封装。注册请求消息中包括UE的安全能力和用户隐藏标识符(subscription concealed identifier，SUCI)。
可理解，在S205中，如果UE已经通过3GPP接入5GC并且存在可用的安全上下文，则UE对注册请求消息进行完整性保护并在接入参数中携带5G-GUTI(也就是说，接入网参数中的5G-GUTI替换为SUCI)。如果UE已经通过3GPP接入注册到相同的AMF，并且如果这是UE第一次通过非3GPP接入连接到5GC，则用于完整性保护的上行NAS计数器(uplink NAS count，UL NAS COUNT)的值为0；否则，它可以使用已有的非3GPP特定UL NAS COUNT进行完整性保护。
可理解，以上接入网参数仅用于举例，在实际实施中，接入网参数还可以包括其他参数，此处不再赘述。
关于S205的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤5的相关介绍，此处不再赘述。
S206a，TNGF选择AMF。
示例性地，S206a可以包括，TNGF按照TS 23.501第6.5.3条的规定选择AMF。
关于S206a的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤6a的相关介绍，此处不再赘述。
S206b，TNGF向AMF发送注册请求消息。相应地，AMF接收来自TNGF的注册请求消息。
关于S206b的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤6b的相关介绍，此处不再赘述。
其中，注册请求消息可以携带在N2消息(N2 message，N2 Msg)中。
S207，AMF获取UE的身份信息。
示例性地，S207可以包括：AMF通过N2接口向TNGF发送身份请求消息，TNGF接收身份请求消息后将消息通过NAS请求消息封装后发送给TNAP，TNAP接收到NAS请求消息后，将NAS请求消息发送给UE。UE接收到NAS请求消息封装的身份请求消息后，向TNAP发送由NAS响应消息封装的身份响应消息。TNAP收到NAS响应消息后将消息转发给TNGF，TNGF收到NAS响应消息后将身份请求消息通过N2接口发送给AMF。
NAS请求消息可以是EAP-5G NAS请求消息。NAS响应消息可以是EAP-5G NAS响应消息。
关于S207的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤7a和步骤7b的相关介绍，此处不再赘述。
S208a，AMF向AUSF发送密钥请求(Key Request)消息。相应地，AUSF接收来自AMF的密钥请求消息。
其中，密钥请求消息中包括用户永久标识符(subscription permanent identifier，SUPI)和用户隐藏标识符(subscription concealed identifier，SUCI)。密钥请求消息可以封装在AAA消息中。
关于S208a的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤8a的相关介绍，此处不再赘述。
S208b，UE执行认证及密钥协商(Authentication and Key Agreement，AKA)流程。
认证及密钥协商流程也可以称为主认证流程。关于主认证流程的实现可以参考TS 33.501版本17.7.0章节6.1.3定义的主认证流程，上述主认证流程可以是EAP-AKA’主认证。
可理解，关于S208b的具体实现原理也可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤8b的相关介绍，此处不再赘述。
S208c，AUSF向AMF发送密钥响应消息。相应地，AMF接收来自AUSF的密钥响应消息。
其中，密钥响应消息包括安全锚点功能(security anchor function，SEAF)密钥(也可以称为锚密钥)和EAP成功消息。
关于S208c的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤8c的相关介绍，此处不再赘述。
S209a，AMF向TNGF发送安全模式命令请求(security mode command request，SMC Request)消息。相应地，TNGF接收来自AMF的SMC消息。
其中，SMC消息承载于N2消息中。
可理解，在执行EAP-AKA’认证流程的情况下，SMC消息中可以携带EAP成功消息。EAP成功消息由AMF从AUSF接收得到。
关于S209a的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤9a的相关介绍，此处不再赘述。
S209b，TNGF通过TNAP向UE发送SMC消息，相应地，UE通过TNAP接收来自TNGF的SMC消息。
其中，SMC消息可以封装在EAP-5G NAS请求消息中。SMC消息中可以携带TNGF地址(address)。此外，在执行EAP-AKA’认证流程的情况下，SMC消息中可以携带EAP成功消息。
关于S209b的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤9b的相关介绍，此处不再赘述。
S209c，UE通过TNAP向TNGF发送SMC完成消息。相应地，TNGF通过TNAP接收来自UE的SMC完成消息。
示例性地，UE向TNAP发送SMC完成消息。TNAP接收来自UE的SMC完成消息。TNAP接收到来自UE的SMC消息后，向TNGF发送SMC完成消息，相应地，TNGF接收来自TNGF的SMC完成消息。TNAP将SMC完成消息发送给TNGF。
其中，SMC完成消息被封装在EAP-5G NAS响应消息中。
关于S209c的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤9c的相关介绍，此处不再赘述。
S209d，TNGF收到SMC完成消息后，向AMF发送SMC完成消息。相应地，AMF接收来自TNGF的SMC完成消息。
关于S209d的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤9d的相关介绍，此处不再赘述。
S210a，AMF向TNGF发送初始上下文建立请求(Initial Ctx Setup Request)消息。相应地，TNGF接收来自AMF的初始上下文建立请求消息。
其中，初始上下文建立请求消息可以封装在N2消息中。初始上下文建立请求消息中可以包括TNGF密钥。
TNGF密钥可以用于推演TNAP密钥，该TNAP密钥用于保护UE与TNAP之间的通信安全。
关于S210a的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤10a的相关介绍，此处不再赘述。
S210b，TNGF通过TNAP向UE发送通知请求消息。相应地，UE通过TNAP接收来自TNGF的 通知请求消息。
其中，通知请求消息中包括TNGF的地址，如IP地址。
示例性地，通知请求消息可以是EAP-5G通知请求(EAP-Req/5G-Notification)消息。
关于S210b的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤10b的相关介绍，此处不再赘述。
S210c，UE通过TNAP向TNGF发送通知响应消息。相应地，TNGF通过TNAP接收来自UE的通知响应消息。
示例性地，通知响应消息可以是EAP-5G通知响应(EAP-Res/5G-Notification)消息。
关于S210c的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤10c的相关介绍，此处不再赘述。
S210d，TNGF向TNAP发送TNAP密钥和EAP成功消息。相应地，TNAP接收来自TNGF的TNAP密钥和EAP成功消息。TNAP密钥用于保护TNAP与TNGF之间的通信安全。
关于S210d的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤10d的相关介绍，此处不再赘述。
S210e，TNAP向UE发送EAP成功消息。相应地，UE接收来自TNAP的EAP成功消息。
关于S210e的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤10e的相关介绍，此处不再赘述。
S211，UE与TNAP使用TNAP密钥建立安全连接。
示例性地，UE和TNAP可以将TNAP密钥作为成对主密钥(pairwise master key，PMK)，并基于该PMK进行四次握手，以建立安全连接。
关于S211的实现原理可以参考TS 33.501版本17.7.0中章节7.2A.1中的步骤11。
S212，UE接收来自TNGF的IP配置信息。
IP配置信息用于指示TNGF与UE通信的IP地址。
关于S212的实现原理可以参考TS 33.501版本17.7.0中章节7.2A.1中的步骤12。
S213，UE完成后续注册流程。
关于S213的实现原理可以参考TS 33.501版本17.7.0中章节7.2A.1中的步骤13a-19。
以上S200-S213为可信非3GPP的注册、认证和PDU会话建立流程。然而，在实际的通信过程中，UE和TNAP之间的相对位置可能会发生变化，如在UE移动的场景中，UE的位置会发生变化，或者，不同TNAP的信号质量变化等，从而会导致为UE提供网络服务的TNAP会发生变化，在此情况下，UE需要切换TNAP。在UE切换TNAP的场景中，为了简化交互流程，可以通过UE认证标识，如重认证标识(Re-authentication identity，Reauth ID)标识UE的身份。这样，TNGF可以通过UE认证标识识别UE是否为在TNGF下切换TNAP的UE。这样，在UE从TNGF下的源TNAP1切换至目标TNAP的情况下，可以执行切换TNAP场景下的重认证流程，以建立UE与目标TNAP之间的安全连接，从而避免执行图2所示的完整认证流程，提高服务连续性。其中，上述UE认证标识可以由TNGF分配，也可以通过随机数生成。
为便于理解，以下结合源TNAP、目标TNAP说明采用不同方式获取UE认证标识的切换流程。
图3为TNAP切换的流程示意图一。图3所示的方法包括S301至S311。
S301，UE与源TNAP建立安全连接，以及TNGF通过源TNAP向UE发送UE认证标识。
其中，UE认证标识包括公共陆地移动网络(public land mobile network，PLMN)ID、TNGF ID、临时(temporary，Temp)ID三个部分组成。
在S301的流程中，UE与源TNAP均可以生成源密钥，即针对原TNAP的TNAP密钥。源密钥可以用于保护UE与源TNAP之间的通信安全。
TNGF通过源TNAP向UE发送UE认证标识可以包括：在UE与源TNAP建立安全连接之后，TNGF通过源TNAP向UE发送UE认证标识。
关于S301中UE与源TNAP建立安全连接的具体实现原理可以参考协议版本TS 33.501版本17.7.0中的7A.2.1中定义的流程，或者参考上述S200至S213的相关介绍，此处不再赘述。
S302，UE确定从源TNAP切换至目标TNAP。
示例性地，在UE检测到源TNAP的信号强度小于或等于第一信号强度阈值，目标TNAP的信号强度大于或等于第二信号强度阈值的情况下，UE确定从源TNAP切换至目标TNAP。可理解，此处UE切换TNAP的场景仅用于举例，在实际实施中，可能存在其他切换TNAP的场景，此处不再赘述。
S303，UE与目标TNAP之间建立层二连接。
关于S303的具体实现原理可以参考S201的相关介绍，此处不再赘述。
S304，目标TNAP向UE发送身份请求消息。相应地，UE接收来自目标TNAP的身份请求消息。
身份请求消息用于目标TNAP获取UE的身份信息。
身份请求消息可以是EAP身份请求消息。
关于S304中的身份请求消息的实现可以参考S202中身份请求消息的相关介绍，此处不再赘述。
关于S304的具体实现原理可以参考S202的相关介绍，此处不再赘述。
S305，UE向目标TNAP发送身份响应消息。相应地，目标TNAP接收来自UE的身份响应消息。
其中，身份响应消息中包括移动性切换指示(TNAP_Mobility_indication)和UE认证标识。移动性切换指示用于指示UE仍处于注册状态，不需要向AMF发送注册请求消息触发主认证流程，只需执行EAP-5G注册流程即可。
S306，目标TNAP向TNGF发送移动性切换指示和UE认证标识。
其中，移动性切换指示和UE认证标识可以携带于认证、授权和计费(authentication、authorization and accounting，AAA)消息中。
S307，TNGF确定目标密钥。
示例性地，TNGF根据UE认证标识识别UE并检索UE的上下文，从而确定TNGF密钥。
其中，UE的上下文包括TNGF密钥。
S308，TNGF向目标TNAP发送第一通知请求消息(EAP-Req/5G-notification)。相应地，目标TNAP接收来自TNGF的第一通知请求消息。
其中，第一EAP-5G通知请求消息包括如下一项或多项：目标密钥、第一随机数和消息认证码(message authentication code，MAC)#0。
其中，消息认证码#0用于保护随机数的完整性。
示例性地，目标密钥、第一随机数和消息认证码#0可以承载于AAA消息中。第一通知请求消息可以是EAP-5G通知请求消息。
S309，目标TNAP向UE发送第二通知请求消息，相应地，UE接收来自目标TNAP的第二通知请求消息。
其中，第二通知请求消息中包括如下一项或多项信息：开始安全模式(start security mode)消息、第一随机数和消息认证码#0。开始安全模式消息，用于指示UE使用随机数和TNGF密钥生成目标密钥。第二通知请求消息可以是EAP-5G通知请求消息。
S310，UE生成目标密钥。
示例性地，UE对消息认证码#0进行校验，在消息认证码#0校验成功的情况下，UE根据接收到的第一随机数生成目标密钥。
UE将TNGF密钥和第一随机数作为输入，计算出消息认证码#1，并将消息认证码#1与消息认证码#0进行比较，若消息认证码#1于与消息认证码#0匹配，则消息认证码#0校验成功。
S311，UE与目标TNAP使用目标密钥建立安全连接。
UE将目标密钥作为PMK，与目标TNAP进行四次握手，以建立UE与目标TNAP之间的安全连接。
关于S311的实现原理可以参考TS 33.501版本17.7.0中章节7.2A.1中的步骤11，或图2中所示的S211的相关介绍，此处不再赘述。
上述图3所示的流程中，在TNGF通过源TNAP发送UE认证标识的过程中，由于TNGF与源TNAP之间已经建立了安全连接，因此，UE认证标识在源TNAP与UE之间传输可以得到安全保护。然而，在UE从源TNAP切换至目标TNAP的过程中，由于TNGF与目标TNAP之间并未建立安全连接，因此，UE认证标识在UE与目标TNAP传输不能得到安全保护。这样，攻击者便可以仿冒UE发起TNAP切换流程，从而会导致通信安全性问题。
另外，在生成采用计数器的值生成TNAP密钥的情况下，攻击者每发起一次切换流程，TNGF的计数值便会增加，但是实际需要接入TNAP的UE的计数值不会发生变化，如此，便会导致TNGF和UE的计数器不一致，从而导致UE无法成功接入TNAP。
图4为TNAP切换的流程示意图二。图4所示的方法包括S400a至S422。
S400a，AMF向TNGF发送初始上下文建立请求消息。相应地，TNGF接收来自AMF的初始上下文建立请求消息。
其中，初始上下文建立请求消息可以封装在N2消息中。初始上下文建立请求消息中可以包括TNGF密钥。
关于S400a的具体实现原理可以参考协议版本TS 33.501版本17.7.0章节7.2A.2.1中步骤10a或上述S210a的相关介绍，此处不再赘述。
可理解，在S400a之前，该图4所提供的方法还可以包括如图2中的S200至S209d，具体原理可以参考图2中的相关介绍，此处不再赘述。
S400b，TNGF通过源TNAP向UE发送通知请求消息。相应地，UE通过源TNAP接收来自TNGF的通知请求消息。
其中，通知请求消息中包括TNGF地址、TNGF的标识(TNGF identifier，TNGF-ID)、TNGF的随机数(TNGF Nnonce，TNonce)。通知请求消息可以是EAP-5G通知请求消息。
S400c，UE通过源TNAP向TNGF发送通知响应消息。TNGF通过源TNAP接收来自UE的通知响应消息。
其中，通知响应消息中包括UE的随机数(UE nonce，UNonce)。示例性地，通知响应消息可以是EAP-5G通知响应消息。
S400d，TNGF向源TNAP发送源密钥和EAP成功消息。相应地，源TNAP接收来自TNGF的源密钥和EAP成功消息。
其中，源密钥是根据TNGF密钥生成的针对源TNAP的TNAP密钥，源密钥用于保护源TNAP与TNGF之间的通信安全。
S400e，源TNAP向UE发送EAP成功消息。相应地，UE接收来自源TNAP的EAP成功消息。
S401，UE与源TNAP使用源密钥建立安全连接。
示例性地，UE和源TNAP可以将源密钥作为PMK，并基于该PMK进行四次握手，以建立安全连接。
关于S401的实现原理可以参考TS 33.501版本17.7.0中章节7.2A.1中的步骤11或上述S211。
S402，UE接收来自TNGF的IP配置信息。
IP配置信息用于指示TNGF与UE通信的IP地址。
关于S402的实现原理可以参考TS 33.501版本17.7.0中章节7.2A.1中的步骤12或上述S212，此处不再赘述。
S403，UE完成后续注册流程。
关于S403的实现原理可以参考TS 33.501版本17.7.0中章节7.2A.1中的步骤13a-19，或上述S213，此处不再赘述。
S404，UE确定从源TNAP切换至目标TNAP。
关于S404的具体实现原理可以参考S302的相关介绍，此处不再赘述。
S405，UE与目标TNAP之间建立层二连接。
关于S405的实现原理可以参考上述S201或S303，此处不再赘述。
S406，目标TNAP向UE发送身份请求消息。相应地，UE接收来自目标TNAP的身份请求消息。
身份请求消息可以是EAP身份请求消息(EAP-Req/Identity)。
S407，UE向目标TNAP发送身份响应消息。相应地，目标TNAP接收来自UE的身份响应消息。
其中，EAP身份响应消息包括UE的身份信息。该UE的身份信息的格式可以是网络访问标识符(network access identifier，NAI)格式。
UE的身份信息包括：用户名和域名。其中，用户名可以是UE认证标识。域名可以是“nai.5gc.tngf<tngf-ID>.mnc<mnc>.mcc<mcc>.3gppnetwork.org”。
S408，目标TNAP选择TNGF。
示例性地，目标TNAP可以根据UE的身份信息选择TNGF。例如，目标TNAP可以根据UE的身份信息的域名中的<tngf-ID>字段选择TNGF。也就是说，域名中<tngf-ID>字段指示的TNGF即UE选择的TNGF。
S409，目标TNAP向TNGF发送身份响应消息。相应地，TNGF接收来自目标TNAP的身份响应消息。
身份响应消息中包括UE认证标识和NAI格式的UE的身份信息。
S410，TNGF根据身份响应消息中的UE认证标识确定UE的上下文。
S411，TNGF通过目标TNAP向UE发送挑战请求(EAP-Req/5G-challenge)消息。相应地，UE通过目标TNAP接收来自TNGF的挑战请求消息。
其中，挑战请求消息中可以包括TNonce和消息认证码#2。消息认证码#2由TNGF根据TNGF密钥和TNonce生成，可以用于验证TNonce是否被篡改。
挑战请求消息可以是EAP-5G挑战请求消息。
S412，UE对TNGF进行认证。
S412也可以说是UE对消息认证码#2进行校验。
示例性地，UE根据TNGF密钥、TNonce生成消息认证码#3，若消息认证码#3与消息认证码#2匹配，则TNGF认证成功。若消息认证码#3与消息认证码#2不匹配，则TNGF认证失败。
S413，在TNGF认证成功的情况下，UE生成消息认证码#4。
其中，息验证码#4根据TNGF密钥TNonce和UNonce生成，可以用于保护UNonce的完整性。
S414，UE通过目标TNAP向TNGF发送挑战响应(EAP-Res/5G-challenge)消息。相应地，TNGF通过目标TNAP接收来自UE的挑战响应消息。
其中，挑战响应消息中包括TNonce、UNonce和消息认证码#4。
示例性地，挑战响应消息可以是EAP-5G挑战响应消息。
S415，TNGF对UE进行认证。
也可以说，TNGF对消息认证码#4进行校验。
示例性地，TNGF根据TNGF密钥、TNonce和UNonce生成消息认证码#5，若消息认证码#5与消息认证码#4匹配，则UE认证成功。若消息认证码#5与消息认证码#4不匹配，则UE认证失败。
S416，在UE认证成功的情况下，TNGF生成目标密钥。
在UE认证成功的情况下，TNGF根据TNGF-ID、TNonce、UNonce和TNGF密钥生成UE的新UE认证标识，以及根据TNGF-ID、TNonce和UNonce、TNGF密钥生成目标密钥。
可理解，该新UE认证标识可以用于UE在从目标TNAP切换至TNGF连接的除目标TNAP之外的TNAP时，用于标识UE的身份，或者说，用于标识UE是否为首次接入TNGF。
S417，TNGF向目标TNAP发送EAP成功消息和目标密钥。相应地，目标TNAP接收来自TNGF的EAP成功消息和目标密钥。
S418，目标TNAP向UE发送EAP成功消息。相应地，UE接收来自目标TNAP的EAP成功消息。
S419，UE生成新的UE认证标识和目标密钥。
UE通过使用存储在UE中的TNGF密钥、TNGF-ID、TNonce和UNonce生成新的UE认证标识，以及通过TNGF-ID、TNonce和UNonce、TNGF密钥生成目标密钥。
如果UE和TNGF共享相同的TNGF密钥，则在UE中和TNGF中独立导出的新UE认证标识将是相同的，目标密钥也是相同的。
S420，UE与目标TNAP使用源密钥建立安全连接。
关于S420的实现原理可以参考上述S211，此处不再赘述。
S421，UE接收新的IP配置信息。
关于S421的实现原理可以参考上述S212，此处不再赘述。
S422，UE通过目标TNAP恢复与TNGF的通信。
在图4所示的方案中，用于生成UE认证标识的参数的传输流程是在UE首次连接到TNGF时，如UE通过TNGF进行初次注册时收到的，也就是在UE与源TNAP建立安全连接之前，如此，用于生成 UE认证标识的参数在传输过程中不存在安全保护，便会导致用于生成UE认证标识的参数被攻击者更改或者传输错误，从而导致无法在UE切换TNAP的情况下，正确识别UE是否为切换TNAP的UE。
本申请实施例的技术方案可以应用于各种通信系统，例如无线保真(wireless fidelity，WiFi)系统，车到任意物体(vehicle to everything，V2X)通信系统、设备间(device-todevie，D2D)通信系统、车联网通信系统、第4代(4th generation，4G)移动通信系统，如长期演进(long term evolution，LTE)系统、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)移动通信系统，如新空口(new radio，NR)系统，以及未来的通信系统，如第六代(6th generation，6G)移动通信系统等。
本申请将围绕可包括多个设备、组件、模块等的系统来呈现各个方面、实施例或特征。应当理解和明白的是，各个系统可以包括另外的设备、组件、模块等，并且/或者可以并不包括结合附图讨论的所有设备、组件、模块等。此外，还可以使用这些方案的组合。
另外，在本申请实施例中，“示例地”、“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用示例的一词旨在以具体方式呈现概念。
本申请实施例中，“信息(information)”，“信号(signal)”，“消息(message)”，“信道(channel)”、“信令(singaling)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。“的(of)”，“相应的(corresponding，relevant)”和“对应的(corresponding)”有时可以混用，应当指出的是，在不强调其区别时，其所要表达的含义是一致的。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为便于理解本申请实施例，首先以图5中示出的通信系统为例详细说明适用于本申请实施例的通信系统。示例性地，图5为本申请实施例提供的通信方法所适用的一种通信系统的架构示意图。
如图5所示，该通信系统包括UE、3GPP接入网、可信非3GPP接入网(trusted non-3GPP access network，TNAN)和AMF。
UE可以通过3GPP接入网进行3GPP接入，UE可以通过TNAN进行non-3GPP接入。其中TNAN包括TNAP1、TNAP2和TNGF。示例性地，UE与TNAP1之间可以通过Yt接口通信连接，UE与TNGF之间可以通过NWt接口通信连接。UE还可以通过N1接口与AMF通信连接。UE与TNAP2之间可以通过Yt接口通信连接，UE与TNGF之间可以通过NWt接口通信连接。UE还可以通过N1接口与AMF通信连接。在此情况下，TNGF为TNAP1、TNAP2的管理网元。TNGF为TNAP的管理网元，是指TNGF与该TNAP建立有连接，并且TNGF生成用于该TNAP与UE之间建立安全通信的密钥，并发送给TNAP。
此外，图5所示的通信系统中还可以包括SMF、UPF、和数据网络。
其中，SMF与AMF之间可以通过N11接口通信，UPF与SMF之间可以通过N4接口通信连接，UPF与TNGF之间可以通过N3接口通信连接，数据网络和UPF之间可以通过N6接口通信连接。3GPP接入网可以通过N2接口与AMF通信连接。3GPP接入网可以包括RAN。
需要说明的是，本申请实施例提供的通信方法，可以适用于图5所示的UE、TNAP1、TNAP2和TNGF之间具体实现可以参考下述方法实施例，此处不再赘述。
应当指出的是，本申请实施例中的方案还可以应用于其他通信系统中，相应的名称也可以用其他通信系统中的对应功能的名称进行替代。
应理解，图5仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他网元，如AMF、AUSF等，图5中未予以画出。
下面将结合图6-图7对本申请实施例提供的通信方法进行具体阐述。
在一些可能的实施例中，可以在UE从源TNAP切换至目标TNAP的过程中，传输UE认证标识。
示例性地，图6为本申请实施例提供的通信方法的流程示意图一。该通信方法可以适用于图5所示的UE、TNAP和TNGF之间的通信。
如图6所示，该通信方法包括如下步骤：
S601，在UE通过源TNAP接入到TNGF的流程中，TNGF获取UE认证标识，以及获取TNGF密钥。
其中，TNGF密钥是TNGF和UE之间共享的密钥。TNGF密钥可以是根据长期密钥生成。
UE认证标识可以是用于UE在TNAP切换时，TNGF识别UE。示例性地，UE认证标识可以是重认证标识(Re-authentication identity，Reauth ID)。
一种可能的设计方案中，UE与TNGF之间直接传输UE认证标识。在此情况下，UE通过源TNAP接入到TNGF的流程，可以包括：图2所示的S200至S213，以及后续UE与TNGF传输数据的流程。在此情况下，在TNGF获取UE认证标识之前，该通信方法还可以包括S200至S213中的一项或多项。
在此情况下，TNGF获取UE认证标识，可以是在S213之后UE与TNGF传输数据的流程中。
TNGF获取TNGF密钥，可以是在执行如图2所示S210a的过程中。例如，TNGF密钥可以携带在S210a中的初始上下文建立请求消息中。
另一种可能的设计方案中，UE与TNGF之间传输用于生成UE认证标识的至少部分参数。在此情况下，UE通过源TNAP接入到TNGF的流程，可以包括：图2所示的S200至S210e。在此情况下，在TNGF获取UE认证标识之前，该通信方法还可以包括S200至S209d中的一项或多项。
在此情况下，TNGF获取UE认证标识的步骤可以位于S210b与S210d之间，具体实现可以参考图7中S701至S703的相关介绍。
TNGF获取TNGF密钥，可以是通过图2中的S210a，或图7中的S700实现，也就是说，TNGF密钥携带在初始上下文建立请求消息中。
S602，在UE通过源TNAP接入TNGF的流程中，UE获取UE认证标识，以及生成TNGF密钥。
在UE与TNGF之间直接传输UE认证标识的情况下，UE获取UE认证标识，可以是在S213之后的UE与TNGF传输数据的流程中。S602中，UE获取UE认证标识，包括：UE通过源TNAP接收来自TNGF的UE认证标识。
在此情况下，UE获取UE认证标识之前，图6所示的通信方法还可以包括：UE通过源TNAP接入到TNGF。具体实现原理可以参考S200至S213，此处不再赘述。
UE获取TNGF密钥，可以是UE根据长期密钥生成TNGF密钥，此处不再赘述。
另一种可能的设计方案中，UE与TNGF之间传输用于生成UE认证标识的至少部分参数。在此情况下，UE获取UE认证标识的原理可以参考下述图7中S700至S706的相关介绍，此处不再赘述。
UE获取TNGF密钥，可以是UE根据长期密钥生成TNGF密钥，此处不再赘述。
S603，UE确定从源TNAP切换至目标TNAP。
UE从源TNAP切换至目标TNAP的情况，可以是UE检测到源TNAP的信号质量低于第一信号质量阈值，目标TNAP的信号质量低于第二信号质量阈值。
关于S603的实现原理可以参考上述S302的实现原理，此处不再赘述。
S604，UE与目标TNAP之间建立层二连接。
关于S604的实现原理可以参考上述S303的实现原理，此处不再赘述。
S605，目标TNAP向UE发送身份请求消息。相应地，UE接收来自目标TNAP的身份请求消息。
关于S605的实现原理可以参考S304的实现原理，此处不再赘述。
S606，UE通过目标TNAP向TNGF发送第一消息。相应地，TNGF通过目标TNAP接收来自UE的第一消息。
可理解，S606可以在UE从源TNAP切换至目标TNAP的情况下执行。
其中，第一消息包括UE认证标识和第一验证参数。第一验证参数由UE根据TNGF密钥和至少UE认证标识生成。
可选地，第一消息还可以包括移动性切换指示。其中，移动性切换指示可以用于指示UE从源TNAP切换至目标TNAP，也就是说，UE在接入目标TNAP之前已经接入到与目标TNAP位于同一TNGF下的其他TNAP。在S606之前，图6所提供的方法还可以包括步骤a1。
步骤a1，UE根据TNGF密钥和至少UE认证标识生成第一验证参数。
以下结合第一验证参数的生成方式，说明步骤a1。
示例性地，在第一消息包括UE认证标识的情况下，第一验证参数可以根据TNGF密钥和UE认证 标识生成。以下结合生成方式1.1或生成方式1.2说明。
生成方式1.1，直接根据UE认证标识以及TNGF密钥生成第一验证参数。
在此情况下，步骤a1可以包括：UE根据TNGF密钥、UE认证标识和预配置的函数计算第一消息验证码，便得到第一验证参数。示例性地，UE将UE认证标识作为输入参数，将TNGF密钥作为输入密钥，输入预配置的函数，从而计算得到第一消息验证码，即第一验证参数。
其中，预配置的函数可以通过如下一项或多项实现：信息摘要算法(message-digest algorithm，MD5)、安全哈希算法-1(secure hash algorithm-1，SHA-1)、SHA-256，后面不再赘述。
在一些可能的设计方案中，预配置的函数也可以称为消息验证码生成函数。
生成方式1.2，先根据TNGF密钥生成中间密钥，再生成第一验证参数。
在此情况下，步骤a1可以包括步骤a1.1和步骤a1.2。
步骤a1.1，UE根据TNGF密钥生成中间密钥。
一种可能的设计方案中，UE根据TNGF密钥和第一类型识别码(usage type distinguisher)生成中间密钥。UE可以将TNGF密钥和第一类型识别码输入密钥生成函数(key derivation function，KDF)，如此便可以得到中间密钥。其中，第一类型识别码用于标识生成密钥的类型为中间密钥。示例性地，第一类型识别码可以是0x03。
可理解，密钥生成函数的输入参数还可以包括固定码，如0x84。
另一种可能的设计方案中，UE可以根据TNGF密钥、第一新鲜性参数和第二新鲜性参数成中间密钥。
其中，第一新鲜性参数是UE生成的随机数、或者计数器值，第二新鲜性参数是UE生成的随机数、或者计数器值，本实施例不做具体限定。
步骤a1.2，UE根据中间密钥、UE认证标识和预配置的函数计算第一消息验证码，便得到所述第一验证参数。
示例性地，UE将UE认证标识作为输入参数，将中间密钥作为输入密钥，输入消息验证码生成函数，从而计算得到第一消息验证码，即第一验证参数。
关于预配置的函数可以参考生成方式1.1的相关介绍，此处不再赘述。
在第一消息包括UE认证标识的情况下，第一验证参数也可以基于如下生成方式1.3或生成方式1.4生成。
生成方式1.3，直接根据移动性切换指示、UE认证标识，以及TNGF密钥生成第一验证参数。
在此情况下，步骤a1可以包括：UE根据TNGF密钥、UE认证标识、移动性切换指示和预配置的函数计算第一消息验证码，便得到所述第一验证参数。
关于预配置函数的生成原理可以参考生成方式1.1中的相关介绍。第一验证参数的生成原理可以参考生成方式1.1的相关介绍，其区别在于，输入预配置函数的输入参数包括UE认证标识和移动性切换指示。
生成方式1.4，先根据TNGF密钥生成中间密钥，再生成第一验证参数。
在此情况下，步骤a1可以包括步骤a1.3和步骤a1.4。
步骤a1.3，UE根据TNGF密钥生成中间密钥。
关于步骤a1.3的实现原理可以参考生成方式1.2中步骤a1.1的相关介绍，此处不再赘述。
步骤a1.4，UE根据中间密钥、UE认证标识、移动性切换指示和预配置的函数计算第一消息验证码，便得到所述第一验证参数。
关于生成方式1.4的实现原理可以参考生成方式1.2的相关介绍，其区别在于，输入预配置的函数输入参数包括UE认证标识和移动性切换指示。
可选地，若在S606之前，UE接收到了来自目标TNAP的EAP身份请求消息，如身份请求消息，则第一消息可以是身份响应消息，如EAP身份响应消息。
S607，TNGF根据TNGF密钥对第一验证参数进行校验。
为便于理解，以下结合第一验证参数的生成方式分情况进一步说明S607。
情况1.1，在第一验证参数通过生成方式1.1生成的情况下，S607可以包括步骤b1和步骤b2。
步骤b1，TNGF根据UE认证标识和TNGF密钥，生成第六验证参数。
步骤b2，TNGF确定第一验证参数与第六验证参数是否匹配。
情况1.2，第一验证参数通过生成方式1.2生成的情况下，S607可以包括步骤b3至步骤b5。
步骤b3，TNGF根据TNGF密钥生成中间密钥。
关于步骤b3的实现原理可以参考上述步骤a1.1，其区别在于，步骤b3的中间密钥由TNGF生成。
步骤b4，TNGF根据中间密钥和UE认证标识生成第六验证参数。
关于第六验证参数的生成原理可以参考上述生成方式1.2中第一验证参数的生成原理，此处不再赘述。
步骤b5，TNGF确定第一验证参数与第六验证参数是否匹配。
情况1.3，第一验证参数通过生成方式1.3生成的情况下，S607可以包括步骤b6和步骤b7。
步骤b6，TNGF根据TNGF密钥、UE认证标识和移动性切换指示生成第六验证参数。
步骤b7，TNGF确定第一验证参数与第六验证参数是否匹配。
情况1.4，第一验证参数通过生成方式1.4生成的情况下，S607可以包括步骤b8至步骤b10。
步骤b8，TNGF根据TNGF密钥生成中间密钥。
关于步骤b8的实现原理可以参考上述步骤a1.1，其区别在于，步骤b8的中间密钥由TNGF生成。
步骤b9，TNGF根据中间密钥、UE认证标识和移动性切换指示生成第六验证参数。
关于第六验证参数的生成原理可以参考上述生成方式1.4中第一验证参数的生成原理，此处不再赘述。
步骤b10，TNGF确定第一验证参数与第六验证参数是否匹配。
可理解，第一验证参数与第六验证参数匹配，即第一验证参数校验成功。第一验证参数与第六验证参数不匹配，即第一验证参数校验失败。示例性地，第一验证参数与第六验证参数匹配，可以指第一验证参数与第六验证参数相同。
对于同一UE而言，该UE中存储的TNGF密钥和TNGF中存储的与该UE对应的TNGF密钥相同，由于生成第一验证参数和第二验证参数的密钥都是TNGF密钥和TNonce，因此，TNGF通过执行S608，便可以实现对UE的认证，以及对UE认证标识的完整性校验。第一验证参数与第六验证参数匹配，可以表示UE认证成功，也就是说UE是实际进行TNAP切换的UE，且UE认证标识未被篡改。第一验证参数与第六验证参数不匹配，可以表示UE认证失败，也就是说UE不是实际进行TNAP切换的UE，或者UE认证标识被篡改。
S608，在第一验证参数校验成功的情况下，TNGF生成目标密钥。
或者说，在第一验证参数与第六验证参数匹配的情况下，TNGF生成目标密钥。
一种可能的设计方案中，S608中，TNGF可以根据TNGF密钥直接生成目标密钥。示例性地：TNGF根据TNGF密钥和计数参数生成目标密钥。
TNGF根据TNGF密钥、第二类型识别码和计数参数确定目标密钥。其中，计数参数可以是计数器的计数值，该计数值可以根据UE切换TNAP的次数确定，如计数值为UE切换TNAP的次数。计数参数也可以是随机数，该随机数在每次切换时，由TNGF生成。
示例性地，TNGF可以将TNGF密钥、第二类型识别码和计数参数输入密钥生成函数，如此便可以得到目标密钥。
可理解，密钥生成函数的输入参数还可以包括固定码，如0x84。
例如，第二类型识别码可以为0x02。
可理解，S608中的密钥生成函数沿用TS33.501 A22中定义的密钥生成函数，此处不再赘述。
另一种可能的设计方案中，S608可以包括：TNGF根据TNGF密钥和第一新鲜性参数、第二新鲜性参数成目标密钥。
再一种可能的设计方案中，可以根据TNGF密钥获取中间密钥，进而根据中间密钥生成目标密钥。在此情况下，S608可以包括步骤c1和步骤c2。
步骤c1，TNGF根据TNGF密钥生成中间密钥。
关于步骤c1的实现原理可以参考上述步骤b3或上述步骤b8的相关介绍，此处不再赘述。
可理解，步骤c1、步骤b3可以是同一个步骤，也可以是不同的步骤。或者步骤c1和步骤b8可以是同一个步骤，也可以是不同的步骤。
步骤c2，TNGF根据中间密钥生成目标密钥。
示例性地，TNGF根据中间密钥和第三类型识别码，如0x02确定目标密钥。
例如，TNGF可以将中间密钥和第三类型识别码输入密钥生成函数，如此便可以得到目标密钥。
可理解，密钥生成函数的输入参数还可以包括固定码，如0x84。
S609，TNGF向目标TNAP发送通知请求消息。相应地，目标TNAP接收来自TNGF的通知请求消息。
其中，通知请求消息包括目标密钥、第一随机数和第七验证参数。目标密钥用于保护UE与目标TNAP之间的通信安全。第七验证参数根据TNGF密钥和第一随机数生成。
关于第七验证参数的生成原理可以参考上述生成方式1.1或生成方式1.2，此处不再赘述。
关于S609的实现原理可以参考上述S308的相关介绍，此处不再赘述。
一种可能的设计方案中，第一随机数和TNGF密钥一起可以用于生成目标密钥。
此外，图6所提供的方法还可以包括S610和S613。
S610，目标TNAP向UE发送通知请求消息。相应地，UE接收来自目标TNAP的通知请求消息。
其中，通知请求消息包括如下信元：开始安全模式(start security mode)消息、第一随机数、第七验证参数。
S611，UE对第七验证参数进行校验。
示例性地，S611可以包括：UE可以根据接收到的第一随机数和TNGF密钥，生成第八验证参数。UE确定第七验证参数与第八验证参数是否一致。
其中，第七验证参数与第八验证参数匹配，即第七验证参数校验成功。第七验证参数与第八验证参数不匹配，即第七验证参数校验失败。
关于第八验证参数的生成原理可以参考上述生成方式1.1或生成方式1.2，此处不再赘述。
S612，在第七验证参数与第八验证参数匹配的情况下，UE通过目标TNAP向TNGF发送通知响应消息。
其中，通知响应消息中包括移动性切换状态(mobility switch complete)消息。移动性切换状态消息用于指示UE成功生成目标密钥。
通知响应消息可以是EAP-5G通知响应消息。
需要说明，第一验证参数与第六验证参数的生成原理相同。第七验证参数与第八验证参数的生成原理相同。生成第一验证参数、第六验证参数的中间密钥与生成第七验证参数、第八验证参数的中间密钥可以相同，也可以不同。
S613，UE与目标TNAP使用目标密钥建立安全连接。
关于S613的实现原理可以参考上述S311的相关介绍，此处不再赘述。
需要说明的是，图6所示的步骤的执行顺序仅用于举例，在实际实施中，不同步骤之间的顺序在符合逻辑的情况下。
基于上述图6所提供的通信方法，在UE从源TNAP切换至目标TNAP的情况下，UE可以在向目标TNAP发送UE认证标识时，发送第一验证参数。其中，第一验证参数根据针对TNGF的TNGF密钥和UE认证标识生成。而TNGF存储有针对UE的TNGF密钥，如此，TNGF便可以根据接收到的UE认证标识和TNGF密钥实现对UE认证标识的完整性认证，以及对UE的身份的认证，从而可以在攻击者仿冒UE发起TNAP切换时，识别出攻击者仿冒的UE，以避免攻击者仿冒的UE接入目标TNAP，从而提高通信安全性。
此外，在目标密钥基于计数器的数参数生成的情况下，可以识别出攻击者仿冒的接入目标密钥，从而避免改变TNGF中计数器的计数参数，以使UE中的计数参数与TNGF中的计数参数一致，以提高UE接入成功率。
在另一些实施例中，可以在UE首次接入TNGF的流程中，传输用于生成UE认证标识的参数。在此情况下，可以对UE首次接入TNGF的流程中传输的用于生成UE认证标识的参数进行完整性保护。
图7为本申请实施例提供的通信方法的流程示意图二。如图7所示，该通信方法包括S701至S711。
S700，TNGF接收来自AMF的初始上下文建立请求消息。
TNGF接收到来自AMF的初始上下文建立请求消息，可以确定UE是首次接入TNGF。
初始上下文建立请求消息中可以包括TNGF密钥。
S701，TNGF通过源TNAP向UE发送通知请求消息。相应地，UE通过源TNAP接收来自TNGF的通知请求消息。
可理解，S701在TNGF接收到来自AMF的初始上下文建立请求消息的情况下执行。也可以说是在UE首次接入TNGF的过程中执行。
其中，通知请求消息包括TNonce和第二验证参数。TNonce用于作为生成UE认证标识一部分输入参数。第二验证参数根据TNGF密钥和至少TNonce生成。
一些可能的设计方案中，通知请求消息中还可以包括如下一项或多项：TNGF地址、或TNGF标识(TNGF identifier，TNGF ID)。
也就是说，通知请求消息可以包括TNonce，或者，通知请求消息可以包括TNonce和TNGF标识，或者，通知请求消息可以包括TNonce和TNGF地址，或者，通知求消息可以包括TNonce、TNGF地址和TNGF标识。
在此情况下，第二验证参数还可以根据TNGF密钥、TNonce和如下一项或多项生成：TNGF地址、或TNGF-ID。
在S701之前，图7所提供的方法还可以包括步骤d1。
步骤d1，TNGF根据TNGF密钥和至少TNonce生成第二验证参数。
为便于理解，以下结合通知请求消息中包括的信息分别说明第二验证参数的生成原理。
在通知请求消息包括TNonce的情况下，第二验证参数可以根据如下生成方式2.1和生成方式2.2生成。
生成方式2.1，TNGF直接基于TNGF密钥生成第二验证参数。
在此情况下，步骤d1可以包括：TNGF根据TNGF密钥、TNonce和预配置的函数计算第二消息验证码，便得到所述第二验证参数。
示例性地，TNGF将TNonce作为输入参数，将TNGF密钥作为输入密钥，输入预配置的函数，从而计算得到第二消息验证码，即第二验证参数。
生成方式2.2，TNGF先根据TNGF密钥生成中间密钥，进而采用中间密钥生成第二验证参数。
在此情况下，步骤d1可以包括步骤d1.1至步骤d1.2。
步骤d1.1，TNGF根据TNGF密钥生成中间密钥。
关于d1.1的实现原理可以参考步骤a1.1中生成中间密钥的原理。
步骤d1.2，TNGF根据中间密钥、TNonce和预配置的函数计算第二消息验证码，便得到所述第二验证参数。
生成方式2.2的实现原理与生成方式2.1中类似，其区别在于，输入密钥为中间密钥。
在通知请求消息包括TNonce、TNGF-ID的情况下，第二验证参数可以根据如下生成方式2.3和生成方式2.4生成。
生成方式2.3，TNGF直接采用TNGF密钥直接生成第二验证参数。
生成方式2.3的实现原理与生成方式2.1中类似，其区别在于，输入参数包括TNonce和TNGF-ID。
生成方式2.4，TNGF先根据TNGF密钥生成中间密钥，进而采用中间密钥生成第二验证参数。
生成方式2.4的实现原理与生成方式2.2中类似，其区别在于，输入参数为TNonce和TNGF-ID。
在通知请求消息包括TNonce、TNGF地址的情况下，第二验证参数可以根据如下生成方式2.5和生成方式2.6生成。
生成方式2.5，TNGF直接采用TNGF密钥直接生成第二验证参数。
生成方式2.5的实现原理与生成方式2.1中类似，其区别在于，输入参数包括TNonce和TNGF地址。
生成方式2.6，TNGF先根据TNGF密钥生成中间密钥，进而采用中间密钥生成第二验证参数。
生成方式2.6的实现原理与生成方式2.2中类似，其区别在于，输入参数为TNonce和TNGF地址。
在通知请求消息包括TNonce、TNGF-ID和TNGF地址的情况下，第二验证参数可以根据如下生成方式2.7和生成方式2.8生成。
生成方式2.7，TNGF直接采用TNGF密钥直接生成第二验证参数。
生成方式2.7的实现原理与生成方式2.1中类似，其区别在于，输入参数包括TNonce、TNGF-ID和TNGF地址。
生成方式2.8，TNGF先根据TNGF密钥生成中间密钥，进而采用中间密钥生成第二验证参数。
生成方式2.8的实现原理与生成方式2.2中类似，其区别在于，输入参数为TNonce、TNGF-ID和TNGF地址。
通知请求消息可以是EAP-5G通知请求消息。
S702，UE根据TNGF密钥对第二验证参数进行校验。
为便于理解，以下结合第二验证参数的生成方式分情况说明UE对TNGF进行认的流程。
情况2.1，第二验证参数通过生成方式2.1生成。在此情况下，S702可以包括步骤e1和步骤e2。
步骤e1，UE根据TNGF密钥和TNonce生成第三验证参数。
生成第三验证参数的原理与生成方式2.1中类似，此处不再赘述。
步骤e2，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。
情况2.2，第二验证参数通过生成方式2.2生成。在此情况下，S702可以包括步骤e3至步骤e5。
步骤e3，UE根据TNGF密钥生成中间密钥。
步骤e4，UE根据中间密钥和TNonce生成第三验证参数。
生成第三验证参数的原理与生成方式2.2中类似，此处不再赘述。
步骤e5，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。
情况2.3，第二验证参数通过生成方式2.3生成。在此情况下，S702可以包括步骤e6和步骤e7。
步骤e6，UE根据TNGF密钥、TNonce和TNGF-ID针对生成第三验证参数。
生成第三验证参数的原理与生成方式2.3中类似，此处不再赘述。
步骤e7，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。
情况2.4，第二验证参数通过生成方式2.4生成。在此情况下，S702可以包括步骤e8至步骤e10。
步骤e8，UE根据TNGF密钥生成中间密钥。
步骤e9，UE根据中间密钥TNonce和TNGF-ID生成第三验证参数。
生成第三验证参数的原理与生成方式2.4中类似，此处不再赘述。
步骤e10，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。
情况2.5，第二验证参数通过生成方式2.5生成。在此情况下，S702可以包括步骤e11和步骤e12。
步骤e11，UE根据TNGF密钥、TNonce和TNGF地址生成第三验证参数。
生成第二验证参数的原理与生成方式2.5中类似，此处不再赘述。
步骤e12，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。
情况2.6，第二验证参数通过生成方式2.6生成。在此情况下，S702可以包括步骤e13至步骤e15。
步骤e13，UE根据TNGF密钥生成中间密钥。
步骤e14，UE根据中间密钥、TNGF地址和TNonce生成第三验证参数。
生成第三验证参数的原理与生成方式2.6中类似，此处不再赘述。
步骤e15，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。
情况2.7，第二验证参数通过生成方式2.7生成。在此情况下，S702可以包括步骤e16和步骤e17。
步骤e16，UE根据TNGF密钥、TNGF地址、TNGF-ID和TNonce生成第三验证参数。
步骤e17，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。步骤e17生成第三验证参数的原理与生成方式2.7中类似，此处不再赘述。
情况2.8，第二验证参数通过生成方式2.8生成。在此情况下，S702可以包括步骤e18至步骤e20。
步骤e18，UE根据TNGF密钥生成中间密钥。
步骤e19，UE根据中间密钥、TNGF地址、TNGF-ID和TNonce生成第三验证参数。
生成第三验证参数的原理与生成方式2.8中类似，此处不再赘述。
步骤e20，若第二验证参数与第三验证参数匹配，则第二验证参数校验成功。
上述情况2.1至上述情况2.8中，生成中间密钥的原理可以参考图6所提供方法中，生成中间密钥的相关介绍，此处不再赘述。
S702可以实现对TNGF的认证，若第二验证参数校验成功，则TNGF认证成功。若第二验证参数 校验失败，则TNGF认证失败。第二验证参数与第三验证参数匹配可以是指第二验证参数与第三验证参数相同。第二验证参数与第三验证参数匹配的情况下，表示生成第二验证参数的输入参数未被篡改。第二验证参数与第三验证参数不匹配的情况下，表示生成第二验证参数的输入参数中，存在被篡改的参数。
可理解，在S702之前，图7所提供的方法还可以包括如图4中S400a至S409，或者包括图2的S200至S209d，此处不再赘述。
在第二验证参数校验成功的情况下，执行下述S703和S704。
S703，UE根据TNGF密钥、至少UNonce和TNonce生成UE认证标识。
S704，UE通过源TNAP向TNGF发送通知响应消息。相应地，TNGF通过源TNAP接收来自UE的通知响应消息。
其中，通知响应消息包括UNonce和第四验证参数。
示例性地，通知响应消息可以是EAP-5G通知响应消息。
其中，第四验证参数根据TNGF密钥和UNonce和生成。
S705，TNGF根据TNGF密钥对第四验证参数进行校验。
一种可能的设计方案中，S705可以包括步骤f1和步骤f2。
步骤f1，TNGF根据TNGF密钥和UNonce生成第五验证参数。
步骤f2，TNGF确定第四验证参数与第五验证参数是否匹配。
另一种可能的设计方案中，在S705可以包括步骤f3至步骤f5。
步骤f3，TNGF根据TNGF密钥生成中间密钥。
步骤f4，TNGF根据中间密钥和UNonce生成第五验证参数。
步骤f5，TNGF确定第四验证参数与第五验证参数是否匹配。
若第五验证参数与第四验证参数匹配，则第四验证参数校验成功，在此情况下，可以表明UNonce未被篡改。若第五验证参数与第四验证参数不匹配，则第四验证参数校验失败，在此情况下，可以表明UNonce被篡改。
需要说明，第二验证参数与第三验证参数的生成原理相同。第四验证参数与第五验证参数的生成原理相同。生成第二验证参数、第三验证参数的中间密钥与生成第四验证参数、第五验证参数的中间密钥可以相同，也可以不同。
在第四验证参数校验成功的情况下，执行下述S706和S707。
S706，TNGF根据TNGF密钥、至少UNonce和TNonce生成UE认证标识。
S707，TNGF向源TNAP发送针对源TNAP的源密钥和EAP成功消息。
其中，源密钥用于保护UE与源TNAP之间的通信安全。源密钥根据TNGF密钥生成。关于源密钥的生成方式，此处不再赘述。
关于源密钥的生成方法，可以参考S400d，此处不再赘述。
关于S707的实现原理可以参考上述S210d或上述S400d，此处不再赘述。
S708，源TNAP向UE发送EAP成功消息。相应地，UE接收来自源TNAP的EAP成功消息。
关于S708的实现原理可以参考上述S210e或上述S400e的相关介绍，此处不再赘述。
S709，UE与源TNAP之间建立安全连接。
关于S709的实现原理可以参考上述S211或上述S401的相关介绍，此处不再赘述。
可理解，在S710之前，图7所提供的方法还可以包括如图2中所示的S212和S213。
S710，UE确定从源TNAP切换至目标TNAP。
关于S710的实现原理可以参考上述S404的相关介绍，此处不再赘述。
S711，UE执行不完整的认证流程，以与目标TNAP之间建立安全连接。
关于S711的实现原理可以参考所述S405至上述S420的相关介绍，此处不再赘述。
上述图7所提供的通信方法，TNGF向UE发送TNonce时，可以携带用于完整性保护的第二验证参数。UE可以生成第三验证参数，并在第二验证参数与第三验证参数匹配的情况下向TNGF发送UNonce和第四验证参数。其中，第二验证参数由TNGF根据TNGF密钥和至少TNonce生成，第四验证参数由UE根据针对UE的TNGF密钥和指示UNonce生成。TNGF再根据UNonce和TNGF密钥生 成第五验证参数。如此，通过第二验证参数和第三验证参数的比对，便可以实现TNonce的完整性保护，通过第四验证参数和第五验证参数的比对，便可以实现TNonce的完整性保护，从而提高通信安全性。
需要说明，本申请实施例中，在UE和TNAP，如源TNAP或目标TNAP之间时，可以通过层二对消息进行封装。TNAP与TNGF之间，可以通过AAA对消息进行封装。另外，上述图6和上述图7中，不同步骤中的身份请求消息位于不同的数据包中，不同步骤中的身份响应消息不同的数据包中。不同步骤中的通知请求消息不同的数据包中，不同步骤中的通知请求消息不同的数据包中。
以上结合图6-图7详细说明了本申请实施例提供的通信方法。以下结合图8-图9详细说明用于执行本申请实施例提供的通信方法的通信装置。
示例性地，图8是本申请实施例提供的通信装置800的结构示意图一。如图8所示，通信装置800包括：处理模块801和收发模块802。为了便于说明，图8仅示出了该通信装置800的主要部件。
一些实施例中，通信装置800可适用于图5中所示出的通信系统中，执行图6中UE的功能。
处理模块801，用于在通信装置800通过源TNAP接入到TNGF的流程中，获取UE认证标识，以及生成TNGF密钥。其中，TNGF密钥是TNGF和通信装置800之间共享的密钥。收发模块802，用于在通信装置800从源TNAP切换至目标TNAP的情况下，通过目标TNAP向TNGF发送第一消息。其中，第一消息包括UE认证标识和第一验证参数。第一验证参数由通信装置800根据UE认证标识和TNGF密钥生成。
一种可能的设计方案中，处理模块801，具体用于通过源TNAP接收来自TNGF的UE认证标识。
一种可能的设计方案中，处理模块801，还用于通过源TNAP接入到TNGF。
一种可能的设计方案中，第一消息为身份响应消息，处理模块801，还用于确定从源TNAP切换至目标TNAP，并与目标TNAP之间建立层二连接。以及通过收发模块802接收来自目标TNAP的身份请求消息，身份请求消息用于触发通信装置800发送第一消息。
一种可能的设计方案中，收发模块802，还可以用于通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce和第二验证参数。第二验证参数由TNGF根据TNGF密钥和TNonce生成。处理模块801，还用于根据TNGF密钥和TNonce生成第三验证参数。处理模块801，还用于在第二验证参数与第三验证参数匹配的情况下，根据TNGF密钥、TNonce和通信装置800的随机数UNonce生成UE认证标识。UNonce由通信装置800生成。
可选地，发送模块，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，收发模块802，还用于通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce和第二验证参数。第二验证参数由TNGF根据中间密钥和TNonce生成。中间密钥由TNGF根据TNGF密钥生成。处理模块801，具体用于根据TNGF密钥生成中间密钥，以及根据中间密钥和TNonce生成第三验证参数。处理模块801，具体用于在第二验证参数与第三验证参数匹配的情况下，根据中间密钥、TNonce和通信装置800的随机数UNonce生成UE认证标识。UNonce由通信装置800生成。
可选地，收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
一种可能的设计方案中，收发模块802，还用于通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的地址和第二验证参数。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的地址生成。处理模块801，还用于根据TNGF密钥、TNonce和TNGF的地址生成第三验证参数。收发模块802，具体用于在第二验证参数与第三验证参数匹配的情况下，根据TNGF密钥、TNonce和通信装置800的随机数UNonce生成UE认证标识。
可选地，收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，收发模块802，还用于通过源TNAP接收来自TNGF的通知请求消息。其 中，通知请求消息包括TNGF的随机数TNonce、TNGF的地址和第二验证参数。第二验证参数由TNGF根据中间密钥、TNGF的随机数TNonce和TNGF的地址生成。中间密钥由TNGF根据TNGF密钥生成。处理模块801，还用于根据TNGF密钥生成中间密钥，以及根据中间密钥、TNonce和TNGF的地址生成第三验证参数。处理模块801，还用于在第二验证参数与第三验证参数匹配的情况下，根据中间密钥、TNonce、通信装置800的随机数UNonce和TNGF密钥生成UE认证标识。UNonce由通信装置800生成。
可选地，收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
一种可能的设计方案中，收发模块802，还用于通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的标识和第二验证参数。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的标识生成。处理模块801，还用于根据TNGF、TNonce和TNGF的标识生成第三验证参数。处理模块801，具体用于在第二验证参数与第三验证参数匹配的情况下，根据TNGF密钥、至少TNonce和通信装置800的随机数UNonce生成UE认证标识。UNonce由通信装置800生成。
可选地，收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，收发模块802，还用于通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据中间密钥、TNonce和TNGF的标识生成。中间密钥由TNGF根据TNGF密钥生成。处理模块801，还用于根据TNGF密钥生成中间密钥，以及根据中间密钥、TNonce和TNGF的标识生成第三验证参数。处理模块801，具体用于在第二验证参数与第三验证参数匹配的情况下，根据中间密钥、至少TNonce和通信装置800的随机数UNonce生成UE认证标识。UNonce由通信装置800生成。
可选地，收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
一种可能的设计方案中，收发模块802，还用于通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括TNGF的随机数TNonce、TNGF的地址、TNGF的标识和第二验证参数。第二验证参数由TNGF根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成。处理模块801，还用于根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。处理模块801，具体用于在第二验证参数与第三验证参数匹配的情况下，根据TNGF密钥、至少TNonce和通信装置800的随机数UNonce生成UE认证标识。UNonce由通信装置800生成。
可选地，收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据TNGF密钥和UNonce生成。
一种可能的设计方案中，收发模块802，还用于通过源TNAP接收来自TNGF的通知请求消息。通知请求消息包括TNonce、TNGF的地址、TNGF的标识和第二验证参数。其中，第二验证参数由TNGF根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成。中间密钥由TNGF根据TNGF密钥生成。处理模块801，还用于根据TNGF密钥生成中间密钥，以及根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。处理模块801，具体用于在第二验证参数与第三验证参数匹配的情况下，根据中间密钥、至少TNonce和通信装置800的随机数UNonce生成UE认证标识。UNonce由通信装置800生成。
可选地，收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息中包括第四验证参数和UNonce。第四验证参数根据中间密钥和UNonce生成。
可选地，处理模块801，还用于通信装置800生成UNonce。
一种可能的设计方案中，处理模块801，还用于根据TNGF密钥和通信装置800的认证标识生成第一验证参数。
可选地，处理模块801，具体用于根据TNGF密钥、通信装置800的认证标识和预配置的函数计算第一消息验证码，得到第一验证参数。
或者，可选地，处理模块801，具体用于根据TNGF密钥生成中间密钥。以及根据中间密钥、通信装置800的认证标识和预配置的函数计算第一消息验证码，得到第一验证参数。
一种可能的设计方案中，TNGF密钥根据长期密钥生成。
可选地，收发模块802可以包括接收模块和发送模块(图8中未示出)。其中，收发模块802用于实现通信装置800的发送功能和接收功能。
可选地，通信装置800还可以包括存储模块(图8中未示出)，该存储模块存储有程序或指令。当处理模块801执行该程序或指令时，使得通信装置800可以执行图6所示出的通信方法中UE的功能。
应理解，通信装置800中涉及的处理模块801可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块802可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置800可以是终端设备，也可以是可设置于终端设备中的芯片(系统)或其他部件或组件，还可以是包含终端设备的装置，本申请对此不做限定。
另一些实施例中，通信装置800可适用于图5中所示出的通信系统中，执行图6所示出的通信方法中TNGF的功能。
其中，处理模块801，用于在UE通过源TNAP接入到通信装置800的流程中，通信装置800获取UE认证标识，以及获取TNGF密钥。其中，TNGF密钥是通信装置800和UE之间共享的密钥。收发模块802，用于通过目标TNAP接收来自UE的第一消息。其中，第一消息包括UE认证标识和第一验证参数。第一验证参数由通信装置800根据UE认证标识和TNGF密钥生成。处理模块801，还用于在第一验证参数校验成功的情况下，根据TNGF密钥生成目标密钥。其中，目标密钥用于保护UE与目标TNAP之间的通信安全。
一种可能的设计方案中，处理模块801，具体用于生成UE认证标识。
可选地，收发模块802，还用于通过源TNAP向UE发送所述UE认证标识。
一种可能的设计方案中，收发模块802，还用于通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce和第二验证参数。其中，第二验证参数由通信装置800根据TNGF密钥和TNonce生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。处理模块801，还用于根据TNGF密钥和UNonce生成第五验证参数。
处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据TNGF密钥、TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，收发模块802，还用于根据TNGF密钥生成中间密钥，以及通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce和第二验证参数。其中，第二验证参数由通信装置800根据中间密钥和TNonce生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。处理模块801，还用于根据中间密钥和UNonce生成第五验证参数。处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据中间密钥、TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，收发模块802，还用于通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce、通信装置800的地址和第二验证参数。其中，第二验证参数由通信装置800根据TNGF密钥、TNonce和通信装置800的地址生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。处理模块801，还用于根据TNGF密钥和UNonce生成第五验证参数。处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据TNGF密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，收发模块802，还用于根据TNGF密钥生成中间密钥，以及通过源TNAP 向UE发送通知请求消息。通知请求消息包括TNonce、通信装置800的地址和第二验证参数。其中，第二验证参数由通信装置800根据中间密钥、TNonce和通信装置800的地址生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。处理模块801，还用于根据中间密钥和UNonce生成第五验证参数。处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据中间密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，收发模块802，还用于通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce、通信装置800的标识和第二验证参数。其中，第二验证参数由通信装置800根据TNGF密钥、TNonce和通信装置800的标识生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。处理模块801，还用于根据TNGF密钥和UNonce生成第五验证参数。处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据TNGF密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，收发模块802，还用于根据TNGF密钥生成中间密钥，以及通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce、通信装置800的标识和第二验证参数。其中，第二验证参数由通信装置800根据中间密钥、TNonce和通信装置800的标识生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。处理模块801，还用于根据中间密钥和UNonce生成第五验证参数。处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据中间密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，收发模块802，还用于通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce、通信装置800的地址、通信装置800的标识和第二验证参数。其中，第二验证参数由通信装置800根据TNGF密钥、TNonce、通信装置800的地址和通信装置800的标识生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据TNGF密钥和UNonce生成。处理模块801，还用于根据TNGF密钥和UNonce生成第五验证参数。处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据TNGF密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，收发模块802，还用于根据TNGF密钥生成中间密钥，以及通过源TNAP向UE发送通知请求消息。通知请求消息包括TNonce、通信装置800的地址、通信装置800的标识和第二验证参数。其中，第二验证参数由通信装置800根据中间密钥、TNonce和通信装置800的地址、通信装置800的标识生成。收发模块802，还用于通过源TNAP接收来自UE的通知响应消息。通知响应消息包括第四验证参数和UE的随机数UNonce。其中，第四验证参数由UE根据中间密钥和UNonce生成。处理模块801，还用于根据中间密钥和UNonce生成第五验证参数。处理模块801，具体用于在四验证参数与第五验证参数匹配的情况下，根据中间密钥、至少TNonce和UNonce生成UE认证标识。
一种可能的设计方案中，处理模块801，还用于根据UE认证标识和TNGF密钥生成第六验证参数。处理模块801，具体用于在第一验证参数与第六验证参数匹配的情况下，根据TNGF密钥生成目标密钥。
一种可能的设计方案中，TNGF密钥由AMF根据长期密钥生成。
可选地，收发模块802可以包括接收模块和发送模块(图8中未示出)。其中，收发模块802用于实现通信装置800的发送功能和接收功能。
可选地，通信装置800还可以包括存储模块(图8中未示出)，该存储模块存储有程序或指令。当处理模块801执行该程序或指令时，使得通信装置800可以执行图6所示出的通信方法中TNGF的功能。
应理解，通信装置800中涉及的处理模块801可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块802可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置800可以是网络设备，如TNGF，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
另一些实施例中，通信装置800可适用于图5中所示出的通信系统中，执行图7所示出的通信方法中UE的功能。
该通信方法应用于UE首次接入TNGF的流程中。
其中，收发模块802，用于通过源TNAP接收来自TNGF的通知请求消息。其中，通知请求消息包括第二验证参数和至少TNGF的随机数TNonce。第二验证参数根据TNGF密钥和至少TNonce生成。TNGF密钥为通信装置800与TNGF之间的共享密钥。处理模块801，用于根据TNGF密钥和至少TNonce生成第三验证参数。收发模块802，还用于在第二验证参数与第三验证参数匹配的情况下，通过源TNAP向TNGF发送通知响应消息。其中，通知响应消息包括通信装置800的随机数UNonce和第四验证参数。第四验证参数由通信装置800根据UNonce和TNGF密钥生成。
一种可能的设计方案中，处理模块801，具体用于根据TNGF密钥生成中间密钥。通信装置800根据中间密钥和TNonce生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的地址生成。处理模块801，具体用于根据TNGF密钥、TNonce和TNGF的地址生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址。第二验证参数由TNGF根据中间密钥、TNonce和TNGF的地址生成。其中，中间密钥由通信装置800根据TNGF密钥生成。处理模块801，具体用于根据中间密钥、TNonce和TNGF的地址生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的标识。第二验证参数由TNGF根据TNGF密钥、TNonce和TNGF的标识生成。处理模块801，具体用于根据TNGF密钥、TNonce和TNGF的标识生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的标识。第二验证参数由TNGF根据中间密钥、TNonce和TNGF的标识生成。其中，中间密钥由通信装置800根据TNGF密钥生成。处理模块801，具体用于根据中间密钥、TNonce和TNGF的标识生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址和TNGF的标识。第二验证参数由TNGF根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成。处理模块801，具体用于根据TNGF密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。
一种可能的设计方案中，通知请求消息还包括TNGF的地址和TNGF的标识。第二验证参数由TNGF根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成。其中，中间密钥由通信装置800根据TNGF密钥生成。处理模块801，具体用于根据中间密钥、TNonce、TNGF的地址和TNGF的标识生成第三验证参数。
一种可能的设计方案中，处理模块801，还用于根据TNGF密钥，至少TNonce和UNonce生成UE认证标识。
可选地，收发模块802可以包括接收模块和发送模块(图8中未示出)。其中，收发模块802用于实现通信装置800的发送功能和接收功能。
可选地，通信装置800还可以包括存储模块(图8中未示出)，该存储模块存储有程序或指令。当处理模块801执行该程序或指令时，使得通信装置800可以执行图7所示出的通信方法中UE的功能。
应理解，通信装置800中涉及的处理模块801可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块802可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置800可以是终端设备，也可以是可设置于终端设备中的芯片(系统)或其他部件或组件，还可以是包含终端设备的装置，本申请对此不做限定。
另一些实施例中，通信装置800可适用于图5中所示出的通信系统中，执行图7所示出的通信方法中TNGF的功能。
收发模块802，用于在通信装置800接收到来自AMF的初始上下文建立请求的情况下，通过源TNAP向UE发送通知请求消息。其中，通知请求消息包括通信装置800的随机数TNonce和第二验证参数。第二验证参数根据TNonce和TNGF密钥生成。TNGF密钥为UE与通信装置800之间的共享密钥。处理模块801，用于根据TNGF密钥和UNonce生成第五验证参数。收发模块802，还用于接收来自UE的通知响应消息。通知响应消息包括UE的随机数UNonce和第四验证参数。第四验证参数根据 UNonce和针对通信装置800的根密钥生成。收发模块802，还用于在第四验证参数与第五验证参数匹配的情况下，向源TNAP发送源密钥。源密钥用于保护源TNAP与UE之间的通信安全。
一种可能的设计方案中，处理模块801，具体用于根据TNGF密钥生成中间要。通信装置800根据中间密钥和UNonce生成第五验证参数。
一种可能的设计方案中，处理模块801，还用于根据TNonce、UNonce和TNGF密钥生成UE认证标识。
可选地，收发模块802可以包括接收模块和发送模块(图8中未示出)。其中，收发模块802用于实现通信装置800的发送功能和接收功能。
可选地，通信装置800还可以包括存储模块(图8中未示出)，该存储模块存储有程序或指令。当处理模块801执行该程序或指令时，使得通信装置800可以执行图7所示出的通信方法中TNGF的功能。
应理解，通信装置800中涉及的处理模块801可以由处理器或处理器相关电路组件实现，可以为处理器或处理单元；收发模块802可以由收发器或收发器相关电路组件实现，可以为收发器或收发单元。
需要说明的是，通信装置800可以是网络设备，如TNGF，也可以是可设置于网络设备中的芯片(系统)或其他部件或组件，还可以是包含网络设备的装置，本申请对此不做限定。
示例性地，图9为本申请实施例提供的通信装置的结构示意图二。该通信装置可以是终端设备或网络设备，也可以是可设置于终端设备或网络设备的芯片(系统)或其他部件或组件。如图9所示，通信装置900可以包括处理器901。可选地，通信装置900还可以包括存储器902和/或收发器903。其中，处理器901与存储器902和收发器903耦合，如可以通过通信总线连接。
下面结合图9对通信装置900的各个构成部件进行具体的介绍：
其中，处理器901是通信装置900的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器901是一个或多个中央处理器(central processing unit，CPU)，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个数字信号处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。
可选地，处理器901可以通过运行或执行存储在存储器902内的软件程序，以及调用存储在存储器902内的数据，执行通信装置900的各种功能。
在具体的实现中，作为一种实施例，处理器901可以包括一个或多个CPU，例如图9中所示出的CPU0和CPU1。
在具体实现中，作为一种实施例，通信装置900也可以包括多个处理器，例如图9中所示的处理器901和处理器904。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
其中，所述存储器902用于存储执行本申请方案的软件程序，并由处理器901来控制执行，具体实现方式可以参考上述方法实施例，此处不再赘述。
可选地，存储器902可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器902可以和处理器901集成在一起，也可以独立存在，并通过通信装置900的接口电路(图9中未示出)与处理器901耦合，本申请实施例对此不作具体限定。
收发器903，用于与其他通信装置之间的通信。例如，通信装置900为终端设备，收发器903可以用于与网络设备通信，或者与另一个终端设备通信。又例如，通信装置900为网络设备，收发器903可以用于与终端设备通信，或者与另一个网络设备通信。
可选地，收发器903可以包括接收器和发送器(图9中未单独示出)。其中，接收器用于实现接收 功能，发送器用于实现发送功能。
可选地，收发器903可以和处理器901集成在一起，也可以独立存在，并通过通信装置900的接口电路(图9中未示出)与处理器901耦合，本申请实施例对此不作具体限定。
需要说明的是，图9中示出的通信装置900的结构并不构成对该通信装置的限定，实际的通信装置可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
此外，通信装置900的技术效果可以参考上述方法实施例所述的通信方法的技术效果，此处不再赘述。
应理解，在本申请实施例中的处理器可以是中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的随机存取存储器(random access memory，RAM)可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
上述实施例，可以全部或部分地通过软件、硬件(如电路)、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令或计算机程序。在计算机上加载或执行所述计算机指令或计算机程序时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系，但也可能表示的是一种“和/或”的关系，具体可参考前后文进行理解。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (47)

  1. 一种通信方法，其特征在于，所述方法包括：
    在用户装置UE通过源可信的非第三代合作伙伴计划接入点TNAP接入到可信的非第三代合作伙伴计划网关功能TNGF的流程中，所述UE获取UE认证标识，以及生成TNGF密钥；其中，所述TNGF密钥是所述TNGF和UE之间共享的密钥；
    在所述UE从所述源TNAP切换至目标TNAP的情况下，所述UE通过所述目标TNAP向所述TNGF发送第一消息；其中，所述第一消息包括所述UE认证标识和第一验证参数；所述第一验证参数由所述UE根据所述UE认证标识和所述TNGF密钥生成。
  2. 根据权利要求1所述的方法，其特征在于，所述UE获取UE认证标识，包括：
    所述UE通过所述源TNAP接收来自所述TNGF的所述UE认证标识。
  3. 根据权利要求1或2所述的方法，其特征在于，在所述UE获取UE认证标识之前，所述方法还包括：
    所述UE通过所述源TNAP接入到所述TNGF。
  4. 根据权利要求3所述的方法，其特征在于，所述第一消息为身份响应消息，在所述UE通过所述目标TNAP向所述TNGF发送第一消息之前，所述方法还包括：
    所述UE确定从所述源TNAP切换至所述目标TNAP；
    所述UE与所述目标TNAP之间建立层二连接；
    所述UE接收来自所述目标TNAP的身份请求消息，所述身份请求消息用于触发所述UE发送所述第一消息。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；其中，所述通知请求消息包括所述TNGF的随机数TNonce和第二验证参数；所述第二验证参数由所述TNGF根据所述TNGF密钥和所述TNonce生成；
    所述UE根据所述TNGF密钥和所述TNonce生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据所述TNGF密钥、所述TNonce和所述UE的随机数UNonce生成所述UE认证标识；所述UNonce由所述UE生成。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述TNGF密钥和所述UNonce生成。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；其中，所述通知请求消息包括所述TNGF的随机数TNonce和第二验证参数；所述第二验证参数由所述TNGF根据中间密钥和所述TNonce生成；所述中间密钥由所述TNGF根据所述TNGF密钥生成；
    所述UE根据所述TNGF密钥生成所述中间密钥；
    所述UE根据所述中间密钥和所述TNonce生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据所述中间密钥、所述TNonce和所述UE的随机数UNonce生成所述UE认证标识；所述UNonce由所述UE生成。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述中间密钥和所述UNonce生成。
  9. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；其中，所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的地址和第二验证参数；所述第二验证参数由所述TNGF根 据所述TNGF密钥、所述TNonce和所述TNGF的地址生成；
    所述UE根据所述TNGF密钥、所述TNonce和所述TNGF的地址生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据所述TNGF密钥、至少所述TNonce和所述UE的随机数UNonce生成所述UE认证标识。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述TNGF密钥和所述UNonce生成。
  11. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；其中，所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的地址和第二验证参数；所述第二验证参数由所述TNGF根据中间密钥、所述TNGF的随机数TNonce和所述TNGF的地址生成；所述中间密钥由所述TNGF根据所述TNGF密钥生成；
    所述UE根据所述TNGF密钥生成所述中间密钥；
    所述UE根据所述中间密钥、所述TNonce和所述TNGF的地址生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据所述中间密钥、至少所述TNonce和所述UE的随机数UNonce生成所述UE认证标识；所述UNonce由所述UE生成。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述中间密钥和所述UNonce生成。
  13. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；其中，所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的标识和第二验证参数；所述第二验证参数由所述TNGF根据所述TNGF密钥、所述TNonce和所述TNGF的标识生成；
    所述UE根据所述TNGF密钥、所述TNonce和所述TNGF的标识生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据TNGF密钥、至少所述TNonce和所述UE的随机数UNonce生成所述UE认证标识；所述UNonce由所述UE生成。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述TNGF密钥和所述UNonce生成。
  15. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；其中，所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的标识和第二验证参数；其中，所述第二验证参数由所述TNGF根据中间密钥、所述TNonce和所述TNGF的标识生成；所述中间密钥由所述TNGF根据所述TNGF密钥生成；
    所述UE根据所述TNGF密钥生成所述中间密钥；
    所述UE根据所述中间密钥、所述TNonce和所述TNGF的标识生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据所述中间密钥、至少TNonce和所述UE的随机数UNonce生成所述UE认证标识；所述UNonce由所述UE生成。
  16. 根据权利要求15所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF 发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述中间密钥和所述UNonce生成。
  17. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；其中，所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的地址、所述TNGF的标识和第二验证参数；所述第二验证参数由所述TNGF根据所述TNGF密钥、所述TNonce、所述TNGF的地址和所述TNGF的标识生成；
    所述UE根据所述TNGF密钥、所述TNonce、所述TNGF的地址和所述TNGF的标识生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据所述TNGF密钥、至少所述TNonce和所述UE的随机数UNonce生成所述UE认证标识；所述UNonce由所述UE生成。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述TNGF密钥和所述UNonce生成。
  19. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述UE通过所述源TNAP接收来自所述TNGF的通知请求消息；所述通知请求消息包括TNonce、所述TNGF的地址、所述TNGF的标识和第二验证参数；其中，所述第二验证参数由所述TNGF根据中间密钥、所述TNonce、所述TNGF的地址和所述TNGF的标识生成；所述中间密钥由所述TNGF根据所述TNGF密钥生成；
    所述UE根据所述TNGF密钥生成所述中间密钥；
    所述UE根据所述中间密钥、所述TNonce、所述TNGF的地址和所述TNGF的标识生成第三验证参数；
    所述UE获取UE认证标识，包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE根据所述中间密钥、至少所述TNonce和所述UE的随机数UNonce生成所述UE认证标识；所述UNonce由所述UE生成。
  20. 根据权利要求19所述的方法，其特征在于，所述方法还包括：
    在所述第二验证参数与所述第三验证参数匹配的情况下，所述UE通过所述源TNAP向所述TNGF发送通知响应消息；其中，所述通知响应消息中包括第四验证参数和所述UNonce；所述第四验证参数根据所述中间密钥和所述UNonce生成。
  21. 根据权利要求5-20中任一项所述的方法，其特征在于，在所述UE获取UE认证标识之前，所述方法还包括：
    所述UE生成UNonce。
  22. 根据权利要求1-21中任一项所述的方法，其特征在于，在所述UE通过所述目标TNAP向所述TNGF发送第一消息之前，所述方法还包括：
    所述UE根据所述TNGF密钥和所述UE认证标识生成所述第一验证参数。
  23. 根据权利要求22所述的方法，其特征在于，所述UE根据所述TNGF密钥和所述UE认证标识生成所述第一验证参数，包括：
    所述UE根据所述TNGF密钥、所述UE认证标识和预配置的函数计算第一消息验证码，得到所述第一验证参数。
  24. 根据权利要求22所述的方法，其特征在于，所述UE根据所述TNGF密钥和所述UE认证标识生成所述第一验证参数，包括：
    所述UE根据所述TNGF密钥生成中间密钥；
    所述UE根据所述中间密钥、所述UE认证标识和预配置的函数计算第一消息验证码，得到所述第一验证参数。
  25. 根据权利要求1-24中任一项所述的方法，其特征在于，所述TNGF密钥根据长期密钥生成。
  26. 一种通信方法，其特征在于，所述方法包括：
    在用户装置UE通过源可信的非第三代合作伙伴计划接入点TNAP接入到可信的非第三代合作伙伴计划网关功能TNGF的流程中，所述UE获取UE认证标识，生成TNGF密钥，所述TNGF密钥是所述TNGF和UE之间共享的密钥；
    在所述UE从所述源TNAP切换至目标TNAP的情况下，所述UE向所述目标TNAP发送所述UE认证标识和第一验证参数；
    其中，所述第一验证参数是根据中间密钥生成的，所述中间密钥是根据所述TNGF密钥和第一类型识别码生成的。
  27. 根据权利要求26所述的方法，其特征在于，所述第一类型识别码为0x03。
  28. 一种通信方法，其特征在于，所述方法包括：
    在用户装置UE通过源可信的非第三代合作伙伴计划3GPP接入点TNAP接入到可信的非第三代合作伙伴计划网关功能TNGF的流程中，TNGF获取UE认证标识，以及获取TNGF密钥；其中，TNGF密钥是TNGF和UE之间共享的密钥；
    所述TNGF通过目标TNAP接收来自所述UE的第一消息；其中，所述第一消息包括所述UE认证标识和第一验证参数；所述第一验证参数由所述TNGF根据所述UE认证标识和所述TNGF密钥生成；
    在所述第一验证参数校验成功的情况下，所述TNGF根据所述TNGF密钥生成目标密钥；其中，所述目标密钥用于保护所述UE与所述目标TNAP之间的通信安全。
  29. 根据权利要求28所述的方法，其特征在于，所述TNGF获取UE认证标识，包括：
    所述TNGF生成所述UE认证标识。
  30. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括所述TNGF的随机数TNonce和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述TNGF密钥和所述TNonce生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述TNGF密钥和所述UNonce生成；
    所述TNGF根据所述TNGF密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述TNGF密钥、所述TNonce和所述UNonce生成所述UE认证标识。
  31. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF根据所述TNGF密钥生成中间密钥；
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括所述TNGF的随机数TNonce和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述中间密钥和所述TNonce生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述中间密钥和所述UNonce生成；
    所述TNGF根据所述中间密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述中间密钥、所述TNonce和所述UNonce生成所述UE认证标识。
  32. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的地址和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述TNGF密钥、所述TNonce和所述TNGF的地址生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述TNGF密钥和所述 UNonce生成；
    所述TNGF根据所述TNGF密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述TNGF密钥、至少所述TNonce和所述UNonce生成所述UE认证标识。
  33. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF根据所述TNGF密钥生成中间密钥；
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的地址和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述中间密钥、所述TNonce和所述TNGF的地址生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述中间密钥和所述UNonce生成；
    所述TNGF根据所述中间密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述中间密钥、至少所述TNonce和所述UNonce生成所述UE认证标识。
  34. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的标识和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述TNGF密钥、所述TNonce和所述TNGF的标识生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述TNGF密钥和所述UNonce生成；
    所述TNGF根据所述TNGF密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述TNGF密钥、至少所述TNonce和所述UNonce生成所述UE认证标识。
  35. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF根据所述TNGF密钥生成中间密钥；
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的标识和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述中间密钥、所述TNonce和所述TNGF的标识生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述中间密钥和所述UNonce生成；
    所述TNGF根据所述中间密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述中间密钥、至少所述TNonce和所述UNonce生成所述UE认证标识。
  36. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括所述TNGF的随机数TNonce、所述TNGF的地址、所述TNGF的标识和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述TNGF密钥、所述TNonce、所述TNGF的地址和所述TNGF的标识生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述TNGF密钥和所述UNonce生成；
    所述TNGF根据所述TNGF密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述TNGF密钥、至少所述TNonce和所述UNonce生成所述UE认证标识。
  37. 根据权利要求28所述的方法，其特征在于，所述方法还包括：
    所述TNGF根据所述TNGF密钥生成中间密钥；
    所述TNGF通过所述源TNAP向所述UE发送通知请求消息；所述通知请求消息包括TNGF的随机数TNonce、所述TNGF的地址、所述TNGF的标识和第二验证参数；其中，所述第二验证参数由所述TNGF根据所述中间密钥、所述TNonce、所述TNGF的地址和所述TNGF的标识生成；
    所述TNGF通过所述源TNAP接收来自所述UE的通知响应消息；所述通知响应消息包括第四验证参数和所述UE的随机数UNonce；其中，所述第四验证参数由所述UE根据所述中间密钥和所述UNonce生成；
    所述TNGF根据所述中间密钥和所述UNonce生成第五验证参数；
    所述TNGF获取UE认证标识，包括：
    在所述四验证参数与所述第五验证参数匹配的情况下，所述TNGF根据所述中间密钥、至少所述TNonce和所述UNonce生成所述UE认证标识。
  38. 根据权利要求28-37中任一项所述的方法，其特征在于，在所述TNGF根据所述TNGF密钥生成目标密钥之前，所述方法还包括：
    所述TNGF根据所述UE认证标识和所述TNGF密钥生成第六验证参数；
    所述TNGF根据所述TNGF密钥生成目标密钥，包括：
    在所述第一验证参数与所述第六验证参数匹配的情况下，所述TNGF根据所述TNGF密钥生成所述目标密钥。
  39. 根据权利要求28-38中任一项所述的方法，其特征在于，所述TNGF密钥根据长期密钥生成。
  40. 一种通信装置，其特征在于，所述通信装置用于执行如权利要求1-27中任一项所述的通信方法。
  41. 一种通信装置，其特征在于，所述通信装置用于执行如权利要求28-39中任一项所述的通信方法。
  42. 一种通信装置，其特征在于，所述通信装置包括：处理器；其中，
    所述处理器，用于执行如权利要求1-39中任一项所述的通信方法。
  43. 一种通信装置，其特征在于，包括：处理器和存储器；所述存储器用于存储计算机指令，当所述处理器执行该指令时，以使所述通信装置执行如权利要求1-39中任一项所述的通信方法。
  44. 一种通信装置，其特征在于，所述通信装置包括处理器和收发器，所述收发器用于所述通信装置和其他通信装置之间进行信息交互，所述处理器执行程序指令，用以执行如权利要求1-39中任一项所述的通信方法。
  45. 一种处理器，其特征在于，包括：所述处理器用于执行如权利要求1-39中任一项所述的通信方法。
  46. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-39中任一项所述的通信方法。
  47. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序或指令，当所述计算机程序或指令在计算机上运行时，使得所述计算机执行如权利要求1-39中任一项所述的通信方法。
PCT/CN2024/076820 2023-02-12 2024-02-07 通信方法及装置 WO2024165058A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310136707.4 2023-02-12
CN202310136707.4A CN118488437A (zh) 2023-02-12 2023-02-12 通信方法及装置

Publications (1)

Publication Number Publication Date
WO2024165058A1 true WO2024165058A1 (zh) 2024-08-15

Family

ID=92190552

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/076820 WO2024165058A1 (zh) 2023-02-12 2024-02-07 通信方法及装置

Country Status (2)

Country Link
CN (1) CN118488437A (zh)
WO (1) WO2024165058A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220116769A1 (en) * 2020-04-06 2022-04-14 Apostolis Salkintzis Notification in eap procedure
CN115552942A (zh) * 2020-05-06 2022-12-30 联想（新加坡）私人有限公司 网关功能重新认证
CN115606217A (zh) * 2020-05-06 2023-01-13 联想（新加坡）私人有限公司（Sg） 网关功能重新认证
CN115699833A (zh) * 2020-06-05 2023-02-03 联想（新加坡）私人有限公司 支持远程单元重新认证

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220116769A1 (en) * 2020-04-06 2022-04-14 Apostolis Salkintzis Notification in eap procedure
CN115552942A (zh) * 2020-05-06 2022-12-30 联想（新加坡）私人有限公司 网关功能重新认证
CN115606217A (zh) * 2020-05-06 2023-01-13 联想（新加坡）私人有限公司（Sg） 网关功能重新认证
CN115699833A (zh) * 2020-06-05 2023-02-03 联想（新加坡）私人有限公司 支持远程单元重新认证

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on Security aspects for 5WWC Phase 2 (Release 18)", 3GPP TR 33.887, no. V0.5.0, 25 January 2023 (2023-01-25), pages 1 - 36, XP052235399 *

Also Published As

Publication number Publication date
CN118488437A (zh) 2024-08-13

Similar Documents

Publication Publication Date Title
US10911948B2 (en) Method and system for performing network access authentication based on non-3GPP network, and related device
US11825303B2 (en) Method for performing verification by using shared key, method for performing verification by using public key and private key, and apparatus
CN109587688B (zh) 系统间移动性中的安全性
US11937079B2 (en) Communication terminal, core network device, core network node, network node, and key deriving method
US8731194B2 (en) Method of establishing security association in inter-rat handover
CN101983517B (zh) 演进分组系统的非3gpp接入的安全性
US20190380033A1 (en) User Identity Privacy Protection in Public Wireless Local Access Network, WLAN, Access
WO2019019736A1 (zh) 安全实现方法、相关装置以及系统
RU2665064C1 (ru) Беспроводная связь, включающая в себя кадр обнаружения быстрого первоначального установления линии связи, fils, для сетевой сигнализации
JP2018523418A (ja) セルラーアクセスネットワークノードのための識別子を含むネットワークアクセス識別子
JP2019527504A (ja) 異種ネットワークのための統一認証
WO2019029531A1 (zh) 触发网络鉴权的方法及相关设备
EP3158827B1 (en) Method for generating a common identifier for a wireless device in at least two different types of networks
US11956626B2 (en) Cryptographic key generation for mobile communications device
WO2022247812A1 (zh) 一种鉴权方法、通信装置和系统
US20240305983A1 (en) Communication method and apparatus
US20240179525A1 (en) Secure communication method and apparatus
WO2024067619A1 (zh) 通信方法和通信装置
JP6861285B2 (ja) 緊急アクセス中のパラメータ交換のための方法およびデバイス
WO2024165058A1 (zh) 通信方法及装置
JP2024517897A (ja) Ｎｓｗｏサービスの認証のための方法、デバイス、および記憶媒体
WO2017000620A1 (zh) 重认证识别方法、演进分组数据网关及系统
WO2024149053A1 (zh) 鉴权方法及通信装置
WO2024164968A1 (zh) 一种通信方法及通信装置
US20240284174A1 (en) Communication method, apparatus, and system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24752912

Country of ref document: EP

Kind code of ref document: A1