WO2024192638A1

WO2024192638A1 - Information processing method and apparatus, communication device, and storage medium

Info

Publication number: WO2024192638A1
Application number: PCT/CN2023/082585
Authority: WO
Inventors: 梁浩然; 陆伟
Original assignee: 北京小米移动软件有限公司
Priority date: 2023-03-20
Filing date: 2023-03-20
Publication date: 2024-09-26

Abstract

Embodiments of the present disclosure provide an information processing method and apparatus, a communication device, and a storage medium. The information processing method is executed by a first UE, and comprises: sending first information to a first network element, wherein the first information comprises first hash information of a first identifier, the first hash information is used by the first network element to determine key information corresponding to the first identifier, and the first identifier is an identifier of the first UE.

Description

Information processing method and device, communication equipment and storage medium

Technical Field

The present disclosure relates to, but is not limited to, the field of wireless communication technology, and in particular to an information processing method and apparatus, a communication device, and a storage medium.

Background Art

With the continuous development of wireless communication technology, each network element in the network can realize more and more functions. At present, the interaction between network elements in the network needs to consider security. For example, the connection between user equipment (UE) and other network elements in the network needs to consider secure connection.

Summary of the invention

The embodiments of the present disclosure provide an information processing method and apparatus, a communication device, and a storage medium.

A first aspect of an embodiment of the present disclosure provides an information processing method, which is executed by a first UE and includes:

Send first information to the first network element, wherein the first information includes first hash information of a first identifier; the first hash information is used by the first network element to determine key information corresponding to the first identifier; the first identifier is an identifier of the first UE.

In some embodiments, the method further includes: determining first hash information based on a first identifier of the first UE.

In some embodiments, the first information further includes: authentication information; the authentication information is determined based on the key information.

In some embodiments, the first identifier includes one of the following:

Subscription Permanent Identifier (SUPI) of the first UE;

The Subscription Concealed Identifier (SUCI) of the first UE;

The globally unique temporary UE identity (GUTI) of the first UE;

Indicates the index or number of the first UE.

In some embodiments, the first network element includes one of the following:

Trusted WLAN Interworking Function (TWIF);

Trusted Non-3GPP Gateway Function (TNGF).

In some embodiments, the key information includes at least one of the following:

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

A second aspect of the embodiment of the present disclosure provides an information processing method, which is executed by a second network element, including:

Send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second information is used by the first network element to determine the key information corresponding to the first identifier; the first identifier is the identifier of the first UE, and the second identifier is the identifier of the second UE.

In some embodiments, the method includes: determining second hash information of at least one second UE based on a second identifier of the at least one second UE.

In some embodiments, the first identifier includes one of: a SUPI of the first UE, a SUCI of the first UE, a GUTI of the first UE, and an index or number indicating the first UE;

And/or, the second identifier includes one of the following: a SUPI of the second UE, a SUCI of the second UE, a GUTI of the second UE, and an index or number indicating the second UE.

In some embodiments, the first network element includes one of: a TWIF, and a TNGF.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

In some embodiments, the second network element is an access and mobility management function (AMF).

A third aspect of the embodiments of the present disclosure provides an information processing method, which is executed by a first network element and includes:

Acquire the first information and acquire the second information; wherein the first information includes the first hash information of the first identifier; the second information includes the second hash information of the second identifier and the key information corresponding to the second hash information; the first identifier is the identifier of the first UE; the second identifier is the identifier of the second UE;

Based on the first information and the second information, determining second hash information that matches the first hash information;

Based on the second hash information, key information of the first UE is determined.

In some embodiments, obtaining the first information includes: receiving the first information sent by the first UE.

In some embodiments, obtaining the second information includes one of the following:

receiving second information sent by the second network element;

The second information stored in the first network element is obtained.

In some embodiments, the method comprises one of the following:

Successfully verifying the authentication information based on the key information, and establishing a connection with the first UE based on the key information;

Verifying the authentication information based on the key information fails, and not establishing a connection with the first UE based on the key information.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

In some embodiments, the second network element is an AMF.

A fourth aspect of the present disclosure provides an information processing device, including:

The first sending module is configured to send first information to the first network element, wherein the first information includes first hash information of a first identifier; the first hash information is used by the first network element to determine key information corresponding to the first identifier; the first identifier is an identifier of the first UE.

In some embodiments, the device also includes: a first processing module configured to determine first hash information based on a first identifier of the first UE.

In some embodiments, the first identifier includes one of the following: a SUPI of the first UE, a SUCI of the first UE, a GUTI of the first UE, and an index or number indicating the first UE.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

A fifth aspect of the present disclosure provides an information processing device, including:

The second sending module is configured to send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second information is used by the first network element to determine the key information corresponding to the first identifier; the first identifier is the identifier of the first UE, and the second identifier is the identifier of the second UE.

In some embodiments, the apparatus includes: a second processing module configured to determine second hash information of at least one second UE based on a second identifier of at least one second UE.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

In some embodiments, the second network element is an AMF.

A sixth aspect of the present disclosure provides an information processing device, including:

The acquisition module is configured to acquire first information and acquire second information; wherein the first information includes first hash information of the first identifier; the second information includes second hash information of the second identifier and key information corresponding to the second hash information; the first identifier is the first The first UE identifier; the second identifier is the identifier of the second UE;

A third processing module is configured to determine second hash information matching the first hash information based on the first information and the second information;

The third processing module is also configured to determine the key information of the first UE based on the second hash information.

In some embodiments, the acquisition module is configured to receive first information sent by the first UE.

In some embodiments, the acquisition module is configured to receive the second information sent by the second network element; or, the acquisition module is configured to acquire the second information stored in the first network element.

In some embodiments, the third processing module is configured to successfully verify the authentication information based on the key information and establish a connection with the first UE based on the key information; or, the third processing module is configured to fail to verify the authentication information based on the key information and not establish a connection with the first UE based on the key information.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

In some embodiments, the second network element is an AMF.

A seventh aspect of the embodiments of the present disclosure provides an information processing system, including: a first UE, a first network element, and a second network element; wherein:

A first UE is configured to send first information to a first network element, wherein the first information includes first hash information of a first identifier; the first identifier is an identifier of the first UE;

The second network element is configured to send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second identifier is an identifier of the second UE;

The first network element is configured to determine second hash information matching the first hash information based on the first information and the second information; and determine key information of the first UE based on the second hash information.

An eighth aspect of an embodiment of the present disclosure provides a communication device, comprising a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor, wherein the processor executes the information processing method provided in the first aspect, the second aspect, or the third aspect when running the executable program.

A ninth aspect of the embodiments of the present disclosure provides a computer storage medium storing an executable program. After the executable program is executed by a processor, the information processing method provided in the first, second or third aspect can be implemented.

The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

In an embodiment of the present disclosure, a first information is sent to a first network element by a first UE, wherein the first information includes first hash information of a first identifier, and the first hash information is used by the first network element to determine key information corresponding to the first identifier of the first UE; in this way, the first network element can accurately determine the key information of the first UE based on the first hash information of the first identifier, thereby facilitating a secure connection between the first UE and the first network element.

The technical solutions provided by the embodiments of the present disclosure should be understood that the above general description and the following detailed description are merely exemplary and explanatory and cannot limit the embodiments of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present invention and, together with the description, serve to explain the principles of the embodiments of the present invention.

FIG1 is a schematic structural diagram of a wireless communication system according to an exemplary embodiment;

Fig. 2 is a schematic flow chart of an information processing method according to an exemplary embodiment.

Fig. 3 is a schematic flow chart of an information processing method according to an exemplary embodiment.

Fig. 4 is a schematic flow chart of an information processing method according to an exemplary embodiment.

Fig. 5 is a schematic flow chart of an information processing method according to an exemplary embodiment.

Fig. 6 is a schematic flow chart of an information processing method according to an exemplary embodiment.

Fig. 7 is a schematic diagram showing the structure of an information processing device according to an exemplary embodiment.

Fig. 8 is a schematic diagram showing the structure of an information processing device according to an exemplary embodiment.

Fig. 9 is a schematic diagram showing the structure of an information processing device according to an exemplary embodiment.

FIG10 is a schematic diagram showing the structure of a UE according to an exemplary embodiment;

Fig. 11 is a schematic structural diagram of a communication device according to an exemplary embodiment.

DETAILED DESCRIPTION

Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present invention. Instead, they are only examples of devices and methods consistent with some aspects of the embodiments of the present invention.

The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments, and are not intended to limit the embodiments of the present disclosure. The singular expressions "one", "a kind of", "the", "above", "aforementioned", "this", etc. in the embodiments of the present disclosure also include plural expressions, unless there is a clear contrary indication in the context. It should also be understood that the term "and/or" used in this article refers to and includes any or all possible combinations of one or more associated listed items. In the embodiments of the present disclosure, "multiple" refers to two or more. The prefixes such as "first" and "second" in the embodiments of the present disclosure are only used to distinguish different description objects, and do not limit the position, order, priority, quantity or content of the description objects. The description of the description object is described in the context of the claims or embodiments, and should not be redundant due to the use of prefix numerals. For example, "first", "second", "third", etc. are used to describe various information, but these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the embodiments of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining". In some embodiments, the names of information and the like are not limited to the names described in the embodiments, and the terms "information", "message", "signaling", "report", "instruction", "configuration", "data" and the like may be interchangeable.

In some embodiments of the present disclosure, "obtain", "obtain", "get", "receive", and "transmit (send and/or receive)" are interchangeable, which can be interpreted as receiving from other entities, obtaining from a protocol, obtaining by self-processing, and other meanings.

In some embodiments of the present disclosure, "send", "report", "send", and "transmit (send and/or receive)" can be replaced with each other.

Please refer to Figure 1, which shows a schematic diagram of the structure of a wireless communication system provided by an embodiment of the present disclosure. As shown in Figure 1, the wireless communication system is a communication system based on cellular mobile communication technology, and the wireless communication system may include: a plurality of UEs 11 and a plurality of access devices 12.

Among them, UE 11 can be a device that provides voice and/or data connectivity to users. UE 11 can communicate with one or more core networks via a radio access network (RAN). UE 11 can be an Internet of Things UE, such as a sensor device, a mobile phone (or a "cellular" phone), and a computer with an Internet of Things UE, for example, a fixed, portable, pocket-sized, handheld, computer-built-in, or vehicle-mounted device. For example, a station (STA), a subscriber unit, a subscriber station, a mobile station, a mobile station, a mobile station, a remote station, an access point, a remote terminal, an access terminal, a user terminal, a user agent, or a user equipment (UE). Alternatively, UE 11 can also be a device of an unmanned aerial vehicle. Alternatively, UE 11 can also be a vehicle-mounted device, for example, a driving computer with wireless communication function, or a wireless communication device connected to an external driving computer. Alternatively, UE 11 may also be a roadside device, for example, a street lamp, traffic light or other roadside device with wireless communication function.

The access device 12 may be a network side device in a wireless communication system. The wireless communication system may be a 4th generation mobile communication technology (4G) system, also known as a long term evolution (LTE) system; or, the wireless communication system may be a 5G system, also known as a new radio (NR) system or a 5G NR system. Alternatively, the wireless communication system may be a next generation system of the 5G system. The access network in the 5G system may be called a new generation-radio access network (NG-RAN). Alternatively, an MTC system.

Among them, the access device 12 can be an evolved access device (eNB) adopted in a 4G system. Alternatively, the access device 12 can also be an access device (gNB) adopting a centralized distributed architecture in a 5G system. When the access device 12 adopts a centralized distributed architecture, it usually includes a centralized unit (central unit, CU) and at least two distributed units (distributed units, DU). The centralized unit is provided with a packet data convergence protocol (Packet Data Convergence Protocol, PDCP) layer, a radio link layer control protocol (Radio Link Control, RLC) layer, and a media access control (Media Access Control, MAC) layer protocol stack; the distributed unit is provided with a physical (Physical, PHY) layer protocol stack. The embodiment of the present disclosure does not limit the specific implementation method of the access device 12.

A wireless connection can be established between the access device 12 and the UE 11 through a wireless air interface. In different implementations, the wireless air interface is a wireless air interface based on the fourth generation mobile communication network technology (4G) standard; or, the wireless air interface is a wireless air interface based on the fifth generation mobile communication network technology (5G) standard, for example, the wireless air interface is a new air interface; or, the wireless air interface can also be a wireless air interface based on the next generation mobile communication network technology standard of 5G.

In some embodiments, in non-3GPP access scenarios, in order to support specific UEs and the Trusted WLAN Interoperability Function (TWIF), Alternatively, in order to support a secure connection between a specific UE and a trusted non-3GPP gateway function (TNGF), the AMF needs to send key information (K _TWIF or K _TNGF ) to the TWIF or TNGF. However, the TWIF or TNGF stores key information belonging to multiple UEs. In a non-public network (NPN) scenario, if the UE sends an anonymous identifier to the TWIF or TNGF, the TWIF/TNGF cannot identify the key information (K _TWIF or K _TNGF ) belonging to a specific UE.

An embodiment of the present disclosure provides an information processing method, which is executed by a first UE and includes: sending first hash information to a first network element.

An embodiment of the present disclosure provides an information processing method, which is executed by a first UE and includes: sending first information to a first network element, where the first information includes first hash information.

As shown in FIG. 2 , an embodiment of the present disclosure provides an information processing method, which is executed by a first UE and includes:

Step S21: Send first information to the first network element, wherein the first information includes first hash information of a first identifier; the first hash information is used by the first network element to determine key information corresponding to the first identifier; the first identifier is an identifier of the first UE.

Exemplarily, the first network element determines the key information corresponding to the first identifier, that is, the first network element determines the key information of the first UE.

The first UE involved in the embodiment of the present disclosure and the second UE involved in the following embodiments may be, but are not limited to, various mobile terminals or fixed terminals. For example, the first UE and the second UE may be at least one of the following: a mobile phone, a computer, a server, a wearable device, a game control platform or a multimedia device, etc. For another example, the first UE and the second UE may be at least one of the following: a fixed, portable, pocket-sized, handheld, computer-built-in or vehicle-mounted device. For another example, the first UE and the second UE may be at least one of the following: an unmanned aerial vehicle device, a vehicle-mounted device, an Internet of Things device, a street lamp, a signal lamp or other roadside device with a wireless communication function, and a driving computer with a wireless communication function or a wireless communication device external to the driving computer.

The first network element involved in the embodiments of the present disclosure and the second network element involved in the embodiments below may be, but are not limited to, logical nodes or functions flexibly deployed in the network. For example, the first network element may be a logical node or function flexibly deployed in an access network or a core network. Exemplarily, the first network element may be a TWIF and/or a TNGF. Exemplarily, the first network element may also be a base station or a network element having some functions of a base station or a network element having network element functions, etc.; the base station may be at least one of the following: a 3G base station, a 4G base station, a 5G base station and other evolved base stations. The second network element may be a logical node or function flexibly deployed in the core network. Exemplarily, the second network element may be an AMF. Exemplarily, the second network element may be a unified data management (UDM) or a unified database (User Data Repository, UDR).

In some embodiments, the first identifier includes one of the following: a SUPI of the first UE, a SUCI of the first UE, a GUTI of the first UE, and an index or number indicating the first UE. The index or number indicating the first UE may be any index or number, for example, a string of one or more bits, as long as the index or number of the first UE can be used to identify the first UE. In this way, multiple identification methods of the first UE are provided, so that the first identifier can be flexibly determined for the first UE.

In some embodiments, the first hash information includes at least a first hash value. The first hash value may be a hash value obtained by operating the first identifier based on any hash algorithm. Exemplarily, the first hash value may be a one-bit character or a multi-bit string.

In some embodiments, the key information includes at least one of the following: a first key associated with TWIF and a second key associated with TNGF. Exemplarily, the first key is K _TWIF . Exemplarily, the second key is K _TNGF .

Exemplarily, the first UE sends first information to the TWIF, where the first information includes a first hash value of the first identifier; the first hash value is used by the TWIF to determine K _TWIF corresponding to the first identifier.

Exemplarily, the first UE sends first information to the TNGF, where the first information includes a first hash value of the first identifier; the first hash value is used by the TNGF to determine K _TNGF corresponding to the first identifier.

In some embodiments, the key information may also be key information determined based on any encryption and decryption algorithm; it is sufficient that the first UE and the second network element have the same encryption and decryption algorithm.

Moreover, different key information can be obtained for different first network elements; for example, for TWIF, the first key can be obtained, and for TNGF, the second key can be obtained; this can help the UE to establish secure connections for different first network elements respectively.

The present disclosure embodiment provides an information processing method, which is executed by a first UE, including: determining first hash information based on a first identifier of the first UE. Exemplarily, the first hash information includes at least a first hash value. Exemplarily, the first UE performs a hash operation on the first identifier of the first UE to obtain first hash information corresponding to the first identifier. In this way, the first hash information corresponding to the first identifier can be accurately determined.

An embodiment of the present disclosure provides an information processing method, which is executed by a first UE and includes: determining authentication information based on key information.

Exemplarily, the authentication information is used to protect the integrity of the key information. For example, if the key information successfully verifies the authentication information, it is determined that the key information has not been tampered with; or if the key information fails to verify the authentication information, it is determined that the key information is incomplete or has been tampered with.

Exemplarily, the authentication information may be a key exchange authentication payload (AUTH payload).

Thus, in the disclosed embodiment, the first UE may also send authentication information to the first network element, so that the first network element can authenticate the key information, thereby facilitating the first network element to determine whether the key information has been tampered with or whether it is complete key information.

In some embodiments, the authentication information may not be carried in the first information, or the authentication information and the first hash information may be sent separately. For example, the first UE sends the first information to the first network element, and the first information carries the first hash information; the first UE sends the authentication information to the first network element. For another example, the first UE sends the first hash information and the authentication information to the first network element respectively.

It should be noted that those skilled in the art can understand that the method provided in the embodiments of the present disclosure can be executed alone or together with some methods in the embodiments of the present disclosure or some methods in related technologies.

The following information processing method is executed by the second network element, which is similar to the description of the information processing method executed by the first UE mentioned above; and for technical details not disclosed in the embodiment of the information processing method executed by the second network element, please refer to the description of the example of the information processing method executed by the first UE, and no detailed description is given here.

An embodiment of the present disclosure provides an information processing method, which is executed by a second network element, and includes: sending second hash information of at least one second identifier and key information corresponding to the second hash information to a first network element.

The embodiment of the present disclosure provides an information processing method, which is executed by a second network element, including: sending second information to a first network element; the second information includes second hash information of at least one second identifier and key information corresponding to the second hash information. Exemplarily, one second UE corresponds to one second identifier. Exemplarily, one second identifier corresponds to one second hash information.

As shown in FIG3 , an embodiment of the present disclosure provides an information processing method, which is executed by a second network element and includes:

Step S31: Send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second information is used by the first network element to determine the key information corresponding to the first identifier; the first identifier is the identifier of the first UE, and the second identifier is the identifier of the second UE.

In some embodiments of the present disclosure, the first UE and the second UE may be the first UE and the second UE in the above-mentioned embodiment, respectively; the first network element and the second network element may be the first network element and the second network element in the above-mentioned embodiment, respectively; and the key information may be the key information in the above-mentioned embodiment. Exemplarily, the first network element may be TWIF and/or TNGF. Exemplarily, the second network element may be AMF. The key information may be the first key and/or the second key. Exemplarily, the first key may be K _TWIF . Exemplarily, the second key may be K _TNGF .

In some embodiments of the present disclosure, the first identifier may be the first identifier in the above embodiment. Exemplarily, the first identifier includes one of the following: a SUPI of the first UE, a SUCI of the first UE, a GUTI of the first UE, and an index or number indicating the first UE.

In some embodiments, the second identifier includes one of the following: a SUPI of the second UE, a SUCI of the second UE, a GUTI of the second UE, and an index or number indicating the second UE. The index or number indicating the second UE may be any index or number, for example, a string of one or more bits, as long as the index or number of the second UE can be used to identify the second UE. In this way, multiple identification methods of the second UE are provided, so that the second identifier can be flexibly determined for the second UE.

In some embodiments, the second hash information includes at least a second hash value. The second hash value may be a hash value obtained by operating the second identifier based on any hash algorithm. Exemplarily, the second hash value is a one-bit character or a multi-bit string.

In some embodiments, the second UE includes the first UE.

In some embodiments, the second UE does not include the first UE.

In an embodiment of the present disclosure, the second network element can send second information to the first network element, and the second information includes second hash information of at least one second identifier and key information corresponding to the second hash information; in this way, the first network element can obtain hash information and corresponding key information of multiple UEs, which is conducive to the first network element identifying the key information corresponding to the first identifier of the first UE.

The embodiment of the present disclosure provides an information processing method, which is executed by a second network element, and includes: determining second hash information of at least one second UE based on a second identifier of at least one second UE. Exemplarily, a second identifier of a second UE corresponds to a second hash information.

Exemplarily, the second network element performs a hash operation on the second identifier of the second UE to obtain second hash information corresponding to the second identifier. In this way, the second network element can accurately determine the second hash information corresponding to the second identifier.

In some embodiments, the second information includes at least one of the following: a third identifier and a fourth identifier. Exemplarily, the third identifier is a RAN UE NG application protocol (NG Application Protocol, NGAP) identifier (ID); the fourth identifier is an AMF UE NGAP ID.

Exemplarily, NGAP may be an application layer protocol of the N2 interface. For example, NGAP is a protocol between AMF and TWIF, or NGAP is a protocol between AMF and TNGF; for the AMF side, the UE identifier may be considered as AMF UE NGAP ID; for the TWIF or NGAP side, the UE identifier may be considered as RAN UE NGAP ID.

In this way, by sending the third identifier and/or the fourth identifier, the first network element and the second network element can know which UE the second identifier corresponds to, thereby facilitating communication between the first network element and the second network element.

For the above implementation modes, please refer to the description on the first UE side for details, which will not be described again here.

The following information processing method is executed by the first network element, which is similar to the description of the information processing method executed by the first UE and/or the second network element. For technical details not disclosed in the embodiment of the information processing method executed by the first network element, please refer to the description of the example of the information processing method executed by the first UE and/or the second network element, and no detailed description is given here.

The disclosed embodiment provides an information processing method, which is executed by a first network element, including: determining second hash information matching the first hash information based on the first information and the second information; and determining key information of the first UE based on the second hash information. Exemplarily, the first network element determines second hash information corresponding to the first hash information based on the first hash information; and determines key information corresponding to the second hash information based on the second hash information; the key information corresponding to the second hash information is the key information of the first UE.

As shown in FIG. 4 , an embodiment of the present disclosure provides an information processing method, which is executed by a first network element and includes:

Step S41: obtaining first information and obtaining second information; wherein the first information includes first hash information of the first identifier; the second information includes second hash information of the second identifier and key information corresponding to the second hash information; the first identifier is the identifier of the first UE; the second identifier is the identifier of the second UE;

Step S42: Determine second hash information matching the first hash information based on the first information and the second information;

Step S43: Determine the key information of the first UE based on the second hash information.

In some embodiments of the present disclosure, the first identifier and the second identifier may be the first identifier and the second identifier in the above-mentioned embodiments, respectively. Exemplarily, the first identifier includes one of the following: a SUPI of the first UE, a SUCI of the first UE, a GUTI of the first UE, and an index or number indicating the first UE. Exemplarily, the second identifier includes one of the following: a SUPI of the second UE, a SUCI of the second UE, a GUTI of the second UE, and an index or number indicating the second UE.

In some embodiments of the present disclosure, the first hash information and the second hash information may be the first hash information and the second hash information in the above embodiment, respectively. Exemplarily, the first hash information includes at least the first hash value. The second hash information includes at least the second hash value.

In some embodiments, the second hash information matching the first hash information may be: second hash information that is the same as the first hash information.

Exemplarily, the first network element obtains first information, the first information includes first hash information, and the first hash information is determined by the first identifier of the first UE; the first network element obtains second information, the second information includes at least one second hash information and at least one key information corresponding to the second hash information, and one second hash information is determined by the second identifier of a second UE; the first network element determines second hash information that is identical to the first hash information based on the first hash information included in the first information; the first network element determines the key information corresponding to the second hash information based on the second hash information and the key information corresponding to at least one second hash information included in the second information; the key information determined by the second network element is the key information corresponding to the first identifier of the first UE.

In this way, in the embodiment of the present disclosure, the first network element can obtain the first information and the second information, and determine the key information of the first UE based on the first information and the second information; in this way, the key information of the first UE can be accurately identified, which is conducive to the first network element and the first UE to establish a secure connection.

In some embodiments, obtaining the first information includes: receiving the first information sent by the first UE. Of course, in other embodiments, the first network element may also obtain the first information of the first UE from other network devices other than the first UE; for example, the first information of the first UE may be obtained from a base station or other core network devices.

An embodiment of the present disclosure provides an information processing method, which is executed by a first network element and includes: receiving first information sent by a first UE.

receiving second information sent by the second network element;

The second information stored in the first network element is obtained.

The embodiment of the present disclosure provides an information processing method, which is executed by a first network element and includes: receiving second information sent by a second network element.

The embodiment of the present disclosure provides an information processing method, which is executed by a first network element, and includes: obtaining second information stored in the first network element. Optionally, the second information may be stored in a database of the first network element. Optionally, the first network element obtains the second information in advance and stores it in the first network element.

In this way, multiple methods can be provided to obtain the second hash information of at least one second UE and the key information corresponding to the second hash information.

For the above implementation modes, please refer to the description on the first UE side and/or the second network element side, which will not be described in detail here.

In some embodiments, the first information further includes: authentication information; the authentication information is determined based on the key information. Exemplarily, the authentication information is used to perform integrity protection on the key information. Exemplarily, the authentication information may be an AUTH payload.

In some embodiments, determining the key information of the first UE includes: successfully verifying the authentication information based on the key information to determine the key information of the first UE. In this way, when the key information passes the integrity authentication, it is determined that the key information is the key information required by the first UE; thus, the accuracy of obtaining the key information of the first UE is further improved.

As shown in FIG5 , an embodiment of the present disclosure provides an information processing method, which is executed by a first network element and includes:

Step S51: successfully verifying the authentication information based on the key information, and establishing a connection with the first UE based on the key information; or, failing to verify the authentication information based on the key information, not establishing a connection with the first UE based on the key information.

Exemplarily, the connection is a secure connection.

Exemplarily, if the key information successfully verifies the authentication information and determines that the key information is the key information of the first UE, the first network element and the first UE may establish a connection based on the key information; or, if the key information fails to verify the authentication information and determines that the key information is not the key information of the first UE, the first network element and the first UE do not establish a connection with the first UE based on the key information.

The embodiment of the present disclosure can determine whether to establish a connection with the first UE based on the key information by whether the first network element successfully verifies the authentication information based on the key information, thereby ensuring the security of the connection when the first network element and the first UE are connected.

In order to further explain any embodiment of the present disclosure, several specific embodiments are provided below.

Example 1

As shown in FIG6 , an embodiment of the present disclosure provides an information processing method, which is performed by a communication device, and the communication device includes a UE, a TWIF or a TNGF, and an AMF; the information processing method includes the following steps:

The UE in the disclosed embodiment may be the first UE in the above embodiment.

Step S61: During the registration process, when the Non-Access Stratum (NAS) Security Mode Control (SMC) is successfully completed, the AMF decides to provide the UE security context to the TWIF or TNGF;

Step S62: Before the AMF initiates the Initial Context Request, the AMF determines the hash value of the SUPI of the UE used to identify the K _TWIF or K _TNGF ;

Step S63: AMF sends K _TWIF or K _TNGF , RAN UE NGAP ID, AMF UE NGAP ID and a hash value of SUPI to TWIF or TNGF;

Step S64: TWIF or TNGF stores the hash value of SUPI received from AMF and associates the received K _TWIF or K _TNGF with the hash value;

Step S65: The UE determines the hash value of the SUPI. Optionally, in order to establish a secure connection with the TWIF or TNGF, the UE calculates the hash value of the SUPI. Optionally, the UE generates an AUTH payload based on K _TWIF or K _TNGF .

Step S66: The UE sends the hash value of the SUPI and the AUTH payload to the TWIF or TNGF;

Step S67: TWIF or TNGF identifies the UE's K _TWIF or K _TNGF by searching for a match between the hash value of the SUPI received by the UE and the hash value of the SUPI stored from the AMF. Optionally, TWIF or TNGF verifies the validity of the AUTH payload based on the identified key information (e.g., K _TWIF or K _TNGF ).

Step S68: If the TWIF or TNGF determines that the AUTH payload is successfully verified, it establishes a secure connection with the UE based on the identified K _TWIF or K _TNGF ; otherwise, the TWIF or TNGF terminates the process.

For the above implementation modes, specific reference may be made to the descriptions on the first UE side and/or the first network element side and/or the second network element side, which will not be described in detail here.

Example 2

The present disclosure provides an information processing system, which includes: a first UE, a first network element, and a second network element; wherein:

In some embodiments, the first UE is configured to determine first hash information based on a first identifier of the first UE.

In some embodiments, the second network element is configured to determine second hash information based on a second identifier of the second UE.

In some embodiments, the first network element is configured to receive first information sent by the first UE and/or receive second information sent by the second network element.

In some embodiments, the first network element is configured to successfully verify the authentication information based on the key information and establish a connection with the first UE based on the key information; or, if the authentication information fails to be verified based on the key information, not establish a connection with the first UE based on the key information.

As shown in FIG. 7 , an embodiment of the present disclosure provides an information processing device, including:

The first sending module 51 is configured to send first information to the first network element, wherein the first information includes first hash information of a first identifier; the first hash information is used by the first network element to determine key information corresponding to the first identifier; the first identifier is an identifier of the first UE.

The information processing device provided by the embodiment of the present disclosure may be a first UE.

An embodiment of the present disclosure provides an information processing device, including: a first processing module, configured to determine first hash information based on a first identifier of a first UE.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

As shown in FIG8 , an embodiment of the present disclosure provides an information processing device, including:

The second sending module 61 is configured to send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second information is used by the first network element to determine the key information corresponding to the first identifier; the first identifier is the identifier of the first UE, and the second identifier is the identifier of the second UE.

The information processing device provided in the embodiment of the present disclosure may be a second network element. Exemplarily, the second network element is an AMF.

An embodiment of the present disclosure provides an information processing device, including: a second processing module, configured to determine second hash information of at least one second UE based on a second identifier of at least one second UE.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

As shown in FIG9 , an embodiment of the present disclosure provides an information processing device, including:

The acquisition module 71 is configured to acquire first information and acquire second information; wherein the first information includes first hash information of the first identifier; the second information includes second hash information of the second identifier and key information corresponding to the second hash information; the first identifier is the identifier of the first UE; the second identifier is the identifier of the second UE;

A third processing module 72 is configured to determine second hash information matching the first hash information based on the first information and the second information;

The third processing module 72 is further configured to determine the key information of the first UE based on the second hash information.

The information processing device provided in the embodiment of the present disclosure may be a first network element. Exemplarily, the first network element may be a TWIF or a TNGF.

An embodiment of the present disclosure provides an information processing device, including: an acquisition module 71, configured to receive first information sent by a first UE.

An embodiment of the present disclosure provides an information processing device, including: an acquisition module 71, configured to receive second information sent by a second network element; or, the acquisition module 71, configured to acquire second information stored in a first network element.

In some embodiments, the third processing module 72 is configured to successfully verify the authentication information based on the key information and establish a connection with the first UE based on the key information; or, the third processing module 72 is configured to fail to verify the authentication information based on the key information and not establish a connection with the first UE based on the key information.

a first key associated with TWIF (K _TWIF );

A second key (K _TNGF ) associated with TNGF.

In some embodiments, the second network element is an AMF.

It should be noted that those skilled in the art can understand that the device provided in the embodiments of the present disclosure can be executed alone or together with some devices in the embodiments of the present disclosure or some devices in related technologies.

Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

An embodiment of the present disclosure provides a communication device, including a processor, a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor, wherein the processor executes the information processing method provided above when running the executable program.

In some embodiments, the processor may include various types of storage media, which are non-transitory computer storage media that can continue to remember information stored thereon after the communication device loses power.

In some embodiments, the communication device includes: a UE or a network element, and the network element may be any one of the aforementioned first network element and the second network element.

The processor may be connected to the memory via a bus or the like, and is used to read an executable program stored in the memory, for example, at least one of the methods shown in FIG. 2 to FIG. 6 .

The present disclosure provides a computer storage medium storing an executable program; after the executable program is executed by a processor, the aforementioned information processing method can be implemented, for example, at least one of the methods shown in FIG. 2 to FIG. 6 .

FIG10 is a block diagram of a UE 800 according to an exemplary embodiment. For example, the UE 800 may be a mobile phone, a computer, a digital broadcast user equipment, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

10 , UE 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input/output (I/O) interface 812 , a sensor component 814 , and a communication component 816 .

The processing component 802 generally controls the overall operation of the UE 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to generate all or part of the steps of the above-described method. In addition, the processing component 802 may include one or more modules to facilitate interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.

The memory 804 is configured to store various types of data to support the operation of the UE 800. Examples of such data include instructions for any application or method operating on the UE 800, contact data, phone book data, messages, pictures, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory. SRAM, electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

The power component 806 provides power to various components of the UE 800. The power component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the UE 800.

The multimedia component 808 includes a screen that provides an output interface between the UE 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and/or a rear camera. When the UE 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and/or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

The audio component 810 is configured to output and/or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the UE 800 is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal may be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting an audio signal.

I/O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the UE 800. For example, the sensor assembly 814 can detect the open/closed state of the device 800, the relative positioning of components, such as the display and keypad of the UE 800, the sensor assembly 814 can also detect the position change of the UE 800 or a component of the UE 800, the presence or absence of user contact with the UE 800, the UE 800 orientation or acceleration/deceleration and the temperature change of the UE 800. The sensor assembly 814 can include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 can also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 can also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor or a temperature sensor.

The communication component 816 is configured to facilitate wired or wireless communication between the UE 800 and other devices. The UE 800 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

In an exemplary embodiment, UE 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the above instructions can be executed by the processor 820 of the UE 800 to generate the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

As shown in FIG. 11 , an embodiment of the present disclosure shows a structure of a communication device. For example, the communication device 900 may be provided as a network side device. The communication device may be various network elements such as the aforementioned access network element and/or network function. The communication device may be the AMF, or the first network element or the second network element in the above embodiment.

11, the communication device 900 includes a processing component 922, which further includes one or more processors, and a memory resource represented by a memory 932 for storing instructions that can be executed by the processing component 922, such as an application. The application stored in the memory 932 may include one or more modules each corresponding to a set of instructions. In addition, the processing component 922 is configured to execute instructions to perform any method of the aforementioned method applied to the access device.

The communication device 900 may also include a power supply component 926 configured to perform power management of the communication device 900, a wired or wireless network interface 950 configured to connect the communication device 900 to a network, and an input/output (I/O) interface 958. The communication device 900 may operate based on an operating system stored in the memory 932, such as Windows Server TM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, or the like.

In the absence of contradiction, each step in a certain implementation mode or embodiment can be implemented as an independent embodiment, and each step can be implemented as an independent embodiment. The steps may be arbitrarily combined. For example, a solution after removing some steps in a certain implementation manner or example may also be implemented as an independent example. The order of the steps in a certain implementation manner or example may be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain implementation manner or example may be arbitrarily combined. Furthermore, the various implementation manners or examples may be arbitrarily combined. For example, some or all of the steps of different implementation manners or examples may be arbitrarily combined. A certain implementation manner or example may be arbitrarily combined with the optional methods or optional examples of other implementation manners or examples.

Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

An information processing method, wherein the method is performed by a first user equipment UE, comprising:

Send first information to a first network element, wherein the first information includes first hash information of a first identifier; the first hash information is used by the first network element to determine key information corresponding to the first identifier; and the first identifier is an identifier of the first UE.
The method according to claim 1, wherein the method further comprises:

Based on the first identifier of the first UE, determine the first hash information.
According to the method according to claim 1 or 2, the first information also includes: authentication information; the authentication information is determined based on the key information.
The method according to any one of claims 1 to 3, wherein the first identifier comprises one of the following:

A Subscriber Permanent User Identity (SUPI) of the first UE;

A subscriber implicit identity SUCI of the first UE;

A globally unique temporary identifier GUTI of the first UE;

Indicates the index or number of the first UE.
The method according to any one of claims 1 to 4, wherein the first network element comprises one of the following:

Trusted WLAN interoperability function TWIF;

Trusted non-3GPP gateway function TNGF.
The method according to claim 5, wherein the key information includes at least one of the following:

a first key K TWIF associated with the TWIF;

A second key K TNGF associated with said TNGF.
An information processing method, wherein the method is performed by a second network element, comprising:

Send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second information is used by the first network element to determine the key information corresponding to the first identifier; the first identifier is the identifier of the first user equipment UE, and the second identifier is the identifier of the second UE.
The method according to claim 7, wherein the method comprises:

Based on the second identifier of at least one second UE, determine the second hash information of at least one second UE.
The method according to claim 7 or 8, wherein

The first identifier includes one of the following: a subscriber permanent identifier SUPI of the first UE, a subscriber implicit identifier SUCI of the first UE, a GUTI of the first UE, and an index or number indicating the first UE;

and/or,

The second identifier includes one of the following: a SUPI of the second UE, a SUCI of the second UE, a GUTI of the second UE, and an index or number indicating the second UE.
The method according to any one of claims 7 to 9, wherein the first network element comprises one of the following:

Trusted WLAN interoperability function TWIF;

Trusted non-3GPP gateway function TNGF.
The method according to claim 10, wherein the key information includes at least one of the following:

a first key K TWIF associated with the TWIF;

A second key K TNGF associated with said TNGF.
The method according to any one of claims 7 to 11, wherein the second network element is an access and mobility management function AMF.
An information processing method, wherein the method is performed by a first network element, comprising:

Acquire first information and acquire second information; wherein the first information includes first hash information of a first identifier; the second information includes second hash information of a second identifier and key information corresponding to the second hash information; the first identifier is an identifier of a first user equipment UE; the second identifier is an identifier of a second UE;

Based on the first information and the second information, determining the second hash information matching the first hash information;

Based on the second hash information, determine the key information of the first UE.
The method according to claim 13, wherein the obtaining the first information comprises:

The first information sent by the first user equipment UE is received.
The method according to claim 13 or 14, wherein the obtaining the second information comprises one of the following:

receiving the second information sent by the second network element;

Acquire the second information stored in the first network element.
The method according to any one of claims 13 to 15, wherein the first information further includes: authentication information; The authentication information is determined based on the key information.
The method according to claim 16, wherein the method comprises one of the following:

Successfully verifying the authentication information based on the key information, and establishing a connection with the first UE based on the key information;

If verification of the authentication information based on the key information fails, a connection is not established with the first UE based on the key information.
The method according to any one of claims 13 to 17, wherein the first network element comprises one of the following:

Trusted WLAN interoperability function TWIF;

Trusted non-3GPP gateway function TNGF.
The method according to claim 18, wherein the key information includes at least one of the following:

a first key K TWIF associated with the TWIF;

A second key K TNGF associated with said TNGF.
The method according to claim 15, wherein the second network element is an access and mobility management function AMF.
An information processing device, comprising:

The first sending module is configured to send first information to the first network element, wherein the first information includes first hash information of a first identifier; the first hash information is used by the first network element to determine key information corresponding to the first identifier; the first identifier is the identifier of the first UE.
An information processing device, comprising:

The second sending module is configured to send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second information is used by the first network element to determine the key information corresponding to the first identifier; the first identifier is the identifier of the first user equipment UE, and the second identifier is the identifier of the second UE.
An information processing device, comprising:

An acquisition module is configured to acquire first information and acquire second information; wherein the first information includes first hash information of a first identifier; the second information includes second hash information of a second identifier and key information corresponding to the second hash information; the first identifier is an identifier of a first user equipment UE; and the second identifier is an identifier of a second UE;

A third processing module is configured to determine the second hash information matching the first hash information based on the first information and the second information;

The third processing module is also configured to determine the key information of the first UE based on the second hash information.
An information processing system, comprising: a first user equipment UE, a first network element and a second network element; wherein:

The first UE is configured to send first information to the first network element, wherein the first information includes first hash information of a first identifier; the first identifier is an identifier of the first UE;

The second network element is configured to send second information to the first network element, wherein the second information includes: second hash information of at least one second identifier, and key information corresponding to the second hash information; the second identifier is an identifier of a second UE;

The first network element is configured to determine the second hash information matching the first hash information based on the first information and the second information; and determine the key information of the first UE based on the second hash information.
A communication device, wherein the communication device comprises: a transceiver, a memory, and an executable program stored in the memory and capable of being run by the processor, wherein the processor executes the information processing method as described in any one of claims 1 to 6, or claims 7 to 12, or claims 13 to 20 when running the executable program.
A computer storage medium, wherein the computer storage medium stores a computer executable program, and after the executable program is executed by a processor, it can implement the information processing method according to any one of claims 1 to 6, or claims 7 to 12, or claims 13 to 20.