WO2019085659A1 - 一种信息交互方法及装置 - Google Patents

一种信息交互方法及装置 Download PDF

Info

Publication number
WO2019085659A1
WO2019085659A1 PCT/CN2018/105504 CN2018105504W WO2019085659A1 WO 2019085659 A1 WO2019085659 A1 WO 2019085659A1 CN 2018105504 W CN2018105504 W CN 2018105504W WO 2019085659 A1 WO2019085659 A1 WO 2019085659A1
Authority
WO
WIPO (PCT)
Prior art keywords
core network
information
terminal device
network device
key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/105504
Other languages
English (en)
French (fr)
Inventor
唐斌
于峰
应江威
涂径玄
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP18872011.4A priority Critical patent/EP3697144B1/en
Publication of WO2019085659A1 publication Critical patent/WO2019085659A1/zh
Priority to US16/860,289 priority patent/US11647390B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/108—Source integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/06—Optimizing the usage of the radio link, e.g. header compression, information sizing, discarding information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W52/00—Power management, e.g. Transmission Power Control [TPC] or power classes
    • H04W52/02—Power saving arrangements
    • H04W52/0209—Power saving arrangements in terminal devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Definitions

  • the present application relates to the field of communications technologies, and in particular, to an information interaction method and apparatus.
  • the terminal device may transmit information to the radio access network device, and then the radio access network device transmits the information to the core network device, so as to implement information interaction between the terminal device and the core network device.
  • the terminal device in order to ensure the security of the communication system, when the terminal device interacts with the core network device, it needs to authenticate the other party and perform data protection on the interactive information.
  • identity authentication and data protection when the terminal device accesses the core network device for the first time, it is usually required that the terminal device and the core network device transmit their own identity authentication information to each other. In this case, the terminal device performs identity authentication on the core network device according to the identity authentication information of the core network device, and the core network device performs identity authentication on the terminal device according to the identity authentication information of the terminal device.
  • the core network device selects an integrity algorithm and an encryption and decryption algorithm for data protection, and transmits the selected integrity algorithm and the encryption and decryption algorithm to the terminal device.
  • the terminal device confirms whether the integrity algorithm and the encryption and decryption algorithm selected by the core network device are supported, and after determining the support, the terminal device sends corresponding feedback to the core network device. After receiving the feedback, the core network device confirms that the terminal device accesses the core network device.
  • both the terminal device and the core network device authenticate the identity of the opposite party, and complete the negotiation of the integrity algorithm and the encryption algorithm. After the terminal device and the core network device perform information, the interaction information is integrity protected and encrypted, thereby improving the security of the communication system.
  • the integrity algorithm and the encryption and decryption algorithm have a large number of information interactions and a large amount of interactive information data, which leads to a problem that the information interaction process takes a long time in the prior art, and the power consumption of the terminal device is high.
  • the embodiment of the present application discloses an information interaction method and device.
  • an information interaction method including: a terminal device transmitting attachment request information to a core network device; the terminal device receiving attachment acceptance information transmitted by the core network device, where the attachment acceptance information is The first integrity check code of the core network device is included; the terminal device acquires a second integrity check code based on the attach accepting information; if the first integrity check code and the second complete The terminal check device obtains the encrypted attachment completion information, and obtains a third integrity check code based on the encrypted attachment completion information, and adds the third integrity to the core network device transmission. Check code and encrypted attachment completion information.
  • the terminal device acquires a second integrity check code based on the attach accepting information, including: the terminal device is based on a preset first root Keys, terminal device parameters, and core network device parameters included in the attachment accepting information, generating a first terminal key by using a preset first key generation algorithm; and the terminal device is based on the first terminal key and
  • the attach accepting information acquires the second integrity check code by using a preset first integrity algorithm.
  • the terminal can obtain the second integrity check code, so that in the subsequent process, the terminal determines the validity of the core network identity according to whether the second integrity check code and the first integrity check code are the same.
  • the terminal device obtains the encrypted attachment completion information, including: the terminal device is based on the preset second root key, the terminal device parameter, and the location Generating, by the preset second key generation algorithm, a second terminal key, where the terminal device generates the attachment completion information, and based on the second terminal key,
  • the preset first encryption and decryption algorithm encrypts the attachment completion information.
  • the terminal can encrypt the attachment completion information, so that in the subsequent process, the core network determines whether the terminal can access the core network according to whether it can decrypt the received attachment completion information.
  • the terminal device parameter includes: a terminal device identifier and The terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and the terminal random number is not easy to be counterfeited, thereby improving the security of the terminal device parameters.
  • the core network device parameter includes: a core network device identity Identifying and core network random numbers generated by the core network device.
  • the core network device identifier can distinguish different core network devices, and the core network random number is not easy to be counterfeited, thereby improving the security of the core network device parameters.
  • an information interaction method including: receiving, by a core network device, attachment request information transmitted by a terminal device; and after generating the attachment acceptance information, the core network device acquiring, according to the attachment acceptance information, An integrity check code, and transmitting, to the terminal device, attachment acceptance information added with the first integrity check code; the core network device receiving encrypted attachment completion information transmitted by the terminal device, The attachment completion information includes a third integrity check code of the terminal device; the core network device acquires a fourth integrity check code based on the encrypted attachment completion information; if the third integrity check The code is the same as the fourth integrity check code, and the core network device decrypts the encrypted attachment completion information, and after the decryption succeeds, determines that the terminal device accesses the core network device.
  • the acquiring, by using the attaching and receiving information, the first integrity check code includes: the core network device is based on a preset third root The key, the core network device parameter, and the terminal device parameter included in the attach request information, generate a first core network key by using a preset third key generation algorithm; the core network device is based on the first core network The key and the attachment accepting information are obtained by using a preset second integrity algorithm.
  • the core network device can obtain the first integrity check code, so that in the subsequent process, the terminal device determines whether the core network identity is legal according to whether the second integrity check code and the first integrity check code are the same. Sex.
  • the core network device decrypts the encrypted attachment completion information, including: the core network device is based on a preset fourth root key And the core network device parameter and the terminal device parameter included in the attach request information, generating a second core network key by using a preset fourth key generation algorithm; the core network device is based on the second core network key And decrypting the encrypted attachment completion information by a preset second encryption and decryption algorithm.
  • the core network device can determine whether the terminal device can access the core network device according to whether the received attachment completion information is successfully decrypted.
  • the terminal device parameter includes: a terminal device identifier and The terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and the terminal random number is not easy to be counterfeited, thereby improving the security of the terminal device parameters.
  • the core network device parameter includes: a core network device identity Identifying and core network random numbers generated by the core network device.
  • the core network device identifier can distinguish different core network devices, and the core network random number is not easy to be counterfeited, thereby improving the security of the core network device parameters.
  • an information interaction apparatus including: a first sending module, a first receiving module, and a first processing module; the first sending module is configured to transmit attach request information to a core network device; The first receiving module is configured to receive the attachment accepting information transmitted by the core network device, where the attach accepting information includes a first integrity check code of the core network device, where the first processing module is configured to be based on The first receiving module is configured to obtain the encrypted attachment completion information, if the first integrity check code and the second integrity check code are the same, And acquiring, according to the encrypted attachment completion information, a third integrity check code, and triggering, by the first sending module, to transmit, to the core network device, the attached complete information that is encrypted and added with the third integrity check code. .
  • the information interaction device only the attachment request information, the attachment acceptance information, and the attachment completion information need to be transmitted between the terminal device and the core network device, that is, only three pieces of information interaction are required, and the identity and data of the other party's identity can be realized. protection.
  • the first processing module is specifically configured to be based on a preset first root key, a terminal device parameter, and a core included in the attach accepting information Generating, by the preset first key generation algorithm, a first terminal key, and acquiring, by using a preset first integrity algorithm, the first terminal algorithm, based on the preset first key generation algorithm Two integrity check codes.
  • the first processing module is specifically configured to be based on a preset second root key, a terminal device parameter, and a core included in the attach accepting information
  • the network device parameter generates a second terminal key by using a preset second key generation algorithm, and after generating the attachment completion information, based on the second terminal key, the preset first encryption and decryption algorithm
  • the attachment completion information is encrypted.
  • the terminal device parameter includes: a terminal device identifier and The terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and the terminal random number is not easy to be counterfeited, thereby improving the security of the terminal device parameters.
  • the core network device parameter includes: a core network device identity Identifying and core network random numbers generated by the core network device.
  • the core network device identifier can distinguish different core network devices, and the core network random number is not easy to be counterfeited, thereby improving the security of the core network device parameters.
  • an information interaction apparatus including: a second receiving module, a second sending module, and a second processing module,
  • the second receiving module is configured to receive the attach request information transmitted by the terminal device, where the second processing module is configured to acquire the first integrity check code based on the attach accepting information, and trigger the The second sending module transmits, to the terminal device, attachment acceptance information added with the first integrity check code; the second receiving module is further configured to receive encrypted attachment completion information transmitted by the terminal device, The attachment completion information includes a third integrity check code of the terminal device; the second processing module is further configured to obtain a fourth integrity check code based on the encrypted attachment completion information, if The third integrity check code is the same as the fourth integrity check code, the second processing module decrypts the encrypted attach complete information, and after the decryption succeeds, determines that the terminal device accesses the core Network equipment.
  • the information interaction device only the attachment request information, the attachment acceptance information, and the attachment completion information need to be transmitted between the terminal device and the core network device, that is, only three pieces of information interaction are required, and the identity and data of the other party's identity can be realized. protection.
  • the second processing module is specifically configured to be based on a preset third root key, a core network device parameter, and the information included in the attach request information a terminal device parameter, generating a first core network key by using a preset third key generation algorithm, and acquiring, by using a preset second integrity algorithm, based on the first core network key and the attachment acceptance information The first integrity check code.
  • the second processing module is specifically configured to be based on a preset fourth root key, a core network device parameter, and the information included in the attach request information
  • the terminal device parameter generates a second core network key by using a preset fourth key generation algorithm, and based on the second core network key, completes the encrypted attachment completion information by using a preset second encryption and decryption algorithm. Decrypt.
  • the terminal device parameter includes: a terminal device identifier and The terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and the terminal random number is not easy to be counterfeited, thereby improving the security of the terminal device parameters.
  • the core network device parameter includes: a core network device identity Identifying and core network random numbers generated by the core network device.
  • the core network device identifier can distinguish different core network devices, and the core network random number is not easy to be counterfeited, thereby improving the security of the core network device parameters.
  • a terminal device includes: a transceiver port, a processor, and a memory connected to the processor; wherein the transceiver port is configured to send and receive information with a core network device. And transmitting information received from the core network device to a processor; the memory storing instructions executable by the processor; the processor is configured to obtain a message transmitted by the transceiver port, and execute The program or instruction stored in the memory implements the information interaction method described in the first aspect of the present application.
  • a core network device including: a transceiver port, a processor, and a memory connected to the processor; wherein the transceiver port is configured to send and receive information with the terminal device And transmitting, to the processor, the information received from the terminal device; the memory storing an instruction executable by the processor; the processor is configured to acquire a message transmitted by the transceiver port, and execute the The program or instruction stored in the memory implements the information interaction method described in the second aspect of the present application.
  • an embodiment of the present application further provides a computer program product comprising instructions for causing a computer to perform the method of the first aspect of the present application when the instruction is run on a computer.
  • an embodiment of the present application further provides a computer program product, comprising instructions for causing a computer to perform the method of the second aspect of the present application when the instruction is run on a computer.
  • an embodiment of the present application further provides a computer storage medium, where the computer storage medium can store a program, where the program can implement the embodiments of the information interaction method provided by the first aspect. Some or all of the steps.
  • an embodiment of the present application further provides a computer storage medium, where the computer storage medium may store a program, where the program can implement the embodiments of the information interaction method provided by the second aspect. Some or all of the steps.
  • an embodiment of the present application further provides a chip, where the chip device includes a memory, a processor, and a computer program stored on the memory and operable on the processor.
  • the method of the first aspect of the present application is implemented when the processor executes the computer program.
  • an embodiment of the present application further provides a chip, where the chip device includes a memory, a processor, and a computer program stored on the memory and operable on the processor.
  • the method of the second aspect of the present application is implemented when the processor executes the computer program.
  • the embodiment of the present application further provides a terminal device, including: a processor and a memory; the memory is configured to store a computer execution instruction, when the terminal device is running, the processor Executing the computer-executable instructions stored in the memory to cause the terminal device to perform the information interaction method as described in the foregoing first aspect or the implementation manners of the first aspect.
  • the embodiment of the present application further provides a core network device, including: a processor and a memory; the memory is configured to store a computer execution instruction, when the core network device is running, The processor executes the computer-executed instructions stored by the memory to cause the core network device to perform the information interaction method as described in the foregoing second aspect or the second aspect implementations.
  • a core network device including: a processor and a memory; the memory is configured to store a computer execution instruction, when the core network device is running, The processor executes the computer-executed instructions stored by the memory to cause the core network device to perform the information interaction method as described in the foregoing second aspect or the second aspect implementations.
  • the solution disclosed in the embodiment of the present application reduces the flow of data interaction and reduces the amount of information of information exchanged between the terminal device and the core network device, while ensuring the security of the communication system. Thereby, the time required for the information exchange process between the terminal device and the core network device is reduced, and the power consumption overhead of the terminal device can be reduced.
  • FIG. 1 is a schematic structural diagram of a communication system disclosed in the prior art
  • FIG. 2 is a schematic diagram of a workflow of an information interaction method according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a flow of information interaction in a communication system disclosed in the prior art
  • FIG. 4 is a schematic diagram of a process of information interaction in a communication system according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of an integrity algorithm applied to a communication system according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a workflow of another information interaction method disclosed in an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an information interaction apparatus according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of still another information interaction apparatus according to an embodiment of the present application.
  • the prior art requires multiple information exchanges between the terminal device and the core network device, and the amount of information exchanged is large, which results in a long time for the information exchange process in the prior art, and power consumption of the terminal device.
  • the problem of high overhead In order to solve the problems in the prior art, the embodiment of the present application discloses an information interaction method and device.
  • FIG. 1 is a schematic structural diagram of a communication system to which an embodiment of the present application is applied.
  • the communication system includes a core network device 110, a radio access network device 120, and at least one terminal device (such as the terminal device 130 and the terminal device 140 in FIG. 1).
  • the terminal device is connected to the radio access network device 120 in a wireless manner, and the radio access network device 120 is connected to the core network device 110 by wireless or wired.
  • the core network device and the wireless access network device may be independent physical devices, or may integrate the functions of the core network device with the logical functions of the wireless access network device on the same physical device, or may be a physical device.
  • the functions of some core network devices and the functions of some wireless access network devices are integrated.
  • the terminal device can be fixed or mobile.
  • FIG. 1 is only a schematic diagram, and the communication system may further include other network devices, such as a wireless relay device and a wireless backhaul device, which are not shown in FIG. 1.
  • the embodiment of the present application does not limit the number of core network devices, radio access network devices, and terminal devices included in the communication system.
  • the radio access network device is an access device in which the terminal device accesses the communication system in a wireless manner, and may be a base station NodeB, an evolved base station eNodeB, a base station in a 5G mobile communication system, a base station in a future mobile communication system, or a WiFi.
  • the specific technology and the specific device configuration adopted by the radio access network device are not limited in the embodiments of the present application, and the access nodes in the LTE-U or other unlicensed spectrum radio systems.
  • the terminal device may also be called a terminal, a user equipment (UE), a mobile station (MS), a mobile terminal (MT), or the like.
  • the terminal device can be a mobile phone, a tablet, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, industrial control (industrial control) Wireless terminal, wireless terminal in self-driving, wireless terminal in remote medical surgery, wireless terminal in smart grid, transportation safety Wireless terminals, wireless terminals in smart cities, wireless terminals in smart homes, smart meters with wireless communication functions, smart water meters, environmental sensors, device tags, positioning tags, and the like.
  • the terminal device can transmit information to the radio access network device, and then the radio access network device transmits the information to the core network device, and the core network device can also transmit the information to the radio access network device. Then, the wireless access network device transmits the information to the terminal device. That is to say, the terminal device and the core network device can implement information interaction through the wireless access network device.
  • the solution disclosed in the embodiment of the present application can be applied to a plurality of communication systems.
  • the solution disclosed in the embodiment of the present application can reduce the power consumption of the terminal device.
  • it can be applied to a narrow band internet of things (NB-IoT) based on a cellular network in the 4.5G mobile communication technology.
  • NB-IoT narrow band internet of things
  • the terminal device, the radio access network device, and the core network device are respectively the terminal device, the radio access network device, and the core network device in the NB-IoT system, and implement the terminal according to the solution disclosed in the embodiment of the present application.
  • Information exchange between the device and the core network device are respectively the terminal device, the radio access network device, and the core network device in the NB-IoT system.
  • the embodiment of the present application can be applied to other communication systems that have the terminal device and the core network device, and the information exchange between the terminal device and the core network device can be performed.
  • an information interaction method is disclosed.
  • the method is applied to a terminal device, and the terminal device can perform information interaction between the wireless access network device and the core network device.
  • the information interaction method disclosed in the first embodiment of the present application includes the following steps:
  • Step S11 The terminal device transmits the attachment request information to the core network device.
  • the terminal device transmits the attach request information to the radio access network device, and then the radio access network device transmits the information to the core network device, so that the core network device can receive the attach request information.
  • terminal device parameters may be included.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device.
  • the terminal device identity can distinguish different terminal devices, for example, it can be an international mobile subscriber identity (IMSI).
  • IMSI international mobile subscriber identity
  • Step S12 The terminal device receives the connection acceptance information transmitted by the core network device, where the attachment acceptance information includes a first integrity check code of the core network device.
  • the core network device After receiving the attach request information, the core network device generates an attach accepting information, and performs calculation on the attach accepting information to obtain a first integrity check code, where the first integrity check code is obtained.
  • the information is added to the attachment accepting information, and the attachment acceptance information added with the first integrity check code is transmitted to the radio access network device.
  • the radio access network device transmits the attach accepting information added with the first integrity check code to the terminal device, so that the terminal device obtains the attach accepting information.
  • Step S13 The terminal device acquires a second integrity check code based on the attach accepting information.
  • the terminal device obtains the second integrity check code by calculating the attachment acceptance information.
  • the terminal device generally performs calculation according to a preset first integrity algorithm when calculating the attachment acceptance information.
  • the core network device calculates the attachment acceptance information by using a preset second integrity algorithm to obtain the first integrity check code.
  • the preset is preset.
  • the first integrity algorithm is the same as the second integrity algorithm. That is to say, the terminal device and the core network device use the same integrity algorithm for integrity verification.
  • Step S14 If the first integrity check code and the second integrity check code are the same, the terminal device acquires encrypted attach completion information, and obtains third integrity based on the encrypted attach completion information. And a check code, and the attachment completion information added with the third integrity check code and encrypted is transmitted to the core network device.
  • the terminal device determines that the identity of the core network device is legal. That is to say, in the embodiment of the present application, the terminal device performs identity authentication on the core network device by using an integrity check code.
  • the terminal device After determining that the identity of the core network device is legal (that is, the first integrity check code and the second integrity check code are the same), the terminal device generates attachment completion information, and then encrypts the attachment completion information, thereby Obtain encrypted attachment completion information. Then, the terminal device calculates the encrypted attachment completion information by using the first integrity algorithm, obtains a third integrity check code, and adds the third integrity check code to the encrypted attachment completion information.
  • the core network device can calculate the attachment completion information according to the second integrity algorithm to obtain the fourth integrity check code. Moreover, if the core network device determines that the third integrity check code is the same as the fourth integrity check code, it may determine that the identity of the terminal device is legal. That is, the core network device implements identity authentication of the terminal device by using the third integrity check code included in the attach complete information.
  • the first integrity algorithm is the same as the second integrity algorithm.
  • the terminal device encrypts the attachment completion information to improve the security of the attachment completion information.
  • the terminal device usually encrypts the attachment completion information by using a preset first encryption and decryption method, and after receiving the attachment completion information, the core network device decrypts the attachment completion information by using a preset second encryption and decryption method. If the terminal device allows access to the core network device, the first encryption and decryption method is preset to be the same as the second encryption and decryption method. In this case, after the identity of the terminal device is determined according to the integrity check code, if the core network device can decrypt the attachment completion information according to the second encryption and decryption method, the information exchanged between the terminal device and the core network device is described. The encryption and decryption can be performed on each other to determine that the terminal device accesses the core network device.
  • the terminal device and the core network device can continue to perform information interaction.
  • the terminal device transmits the acquired detection data to the core network device through the wireless access network device, and the core
  • the network device transmits instruction information and the like to the terminal device through the wireless access network device.
  • the sender of the information may add an integrity check code calculated according to the information to the interactive information, and encrypt the information.
  • the receiving end that receives the information calculates the information and obtains a corresponding integrity check. If the integrity check code obtained by the calculation is the same as the integrity check code added in the information, the receiving end may determine that the received end is received.
  • the information is complete, and after determining that the received information is complete, it can be decrypted according to a preset encryption and decryption algorithm, thereby improving the security of the communication system.
  • the embodiment of the present application discloses an information interaction method, in which the terminal device transmits the attachment request information to the core network device; after receiving the attachment request information, the core network device generates the attachment acceptance information, and acquires the first complete based on the attachment acceptance information. a checksum code, and adding the first integrity check code to the attach accepting information; the terminal device receiving the attach accepting information transmitted by the core network device, and acquiring a second integrity check based on the attach accepting information If the first integrity check code and the second integrity check code are the same, the terminal device determines that the identity of the core network device is legal, that is, the terminal device accepts the first complete information included in the information.
  • the verification code implements identity authentication for the core network, and after confirming that the identity of the core network device is legal, the terminal device generates attachment completion information and encrypts the attachment completion information, and then acquires the third complete based on the encrypted attachment completion information. a checksum code, adding the third integrity check code to the encrypted attachment completion information, and then to the core network And transmitting, by the device, the third integrity check code and the encrypted attachment completion information; after receiving the attachment completion information, the core network device acquires the fourth integrity check code based on the attachment completion information, if the third integrity school
  • the verification code is the same as the fourth integrity check code, and the core network device determines that the identity of the terminal device is legal, that is, the core network device implements the identity authentication of the terminal device by using the fourth integrity check code included in the attachment completion information. Then, the core network device decrypts the attachment completion information, and if the decryption is successful, determines that the terminal device accesses the core network device.
  • connection request information only the connection request information, the attachment acceptance information, and the attachment completion information need to be transmitted between the terminal device and the core network device, that is, only three information interactions are needed to implement the other party.
  • Identity authentication and data protection only the connection request information, the attachment acceptance information, and the attachment completion information need to be transmitted between the terminal device and the core network device, that is, only three information interactions are needed to implement the other party.
  • the solution disclosed in the embodiment of the present application reduces the flow of data interaction and reduces the amount of information of information exchanged between the terminal device and the core network device, thereby reducing the security of the communication system.
  • Step 1 The terminal device generates the attach request information carrying the terminal IMSI, and transmits the attach request information to the core network device by using the radio access network device.
  • Step 2 After receiving the attach request information sent by the terminal device, the core network device acquires the IMSI included therein, and then sends the user identity verification request information to the terminal device by using the radio access network device, where the user identity verification request information is used. It includes the core network authentication code and the core network random number generated by the core network device.
  • Step 3 After receiving the user identity verification request information sent by the core network device, the terminal device performs identity authentication on the core network according to the core network authentication code included therein. If the identity of the core network device is determined to be legal, the terminal device passes the preset The root key, the terminal random number generated by the terminal device itself, and the core network random number generate a key for encrypting the subsequent information. Then, the terminal device generates the user identity verification response information, and transmits the user identity verification response information to the core network device by using the wireless access network device, where the user identity verification response information includes the terminal authentication code and the terminal random number. That is to say, through this step, the terminal device can perform identity authentication on the core network device and generate a key for encryption.
  • Step 4 After receiving the user identity verification response message sent by the terminal device, the core network device performs identity authentication on the terminal device according to the terminal authentication code included therein. If it is determined that the identity of the terminal device is legal, the core network device generates a key for encrypting the subsequent information by using a preset root key, a terminal random number, and a core network random number. If the terminal device is allowed to access the core network device, the root key preset in the core network is the same as the root key preset in the terminal, and the core network generates the key in the same manner as the terminal generates the key. In this case, the key generated by the core network device is the same as the key generated by the terminal device.
  • the core network device selects an integrity algorithm and an encryption algorithm, and generates security mode command information, where the security mode command information includes an integrity algorithm and an encryption algorithm selected by the core network device, and the integrity algorithm is used.
  • the security mode command information is integrity protected, it is transmitted to the terminal through the radio access network device. That is, through this step, the core network device can authenticate the terminal and generate a key for encryption.
  • Step 5 After receiving the security mode command information transmitted by the core network device, the terminal device confirms whether it supports the integrity algorithm and the encryption algorithm selected by the core network device. If supported, the terminal device performs integrity verification on the security mode command information. If the information passes the integrity verification, the terminal device transmits the integrity mode and the encrypted security mode completion information to the core network device through the radio access network device. .
  • Step 6 After receiving the security mode completion information transmitted by the terminal device, the core network device first performs integrity verification on the information, and if the information passes the integrity verification, the information is decrypted. Then, the core network device generates attachment acceptance information, and transmits the attachment acceptance information to the terminal device through the wireless access network device.
  • Step 7 After receiving the connection acceptance information transmitted by the core network device, the terminal device confirms whether it can access the core network device, and if yes, sends the integrity protection and encryption processing to the core network device through the wireless access network device. Attachment completion information. After receiving the attachment completion information transmitted by the terminal, the core network device performs integrity verification and decryption on the attachment completion information. If the attachment completion information can pass integrity verification and decryption, the terminal device is allowed to access the core network device to complete the terminal device. The process of accessing core network devices.
  • both the terminal device and the core network device authenticate the other party, and complete the negotiation between the integrity algorithm and the encryption algorithm.
  • the interaction information will be Integrity protection and encryption protection to improve the security of the communication system.
  • the terminal device when the terminal device performs information interaction with the core network device, the terminal device first transmits the attachment request information to the core network device.
  • the core network device core network device that receives the attach request information generates the attach accepting information, and obtains the first integrity check code based on the attach accepting information, and adds the first integrity check code to the attach accepting information, and then sends the first integrity check code to the terminal.
  • the device transmits the attachment acceptance information.
  • the terminal device acquires a second integrity check code based on the attachment acceptance information, and generates attachment completion information when the first integrity check code and the second integrity check code are the same. And encrypted.
  • the terminal device acquires a third integrity check code based on the encrypted attachment completion information, and adds a third integrity check code to the encrypted attachment completion information, and adds the third integrity check code and the encrypted attachment.
  • the information transmission is completed to the core network device, so that the core network device determines whether to allow the terminal device to access the core network device according to the received attachment completion information.
  • connection request information in the solution disclosed in the embodiment of the present application, only the connection request information, the attachment acceptance information, and the attachment completion information need to be transmitted between the terminal device and the core network device, that is, only the terminal device and the core network device are needed.
  • Three information interactions can be made between. Compared with the prior art, the number of information interactions is reduced, and the amount of data of the interaction information is reduced, thereby reducing the time-consuming interaction between the terminal device and the core network device, and effectively reducing the power consumption overhead of the terminal device.
  • step S13 the operation of the terminal device to acquire the second integrity check code based on the attach accepting information is disclosed, and the operation generally includes the following steps:
  • the terminal device generates a first terminal key by using a preset first key generation algorithm based on the preset first root key, the terminal device parameter, and the core network device parameter included in the attachment accepting information.
  • the terminal device acquires the second integrity check code by using a preset first integrity algorithm based on the first terminal key and the attach accepting information.
  • the first root key is preset in the terminal device, and the core network device parameter is included in the attach accepting information.
  • the terminal device After receiving the attachment accepting information, the terminal device generates a first terminal key according to the first root key, the terminal device parameter, and the core network device parameter included in the attach and receive information, and the first key generation algorithm, where the first terminal The key is used to generate an integrity check code.
  • a third root key is preset in the core network device, and after receiving the attach request information transmitted by the terminal device, the core network device can include the third root key, the core network device parameter, and the attach request information.
  • the terminal device parameter generates a first core network key by using a third key generation algorithm, and the first core network key is used to generate an integrity check code.
  • the first root key is the same as the third root key according to the preset setting, and the first key generation algorithm is the same as the second key generation algorithm, and Because the process of calculating the first terminal key and calculating the first core network key are based on the terminal device parameters and the core network device parameters, the calculated first terminal key is the same as the first core network key.
  • the first integrity algorithm is preset in the terminal device, and the second integrity check code is obtained by calculating the attach and accept information by using the first integrity algorithm and the first terminal key.
  • a second integrity algorithm is preset in the core network device, and the first integrity check code is obtained by calculating the attachment acceptance information by using the second integrity algorithm and the first core network key. If the terminal device allows access to the core network device, the first integrity algorithm is preset to be the same as the second integrity algorithm.
  • the first integrity algorithm is the same as the second integrity algorithm, and the first integrity check code is calculated and the second integrity check code is calculated.
  • the calculation of the attachment acceptance information is performed. Therefore, in the case where the identity of the core network device is legal, the first integrity check code is the same as the second integrity check code.
  • the terminal device determines whether the identity of the core network device is legal by comparing whether the first integrity check code and the second integrity check code are the same.
  • the terminal device generates the first terminal key according to the first root key, the terminal device parameter, and the core network device parameter.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices. Therefore, the terminal devices of different terminal devices have different identity identifiers, and the first terminal keys generated by different terminal devices are different, so that the first terminal generated by different terminal devices can be distinguished. Terminal key.
  • the terminal device identity identifier may be an international mobile subscriber identity (IMSI) of the terminal device.
  • IMSI international mobile subscriber identity
  • other parameters that can distinguish different terminal devices may be used as the terminal device identity identifier. limited.
  • the terminal random number is a data randomly generated by the terminal device, and the terminal random number is used as the terminal device parameter, which can ensure that the terminal device parameter is not easily counterfeited, thereby improving the security of the terminal device parameter, and further improving the acquisition of the first terminal key. safety.
  • the core network device parameters may include multiple forms.
  • the core network device parameters include: a core network device identity identifier and a core network random number generated by the core network device.
  • the core network device identifier is used to distinguish different core network devices. Therefore, when the terminal device performs information interaction with different core network devices, the core network device identifiers in the core network device parameters are different, resulting in the terminal.
  • the first terminal key generated by the device is different, so that the first terminal key generated when the terminal device performs information interaction with different core network devices can be distinguished.
  • each core network device may be assigned a different core network label in advance, and each core network device is distinguished by the core network label.
  • the core network label may be used as the core network device identifier.
  • the core network device identity identifier which is not limited in this embodiment.
  • the core network random number is a data randomly generated by the core network device, and is not easily attacked by multiple times of data capture.
  • the core network random number is used as a core network device parameter, which can ensure that the core network device parameters are not easily counterfeited, thereby improving the core.
  • the security of the network device parameters further improves the security of obtaining the first terminal key.
  • the terminal device generates a first terminal key by using a first key generation algorithm.
  • the first key generation algorithm may be a plurality of forms of key generation algorithms.
  • the first key generation algorithm may be the HMAC-SHA-256 algorithm.
  • the HMAC-SHA-256 algorithm contains the following formula:
  • Equation (1) the Derived Key is the first terminal key
  • the RootKey is the first key in the terminal device
  • S is the key. Calculate the parameters.
  • the character length of the formula is usually 256 bits. In the embodiment of the present application, the lower 128 bits can be used as the first terminal key.
  • the NET ID is a core network label as a core network device identity;
  • L0 is a byte length of the Algorithm Type Distinguisher;
  • L1 is a byte of the NET ID.
  • NET Rand is the core network random number
  • L2 is the byte length of the core network random number NET Rand
  • IMSI is the terminal device international mobile user flag as the terminal device identity
  • L3 is the IMSI byte length
  • UE Rand is the terminal Random number
  • L4 is the byte length of the terminal random number UE Rand.
  • the value of S can be obtained by the formula (2), and then the value of S is brought to the formula (1), and the first terminal key is calculated.
  • the terminal device acquires the second integrity check code by using a preset first integrity algorithm based on the first terminal key and the attach accepting information, where the first integrity algorithm may be in multiple forms, for example, An integrity algorithm can use AES-128-CMAC, and its algorithm diagram is shown in Figure 5.
  • the integrity check code is calculated according to the information count, the information, the information direction, the fixed numerical parameter, and the key used for integrity protection.
  • the information is the information applied when calculating the integrity check code.
  • the second integrity check code is calculated, the information is the attach and accept information.
  • the information direction of the applied information is uplink, the information direction is usually The value is 0. If the information direction of the applied information is Down, the information direction is usually 1; the fixed value is usually 0.
  • step S14 of the embodiment of the present application the operation of the terminal device to acquire the encrypted attachment completion information is disclosed.
  • the terminal device obtains the encrypted attachment completion information, including the following steps:
  • the terminal device generates a second terminal key by using a preset second key generation algorithm based on the preset second root key, the terminal device parameter, and the core network device parameter included in the attachment accepting information; Then, after generating the attachment completion information, the terminal device encrypts the attachment completion information by using a preset first encryption and decryption algorithm based on the second terminal key.
  • the second root key is preset in the terminal device, and the core network device parameter is included in the attach accepting information.
  • the terminal device After receiving the attachment accepting information, the terminal device acquires the core network device parameter, and then generates a second terminal key according to the second root key, the terminal device parameter and the core network device parameter, and the second key generation algorithm, where the second The terminal key is used to encrypt and protect the interactive information.
  • the fourth root key is preset, and after receiving the attach request information transmitted by the terminal device, the core network device is included in the fourth root key, the core network device parameter, and the attach request information.
  • the terminal device parameter generates a second core network key by using a fourth key generation algorithm, and the second core network key is used to encrypt and protect the interactive information.
  • the second key is set in advance to be the same as the fourth key, and the second key generation algorithm is the same as the fourth key generation algorithm, and In the process of calculating the second terminal key and the second core network key, both the terminal device parameter and the core network device parameter are used. Therefore, the second terminal key is the same as the second core network key.
  • the first encryption and decryption algorithm is preset in the terminal device to encrypt the attachment completion information by the first encryption and decryption algorithm.
  • a second encryption and decryption algorithm is preset in the core network device to decrypt the attachment completion information by the second encryption and decryption algorithm. If the terminal device is allowed to access the core network device, the first encryption and decryption algorithm is preset to be the same as the second encryption and decryption algorithm, so that the core network device can decrypt the information encrypted by the terminal device.
  • the terminal device generates a second terminal key according to the second root key, the terminal device parameter, and the core network device parameter.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and the terminal devices of different terminal devices have different identity identifiers, so the second terminal keys generated by different terminal devices are different, so that the second terminal generated by different terminal devices can be distinguished. Terminal key.
  • the terminal device identity identifier may be an international mobile subscriber identity (IMSI) of the terminal device.
  • IMSI international mobile subscriber identity
  • other parameters that can distinguish different terminal devices may be used as the terminal device identity identifier. limited.
  • the terminal random number is a data randomly generated by the terminal device, and the terminal random number is used as the terminal device parameter, which can ensure that the terminal device parameter is not easily counterfeited, thereby improving the security of the terminal device parameter, and further improving the acquisition of the second terminal key. safety.
  • the core network device parameters may include multiple forms.
  • the core network device parameters include: a core network device identity identifier and a core network random number generated by the core network device.
  • the core network device identifier is used to distinguish different core network devices. Therefore, when the terminal device performs information interaction with different core network devices, the core network device identifiers in the core network device parameters are different, resulting in the terminal.
  • the second terminal key generated by the device is different, so that the second terminal key generated when the terminal device performs information interaction with different core network devices can be distinguished.
  • each core network device may be assigned a different core network label in advance, and each core network device is distinguished by the core network label.
  • the core network label may be used as the core network device identifier.
  • the core network device identity identifier which is not limited in this embodiment.
  • the core network random number is a data randomly generated by the core network device, and is not easily attacked by multiple times of data capture.
  • the core network random number is used as a core network device parameter, which can ensure that the core network device parameters are not easily counterfeited, thereby improving the core.
  • the security of the network device parameters further improves the security of acquiring the second terminal key.
  • the terminal device generates a second terminal key by using a second key generation algorithm.
  • the second key generation algorithm may adopt various forms of key generation algorithms.
  • the second key generation algorithm may also be an HMAC-SHA-256 algorithm. That is to say, the second terminal key can be calculated by the formula (1) and the formula (2).
  • the Derived Key is the second terminal key
  • the RootKey is the first key in the terminal device
  • S is the key calculation parameter.
  • the length of the character output by the formula is usually 256 bits. In the embodiment of the present application, the lower 128 bits may be used as the second terminal key.
  • the NET ID is the core network label as the core network device identity;
  • L0 is the byte length of the Algorithm Type Distinguisher;
  • L1 is the byte of the NET ID.
  • NET Rand is the core network random number
  • L2 is the byte length of the core network random number NET Rand
  • IMSI is the terminal device international mobile user flag as the terminal device identity
  • L3 is the IMSI byte length
  • UE Rand is the terminal Random number
  • L4 is the byte length of the terminal random number UE Rand.
  • the first key and the second key preset in the terminal device may be encrypted, and when needed, the terminal device decrypts the device and then decrypts it separately.
  • the first first key generates a first terminal key
  • the second terminal key is generated by the decrypted second root key.
  • the encryption and decryption manners of the first key and the second key may be the same or different, and the embodiment of the present application does not limit this.
  • first root key and the second root key may be the same root key, that is, the terminal device generates the first terminal key and the second terminal key by using the same root key, or the first root key and the first key
  • the two keys are different root keys, which are not limited in this embodiment.
  • the attachment acceptance information and the attachment completion information both include an integrity check code.
  • the partial information structure of the attachment acceptance information and the attachment completion information may be as follows:
  • the Sec Hdr Type is used to indicate the security type of the information.
  • a preset value for example, 11
  • the integrity check code is set in the message; "Reserved” is the reserved field; the "MAC” field constitutes the 32-bit integrity check code; the sequence number is the information count.
  • the present application discloses an information interaction method by using a second embodiment, where the method is applied to a core network device, where the core network device can perform information interaction between the wireless access network device and the terminal device, and the terminal device can perform
  • the information exchange method disclosed in the first embodiment of the present application, the core network device, when performing the information interaction method disclosed in the second embodiment of the present application, the operations performed by the terminal device can refer to the content disclosed in the first embodiment of the present application.
  • the information interaction method disclosed in the embodiment of the present application includes:
  • Step S21 The core network device receives the attachment request information transmitted by the terminal device.
  • the terminal device When the terminal device needs to access the core network device, the terminal device generates the attach request information, and transmits the attach request information to the radio access network device, and then the radio access network device transmits the information to the core network device, so that the core network device can The attachment request information is received.
  • terminal device parameters may be included.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and can be an international mobile subscriber identity (IMSI) of the terminal device.
  • IMSI international mobile subscriber identity
  • Step S22 After generating the attach accepting information, the core network device acquires a first integrity check code based on the attach accepting information, and transmits, to the terminal device, the first integrity check code added Attach the acceptance information.
  • a second integrity algorithm is preset in the core network device. After receiving the attach request information, the core network device can calculate the attach accept information according to a preset second integrity algorithm, and obtain a corresponding first integrity check code. Then, the core network device adds the first integrity check code to the attach accepting information, and transmits the attach accepting information that adds the first integrity check code to the radio access network device to The terminal device.
  • Step S23 The core network device receives the encrypted attachment completion information transmitted by the terminal device, where the attachment completion information includes a third integrity check code of the terminal device.
  • the terminal device After receiving the attachment acceptance information, the terminal device calculates the attachment acceptance information to obtain a second integrity check code.
  • the terminal device generally performs calculation according to a preset first integrity algorithm when calculating the attachment acceptance information.
  • the core network device calculates the attachment acceptance information through a preset second integrity algorithm to obtain a first integrity check code. If the terminal device is allowed to access the core network device, the first integrity algorithm is preset to be the same as the second integrity algorithm. That is to say, the terminal device and the core network device use the same integrity algorithm for integrity verification.
  • the terminal device determines that the identity of the core network device is legal. That is to say, in the embodiment of the present application, the terminal device performs identity authentication on the core network device by using an integrity check code.
  • the terminal device After determining that the identity of the core network device is legal (that is, the first integrity check code and the second integrity check code are the same), the terminal device generates attachment completion information, and then encrypts the attachment completion information, thereby Obtain encrypted attachment completion information. Then, the terminal device uses the first integrity algorithm to calculate the encrypted attachment completion information, obtains a third integrity check code, and adds the third integrity check code to the encrypted attachment completion information. The attachment completion information added with the third integrity check code is transmitted to the core network device by the wireless access network device.
  • Step S24 The core network device acquires a fourth integrity check code based on the encrypted attachment completion information.
  • the core network device can calculate the attachment completion information according to the second integrity algorithm to obtain the fourth integrity check code.
  • Step S25 If the third integrity check code is the same as the fourth integrity check code, the core network device decrypts the encrypted attach complete information, and after the decryption succeeds, determines the The terminal device accesses the core network device.
  • the core network device determines that the third integrity check code is the same as the fourth integrity check code, it may determine that the identity of the terminal device is legal. That is, the core network device implements identity authentication of the terminal device by using the third integrity check code included in the attach complete information.
  • the terminal device encrypts the attachment completion information to improve the security of the attachment completion information.
  • the terminal device usually encrypts the attachment completion information by using a preset first encryption and decryption method, and after receiving the attachment completion information, the core network device decrypts the attachment completion information by using a preset second encryption and decryption method. If the terminal device allows access to the core network device, the first encryption and decryption method is preset to be the same as the second encryption and decryption method.
  • the core network device can decrypt the attachment completion information according to the second encryption and decryption method, the information exchanged between the terminal device and the core network device can be encrypted and decrypted. Then, it is determined that the terminal device accesses the core network device.
  • the terminal device and the core network device can continue to perform information interaction.
  • the terminal device transmits the acquired detection data to the core network device through the wireless access network device, and the core
  • the network device transmits instruction information and the like to the terminal device through the wireless access network device.
  • the sender of the information may add an integrity check code calculated according to the information to the interactive information, and encrypt the information.
  • the receiving end that receives the information calculates the information and obtains a corresponding integrity check. If the integrity check code obtained by the calculation is the same as the integrity check code added in the information, the receiving end may determine that the received end is received.
  • the information is complete, and after determining that the received information is complete, it can be decrypted according to a preset encryption and decryption algorithm, thereby improving the security of the communication system.
  • the embodiment of the present application discloses an information interaction method. After receiving the attachment request information transmitted by the terminal device, the core network device generates the attachment acceptance information, and acquires the first integrity check code based on the attachment acceptance information, and Adding the first integrity check code to the attach accepting information, and then transmitting the attach accepting information to the terminal device; the terminal device receiving the attach accepting information transmitted by the core network device, and acquiring the second according to the attaching and receiving information An integrity check code; if the first integrity check code and the second integrity check code are the same, the terminal device determines that the identity of the core network device is legal, that is, the terminal device includes the information included in the attach The first integrity check code implements identity authentication for the core network.
  • the terminal device generates attachment completion information and encrypts the attachment completion information, and then acquires a third integrity criterion based on the encrypted attachment completion information.
  • the code is verified, and the third integrity check code is added to the encrypted attachment completion information, and then transmitted to the core network device.
  • the core network device acquires the fourth integrity check code based on the attachment completion information, if the third integrity check code
  • the core network device determines that the identity of the terminal device is legal, that is, the core network device implements identity authentication of the terminal device by using the fourth integrity check code included in the attachment completion information, and then, The core network device decrypts the attachment completion information. If the decryption is successful, it determines that the terminal device accesses the core network device.
  • the information interaction method disclosed in the embodiment of the present application only needs to transmit the attachment request information, the attachment acceptance information, and the attachment completion information between the terminal device and the core network device, that is, only Three times of information interaction is required to achieve authentication and data protection for the identity of the other party.
  • the solution disclosed in the embodiment of the present application reduces the flow of data interaction and reduces the amount of information of information exchanged between the terminal device and the core network device, thereby reducing the security of the communication system.
  • step S22 after the core network device generates the attachment acceptance information, the operation of acquiring the first integrity check code based on the attachment acceptance information is disclosed.
  • the obtaining the first integrity check code based on the attach accepting information includes the following steps:
  • the core network device generates the first core network secret by using a preset third key generation algorithm based on the preset third root key, the core network device parameter, and the terminal device parameter included in the attach request information. And the core network device obtains the first integrity check code by using a preset second integrity algorithm based on the first core network key and the attach accepting information.
  • the first root key is preset in the terminal device, and the core network device parameter is included in the attach accepting information.
  • the terminal device After receiving the attachment accepting information, the terminal device generates a first terminal key according to the first root key, the terminal device parameter, and the core network device parameter included in the attach and receive information, and the first key generation algorithm, where the first terminal The key is used to generate an integrity check code.
  • a third root key is preset in the core network device, and after receiving the attach request information transmitted by the terminal device, the core network device can be configured according to the third root key, the core network device parameter, and the attach request information.
  • the included terminal device parameter generates a first core network key by using a third key generation algorithm, and the first core network key is used to generate an integrity check code.
  • the first root key is the same as the third root key according to the preset setting, and the first key generation algorithm is the same as the second key generation algorithm, and Because the process of calculating the first terminal key and calculating the first core network key are based on the terminal device parameters and the core network device parameters, the calculated first terminal key is the same as the first core network key.
  • the first integrity algorithm is preset in the terminal device, and the second integrity verification code is obtained by calculating the attachment acceptance information by using the first integrity algorithm.
  • the second integrity algorithm is preset in the core network device, and the first integrity check code can be obtained by calculating the attachment acceptance information by using the second integrity algorithm. If the terminal device allows access to the core network device, the first integrity algorithm is preset to be the same as the second integrity algorithm.
  • the first integrity algorithm is the same as the second integrity algorithm, and the first integrity check code is calculated and the second integrity check code is calculated.
  • the calculation of the attachment acceptance information is performed. Therefore, in the case where the identity of the core network device is legal, the first integrity check code is the same as the second integrity check code.
  • the terminal device determines whether the identity of the core network device is legal by comparing whether the first integrity check code and the second integrity check code are the same.
  • the core network device generates the first core network key according to the third root key, the core network device parameter, and the terminal device parameter.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and the terminal devices of different terminal devices have different identity identifiers, so that the first core network secret generated by the core network device when interacting with different terminal devices can be distinguished. key.
  • the terminal device identity identifier may be an international mobile subscriber identity (IMSI) of the terminal device.
  • IMSI international mobile subscriber identity
  • other parameters that can distinguish different terminal devices may be used as the terminal device identity identifier. limited.
  • the terminal random number is a data randomly generated by the terminal device, and the terminal random number is used as the terminal device parameter, which can ensure that the terminal device parameter is not easily counterfeited, thereby improving the security of the terminal device parameter, and further improving the acquisition of the first core network key. Security.
  • the core network device parameters may include multiple forms.
  • the core network device parameters include: a core network device identity identifier and a core network random number generated by the core network device.
  • the core network device identifier is used to distinguish different core network devices. Therefore, the first core network keys generated by different core network devices are different, so that the first core network secret generated by different core network devices can be distinguished. key.
  • each core network device may be assigned a different core network label in advance, and each core network device is distinguished by the core network label.
  • the core network label may be used as the core network device identifier.
  • the core network device identity identifier which is not limited in this embodiment.
  • the core network random number is a data randomly generated by the core network device, and is not easily attacked by multiple times of data capture.
  • the core network random number is used as a core network device parameter, which can ensure that the core network device parameters are not easily counterfeited, thereby improving the core.
  • the security of the network device parameters further improves the security of obtaining the first core network key.
  • the core network device generates a first core network key by using a third key generation algorithm.
  • the third key generation algorithm may be a plurality of forms of key generation algorithms.
  • the third key generation algorithm may be the HMAC-SHA-256 algorithm. That is, the core network device can generate the first core network key according to formula (1) and formula (2).
  • the core network device adopts the HMAC-SHA-256 algorithm when calculating the first core network key.
  • the Derived Key is the first core network key
  • the RootKey is the third root in the core network device.
  • S is the key calculation parameter.
  • the character length of the formula (1) is usually 256 bits. In the embodiment of the present application, the lower 128 bits may be used as the first core network key.
  • the NET ID is the core network label of the core network device identity; L0 is the byte length of the Algorithm Type Distinguisher; L1 is the byte length of the core network label NET ID; NET Rand is the core network random number; L2 is the core network random number The byte length of the NET Rand; the IMSI is the terminal device international mobile subscriber identity as the terminal device identity; L3 is the byte length of the IMSI; the UE Rand is the terminal random number; and L4 is the byte length of the terminal random number UE Rand.
  • the value of S can be obtained by the formula (2), and then the value of S is brought to the formula (1), and the first core network key is calculated.
  • the core network device obtains the first integrity check code by using a preset second integrity algorithm based on the first core network key and the attach accepting information, where the second integrity algorithm may be in multiple forms, for example,
  • the second integrity algorithm can adopt AES-128-CMAC, and the algorithm diagram is shown in FIG. 5.
  • the integrity check code can be calculated based on the information count, information, information direction, fixed numerical parameters, and the key used for integrity protection.
  • the information is information used when calculating the integrity check code, wherein when the first integrity check code is calculated, the information is the attach accept information; and if the information direction of the applied information is uplink, the information The direction is usually 0. If the information direction of the applied information is downlink, the information direction usually takes the value 1.
  • the fixed value parameter usually takes the value 0.
  • step S25 of the embodiment of the present application the operation of decrypting the encrypted attachment completion information by the core network device is disclosed.
  • Decrypting the encrypted attachment completion information by the core network device generally includes the following steps:
  • the core network device generates a second core network secret by using a preset fourth key generation algorithm based on a preset fourth root key, a core network device parameter, and a terminal device parameter included in the attach request information. Key; then, the core network device decrypts the encrypted attachment completion information by a preset second encryption and decryption algorithm based on the second core network key.
  • the second root key is preset in the terminal device, and the terminal device parameter is included in the attach request information.
  • the terminal device After receiving the attachment accepting information, the terminal device acquires the core network device parameter, and then generates a second terminal device key according to the second root key, the terminal device parameter, and the core network device parameter, and the second key generation algorithm, where the The second terminal device key is used to encrypt and protect the interactive information.
  • the fourth root key is preset, and after receiving the attach request information transmitted by the terminal device, the core network device is included in the fourth root key, the core network device parameter, and the attach request information.
  • the terminal device parameter generates a second core network device key by using a fourth key generation algorithm, and the second core network device key is used to encrypt and protect the interactive information.
  • the second key is set in advance to be the same as the fourth key, and the second key generation algorithm is the same as the fourth key generation algorithm, and In the process of calculating the second terminal device key and calculating the second core network device key, both the terminal device parameter and the core network device parameter are used. Therefore, the second terminal device key is the same as the second core network device key.
  • the first encryption and decryption algorithm is preset in the terminal device to encrypt the attachment completion information by the first encryption and decryption algorithm.
  • a second encryption and decryption algorithm is preset in the core network device to decrypt the attachment completion information by the second encryption and decryption algorithm. If the terminal device is allowed to access the core network device, the first encryption and decryption algorithm is preset to be the same as the second encryption and decryption algorithm, so that the core network device can decrypt the information encrypted by the terminal device.
  • the core network device generates the second core network key according to the fourth root key, the core network device parameter, and the terminal device parameter.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device.
  • the terminal device identifier can distinguish different terminal devices, and the terminal devices of different terminal devices have different identity identifiers, so that the second core network secret generated by the core network device when interacting with different terminal devices can be distinguished. key.
  • the terminal device identity identifier may be an international mobile subscriber identity (IMSI) of the terminal device.
  • IMSI international mobile subscriber identity
  • other parameters that can distinguish different terminal devices may be used as the terminal device identity identifier. limited.
  • the terminal random number is a data randomly generated by the terminal device, and the terminal random number is used as the terminal device parameter, which can ensure that the terminal device parameter is not easily counterfeited, thereby improving the security of the terminal device parameter, and further improving the acquisition of the second core network key. Security.
  • the core network device parameters may include multiple forms.
  • the core network device parameters include: a core network device identity identifier and a core network random number generated by the core network device.
  • the core network device identifier is used to distinguish different core network devices. Therefore, the second core network keys generated by different core network devices are different, so that the second core network secret generated by different core network devices can be distinguished. key.
  • each core network device may be assigned a different core network label in advance, and each core network device is distinguished by the core network label.
  • the core network label may be used as the core network device identifier.
  • the core network device identity identifier which is not limited in this embodiment.
  • the core network random number is a data randomly generated by the core network device, and is not easily attacked by multiple times of data capture.
  • the core network random number is used as a core network device parameter, which can ensure that the core network device parameters are not easily counterfeited, thereby improving the core.
  • the security of the network device parameters further improves the security of acquiring the second core network key.
  • the core network device generates a second core network key by using a fourth key generation algorithm.
  • the fourth key generation algorithm may adopt various forms of key generation algorithms.
  • the fourth key generation algorithm may also be an HMAC-SHA-256 algorithm. That is to say, the second core network key can be calculated by the formula (1) and the formula (2).
  • the Derived Key is the second core network key
  • the RootKey is the fourth key in the core network device
  • S is the key calculation parameter.
  • the character length of the formula is usually 256 bits. In the embodiment of the present application, the lower 128 bits can be used as the second core network key.
  • the third root key and the fourth root key may be encrypted, and when needed, the core network device decrypts the network and then decrypts the third.
  • the root key generates a first core network key
  • the second core network key is generated by the decrypted fourth key.
  • the core network device can use the same encryption and decryption algorithm, and can also use different encryption and decryption algorithms for the encryption and decryption of the third and fourth keys.
  • the third root key and the fourth root key may be the same root key, that is, the core network device generates the first core network key and the second core network key by using the same root key.
  • the third root key and the fourth root key are different root keys, which are not limited in this embodiment of the present application.
  • the present application discloses an information interaction apparatus through a third embodiment.
  • the device is applied to the terminal device in FIG. 1 , and the terminal device is capable of performing information interaction between the wireless access network device and the core network device, and performing the information interaction method disclosed in the first embodiment of the present application.
  • the information interaction apparatus disclosed in the embodiment of the present application includes: a first sending module 100, a first receiving module 200, and a first processing module 300.
  • the first sending module 100 is configured to transmit the attach request information to the core network device.
  • terminal device parameters may be included.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device.
  • the first receiving module 200 is configured to receive the attachment accepting information transmitted by the core network device, where the attach accepting information includes a first integrity check code of the core network device.
  • the core network device After receiving the attachment request information, the core network device generates attachment acceptance information, calculates the attachment acceptance information, obtains a first integrity check code, and adds the first integrity check code to the attachment acceptance. In the information, the attachment acceptance information added with the first integrity check code is transmitted to the terminal device through the wireless access device.
  • the first processing module 300 is configured to obtain a second integrity check code based on the attach accepting information, where the first integrity check code and the second integrity check code are the same, the first The processing module is configured to obtain the encrypted attachment completion information, and obtain a third integrity check code based on the encrypted attachment completion information, and trigger the first sending module to transmit the third integrity to the core network device. Integrity check code and encrypted attachment completion information.
  • the first processing module 300 generally performs calculation according to a preset first integrity algorithm to obtain a second integrity check code.
  • the core network device calculates the attachment acceptance information by using a preset second integrity algorithm to obtain the first integrity check code.
  • the preset is preset.
  • the first integrity algorithm is the same as the second integrity algorithm.
  • the terminal device determines that the identity of the core network device is legal. After determining that the identity of the core network device is legal, the first processing module 300 generates the attachment completion information, and then encrypts the attachment completion information to obtain the encrypted attachment completion information, and then completes the encryption attachment using the first integrity algorithm. The information is calculated, the third integrity check code is obtained, and the third integrity check code is added to the encrypted attach completion information.
  • the core network device can calculate the attachment completion information according to the second integrity algorithm to obtain the fourth integrity check code. Moreover, if the core network device determines that the third integrity check code is the same as the fourth integrity check code, it may determine that the identity of the terminal device is legal. That is, the core network device implements identity authentication of the terminal device by using the third integrity check code included in the attach complete information.
  • the first integrity algorithm is the same as the second integrity algorithm.
  • the first processing module encrypts the attachment completion information, and generally encrypts the attachment completion information by using a preset first encryption and decryption method, and the core network device adopts the preset second after receiving the attachment completion information.
  • the encryption and decryption method decrypts the attachment completion information. If the terminal device allows access to the core network device, the first encryption and decryption method is preset to be the same as the second encryption and decryption method. In this case, after the identity of the terminal device is determined according to the integrity check code, if the core network device can decrypt the attachment completion information according to the second encryption and decryption method, the information exchanged between the terminal device and the core network device is described. The encryption and decryption can be performed on each other to determine that the terminal device accesses the core network device.
  • the solution disclosed in the embodiment of the present application reduces the flow of data interaction and reduces the amount of information of information exchanged between the terminal device and the core network device, thereby reducing the security of the communication system.
  • the first processing module is specifically configured to generate, by using a preset first key generation algorithm, based on a preset first root key, a terminal device parameter, and a core network device parameter included in the attach and receive information. And obtaining, by the preset first integrity algorithm, the second integrity check code, based on the first terminal key and the attach accepting information.
  • the first root key is preset in the terminal device, and the core network device parameter is included in the attach accepting information.
  • the terminal device After receiving the attachment accepting information, the terminal device generates a first terminal key according to the first root key, the terminal device parameter, and the core network device parameter included in the attach and receive information, and the first key generation algorithm, where the first terminal The key is used to generate an integrity check code.
  • a third root key is preset in the core network device, and after receiving the attach request information transmitted by the terminal device, the core network device can include the third root key, the core network device parameter, and the attach request information.
  • the terminal device parameter generates a first core network key by using a third key generation algorithm, and the first core network key is used to generate an integrity check code.
  • the first root key is the same as the third root key according to the preset setting, and the first key generation algorithm is the same as the second key generation algorithm, and Because the process of calculating the first terminal key and calculating the first core network key are based on the terminal device parameters and the core network device parameters, the calculated first terminal key is the same as the first core network key.
  • the first integrity algorithm is preset in the terminal device, and the second integrity check code is obtained by calculating the attach and accept information by using the first integrity algorithm and the first terminal key.
  • a second integrity algorithm is preset in the core network device, and the first integrity check code is obtained by calculating the attachment acceptance information by using the second integrity algorithm and the first core network key. If the terminal device allows access to the core network device, the first integrity algorithm is preset to be the same as the second integrity algorithm.
  • the first integrity algorithm is the same as the second integrity algorithm, and the first integrity check code is calculated and the second integrity check code is calculated.
  • the calculation of the attachment acceptance information is performed. Therefore, in the case where the identity of the core network device is legal, the first integrity check code is the same as the second integrity check code.
  • the terminal device determines whether the identity of the core network device is legal by comparing whether the first integrity check code and the second integrity check code are the same.
  • the first processing module is specifically configured to generate, by using a preset second key generation algorithm, based on the preset second root key, the terminal device parameter, and the core network device parameter included in the attach accepting information. And the second terminal key, and after generating the attachment completion information, encrypting the attachment completion information by using a preset first encryption and decryption algorithm based on the second terminal key.
  • the second root key is preset in the terminal device, and the core network device parameter is included in the attach accepting information.
  • the terminal device After receiving the attachment accepting information, the terminal device acquires the core network device parameter, and then generates a second terminal key according to the second root key, the terminal device parameter and the core network device parameter, and the second key generation algorithm, where the second The terminal key is used to encrypt and protect the interactive information.
  • the fourth root key is preset, and after receiving the attach request information transmitted by the terminal device, the core network device is included in the fourth root key, the core network device parameter, and the attach request information.
  • the terminal device parameter generates a second core network key by using a fourth key generation algorithm, and the second core network key is used to encrypt and protect the interactive information.
  • the second key is set in advance to be the same as the fourth key, and the second key generation algorithm is the same as the fourth key generation algorithm, and In the process of calculating the second terminal key and the second core network key, both the terminal device parameter and the core network device parameter are used. Therefore, the second terminal key is the same as the second core network key.
  • the first encryption and decryption algorithm is preset in the terminal device to encrypt the attachment completion information by the first encryption and decryption algorithm.
  • a second encryption and decryption algorithm is preset in the core network device to decrypt the attachment completion information by the second encryption and decryption algorithm. If the terminal device is allowed to access the core network device, the first encryption and decryption algorithm is preset to be the same as the second encryption and decryption algorithm, so that the core network device can decrypt the information encrypted by the terminal device.
  • the terminal device parameter generally includes: a terminal device identity identifier and a terminal random number generated by the terminal device
  • the core network device parameter includes: a core network device identity identifier and the core network The core network random number generated by the device.
  • the present application discloses an information interaction device by using a fourth embodiment, where the device is applied to a core network device, and the core network device can perform information interaction between the wireless access network device and the terminal device, and execute the application.
  • the information interaction method disclosed in the second embodiment is the same as the first embodiment.
  • the information interaction apparatus disclosed in the embodiment of the present application includes: a second receiving module 400, a second sending module 500, and a second processing module 600.
  • the second receiving module 400 is configured to receive the attach request information transmitted by the terminal device.
  • the terminal device When the terminal device needs to access the core network device, the terminal device generates the attachment request information, and transmits the information to the second receiving module 400 through the wireless access network device.
  • the attach request information terminal device parameters may be included.
  • the second processing module 600 is configured to acquire a first integrity check code based on the attach accepting information, and trigger the second sending module 500 to transmit the added identifier to the terminal device after generating the attach accepting information. Attachment acceptance information of the first integrity check code.
  • a second integrity algorithm is preset in the core network device. After receiving the attach request information, the second processing module 600 can calculate the attach accept information according to a preset second integrity algorithm, and obtain a corresponding first integrity check code. Then, the second processing module 600 adds the first integrity check code to the attach accepting information, and adds the attach accepting information of the first integrity check code to the radio access network device. Transfer to the terminal device.
  • the second receiving module 400 is further configured to receive encrypted attachment completion information transmitted by the terminal device, where the attachment completion information includes a third integrity check code of the terminal device.
  • the terminal device After receiving the attachment acceptance information, the terminal device calculates the attachment acceptance information to obtain a second integrity check code.
  • the terminal device generally performs calculation according to a preset first integrity algorithm when calculating the attachment acceptance information.
  • the core network device calculates the attachment acceptance information through a preset second integrity algorithm to obtain a first integrity check code. If the terminal device is allowed to access the core network device, the first integrity algorithm is preset to be the same as the second integrity algorithm. That is to say, the terminal device and the core network device use the same integrity algorithm for integrity verification. In this case, if the first integrity check code and the second integrity check code are the same, the terminal device determines that the identity of the core network device is legal.
  • the terminal device After determining that the identity of the core network device is legal, the terminal device generates attachment completion information, and then encrypts the attachment completion information to obtain encrypted attachment completion information. Then, the terminal device uses the first integrity algorithm to calculate the encrypted attachment completion information, obtains a third integrity check code, and adds the third integrity check code to the encrypted attachment completion information. The attachment completion information added with the third integrity check code is transmitted to the core network device by the wireless access network device, so that the core network device acquires the attachment completion information through the second receiving module 500.
  • the second processing module 600 is further configured to obtain a fourth integrity check code based on the encrypted attach complete information, if the third integrity check code is the same as the fourth integrity check code, The second processing module 600 decrypts the encrypted attachment completion information, and after the decryption succeeds, determines that the terminal device accesses the core network device.
  • the second processing module 600 is configured to calculate the attachment completion information according to the second integrity algorithm to obtain a fourth integrity check code. If it is determined that the third integrity check code is the same as the fourth integrity check code, it may be determined that the identity of the terminal device is legal.
  • the terminal device encrypts the attachment completion information to improve the security of the attachment completion information.
  • the terminal device usually encrypts the attachment completion information by using a preset first encryption and decryption method, and after receiving the attachment completion information, the core network device decrypts the attachment completion information by using a preset second encryption and decryption method. If the terminal device allows access to the core network device, the first encryption and decryption method is preset to be the same as the second encryption and decryption method.
  • the core network device can decrypt the attachment completion information according to the second encryption and decryption method, the information exchanged between the terminal device and the core network device can be encrypted and decrypted. Then, it is determined that the terminal device accesses the core network device.
  • the solution disclosed in the embodiment of the present application reduces the flow of data interaction and reduces the amount of information of information exchanged between the terminal device and the core network device, thereby reducing the security of the communication system.
  • the second processing module is specifically configured to preset by using a preset third root key, a core network device parameter, and a terminal device parameter included in the attach request information.
  • the third key generation algorithm generates a first core network key, and obtains the first integrity check by using a preset second integrity algorithm based on the first core network key and the attach accepting information. code.
  • the first root key is preset in the terminal device, and the core network device parameter is included in the attach accepting information.
  • the terminal device After receiving the attachment accepting information, the terminal device generates a first terminal key according to the first root key, the terminal device parameter, and the core network device parameter included in the attach and receive information, and the first key generation algorithm, where the first terminal The key is used to generate an integrity check code.
  • a third root key is preset in the core network device, and after receiving the attach request information transmitted by the terminal device, the core network device can be configured according to the third root key, the core network device parameter, and the attach request information.
  • the included terminal device parameter generates a first core network key by using a third key generation algorithm, and the first core network key is used to generate an integrity check code.
  • the first root key is the same as the third root key according to the preset setting, and the first key generation algorithm is the same as the second key generation algorithm, and Because the process of calculating the first terminal key and calculating the first core network key are based on the terminal device parameters and the core network device parameters, the calculated first terminal key is the same as the first core network key.
  • the first integrity algorithm is preset in the terminal device, and the second integrity verification code is obtained by calculating the attachment acceptance information by using the first integrity algorithm.
  • the second integrity algorithm is preset in the core network device, and the first integrity check code can be obtained by calculating the attachment acceptance information by using the second integrity algorithm. If the terminal device allows access to the core network device, the first integrity algorithm is preset to be the same as the second integrity algorithm.
  • the first integrity algorithm is the same as the second integrity algorithm, and the first integrity check code is calculated and the second integrity check code is calculated.
  • the calculation of the attachment acceptance information is performed. Therefore, in the case where the identity of the core network device is legal, the first integrity check code is the same as the second integrity check code.
  • the terminal device determines whether the identity of the core network device is legal by comparing whether the first integrity check code and the second integrity check code are the same.
  • the second processing module is specifically configured to preset by using a preset fourth root key, a core network device parameter, and a terminal device parameter included in the attach request information.
  • the fourth key generation algorithm generates a second core network key, and decrypts the encrypted attachment completion information by a preset second encryption and decryption algorithm based on the second core network key.
  • the second root key is preset in the terminal device, and the terminal device parameter is included in the attach request information.
  • the terminal device After receiving the attachment accepting information, the terminal device acquires the core network device parameter, and then generates a second terminal device key according to the second root key, the terminal device parameter, and the core network device parameter, and the second key generation algorithm, where the The second terminal device key is used to encrypt and protect the interactive information.
  • the fourth root key is preset, and after receiving the attach request information transmitted by the terminal device, the core network device is included in the fourth root key, the core network device parameter, and the attach request information.
  • the terminal device parameter generates a second core network device key by using a fourth key generation algorithm, and the second core network device key is used to encrypt and protect the interactive information.
  • the second key is set in advance to be the same as the fourth key, and the second key generation algorithm is the same as the fourth key generation algorithm, and In the process of calculating the second terminal device key and calculating the second core network device key, both the terminal device parameter and the core network device parameter are used. Therefore, the second terminal device key is the same as the second core network device key.
  • the first encryption and decryption algorithm is preset in the terminal device to encrypt the attachment completion information by the first encryption and decryption algorithm.
  • a second encryption and decryption algorithm is preset in the core network device to decrypt the attachment completion information by the second encryption and decryption algorithm. If the terminal device is allowed to access the core network device, the first encryption and decryption algorithm is preset to be the same as the second encryption and decryption algorithm, so that the core network device can decrypt the information encrypted by the terminal device.
  • the terminal device parameter includes: a terminal device identity identifier and a terminal random number generated by the terminal device
  • the core network device parameter includes: a core network device identity identifier and the core network device Generated core network random numbers.
  • the embodiment of the present application further discloses a terminal device, where the terminal device includes: a transceiver port, a processor, and a memory connected to the processor; wherein the transceiver port is used to communicate with a core network device. Interacting information and transmitting information received from the core network device to a processor; the memory storing instructions executable by the processor; the processor for acquiring a message transmitted by the transceiver port, And the information interaction method disclosed in the first embodiment of the present application is executed by executing a program or an instruction stored in the memory.
  • the embodiment of the present application further discloses a core network device, where the core network device includes: a transceiver port, a processor, and a memory connected to the processor; wherein the transceiver port is used between the transceiver device and the terminal device Performing information interaction and transmitting information received from the terminal device to a processor; the memory storing instructions executable by the processor; the processor is configured to acquire a message transmitted by the transceiver port, And the information interaction method disclosed in the second embodiment of the present application is executed by executing a program or an instruction stored in the memory.
  • the embodiment of the present application further provides a computer program product, comprising instructions for causing a computer to execute the information interaction method disclosed in the method embodiment disclosed in FIG. 2 when the instruction is run on a computer.
  • the embodiment of the present application further provides a computer program product, comprising instructions for causing a computer to execute the information interaction method disclosed in the method embodiment disclosed in FIG. 6 when the instruction is run on a computer.
  • the embodiment of the present application further provides a computer storage medium, where the computer storage medium can store a program, and the program can be implemented in the information interaction method in the method embodiment disclosed in FIG. 2 or FIG. Some or all of the steps.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).
  • the embodiment of the present application further provides a chip, the chip device includes a memory, a processor, and a computer program stored on the memory and operable on the processor, when the processor executes the computer program
  • the chip device includes a memory, a processor, and a computer program stored on the memory and operable on the processor, when the processor executes the computer program
  • the technology in the embodiments of the present application can be implemented by means of software plus a necessary general hardware platform.
  • the technical solution in the embodiments of the present application may be embodied in the form of a software product in essence or in the form of a software product, and the computer software product may be stored in a storage medium such as a ROM/RAM. , a diskette, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application or portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开一种信息交互方法及装置。该方法中，终端设备向核心网设备传输附着请求信息，接收核心网设备的附着接受信息，附着接受信息中包括第一完整性校验码；终端设备基于附着接受信息获取第二完整性校验码；若第一完整性校验码和第二完整性校验码相同，终端设备基于加密的附着完成信息获取第三完整性校验码，向核心网设备传输添加有第三完整性校验码且加密的附着完成信息。通过本申请实施例公开的方案，终端设备与核心网设备之间只需传输附着请求信息、附着接受信息和附着完成信息，减少数据交互的流程，并减少交互的信息的数据量，减少了终端设备与核心网设备进行信息交互过程的耗时，并能够减少终端设备的功耗开销。

Description

一种信息交互方法及装置
本申请要求在2017年11月3日提交中国专利局、申请号为201711071266.5、发明名称为“一种信息交互方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种信息交互方法及装置。
背景技术
目前一些通信系统中设置有终端设备和核心网设备，并且终端设备和核心网设备之间通常能够进行信息交互。例如，终端设备可将信息传输至无线接入网设备，再由无线接入网设备将该信息传输至核心网设备，实现终端设备与核心网设备的信息交互。
另外，为了保障通信系统的安全，终端设备与核心网设备之间在进行信息交互时，需要对对方进行身份认证，并对交互的信息进行数据保护。现有技术中，为了实现身份认证和数据保护，在终端设备首次接入核心网设备时，通常需要终端设备和核心网设备互相向对方传输自身的身份认证信息。这种情况下，终端设备会根据核心网设备的身份认证信息对核心网设备进行身份认证，以及核心网设备根据终端设备的身份认证信息对终端设备进行身份认证。在终端设备和核心网设备均通过身份认证后，核心网设备选择用于数据保护的完整性算法和加解密算法，并将选择的完整性算法和加解密算法传输至终端设备。终端设备确认是否支持核心网设备选择的完整性算法和加解密算法，并在确定支持后，终端设备向核心网设备发出相应的反馈。核心网设备在接收到反馈后，确认终端设备接入核心网设备。通过上述步骤，终端设备和核心网设备均对对方身份进行认证，并且完成完整性算法和加密算法的协商。之后终端设备与核心网设备进行信息时，交互的信息均进行完整性保护和加密保护，从而提高了通信系统的安全性。
但是，发明人在本申请的研究过程中发现，现有技术虽然能够保障通信系统的安全，但终端设备与核心网设备之间进行多次信息交互才能完成身份认证，以及确定用于数据保护的完整性算法和加解密算法，信息交互次数较多，并且交互的信息数据量较大，导致现有技术中存在信息交互过程耗时长，以及终端设备功耗开销高的问题。
发明内容
现有技术中，为了保障通信系统的安全，需要终端设备与核心网设备之间进行多次信息交互，且交互的信息数据量较大，导致现有技术存在信息交互过程耗时长，以及终端设备功耗开销高的问题。为了解决现有技术中的问题，本申请实施例公开一种信息交互方法及装置。
在本申请的第一方面，公开一种信息交互方法，包括：终端设备向核心网设备传输附着请求信息；所述终端设备接收所述核心网设备传输的附着接受信息，所述附着接受信息中包括所述核心网设备的第一完整性校验码；所述终端设备基于所述附着接受信息获取第 二完整性校验码；若所述第一完整性校验码和所述第二完整性校验码相同，所述终端设备获取加密的附着完成信息，并基于所述加密的附着完成信息获取第三完整性校验码，向所述核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息。
通过该信息交互方法，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。
结合第一方面，在第一方面第一种可能的实现方式中，所述终端设备基于所述附着接受信息获取第二完整性校验码，包括：所述终端设备基于预设的第一根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第一密钥生成算法生成第一终端密钥；所述终端设备基于所述第一终端密钥和所述附着接受信息，通过预设的第一完整性算法获取所述第二完整性校验码。
通过上述步骤，能够使终端获取第二完整性校验码，以便后续过程中，终端根据第二完整性校验码与第一完整性校验码是否相同，确定核心网身份的合法性。
结合第一方面，在第一方面第二种可能的实现方式中，所述终端设备获取加密的附着完成信息，包括：所述终端设备基于预设的第二根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第二密钥生成算法生成第二终端密钥；所述终端设备在生成附着完成信息后，基于所述第二终端密钥，通过预设的第一加解密算法对所述附着完成信息进行加密。
通过上述步骤，能够使终端对附着完成信息进行加密，以便后续过程中，核心网根据是否能够对接收到的附着完成信息进行解密，确定终端是否能够接入核心网。
结合第一方面第一种可能的实现方式，或结合第一方面第二种可能的实现方式，在第一方面第三种可能的实现方式中，所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。其中，终端设备身份标识能够区分不同终端设备，并且终端随机数不易被仿冒，从而提高终端设备参数的安全性。
结合第一方面第一种可能的实现方式，或结合第一方面第二种可能的实现方式，在第一方面第四种可能的实现方式中，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。其中，核心网设备身份标识能够区分不同核心网设备，并且核心网随机数不易被仿冒，从而提高核心网设备参数的安全性。
在本申请的第二方面，公开一种信息交互方法，包括：核心网设备接收终端设备传输的附着请求信息；所述核心网设备在生成附着接受信息后，基于所述附着接受信息，获取第一完整性校验码，并向所述终端设备传输添加有所述第一完整性校验码的附着接受信息；所述核心网设备接收所述终端设备传输的加密的附着完成信息，所述附着完成信息中包含所述终端设备的第三完整性校验码；所述核心网设备基于所述加密的附着完成信息，获取第四完整性校验码；若所述第三完整性校验码与所述第四完整性校验码相同，所述核心网设备对所述加密的附着完成信息进行解密，并在解密成功后，确定所述终端设备接入核心网设备。
通过该信息交互方法，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。
结合第二方面，在第二方面第一种可能的实现方式中，所述基于所述附着接受信息，获取第一完整性校验码，包括：所述核心网设备基于预设的第三根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第三密钥生成算法生成第一核心网密钥；所述核心网设备基于所述第一核心网密钥和所述附着接受信息，通过预设的第二完整性算法，获取所述第一完整性校验码。
通过上述步骤，能够使核心网设备获取第一完整性校验码，以便后续过程中，终端设备根据第二完整性校验码与第一完整性校验码是否相同，确定核心网身份的合法性。
结合第二方面，在第二方面第二种可能的实现方式中，所述核心网设备对所述加密的附着完成信息进行解密，包括：所述核心网设备基于预设的第四根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第四密钥生成算法生成第二核心网密钥；所述核心网设备基于所述第二核心网密钥，通过预设的第二加解密算法对所述加密的附着完成信息进行解密。
通过上述步骤，核心网设备能够根据是否对接收到的附着完成信息解密成功，确定终端设备是否能够接入核心网设备。
结合第二方面第一种可能的实现方式，或结合第二方面第二种可能的实现方式，在第二方面第三种可能的实现方式中，所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。
其中，终端设备身份标识能够区分不同终端设备，并且终端随机数不易被仿冒，从而提高终端设备参数的安全性。
结合第二方面第一种可能的实现方式，或结合第二方面第二种可能的实现方式，在第二方面第四种可能的实现方式中，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。
其中，核心网设备身份标识能够区分不同核心网设备，并且核心网随机数不易被仿冒，从而提高核心网设备参数的安全性。
在本申请的第三方面，公开一种信息交互装置，包括：第一发送模块、第一接收模块和第一处理模块；所述第一发送模块用于向核心网设备传输附着请求信息；所述第一接收模块用于接收所述核心网设备传输的附着接受信息，所述附着接受信息中包括所述核心网设备的第一完整性校验码；所述第一处理模块用于基于所述附着接受信息获取第二完整性校验码，若所述第一完整性校验码和所述第二完整性校验码相同，所述第一处理模块用于获取加密的附着完成信息，并基于所述加密的附着完成信息获取第三完整性校验码，并触发所述第一发送模块向所述核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息。
通过该信息交互装置，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。
结合第三方面，在第三方面第一种可能的实现方式中，所述第一处理模块具体用于基于预设的第一根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第一密钥生成算法生成第一终端密钥，并基于所述第一终端密钥和所述附着接受信息，通过预设的第一完整性算法获取所述第二完整性校验码。
结合第三方面，在第三方面第二种可能的实现方式中，所述第一处理模块具体用于基于预设的第二根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第二密钥生成算法生成第二终端密钥，并在生成附着完成信息后，基于所述第二终端密钥，通过预设的第一加解密算法对所述附着完成信息进行加密。
结合第三方面第一种可能的实现方式，或结合第三方面第二种可能的实现方式，在第三方面第三种可能的实现方式中，所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。其中，终端设备身份标识能够区分不同终端设备，并且终端随机数不易被仿冒，从而提高终端设备参数的安全性。
结合第三方面第一种可能的实现方式，或结合第三方面第二种可能的实现方式，在第三方面第四种可能的实现方式中，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。其中，核心网设备身份标识能够区分不同核心网设备，并且核心网随机数不易被仿冒，从而提高核心网设备参数的安全性。
在本申请的第四方面，公开一种信息交互装置，包括：第二接收模块、第二发送模块和第二处理模块，
所述第二接收模块用于接收终端设备传输的附着请求信息；所述第二处理模块用于在生成附着接受信息后，基于所述附着接受信息，获取第一完整性校验码，并触发所述第二发送模块向所述终端设备传输添加有所述第一完整性校验码的附着接受信息；所述第二接收模块还用于接收所述终端设备传输的加密的附着完成信息，所述附着完成信息中包含所述终端设备的第三完整性校验码；所述第二处理模块还用于基于所述加密的附着完成信息，获取第四完整性校验码，若所述第三完整性校验码与所述第四完整性校验码相同，所述第二处理模块对所述加密的附着完成信息进行解密，并在解密成功后，确定所述终端设备接入核心网设备。
通过该信息交互装置，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。
结合第四方面，在第四方面第一种可能的实现方式中，所述第二处理模块具体用于基于预设的第三根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第三密钥生成算法生成第一核心网密钥，并基于所述第一核心网密钥和所述附着接受信息，通过预设的第二完整性算法，获取所述第一完整性校验码。
结合第四方面，在第四方面第二种可能的实现方式中，所述第二处理模块具体用于基于预设的第四根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第四密钥生成算法生成第二核心网密钥，并基于所述第二核心网密钥，通过预设的第二加解密算法对所述加密的附着完成信息进行解密。
结合第四方面第一种可能的实现方式，或结合第四方面第二种可能的实现方式，在第四方面第三种可能的实现方式中，所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。其中，终端设备身份标识能够区分不同终端设备，并且终端随机数不易被仿冒，从而提高终端设备参数的安全性。
结合第四方面第一种可能的实现方式，或结合第四方面第二种可能的实现方式，在第四方面第四种可能的实现方式中，所述核心网设备参数包括：核心网设备身份标识和所述 核心网设备产生的核心网随机数。其中，核心网设备身份标识能够区分不同核心网设备，并且核心网随机数不易被仿冒，从而提高核心网设备参数的安全性。
在本申请的第五方面，公开一种终端设备，包括：收发端口、处理器和与所述处理器相连接的存储器；其中，所述收发端口用于和核心网设备之间进行信息的收发，并将从所述核心网设备接收的信息传输至处理器；所述存储器存储有可被所述处理器执行的指令；所述处理器用于获取所述收发端口传输的报文，并通过执行所述存储器中所存储的程序或指令，实现本申请的第一方面所述的信息交互方法。
在本申请的第六方面，公开一种核心网设备，包括：收发端口、处理器和与所述处理器相连接的存储器；其中，所述收发端口用于和终端设备之间进行信息的收发，并将从所述终端设备接收的信息传输至处理器；所述存储器存储有可被所述处理器执行的指令；所述处理器用于获取所述收发端口传输的报文，并通过执行所述存储器中所存储的程序或指令，实现本申请的第二方面所述的信息交互方法。
在本申请的第七方面，本申请实施例还提供了一种计算机程序产品，包括指令，当指令在计算机上运行时，使得计算机执行本申请第一方面的方法。
在本申请的第八方面，本申请实施例还提供了一种计算机程序产品，包括指令，当指令在计算机上运行时，使得计算机执行本申请第二方面的方法。
在本申请的第九方面，本申请实施例还提供了一种计算机存储介质，该计算机存储介质可存储有程序，该程序执行时可实现第一方面提供的信息交互方法的各实施例中的部分或全部步骤。
在本申请的第十方面，本申请实施例还提供了一种计算机存储介质，该计算机存储介质可存储有程序，该程序执行时可实现第二方面提供的信息交互方法的各实施例中的部分或全部步骤。
在本申请的第十一方面，本申请实施例还提供了一种芯片，所述芯片装置包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时，实现本申请第一方面所述的方法。
在本申请的第十二方面，本申请实施例还提供了一种芯片，所述芯片装置包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时，实现本申请第二方面所述的方法。
在本申请的第十三方面，本申请实施例还提供了一种终端设备，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述终端设备运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述终端设备执行如前述第一方面或第一方面各实现方式所述的信息交互方法。
在本申请的第十四方面，本申请实施例还提供了一种核心网设备，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述核心网设备运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述核心网设备执行如前述第二方面或第二方面各实现方式所述的信息交互方法。
通过本申请实施例公开的方案，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。与现有技术相比，本申请实施例公开的方案，在保障了通信系统的 安全性的前提下，减少数据交互的流程，并且减少终端设备与核心网设备之间交互的信息的数据量，从而减少了终端设备与核心网设备进行信息交互过程的耗时，并能够减少终端设备的功耗开销。
附图说明
图1为现有技术公开的一种通信系统的结构示意图；
图2为本申请实施例公开的一种信息交互方法的工作流程示意图；
图3为现有技术公开的一种通信系统中信息交互流程示意图；
图4为本申请实施例公开的一种通信系统中信息交互流程示意图；
图5为本申请实施例公开的一种应用于通信系统中的完整性算法的示意图；
图6为本申请实施例公开的又一种信息交互方法的工作流程示意图；
图7为本申请实施例公开的一种信息交互装置的结构示意图；
图8为本申请实施例公开的又一种信息交互装置的结构示意图。
具体实施方式
为了保障通信系统的安全，现有技术需要终端设备与核心网设备之间进行多次信息交互，且交互的信息数据量较大，导致现有技术存在信息交互过程耗时长，以及终端设备功耗开销高的问题。为了解决现有技术中的问题，本申请实施例公开一种信息交互方法及装置。
图1是本申请的实施例应用的通信系统的架构示意图。如图1所示，该通信系统包括核心网设备110、无线接入网设备120和至少一个终端设备(如图1中的终端设备130和终端设备140)。终端设备通过无线的方式与无线接入网设备120相连，无线接入网设备120通过无线或有线方式与核心网设备110连接。核心网设备与无线接入网设备可以是独立的不同的物理设备，也可以是将核心网设备的功能与无线接入网设备的逻辑功能集成在同一个物理设备上，还可以是一个物理设备上集成了部分核心网设备的功能和部分的无线接入网设备的功能。终端设备可以是固定位置的，也可以是可移动的。图1只是示意图，该通信系统中还可以包括其它网络设备，如还可以包括无线中继设备和无线回传设备，在图1中未画出。本申请的实施例对该通信系统中包括的核心网设备、无线接入网设备和终端设备的数量不做限定。
无线接入网设备是终端设备通过无线方式接入到该通信系统中的接入设备，可以是基站NodeB、演进型基站eNodeB、5G移动通信系统中的基站、未来移动通信系统中的基站或WiFi系统、LTE-U或其他免授权频谱无线系统中的接入节点等，本申请的实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。
终端设备也可以称为终端(Terminal)、用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端(mobile terminal，MT)等。终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(Augmented Reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self-driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无 线终端、具有无线通信功能的智能电表、智能水表、环境感应器、设备标签、定位标签等等。
本申请实施例中，终端设备能够将信息传输至无线接入网设备，再由无线接入网设备将信息传输至核心网设备，并且，核心网设备还能够将信息传输至无线接入网设备，再由无线接入网设备将信息传输至终端设备。也就是说，终端设备与核心网设备之间能够通过无线接入网设备实现信息交互。
本申请实施例公开的方案能够应用于多种通信系统，具体的，可以应用于对终端设备功耗有限制的通信系统中，以通过本申请实施例公开的方案减少对终端设备的功耗。例如，可以应用于4.5G移动通信技术中的基于蜂窝网络的窄带物联网(narrow band internet of things，NB-IoT)中。这种情况下，终端设备、无线接入网设备和核心网设备即分别为NB-IoT系统中的终端设备、无线接入网设备和核心网设备，并根据本申请实施例公开的方案实现终端设备与核心网设备之间的信息交互。
当然本申请实施例还可以应用于其他具备终端设备和核心网设备，且终端设备与核心网设备之间能够进行信息交互的通信系统中，本申请实施例对此不做限定。
以下通过多个实施例对本申请公开的方案进行介绍。其中，在本申请公开的第一实施例中，公开一种信息交互方法，该方法应用于终端设备，该终端设备能够通过无线接入网设备与核心网设备之间进行信息交互。
参见图2所示的工作流程示意图，本申请第一实施例公开的所述信息交互方法包括以下步骤：
步骤S11、终端设备向核心网设备传输附着请求信息。
该步骤中，终端设备将附着请求信息传输至无线接入网设备，再由无线接入网设备传输至核心网设备，以使核心网设备能够接收到所述附着请求信息。
另外，在该附着请求信息中，可以包括终端设备参数。其中，所述终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数。所述终端设备身份标识能够对不同的终端设备起到区分作用，例如可以为终端设备国际移动用户标志(international mobile subscriber identity，IMSI)。
步骤S12、所述终端设备接收所述核心网设备传输的附着接受信息，所述附着接受信息中包括所述核心网设备的第一完整性校验码。
其中，所述核心网设备接收到所述附着请求信息后，生成附着接受信息，并对所述附着接受信息进行计算，获取第一完整性校验码，将所述第一完整性校验码添加至附着接受信息中，再将添加有第一完整性校验码的附着接受信息传输至无线接入网设备。无线接入网设备会将添加有第一完整性校验码的附着接受信息传输至终端设备，从而使终端设备获取到所述附着接受信息。
步骤S13、所述终端设备基于所述附着接受信息获取第二完整性校验码。
该步骤中，终端设备通过对附着接受信息进行计算，获取第二完整性校验码。其中，终端设备在对附着接受信息进行计算时，通常根据预先设定的第一完整性算法进行计算。
另外，核心网设备通过预先设定的第二完整性算法对附着接受信息进行计算，获取第一完整性校验码，这种情况下，若允许终端设备接入核心网设备，则预先设定第一完整性算法与第二完整性算法相同。也就是说，终端设备与核心网设备采用相同的完整性算法进 行完整性验证。
步骤S14、若所述第一完整性校验码和所述第二完整性校验码相同，所述终端设备获取加密的附着完成信息，并基于所述加密的附着完成信息获取第三完整性校验码，向所述核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息。
该步骤中，若所述第一完整性校验码和第二完整性校验码相同，则终端设备确定核心网设备的身份合法。也就是说，在本申请实施例中，终端设备通过完整性校验码对核心网设备进行身份认证。
在确定核心网设备的身份合法(即第一完整性校验码和第二完整性校验码相同)后，所述终端设备会生成附着完成信息，再对所述附着完成信息进行加密，从而获取加密的附着完成信息。然后，终端设备使用第一完整性算法对加密的附着完成信息进行计算，获取第三完整性校验码，再将所述第三完整性校验码添加至所述加密的附着完成信息中。
这种情况下，核心网设备在接收到附着完成信息后，能够根据第二完整性算法对附着完成信息进行计算，获取第四完整性校验码。并且，核心网设备若确定第三完整性校验码与第四完整性校验码相同，则可确定终端设备的身份合法。也就是说，核心网设备通过所述附着完成信息中包含的第三完整性校验码实现对终端设备的身份认证。其中，第一完整性算法与第二完整性算法相同。
另外，终端设备对附着完成信息进行了加密处理，以提高附着完成信息的安全性。并且，终端设备通常采用预设的第一加解密方法对附着完成信息进行加密，而核心网设备接收到附着完成信息后，采用预设的第二加解密方法对附着完成信息进行解密。若终端设备允许接入核心网设备，则预先设定第一加解密方法与第二加解密方法相同。这种情况下，在根据完整性校验码确定终端设备的身份合法后，若核心网设备能够根据第二加解密方法对附着完成信息进行解密，说明终端设备与核心网设备之间交互的信息能够互相进行加解密，则确定终端设备接入核心网设备。
进一步的，终端设备在接入核心网设备之后，终端设备与核心网设备之间能够继续进行信息交互，例如，终端设备将获取到的检测数据通过无线接入网设备传输至核心网设备，核心网设备向通过无线接入网设备向终端设备传输指令信息等。这种情况下，每次信息交互时，信息的发送端可在交互的信息中添加根据该信息计算得到的完整性校验码，以及对该信息进行加密。接收到该信息的接收端对该信息进行计算，获取相应的完整性校验，若计算获取的完整性校验码与该信息中添加的完整性校验码相同，则接收端可确定接收到的信息完整，并在确定接收到的信息完整之后，可根据预设的加解密算法进行解密，从而提高了通信系统的安全性。
本申请实施例公开一种信息交互方法，该方法中，终端设备向核心网设备传输附着请求信息；核心网设备接收到附着请求信息后，生成附着接受信息，基于该附着接受信息获取第一完整性校验码，并将该第一完整性校验码添加至附着接受信息中；终端设备接收所述核心网设备传输的附着接受信息，并基于所述附着接受信息获取第二完整性校验码；若所述第一完整性校验码和所述第二完整性校验码相同，终端设备确定核心网设备的身份合法，也就是说，终端设备通过附着接受信息中包含的第一完整性校验码实现对核心网的身份认证，并在确认核心网设备的身份合法后，终端设备生成附着完成信息并对所述附着完成信息进行加密，然后基于加密的附着完成信息获取第三完整性校验码，将所述第三完整 性校验码添加至加密的附着完成信息中，再向核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息；核心网设备接收到附着完成信息后，基于该附着完成信息获取第四完整性校验码，若第三完整性校验码与第四完整性校验码相同，核心网设备确定终端设备的身份合法，也就是说，核心网设备通过附着完成信息中包含的第四完整性校验码实现对终端设备的身份认证，然后，核心网设备对附着完成信息进行解密，若解密成功，则确定终端设备接入核心网设备。
通过本申请实施例公开的信息交互方法，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。
与现有技术相比，本申请实施例公开的方案，在保障通信系统安全性的前提下，减少数据交互的流程，并且减少终端设备与核心网设备之间交互的信息的数据量，从而减少了终端设备与核心网设备进行信息交互的耗时，以及减少终端设备的功耗开销。
进一步的，为了明确本申请实施例公开的方案的优势，以下对现有技术中通常采用的信息交互方法进行介绍。参见图3所示的现有技术的信息交互流程示意图，在现有技术中，终端设备首次接入核心网设备时，通常包括以下信息交互的流程：
步骤1：终端设备产生携带有终端IMSI的附着请求信息，并通过无线接入网设备将该附着请求信息传输至核心网设备。
步骤2：核心网设备在接收到终端设备发出的附着请求信息之后，获取其中包含的IMSI，再通过无线接入网设备向该终端设备发送用户身份验证请求信息，所述用户身份验证请求信息中包括核心网认证码及核心网设备产生的核心网随机数。
步骤3：终端设备在接收到核心网设备发出的用户身份验证请求信息后，根据其中包括的核心网认证码对核心网进行身份认证，若确定核心网设备的身份合法，终端设备通过预先设置的根密钥、终端设备自身产生的终端随机数及核心网随机数，生成用于对后续信息进行加密的密钥。然后，终端设备生成用户身份验证响应信息，并通过无线接入网设备向核心网设备传输所述用户身份验证响应信息，所述用户身份验证响应信息中包括终端认证码和终端随机数。也就是说，通过该步骤，终端设备能够对核心网设备进行身份认证，以及生成用于加密的密钥。
步骤4：核心网设备接收到终端设备发出的用户身份验证响应信息后，根据其中包括的终端认证码对终端设备进行身份认证。若确定终端设备的身份合法，核心网设备通过预置的根密钥、终端随机数和核心网随机数，生成用于对后续信息进行加密的密钥。其中，若允许终端设备接入核心网设备，核心网中预置的根密钥与终端中预置的根密钥相同，核心网生成密钥的方式与终端生成密钥的方式相同，这种情况下，核心网设备生成的密钥与终端设备生成的密钥相同。生成密钥后，核心网设备选择完整性算法和加密算法，并生成安全模式命令信息，所述安全模式命令信息中包括核心网设备选择的完整性算法和加密算法，并在使用完整性算法对该安全模式命令信息进行完整性保护后，通过无线接入网设备将其传输至终端。也就是说，通过该步骤，核心网设备能够对终端进行身份认证，以及生成用于加密的密钥。
步骤5：终端设备接收到核心网设备传输的安全模式命令信息后，确认自身是否支持核心网设备选择的完整性算法和加密算法。若支持，终端设备对所述安全模式命令信息进 行完整性验证，若该信息通过完整性验证，则终端设备通过无线接入网设备向核心网设备传输经过完整性保护和加密的安全模式完成信息。
步骤6：核心网设备接收到终端设备传输的安全模式完成信息后，首先对该信息进行完整性验证，若该信息通过完整性验证，再解密该信息。然后，核心网设备产生附着接受信息，并通过无线接入网设备将所述附着接受信息传输至终端设备。
步骤7：终端设备接收到核心网设备传输的附着接受信息后，确认自身是否能够接入核心网设备，若是，则通过无线接入网设备向核心网设备发送经过完整性保护和加密处理后的附着完成信息。核心网设备接收到终端传输的附着完成信息后，对附着完成信息进行完整性验证和解密，若该附着完成信息能够通过完整性验证及解密，则允许终端设备接入核心网设备，完成终端设备接入核心网设备的流程。
通过上述步骤，终端设备和核心网设备均对对方进行了身份认证，并且，完成完整性算法和加密算法的协商，之后终端设备与核心网设备之间再进行信息交互时，交互的信息都将做完整性保护和加密保护，从而提高通信系统的安全性。
但是，根据对上述步骤的描述以及图3所示的信息交互流程图可知，通过现有技术虽然能够保障通信系统的安全，但终端设备与核心网设备之间至少需要进行七次信息交互，信息交互的次数较多，且交互的信息数据量较大，导致现有技术中存在信息交互耗时长，以及终端设备功耗开销高的问题。
而采用本申请实施例公开的方案时，参见图4所示的信息交互流程示意图，终端设备与核心网设备进行信息交互时，首先由终端设备向核心网设备传输附着请求信息。接收到附着请求信息的核心网设备核心网设备生成附着接受信息，并基于所述附着接受信息获取第一完整性校验码，将第一完整性校验码添加至附着接受信息后，向终端设备传输该附着接受信息。终端设备接收到附着接受信息后，基于所述附着接受信息，获取第二完整性校验码，在第一完整性校验码和第二完整性校验码相同的情况下，生成附着完成信息并加密。然后，终端设备基于加密的附着完成信息获取第三完整性校验码，并在加密的附着完成信息中添加第三完整性校验码，将添加有第三完整性校验码且加密的附着完成信息传输至核心网设备，以便核心网设备根据接收到的附着完成信息确定是否允许终端设备接入核心网设备。
根据图4可知，本申请实施例公开的方案中，只需要在终端设备与核心网设备之间传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需终端设备与核心网设备之间进行三次信息交互即可。与现有技术相比，减少了信息交互的次数，并且减少交互信息的数据量，从而减少了终端设备与核心网设备进行信息交互的耗时，且有效的减少了终端设备的功耗开销。
进一步的，在步骤S13中，公开了所述终端设备基于所述附着接受信息获取第二完整性校验码的操作，该操作通常包括以下步骤：
首先，所述终端设备基于预设的第一根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第一密钥生成算法生成第一终端密钥。
然后，所述终端设备基于所述第一终端密钥和所述附着接受信息，通过预设的第一完整性算法获取所述第二完整性校验码。
在本申请实施例中，在终端设备中预先设置第一根密钥，并且在附着接受信息中包含 核心网设备参数。接收到附着接受信息后，终端设备根据第一根密钥、终端设备参数及附着接受信息中包含的核心网设备参数，以及第一密钥生成算法生成第一终端密钥，所述第一终端密钥用于生成完整性校验码。
另外，在核心网设备中预先设置有第三根密钥，并且在接收到终端设备传输的附着请求信息后，核心网设备能够根据第三根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第三密钥生成算法生成第一核心网密钥，所述第一核心网密钥用于生成完整性校验码。
这种情况下，若终端设备允许接入核心网设备，则根据预先的设置，第一根密钥与第三根密钥相同，第一密钥生成算法与第二密钥生成算法相同，并且，由于计算第一终端密钥与计算第一核心网密钥的过程中，均依据终端设备参数及核心网设备参数，因此，计算得到的第一终端密钥与第一核心网密钥相同。
进一步的，在终端设备中预先设置第一完整性算法，通过第一完整性算法和第一终端密钥对附着接受信息进行计算，能够得到第二完整性校验码。在核心网设备中预先设置第二完整性算法，通过第二完整性算法和第一核心网密钥对附着接受信息进行计算，能够得到第一完整性校验码。若终端设备允许接入核心网设备，则预先设置第一完整性算法与第二完整性算法相同。
由于第一终端密钥与第一核心网密钥相同，第一完整性算法与第二完整性算法相同，并且，计算第一完整性校验码与计算第二完整性校验码的过程中，均对附着接受信息进行计算，因此，在核心网设备身份合法的情况下，第一完整性校验码与第二完整性校验码相同。这种情况下，终端设备通过比较第一完整性校验码与第二完整性校验码是否相同，即可判定核心网设备的身份是否合法。
另外，本申请实施例中，终端设备根据第一根密钥、终端设备参数及核心网设备参数生成第一终端密钥。其中，终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数。所述终端设备身份标识能够对不同的终端设备起到区分作用，因此不同终端设备的终端设备身份标识不同，不同终端设备生成的第一终端密钥不同，从而能够区分不同终端设备生成的第一终端密钥。
所述终端设备身份标识可以采用终端设备国际移动用户标志(international mobile subscriber identity，IMSI)，当然，还可以采用其他能够区分不同终端设备的参数作为终端设备身份标识，本申请实施例对此不做限定。
另外，终端随机数为终端设备随机生成的一个数据，将终端随机数作为终端设备参数，能够保障终端设备参数不易被仿冒，从而提高终端设备参数的安全性，进一步提高获取第一终端密钥的安全性。
其中，核心网设备参数可包括多种形式，在其中一种形式中，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。所述核心网设备身份标识用于对不同的核心网设备起到区分作用，因此终端设备在与不同的核心网设备进行信息交互时，核心网设备参数中的核心网设备身份标识不同，导致终端设备生成的第一终端密钥不同，从而能够区分终端设备与不同核心网设备进行信息交互时生成的第一终端密钥。
在本申请实施例中，可预先为各个核心网设备分配一个不同的核心网标签，通过核心网标签区分各个核心网设备，这种情况下，可将该核心网标签作为核心网设备身份标识。 当然，还可以采用其他能够区分不同核心网设备的参数作为核心网设备身份标识，本申请实施例对此不做限定。
另外，核心网随机数为核心网设备随机生成的一个数据，不易通过多次抓取数据被攻击，将核心网随机数作为核心网设备参数，能够保证核心网设备参数不易被仿冒，从而提高核心网设备参数的安全性，进一步提高获取第一终端密钥的安全性。
本申请实施例中，终端设备采用第一密钥生成算法生成第一终端密钥。其中，第一密钥生成算法可以为多种形式的密钥生成算法。例如，第一密钥生成算法可以为HMAC-SHA-256算法。其中，HMAC-SHA-256算法包含以下公式：
Derived Key＝HMAC-SHA-256(RootKey,S)公式(1)；
S＝FC||Algorithm Type Distinguisher||L0||NET ID||L1||NET Rand||L2||IMSI||L3||UE Rand||L4 公式(2)。
若在计算第一终端密钥时采用HMAC-SHA-256算法，则在公式(1)中，Derived Key为第一终端密钥，RootKey为终端设备中的第一根密钥，S为密钥计算参数。该公式输出的字符长度通常为256bit，在本申请实施例中，可以使用其中的低128位作为第一终端密钥。
另外，用于获取密钥计算参数S的公式(2)中，FC为预设值，通常情况下，FC＝0x015，当然，也可将FC设置为其他数值；Algorithm Type Distinguisher为预设值，例如，在计算第一终端密钥时，可设置Algorithm Type Distinguisher＝0x02；NET ID是作为核心网设备身份标识的核心网标签；L0为Algorithm Type Distinguisher的字节长度；L1为NET ID的字节长度；NET Rand为核心网随机数；L2为核心网随机数NET Rand的字节长度；IMSI是作为终端设备身份标识的终端设备国际移动用户标志；L3为IMSI的字节长度；UE Rand为终端随机数；L4为终端随机数UE Rand的字节长度。
这种情况下，可通过公式(2)获取S的值，然后将S的值带入至公式(1)，计算得到第一终端密钥。
当然，还可以采用其他形式的密钥生成算法，本申请实施例对此不作限定。
另外，终端设备基于第一终端密钥和附着接受信息，通过预设的第一完整性算法获取所述第二完整性校验码，该第一完整性算法可为多种形式，例如，第一完整性算法可采用AES-128-CMAC，其算法示意图如图5所示。该算法中，根据信息计数、信息、信息方向、固定数值参数以及用于完整性保护的密钥，计算得到完整性校验码。其中，信息为计算完整性校验码时所应用的信息，在计算第二完整性校验码时，信息即为附着接受信息；另外，若应用的信息的信息方向为上行，则信息方向通常取值为0，若应用的信息的信息方向为下行，则信息方向通常取值为1；固定数值参数通常取值为0。
当然，还可以采用其他的完整性算法，本申请实施例对此不作限定。
在本申请实施例的步骤S14中，公开终端设备获取加密的附着完成信息的操作。其中，所述终端设备获取加密的附着完成信息，包括以下步骤：
首先，所述终端设备基于预设的第二根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第二密钥生成算法生成第二终端密钥；然后，所述终端设备在生成附着完成信息后，基于所述第二终端密钥，通过预设的第一加解密算法对所述附着完成信息进行加密。
本申请实施例中，在终端设备中预先设置第二根密钥，并且在附着接受信息中包含核心网设备参数。接收到附着接受信息后，终端设备获取核心网设备参数，然后根据第二根密钥、终端设备参数及核心网设备参数，以及第二密钥生成算法生成第二终端密钥，所述第二终端密钥用于对交互的信息进行加密保护。
另外，在核心网设备中，预先设置第四根密钥，并且在接收到终端设备传输的附着请求信息后，核心网设备根据第四根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第四密钥生成算法生成第二核心网密钥，所述第二核心网密钥用于对交互的信息进行加密保护。
这种情况下，若允许终端设备接入核心网设备，则预先设置第二根密钥与第四根密钥相同，第二密钥生成算法与第四密钥生成算法相同，并且，由于计算第二终端密钥与计算第二核心网密钥的过程中，均依据终端设备参数及核心网设备参数，因此，第二终端密钥与第二核心网密钥相同。
进一步的，在终端设备中预先设置第一加解密算法，以便通过第一加解密算法对附着完成信息进行加密。在核心网设备中预先设置第二加解密算法，以便通过第二加解密算法对附着完成信息进行解密。其中，若允许终端设备接入核心网设备，则预先设置第一加解密算法与第二加解密算法相同，以便核心网设备能够对终端设备加密的信息进行解密。
另外，本申请实施例中，终端设备根据第二根密钥、终端设备参数及核心网设备参数生成第二终端密钥。其中，终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数。所述终端设备身份标识能够对不同的终端设备起到区分作用，不同终端设备的终端设备身份标识不同，因此不同终端设备生成的第二终端密钥不同，从而能够区分不同终端设备生成的第二终端密钥。
所述终端设备身份标识可以采用终端设备国际移动用户标志(international mobile subscriber identity，IMSI)，当然，还可以采用其他能够区分不同终端设备的参数作为终端设备身份标识，本申请实施例对此不做限定。
另外，终端随机数为终端设备随机生成的一个数据，将终端随机数作为终端设备参数，能够保障终端设备参数不易被仿冒，从而提高终端设备参数的安全性，进一步提高获取第二终端密钥的安全性。
其中，核心网设备参数可包括多种形式，在其中一种形式中，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。所述核心网设备身份标识用于对不同的核心网设备起到区分作用，因此终端设备在与不同的核心网设备进行信息交互时，核心网设备参数中的核心网设备身份标识不同，导致终端设备生成的第二终端密钥不同，从而能够区分终端设备与不同核心网设备进行信息交互时生成的第二终端密钥。
在本申请实施例中，可预先为各个核心网设备分配一个不同的核心网标签，通过核心网标签区分各个核心网设备，这种情况下，可将该核心网标签作为核心网设备身份标识。当然，还可以采用其他能够区分不同核心网设备的参数作为核心网设备身份标识，本申请实施例对此不做限定。
另外，核心网随机数为核心网设备随机生成的一个数据，不易通过多次抓取数据被攻击，将核心网随机数作为核心网设备参数，能够保证核心网设备参数不易被仿冒，从而提高核心网设备参数的安全性，进一步提高获取第二终端密钥的安全性。
终端设备采用第二密钥生成算法生成第二终端密钥。其中，第二密钥生成算法可采用多种形式的密钥生成算法，例如，第二密钥生成算法也可以为HMAC-SHA-256算法。也就是说，可以通过公式(1)与公式(2)计算第二终端密钥。
Derived Key为第二终端密钥，RootKey为终端设备中的第一根密钥，S为密钥计算参数。该公式输出的字符长度通常为256bit，在本申请实施例中，可以使用其中的低128位作为第二终端密钥。
另外，用于获取密钥计算参数S的公式(2)中，FC为预设值，通常情况下，FC＝0x015，当然，也可将FC设置为其他数值；Algorithm Type Distinguisher为预设值，例如，在计算第二终端密钥时，可设置Algorithm Type Distinguisher＝0x01；NET ID是作为核心网设备身份标识的核心网标签；L0为Algorithm Type Distinguisher的字节长度；L1为NET ID的字节长度；NET Rand为核心网随机数；L2为核心网随机数NET Rand的字节长度；IMSI是作为终端设备身份标识的终端设备国际移动用户标志；L3为IMSI的字节长度；UE Rand为终端随机数；L4为终端随机数UE Rand的字节长度。
当然，还可以采用其他形式的密钥生成算法，本申请实施例对此不作限定。
进一步的，为了提高通信系统的安全性，预先设置在终端设备中的第一根密钥和第二根密钥可经过加密处理，当需要时，终端设备再对其进行解密，然后分别通过解密后的第一根密钥生成第一终端密钥，通过解密后的第二根密钥生成第二终端密钥。第一根密钥和第二根密钥的加解密方式可以相同，也可以不同，本申请实施例对此不做限定。
另外，第一根密钥和第二根密钥可为同一根密钥，即终端设备通过相同的根密钥生成第一终端密钥和第二终端密钥，或者第一根密钥和第二根密钥分别为不同的根密钥，本申请实施例对此不做限定。
在本申请实施例中，附着接受信息和附着完成信息中均包含完整性校验码，这种情况下，附着接受信息和附着完成信息的部分信息结构可如下表所示：
Figure PCTCN2018105504-appb-000001
其中，“Sec Hdr Type”用于表示该条信息的安全类型，在本申请实施例中，若在“Sec Hdr Type”字段中设置有预设值(例如11)，则表示该条信息经过完整性保护，该条信息中设置有完整性校验码；“Reserved”为预留字段；“MAC”字段构成32位的完整性校验码；Sequence number为信息计数。
相应的，本申请通过第二实施例公开一种信息交互方法，该方法应用于核心网设备，该核心网设备可通过无线接入网设备与终端设备之间进行信息交互，该终端设备能够执行本申请第一实施例公开的信息交互方法，因此，核心网设备在执行本申请第二实施例公开的信息交互方法时，终端设备所执行的操作可参见本申请第一实施例公开的内容。
参见图6所示的工作流程示意图，本申请实施例公开的所述信息交互方法包括：
步骤S21、核心网设备接收终端设备传输的附着请求信息。
当终端设备需要接入核心网设备时，终端设备会产生附着请求信息，将附着请求信息传输至无线接入网设备，再由无线接入网设备传输至核心网设备，以使核心网设备能够接收到所述附着请求信息。
另外，在该附着请求信息中，可以包括终端设备参数。其中，所述终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数。所述终端设备身份标识能够对不同的终端设备起到区分作用，可以为终端设备国际移动用户标志(international mobile subscriber identity，IMSI)。
步骤S22、所述核心网设备在生成附着接受信息后，基于所述附着接受信息，获取第一完整性校验码，并向所述终端设备传输添加有所述第一完整性校验码的附着接受信息。
核心网设备中预先设置有第二完整性算法。在接收到附着请求信息后，核心网设备能够根据预先设定的第二完整性算法对附着接受信息进行计算，获取相应的第一完整性校验码。然后，所述核心网设备将所述第一完整性校验码添加至所述附着接受信息中，并将添加所述第一完整性校验码的附着接受信息通过无线接入网设备传输至所述终端设备。
步骤S23、所述核心网设备接收所述终端设备传输的加密的附着完成信息，所述附着完成信息中包含所述终端设备的第三完整性校验码。
终端设备接收到附着接受信息后，对所述附着接受信息进行计算，获取第二完整性校验码。其中，终端设备在对附着接受信息进行计算时，通常根据预先设定的第一完整性算法进行计算。另外，核心网设备通过预先设定的第二完整性算法对附着接受信息进行计算，获取第一完整性校验码。若允许终端设备接入核心网设备，则预先设定第一完整性算法与第二完整性算法相同。也就是说，终端设备与核心网设备采用相同的完整性算法进行完整性验证。
这种情况下，若所述第一完整性校验码和第二完整性校验码相同，则终端设备确定核心网设备的身份合法。也就是说，本申请实施例中，终端设备通过完整性校验码对核心网设备进行身份认证。
在确定核心网设备的身份合法(即第一完整性校验码和第二完整性校验码相同)后，所述终端设备会生成附着完成信息，再对所述附着完成信息进行加密，从而获取加密的附着完成信息。然后，终端设备使用第一完整性算法对加密的附着完成信息进行计算，获取第三完整性校验码，再将所述第三完整性校验码添加至所述加密的附着完成信息中，通过无线接入网设备将添加有所述第三完整性校验码的附着完成信息传输至核心网设备。
步骤S24、所述核心网设备基于所述加密的附着完成信息，获取第四完整性校验码。
该步骤中，核心网设备在接收到附着完成信息后，能够根据第二完整性算法对附着完成信息进行计算，获取第四完整性校验码。
步骤S25、若所述第三完整性校验码与所述第四完整性校验码相同，所述核心网设备对所述加密的附着完成信息进行解密，并在解密成功后，确定所述终端设备接入核心网设备。
核心网设备若确定第三完整性校验码与第四完整性校验码相同，则可确定终端设备的身份合法。也就是说，核心网设备通过所述附着完成信息中包含的第三完整性校验码实现对终端设备的身份认证。
另外，终端设备对附着完成信息进行了加密处理，以提高附着完成信息的安全性。并且，终端设备通常采用预设的第一加解密方法对附着完成信息进行加密，而核心网设备接收到附着完成信息后，采用预设的第二加解密方法对附着完成信息进行解密。若终端设备允许接入核心网设备，则预先设定第一加解密方法与第二加解密方法相同。
这种情况下，在根据确定终端设备的身份合法后，若核心网设备能够根据第二加解密方法对附着完成信息进行解密，说明终端设备与核心网设备之间交互的信息能够进行加解密，则确定终端设备接入核心网设备。
进一步的，终端设备在接入核心网设备之后，终端设备与核心网设备之间能够继续进行信息交互，例如，终端设备将获取到的检测数据通过无线接入网设备传输至核心网设备，核心网设备向通过无线接入网设备向终端设备传输指令信息等。这种情况下，每次信息交互时，信息的发送端可在交互的信息中添加根据该信息计算得到的完整性校验码，以及对该信息进行加密。接收到该信息的接收端对该信息进行计算，获取相应的完整性校验，若计算获取的完整性校验码与该信息中添加的完整性校验码相同，则接收端可确定接收到的信息完整，并在确定接收到的信息完整之后，可根据预设的加解密算法进行解密，从而提高了通信系统的安全性。
本申请实施例公开一种信息交互方法，该方法中，核心网设备在接收到终端设备传输的附着请求信息之后，生成附着接受信息，基于该附着接受信息获取第一完整性校验码，并将该第一完整性校验码添加至附着接受信息中，然后将附着接受信息传输至终端设备；终端设备接收所述核心网设备传输的附着接受信息，并基于所述附着接受信息获取第二完整性校验码；若所述第一完整性校验码和所述第二完整性校验码相同，终端设备确定核心网设备的身份合法，也就是说，终端设备通过附着接受信息中包含的第一完整性校验码实现对核心网的身份认证，这种情况下，终端设备生成附着完成信息并对所述附着完成信息进行加密，然后基于加密的附着完成信息获取第三完整性校验码，将所述第三完整性校验码添加至加密的附着完成信息中，再向核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息；核心网设备接收到附着完成信息后，基于该附着完成信息获取第四完整性校验码，若第三完整性校验码与第四完整性校验码相同核心网设备确定终端设备的身份合法，也就是说，核心网设备通过附着完成信息中包含的第四完整性校验码实现对终端设备的身份认证，然后，核心网设备对附着完成信息进行解密，若解密成功，则确定终端设备接入核心网设备。
参见图4所示的信息交互流程示意图，通过本申请实施例公开的信息交互方法，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。
与现有技术相比，本申请实施例公开的方案，在保障通信系统安全性的前提下，减少数据交互的流程，并且减少终端设备与核心网设备之间交互的信息的数据量，从而减少了终端设备与核心网设备进行信息交互的耗时，以及减少终端设备的功耗开销。
进一步的，在步骤S22中，公开核心网设备在生成附着接受信息后，基于所述附着接受信息，获取第一完整性校验码的操作。其中，所述基于所述附着接受信息，获取第一完整性校验码，包括以下步骤：
首先，所述核心网设备基于预设的第三根密钥、核心网设备参数及所述附着请求信息 中包含的终端设备参数，通过预设的第三密钥生成算法生成第一核心网密钥；然后，所述核心网设备基于所述第一核心网密钥和所述附着接受信息，通过预设的第二完整性算法，获取所述第一完整性校验码。
本申请实施例中，在终端设备中预先设置第一根密钥，并且在附着接受信息中包含核心网设备参数。接收到附着接受信息后，终端设备根据第一根密钥、终端设备参数及附着接受信息中包含的核心网设备参数，以及第一密钥生成算法生成第一终端密钥，所述第一终端密钥用于生成完整性校验码。
相应的，在核心网设备中预先设置有第三根密钥，并且在接收到终端设备传输的附着请求信息后，核心网设备能够根据第三根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第三密钥生成算法生成第一核心网密钥，所述第一核心网密钥用于生成完整性校验码。
这种情况下，若终端设备允许接入核心网设备，则根据预先的设置，第一根密钥与第三根密钥相同，第一密钥生成算法与第二密钥生成算法相同，并且，由于计算第一终端密钥与计算第一核心网密钥的过程中，均依据终端设备参数及核心网设备参数，因此，计算得到的第一终端密钥与第一核心网密钥相同。
进一步的，在终端设备中预先设置第一完整性算法，通过第一完整性算法对附着接受信息进行计算，能够得到第二完整性校验码。在核心网设备中预先设置第二完整性算法，通过第二完整性算法对附着接受信息进行计算，能够得到第一完整性校验码。若终端设备允许接入核心网设备，则预先设置第一完整性算法与第二完整性算法相同。
由于第一终端密钥与第一核心网密钥相同，第一完整性算法与第二完整性算法相同，并且，计算第一完整性校验码与计算第二完整性校验码的过程中，均对附着接受信息进行计算，因此，在核心网设备身份合法的情况下，第一完整性校验码与第二完整性校验码相同。这种情况下，终端设备通过比较第一完整性校验码与第二完整性校验码是否相同，即可判定核心网设备的身份是否合法。
另外，本申请实施例中，核心网设备根据第三根密钥、核心网设备参数及终端设备参数生成第一核心网密钥。其中，终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数。所述终端设备身份标识能够对不同的终端设备起到区分作用，不同终端设备的终端设备身份标识不同，因此能够区分核心网设备在与不同终端设备进行信息交互时，生成的第一核心网密钥。
所述终端设备身份标识可以采用终端设备国际移动用户标志(international mobile subscriber identity，IMSI)，当然，还可以采用其他能够区分不同终端设备的参数作为终端设备身份标识，本申请实施例对此不做限定。
另外，终端随机数为终端设备随机生成的一个数据，将终端随机数作为终端设备参数，能够保障终端设备参数不易被仿冒，从而提高终端设备参数的安全性，进一步提高获取第一核心网密钥的安全性。
其中，核心网设备参数可包括多种形式，在其中一种形式中，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。所述核心网设备身份标识用于对不同的核心网设备起到区分作用，因此不同的核心网设备生成的第一核心网密钥不同，从而能够区分不同核心网设备生成的第一核心网密钥。
在本申请实施例中，可预先为各个核心网设备分配一个不同的核心网标签，通过核心网标签区分各个核心网设备，这种情况下，可将该核心网标签作为核心网设备身份标识。当然，还可以采用其他能够区分不同核心网设备的参数作为核心网设备身份标识，本申请实施例对此不做限定。
另外，核心网随机数为核心网设备随机生成的一个数据，不易通过多次抓取数据被攻击，将核心网随机数作为核心网设备参数，能够保证核心网设备参数不易被仿冒，从而提高核心网设备参数的安全性，进一步提高获取第一核心网密钥的安全性。
本申请实施例中，核心网设备采用第三密钥生成算法生成第一核心网密钥。其中，第三密钥生成算法可以为多种形式的密钥生成算法。例如，第三密钥生成算法可以为HMAC-SHA-256算法。也就是说，核心网设备能够根据公式(1)和公式(2)生成第一核心网密钥。
其中，核心网设备在计算第一核心网密钥时采用HMAC-SHA-256算法，则在公式(1)中，Derived Key为第一核心网密钥，RootKey为核心网设备中的第三根密钥，S为密钥计算参数。公式(1)输出的字符长度通常为256bit，在本申请实施例中，可以使用其中的低128位作为第一核心网密钥。并且，用于获取密钥计算参数S的公式(2)中，FC为预设值，通常情况下，FC＝0x015，当然，也可将FC设置为其他数值；Algorithm Type Distinguisher的具体数值与计算第一终端密钥时设置的具体数值相同。例如，若在计算第一终端密钥时，Algorithm Type Distinguisher＝0x02，相应的，在计算第一核心网密钥时，Algorithm Type Distinguisher＝0x02。NET ID是作为核心网设备身份标识的核心网标签；L0为Algorithm Type Distinguisher的字节长度；L1为核心网标签NET ID的字节长度；NET Rand为核心网随机数；L2为核心网随机数NET Rand的字节长度；IMSI是作为终端设备身份标识的终端设备国际移动用户标志；L3为IMSI的字节长度；UE Rand为终端随机数；L4为终端随机数UE Rand的字节长度。
这种情况下，可通过公式(2)获取S的值，然后将S的值带入至公式(1)，计算得到第一核心网密钥。
当然，还可以采用其他形式的密钥生成算法，本申请实施例对此不作限定。
另外，核心网设备基于第一核心网密钥和附着接受信息，通过预设的第二完整性算法获取所述第一完整性校验码，该第二完整性算法可为多种形式，例如，第二完整性算法可采用AES-128-CMAC，其算法示意图如图5所示。该算法中，根据信息计数、信息、信息方向、固定数值参数以及用于完整性保护的密钥，即可计算得到完整性校验码。其中，信息为计算完整性校验码时所应用的信息，其中，在计算第一完整性校验码时，信息即为附着接受信息；另外，若应用的信息的信息方向为上行，则信息方向通常取值为0，若应用的信息的信息方向为下行，则信息方向通常取值为1；固定数值参数通常取值为0。
当然，还可以采用其他的完整性算法，本申请实施例对此不作限定。
进一步的，本申请实施例的步骤S25中，公开核心网设备对所述加密的附着完成信息进行解密的操作。所述核心网设备对所述加密的附着完成信息进行解密通常包括以下步骤：
首先，所述核心网设备基于预设的第四根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第四密钥生成算法生成第二核心网密钥；然后，所述核心网设备基于所述第二核心网密钥，通过预设的第二加解密算法对所述加密的附着完成 信息进行解密。
本申请实施例中，在终端设备中预先设置第二根密钥，并且在附着请求信息中包含终端设备参数。接收到附着接受信息后，终端设备获取核心网设备参数，然后根据第二根密钥、终端设备参数及核心网设备参数，以及第二密钥生成算法生成第二终端设备密钥，所述第二终端设备密钥用于对交互的信息进行加密保护。
另外，在核心网设备中，预先设置第四根密钥，并且在接收到终端设备传输的附着请求信息后，核心网设备根据第四根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第四密钥生成算法生成第二核心网设备密钥，所述第二核心网设备密钥用于对交互的信息进行加密保护。
这种情况下，若允许终端设备接入核心网设备，则预先设置第二根密钥与第四根密钥相同，第二密钥生成算法与第四密钥生成算法相同，并且，由于计算第二终端设备密钥与计算第二核心网设备密钥的过程中，均依据终端设备参数及核心网设备参数，因此，第二终端设备密钥与第二核心网设备密钥相同。
进一步的，在终端设备中预先设置第一加解密算法，以便通过第一加解密算法对附着完成信息进行加密。在核心网设备中预先设置第二加解密算法，以便通过第二加解密算法对附着完成信息进行解密。其中，若允许终端设备接入核心网设备，则预先设置第一加解密算法与第二加解密算法相同，以便核心网设备能够对终端设备加密的信息进行解密。
另外，本申请实施例中，核心网设备根据第四根密钥、核心网设备参数及终端设备参数生成第二核心网密钥。其中，终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数。所述终端设备身份标识能够对不同的终端设备起到区分作用，不同终端设备的终端设备身份标识不同，因此能够区分核心网设备在与不同终端设备进行信息交互时，生成的第二核心网密钥。
所述终端设备身份标识可以采用终端设备国际移动用户标志(international mobile subscriber identity，IMSI)，当然，还可以采用其他能够区分不同终端设备的参数作为终端设备身份标识，本申请实施例对此不做限定。
另外，终端随机数为终端设备随机生成的一个数据，将终端随机数作为终端设备参数，能够保障终端设备参数不易被仿冒，从而提高终端设备参数的安全性，进一步提高获取第二核心网密钥的安全性。
其中，核心网设备参数可包括多种形式，在其中一种形式中，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。所述核心网设备身份标识用于对不同的核心网设备起到区分作用，因此不同的核心网设备生成的第二核心网密钥不同，从而能够区分不同核心网设备生成的第二核心网密钥。
在本申请实施例中，可预先为各个核心网设备分配一个不同的核心网标签，通过核心网标签区分各个核心网设备，这种情况下，可将该核心网标签作为核心网设备身份标识。当然，还可以采用其他能够区分不同核心网设备的参数作为核心网设备身份标识，本申请实施例对此不做限定。
另外，核心网随机数为核心网设备随机生成的一个数据，不易通过多次抓取数据被攻击，将核心网随机数作为核心网设备参数，能够保证核心网设备参数不易被仿冒，从而提高核心网设备参数的安全性，进一步提高获取第二核心网密钥的安全性。
上述步骤中，核心网设备采用第四密钥生成算法生成第二核心网密钥。其中，第四密钥生成算法可采用多种形式的密钥生成算法，例如，第四密钥生成算法也可以为HMAC-SHA-256算法。也就是说，可以通过公式(1)与公式(2)计算第二核心网密钥。
在通过HMAC-SHA-256算法计算第二核心网密钥时，Derived Key为第二核心网密钥，RootKey为核心网设备中的第四根密钥，S为密钥计算参数。该公式输出的字符长度通常为256bit，在本申请实施例中，可以使用其中的低128位作为第二核心网密钥。
另外，用于获取密钥计算参数S的公式(2)中，FC为预设值，通常情况下，FC＝0x015，当然，也可将FC设置为其他数值；Algorithm Type Distinguisher为预设值，Algorithm Type Distinguisher的具体数值与计算第二终端密钥时设置的具体数值相同，例如，若在计算第二终端密钥时，Algorithm Type Distinguisher＝0x01，相应的，在计算第二核心网密钥时，Algorithm Type Distinguisher＝0x01；NET ID是作为核心网设备身份标识的核心网标签；L0为Algorithm Type Distinguisher的字节长度；L1为核心网标签NET ID的字节长度；NET Rand为核心网随机数；L2为核心网随机数NET Rand的字节长度；IMSI是作为终端设备身份标识的终端设备国际移动用户标志；L3为IMSI的字节长度；UE Rand为终端随机数；L4为终端随机数UE Rand的字节长度。
当然，还可以采用其他形式的密钥生成算法，本申请实施例对此不作限定。
进一步的，为了提高通信系统的安全性，所述第三根密钥和第四根密钥可经过加密处理，当需要时，核心网设备再对其进行解密，然后分别通过解密后的第三根密钥生成第一核心网密钥，通过解密后的第四根密钥生成第二核心网密钥。其中，核心网设备对第三根密钥和第四根密钥进行加解密时，可采用相同的加解密算法，也可采用不同的加解密算法，本申请实施例对此不做限定。
另外，第三根密钥和第四根密钥可为同一根密钥，即核心网设备通过相同的根密钥生成第一核心网密钥和第二核心网密钥。或者，第三根密钥和第四根密钥分别为不同的根密钥，本申请实施例对此不做限定。
下述为本申请装置实施例，可以用于执行本申请方法实施例。对于本申请装置实施例中未披露的细节，请参照本申请方法实施例。
本申请通过第三实施例公开一种信息交互装置。该装置应用于图1中的终端设备，该终端设备能够通过无线接入网设备与核心网设备之间进行信息交互，并执行本申请第一实施例公开的信息交互方法。
参见图7所示的结构示意图，本申请实施例公开的信息交互装置包括：第一发送模块100、第一接收模块200和第一处理模块300。
其中，所述第一发送模块100用于向核心网设备传输附着请求信息。在该附着请求信息中，可以包括终端设备参数。其中，所述终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数。
所述第一接收模块200用于接收所述核心网设备传输的附着接受信息，所述附着接受信息中包括所述核心网设备的第一完整性校验码。
核心网设备接收到所述附着请求信息后，生成附着接受信息，并对所述附着接受信息进行计算，获取第一完整性校验码，将所述第一完整性校验码添加至附着接受信息中，再通过无线接入设备将添加有第一完整性校验码的附着接受信息传输至终端设备。
所述第一处理模块300用于基于所述附着接受信息获取第二完整性校验码，若所述第一完整性校验码和所述第二完整性校验码相同，所述第一处理模块用于获取加密的附着完成信息，并基于所述加密的附着完成信息获取第三完整性校验码，并触发所述第一发送模块向所述核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息。
其中，第一处理模块300通常根据预先设定的第一完整性算法进行计算，获取第二完整性校验码。另外，核心网设备通过预先设定的第二完整性算法对附着接受信息进行计算，获取第一完整性校验码，这种情况下，若允许终端设备接入核心网设备，则预先设定第一完整性算法与第二完整性算法相同。
若所述第一完整性校验码和第二完整性校验码相同，则终端设备确定核心网设备的身份合法。在确定核心网设备的身份合法后，第一处理模块300生成附着完成信息，再对所述附着完成信息进行加密，从而获取加密的附着完成信息，然后使用第一完整性算法对加密的附着完成信息进行计算，获取第三完整性校验码，再将所述第三完整性校验码添加至所述加密的附着完成信息中。
这种情况下，核心网设备在接收到附着完成信息后，能够根据第二完整性算法对附着完成信息进行计算，获取第四完整性校验码。并且，核心网设备若确定第三完整性校验码与第四完整性校验码相同，则可确定终端设备的身份合法。也就是说，核心网设备通过所述附着完成信息中包含的第三完整性校验码实现对终端设备的身份认证。其中，第一完整性算法与第二完整性算法相同。
另外，第一处理模块对附着完成信息进行了加密处理，并且通常采用预设的第一加解密方法对附着完成信息进行加密，而核心网设备接收到附着完成信息后，采用预设的第二加解密方法对附着完成信息进行解密。若终端设备允许接入核心网设备，则预先设定第一加解密方法与第二加解密方法相同。这种情况下，在根据完整性校验码确定终端设备的身份合法后，若核心网设备能够根据第二加解密方法对附着完成信息进行解密，说明终端设备与核心网设备之间交互的信息能够互相进行加解密，则确定终端设备接入核心网设备。
通过本申请实施例公开的信息交互装置，终端设备与核心网设备之间只需要传输附着请求信息、附着接受信息和附着完成信息，也就是说，只需要进行三次信息交互，即可实现对对方身份的认证及数据保护。
与现有技术相比，本申请实施例公开的方案，在保障通信系统安全性的前提下，减少数据交互的流程，并且减少终端设备与核心网设备之间交互的信息的数据量，从而减少了终端设备与核心网设备进行信息交互的耗时，以及减少终端设备的功耗开销。
进一步的，所述第一处理模块具体用于基于预设的第一根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第一密钥生成算法生成第一终端密钥，并基于所述第一终端密钥和所述附着接受信息，通过预设的第一完整性算法获取所述第二完整性校验码。
在本申请实施例中，在终端设备中预先设置第一根密钥，并且在附着接受信息中包含核心网设备参数。接收到附着接受信息后，终端设备根据第一根密钥、终端设备参数及附着接受信息中包含的核心网设备参数，以及第一密钥生成算法生成第一终端密钥，所述第一终端密钥用于生成完整性校验码。
另外，在核心网设备中预先设置有第三根密钥，并且在接收到终端设备传输的附着请 求信息后，核心网设备能够根据第三根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第三密钥生成算法生成第一核心网密钥，所述第一核心网密钥用于生成完整性校验码。
这种情况下，若终端设备允许接入核心网设备，则根据预先的设置，第一根密钥与第三根密钥相同，第一密钥生成算法与第二密钥生成算法相同，并且，由于计算第一终端密钥与计算第一核心网密钥的过程中，均依据终端设备参数及核心网设备参数，因此，计算得到的第一终端密钥与第一核心网密钥相同。
进一步的，在终端设备中预先设置第一完整性算法，通过第一完整性算法和第一终端密钥对附着接受信息进行计算，能够得到第二完整性校验码。在核心网设备中预先设置第二完整性算法，通过第二完整性算法和第一核心网密钥对附着接受信息进行计算，能够得到第一完整性校验码。若终端设备允许接入核心网设备，则预先设置第一完整性算法与第二完整性算法相同。
由于第一终端密钥与第一核心网密钥相同，第一完整性算法与第二完整性算法相同，并且，计算第一完整性校验码与计算第二完整性校验码的过程中，均对附着接受信息进行计算，因此，在核心网设备身份合法的情况下，第一完整性校验码与第二完整性校验码相同。这种情况下，终端设备通过比较第一完整性校验码与第二完整性校验码是否相同，即可判定核心网设备的身份是否合法。
进一步的，所述第一处理模块具体用于基于预设的第二根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第二密钥生成算法生成第二终端密钥，并在生成附着完成信息后，基于所述第二终端密钥，通过预设的第一加解密算法对所述附着完成信息进行加密。
本申请实施例中，在终端设备中预先设置第二根密钥，并且在附着接受信息中包含核心网设备参数。接收到附着接受信息后，终端设备获取核心网设备参数，然后根据第二根密钥、终端设备参数及核心网设备参数，以及第二密钥生成算法生成第二终端密钥，所述第二终端密钥用于对交互的信息进行加密保护。
另外，在核心网设备中，预先设置第四根密钥，并且在接收到终端设备传输的附着请求信息后，核心网设备根据第四根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第四密钥生成算法生成第二核心网密钥，所述第二核心网密钥用于对交互的信息进行加密保护。
这种情况下，若允许终端设备接入核心网设备，则预先设置第二根密钥与第四根密钥相同，第二密钥生成算法与第四密钥生成算法相同，并且，由于计算第二终端密钥与计算第二核心网密钥的过程中，均依据终端设备参数及核心网设备参数，因此，第二终端密钥与第二核心网密钥相同。
进一步的，在终端设备中预先设置第一加解密算法，以便通过第一加解密算法对附着完成信息进行加密。在核心网设备中预先设置第二加解密算法，以便通过第二加解密算法对附着完成信息进行解密。其中，若允许终端设备接入核心网设备，则预先设置第一加解密算法与第二加解密算法相同，以便核心网设备能够对终端设备加密的信息进行解密。
另外，在本申请实施例中，所述终端设备参数通常包括：终端设备身份标识和所述终端设备产生的终端随机数，所述核心网设备参数包括：核心网设备身份标识和所述核心网 设备产生的核心网随机数。
相应的，本申请通过第四实施例公开一种信息交互装置，该装置应用于核心网设备，该核心网设备可通过无线接入网设备与终端设备之间进行信息交互，并执行本申请第二实施例公开的信息交互方法。
参见图8所示的结构示意图，本申请实施例公开的信息交互装置包括：第二接收模块400、第二发送模块500和第二处理模块600。
其中，所述第二接收模块400用于接收终端设备传输的附着请求信息。
其中，当终端设备需要接入核心网设备时，终端设备会产生附着请求信息，并通过无线接入网设备将其传输至第二接收模块400。在该附着请求信息中，可以包括终端设备参数。
所述第二处理模块600用于在生成附着接受信息后，基于所述附着接受信息，获取第一完整性校验码，并触发所述第二发送模块500向所述终端设备传输添加有所述第一完整性校验码的附着接受信息。
核心网设备中预先设置有第二完整性算法。在接收到附着请求信息后，第二处理模块600能够根据预先设定的第二完整性算法对附着接受信息进行计算，获取相应的第一完整性校验码。然后，所述第二处理模块600将所述第一完整性校验码添加至所述附着接受信息中，并将添加所述第一完整性校验码的附着接受信息通过无线接入网设备传输至所述终端设备。
所述第二接收模块400还用于接收所述终端设备传输的加密的附着完成信息，所述附着完成信息中包含所述终端设备的第三完整性校验码。
终端设备接收到附着接受信息后，对所述附着接受信息进行计算，获取第二完整性校验码。其中，终端设备在对附着接受信息进行计算时，通常根据预先设定的第一完整性算法进行计算。另外，核心网设备通过预先设定的第二完整性算法对附着接受信息进行计算，获取第一完整性校验码。若允许终端设备接入核心网设备，则预先设定第一完整性算法与第二完整性算法相同。也就是说，终端设备与核心网设备采用相同的完整性算法进行完整性验证。这种情况下，若所述第一完整性校验码和第二完整性校验码相同，则终端设备确定核心网设备的身份合法。
在确定核心网设备的身份合法后，所述终端设备会生成附着完成信息，再对所述附着完成信息进行加密，从而获取加密的附着完成信息。然后，终端设备使用第一完整性算法对加密的附着完成信息进行计算，获取第三完整性校验码，再将所述第三完整性校验码添加至所述加密的附着完成信息中，通过无线接入网设备将添加有所述第三完整性校验码的附着完成信息传输至核心网设备，以便核心网设备通过第二接收模块500获取该附着完成信息。
所述第二处理模块600还用于基于所述加密的附着完成信息，获取第四完整性校验码，若所述第三完整性校验码与所述第四完整性校验码相同，所述第二处理模块600对所述加密的附着完成信息进行解密，并在解密成功后，确定所述终端设备接入核心网设备。
其中，第二处理模块600能够根据第二完整性算法对附着完成信息进行计算，获取第四完整性校验码。若确定第三完整性校验码与第四完整性校验码相同，则可确定终端设备的身份合法。
另外，终端设备对附着完成信息进行了加密处理，以提高附着完成信息的安全性。并且，终端设备通常采用预设的第一加解密方法对附着完成信息进行加密，而核心网设备接收到附着完成信息后，采用预设的第二加解密方法对附着完成信息进行解密。若终端设备允许接入核心网设备，则预先设定第一加解密方法与第二加解密方法相同。
这种情况下，在根据确定终端设备的身份合法后，若核心网设备能够根据第二加解密方法对附着完成信息进行解密，说明终端设备与核心网设备之间交互的信息能够进行加解密，则确定终端设备接入核心网设备。
与现有技术相比，本申请实施例公开的方案，在保障通信系统安全性的前提下，减少数据交互的流程，并且减少终端设备与核心网设备之间交互的信息的数据量，从而减少了终端设备与核心网设备进行信息交互的耗时，以及减少终端设备的功耗开销。
进一步的，在本申请实施例中，所述第二处理模块具体用于基于预设的第三根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第三密钥生成算法生成第一核心网密钥，并基于所述第一核心网密钥和所述附着接受信息，通过预设的第二完整性算法，获取所述第一完整性校验码。
本申请实施例中，在终端设备中预先设置第一根密钥，并且在附着接受信息中包含核心网设备参数。接收到附着接受信息后，终端设备根据第一根密钥、终端设备参数及附着接受信息中包含的核心网设备参数，以及第一密钥生成算法生成第一终端密钥，所述第一终端密钥用于生成完整性校验码。
相应的，在核心网设备中预先设置有第三根密钥，并且在接收到终端设备传输的附着请求信息后，核心网设备能够根据第三根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第三密钥生成算法生成第一核心网密钥，所述第一核心网密钥用于生成完整性校验码。
这种情况下，若终端设备允许接入核心网设备，则根据预先的设置，第一根密钥与第三根密钥相同，第一密钥生成算法与第二密钥生成算法相同，并且，由于计算第一终端密钥与计算第一核心网密钥的过程中，均依据终端设备参数及核心网设备参数，因此，计算得到的第一终端密钥与第一核心网密钥相同。
进一步的，在终端设备中预先设置第一完整性算法，通过第一完整性算法对附着接受信息进行计算，能够得到第二完整性校验码。在核心网设备中预先设置第二完整性算法，通过第二完整性算法对附着接受信息进行计算，能够得到第一完整性校验码。若终端设备允许接入核心网设备，则预先设置第一完整性算法与第二完整性算法相同。
由于第一终端密钥与第一核心网密钥相同，第一完整性算法与第二完整性算法相同，并且，计算第一完整性校验码与计算第二完整性校验码的过程中，均对附着接受信息进行计算，因此，在核心网设备身份合法的情况下，第一完整性校验码与第二完整性校验码相同。这种情况下，终端设备通过比较第一完整性校验码与第二完整性校验码是否相同，即可判定核心网设备的身份是否合法。
进一步的，在本申请实施例中，所述第二处理模块具体用于基于预设的第四根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第四密钥生成算法生成第二核心网密钥，并基于所述第二核心网密钥，通过预设的第二加解密算法对所述加密的附着完成信息进行解密。
本申请实施例中，在终端设备中预先设置第二根密钥，并且在附着请求信息中包含终端设备参数。接收到附着接受信息后，终端设备获取核心网设备参数，然后根据第二根密钥、终端设备参数及核心网设备参数，以及第二密钥生成算法生成第二终端设备密钥，所述第二终端设备密钥用于对交互的信息进行加密保护。
另外，在核心网设备中，预先设置第四根密钥，并且在接收到终端设备传输的附着请求信息后，核心网设备根据第四根密钥、核心网设备参数及附着请求信息中包含的终端设备参数，利用第四密钥生成算法生成第二核心网设备密钥，所述第二核心网设备密钥用于对交互的信息进行加密保护。
这种情况下，若允许终端设备接入核心网设备，则预先设置第二根密钥与第四根密钥相同，第二密钥生成算法与第四密钥生成算法相同，并且，由于计算第二终端设备密钥与计算第二核心网设备密钥的过程中，均依据终端设备参数及核心网设备参数，因此，第二终端设备密钥与第二核心网设备密钥相同。
进一步的，在终端设备中预先设置第一加解密算法，以便通过第一加解密算法对附着完成信息进行加密。在核心网设备中预先设置第二加解密算法，以便通过第二加解密算法对附着完成信息进行解密。其中，若允许终端设备接入核心网设备，则预先设置第一加解密算法与第二加解密算法相同，以便核心网设备能够对终端设备加密的信息进行解密。
另外，在本申请实施例中，所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数，所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。
相应的，本申请实施例还公开一种终端设备，该终端设备包括：收发端口、处理器和与所述处理器相连接的存储器；其中，所述收发端口用于和核心网设备之间进行信息的交互，并将从所述核心网设备接收的信息传输至处理器；所述存储器存储有可被所述处理器执行的指令；所述处理器用于获取所述收发端口传输的报文，并通过执行所述存储器中所存储的程序或指令，执行本申请第一实施例中所公开的信息交互方法。
相应的，本申请实施例还公开一种核心网设备，该核心网设备包括：收发端口、处理器和与所述处理器相连接的存储器；其中，所述收发端口用于和终端设备之间进行信息的交互，并将从所述终端设备接收的信息传输至处理器；所述存储器存储有可被所述处理器执行的指令；所述处理器用于获取所述收发端口传输的报文，并通过执行所述存储器中所存储的程序或指令，执行本申请第二实施例中所公开的信息交互方法。
本申请实施例还提供一种计算机程序产品，包括指令，当指令在计算机上运行时，使得计算机执行图2所公开的方法实施例中所公开的信息交互方法。
本申请实施例还提供一种计算机程序产品，包括指令，当指令在计算机上运行时，使得计算机执行图6所公开的方法实施例中所公开的信息交互方法。
具体实现中，本申请实施例还提供一种计算机存储介质，其中，该计算机存储介质可存储有程序，该程序执行时可实现图2或图6所公开方法实施例中的信息交互方法中的部分或全部步骤。所述的存储介质可为磁碟、光盘、只读存储记忆体(read-only memory，ROM)或随机存储记忆体(random access memory，RAM)等。
本申请实施例还提供了一种芯片，所述芯片装置包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时，实现 本申请第一实施例或第二实施例中所公开的信息交互方法。
需要指出，根据实施的需要，可将本申请实施例中描述的各个部件/步骤拆分为更多部件/步骤，也可将两个或多个部件/步骤或者部件/步骤的部分操作组合成新的部件/步骤，以实现本申请的目的。
本领域的技术人员可以清楚地了解到本申请实施例中的技术可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本申请实施例中的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例或者实施例的某些部分所述的方法。
本说明书中各个实施例之间相同相似的部分互相参见即可。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例中的说明即可。
以上所述的本申请实施方式并不构成对本申请保护范围的限定。

Claims (24)

  1. 一种信息交互方法，其特征在于，包括：
    终端设备向核心网设备传输附着请求信息；
    所述终端设备接收所述核心网设备传输的附着接受信息，所述附着接受信息中包括所述核心网设备的第一完整性校验码；
    所述终端设备基于所述附着接受信息获取第二完整性校验码；
    若所述第一完整性校验码和所述第二完整性校验码相同，所述终端设备获取加密的附着完成信息，并基于所述加密的附着完成信息获取第三完整性校验码，向所述核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息。
  2. 根据权利要求1所述的信息交互方法，其特征在于，所述终端设备基于所述附着接受信息获取第二完整性校验码，包括：
    所述终端设备基于预设的第一根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第一密钥生成算法生成第一终端密钥；
    所述终端设备基于所述第一终端密钥和所述附着接受信息，通过预设的第一完整性算法获取所述第二完整性校验码。
  3. 根据权利要求1所述的信息交互方法，其特征在于，所述终端设备获取加密的附着完成信息，包括：
    所述终端设备基于预设的第二根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第二密钥生成算法生成第二终端密钥；
    所述终端设备在生成附着完成信息后，基于所述第二终端密钥，通过预设的第一加解密算法对所述附着完成信息进行加密。
  4. 根据权利要求2或3所述的信息交互方法，其特征在于，
    所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。
  5. 根据权利要求2或3所述的信息交互方法，其特征在于，
    所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。
  6. 一种信息交互方法，其特征在于，包括：
    核心网设备接收终端设备传输的附着请求信息；
    所述核心网设备在生成附着接受信息后，基于所述附着接受信息，获取第一完整性校验码，并向所述终端设备传输添加有所述第一完整性校验码的附着接受信息；
    所述核心网设备接收所述终端设备传输的加密的附着完成信息，所述附着完成信息中包含所述终端设备的第三完整性校验码；
    所述核心网设备基于所述加密的附着完成信息，获取第四完整性校验码；
    若所述第三完整性校验码与所述第四完整性校验码相同，所述核心网设备对所述加密的附着完成信息进行解密，并在解密成功后，确定所述终端设备接入核心网设备。
  7. 根据权利要求6所述的信息交互方法，其特征在于，所述基于所述附着接受信息，获取第一完整性校验码，包括：
    所述核心网设备基于预设的第三根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第三密钥生成算法生成第一核心网密钥；
    所述核心网设备基于所述第一核心网密钥和所述附着接受信息，通过预设的第二完整性算法，获取所述第一完整性校验码。
  8. 根据权利要求6所述的信息交互方法，其特征在于，所述核心网设备对所述加密的附着完成信息进行解密，包括：
    所述核心网设备基于预设的第四根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第四密钥生成算法生成第二核心网密钥；
    所述核心网设备基于所述第二核心网密钥，通过预设的第二加解密算法对所述加密的附着完成信息进行解密。
  9. 根据权利要求7或8所述的信息交互方法，其特征在于，
    所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。
  10. 根据权利要求7或8所述的信息交互方法，其特征在于，
    所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。
  11. 一种信息交互装置，其特征在于，包括：
    第一发送模块、第一接收模块和第一处理模块；
    所述第一发送模块用于向核心网设备传输附着请求信息；
    所述第一接收模块用于接收所述核心网设备传输的附着接受信息，所述附着接受信息中包括所述核心网设备的第一完整性校验码；
    所述第一处理模块用于基于所述附着接受信息获取第二完整性校验码，若所述第一完整性校验码和所述第二完整性校验码相同，所述第一处理模块用于获取加密的附着完成信息，并基于所述加密的附着完成信息获取第三完整性校验码，并触发所述第一发送模块向所述核心网设备传输添加有所述第三完整性校验码且加密的附着完成信息。
  12. 根据权利要求11所述的信息交互装置，其特征在于，
    所述第一处理模块具体用于基于预设的第一根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第一密钥生成算法生成第一终端密钥，并基于所述第一终端密钥和所述附着接受信息，通过预设的第一完整性算法获取所述第二完整性校验码。
  13. 根据权利要求11所述的信息交互装置，其特征在于，
    所述第一处理模块具体用于基于预设的第二根密钥、终端设备参数及所述附着接受信息中包含的核心网设备参数，通过预设的第二密钥生成算法生成第二终端密钥，并在生成附着完成信息后，基于所述第二终端密钥，通过预设的第一加解密算法对所述附着完成信息进行加密。
  14. 根据权利要求12或13所述的信息交互装置，其特征在于，
    所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。
  15. 根据权利要求12或13所述的信息交互装置，其特征在于，
    所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。
  16. 一种信息交互装置，其特征在于，包括：
    第二接收模块、第二发送模块和第二处理模块，
    所述第二接收模块用于接收终端设备传输的附着请求信息；
    所述第二处理模块用于在生成附着接受信息后，基于所述附着接受信息，获取第一完整性校验码，并触发所述第二发送模块向所述终端设备传输添加有所述第一完整性校验码的附着接受信息；
    所述第二接收模块还用于接收所述终端设备传输的加密的附着完成信息，所述附着完成信息中包含所述终端设备的第三完整性校验码；
    所述第二处理模块还用于基于所述加密的附着完成信息，获取第四完整性校验码，若所述第三完整性校验码与所述第四完整性校验码相同，所述第二处理模块对所述加密的附着完成信息进行解密，并在解密成功后，确定所述终端设备接入核心网设备。
  17. 根据权利要求16所述的信息交互装置，其特征在于，
    所述第二处理模块具体用于基于预设的第三根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第三密钥生成算法生成第一核心网密钥，并基于所述第一核心网密钥和所述附着接受信息，通过预设的第二完整性算法，获取所述第一完整性校验码。
  18. 根据权利要求16所述的信息交互装置，其特征在于，
    所述第二处理模块具体用于基于预设的第四根密钥、核心网设备参数及所述附着请求信息中包含的终端设备参数，通过预设的第四密钥生成算法生成第二核心网密钥，并基于所述第二核心网密钥，通过预设的第二加解密算法对所述加密的附着完成信息进行解密。
  19. 根据权利要求17或18所述的信息交互装置，其特征在于，
    所述终端设备参数包括：终端设备身份标识和所述终端设备产生的终端随机数。
  20. 根据权利要求17或18所述的信息交互装置，其特征在于，
    所述核心网设备参数包括：核心网设备身份标识和所述核心网设备产生的核心网随机数。
  21. 一种计算机可读存储介质，其特征在于，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1至5中任一项所述的方法，或使得计算机执行如权利要求6至10中任一项所述的方法。
  22. 一种计算机程序产品，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求1至5中任一项所述的方法，或使得计算机执行如权利要求6至10中任一项所述的方法。
  23. 一种终端设备，其特征在于，包括：处理器和存储器；
    所述存储器用于存储计算机执行指令，当所述终端设备运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述终端设备执行如权利要求1至5中任一项所述的信息交互方法。
  24. 一种核心网设备，其特征在于，包括：处理器和存储器；
    所述存储器用于存储计算机执行指令，当所述核心网设备运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述核心网设备执行如权利要求6至10中任一项所述的信息交互方法。
PCT/CN2018/105504 2017-11-03 2018-09-13 一种信息交互方法及装置 Ceased WO2019085659A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18872011.4A EP3697144B1 (en) 2017-11-03 2018-09-13 Information interaction method and device
US16/860,289 US11647390B2 (en) 2017-11-03 2020-04-28 Information exchange method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711071266.5A CN109756451B (zh) 2017-11-03 2017-11-03 一种信息交互方法及装置
CN201711071266.5 2017-11-03

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/860,289 Continuation US11647390B2 (en) 2017-11-03 2020-04-28 Information exchange method and apparatus

Publications (1)

Publication Number Publication Date
WO2019085659A1 true WO2019085659A1 (zh) 2019-05-09

Family

ID=66331317

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/105504 Ceased WO2019085659A1 (zh) 2017-11-03 2018-09-13 一种信息交互方法及装置

Country Status (4)

Country Link
US (1) US11647390B2 (zh)
EP (1) EP3697144B1 (zh)
CN (1) CN109756451B (zh)
WO (1) WO2019085659A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022082667A1 (zh) * 2020-10-22 2022-04-28 华为技术有限公司 一种数据安全传输的方法及装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111654731A (zh) * 2020-07-07 2020-09-11 成都卫士通信息产业股份有限公司 密钥信息传输方法、装置、电子设备及计算机存储介质
CN114339473A (zh) * 2021-12-31 2022-04-12 智联数聚科技(江苏)有限公司 一种信息交互方法以及装置
CN117061164B (zh) * 2023-08-09 2024-12-03 杰创智能科技股份有限公司 物联网系统接入安全处理方法
CN119922543A (zh) * 2023-10-31 2025-05-02 华为技术有限公司 一种认证方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102333386A (zh) * 2011-10-20 2012-01-25 大唐移动通信设备有限公司 终端附着方法和设备
EP2713664A1 (en) * 2012-09-28 2014-04-02 Alcatel-Lucent Network attachment
CN104852994A (zh) * 2014-02-13 2015-08-19 普天信息技术研究院有限公司 一种终端侧分组数据网服务器地址管理方法

Family Cites Families (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101336000B (zh) 2008-08-06 2011-11-30 中兴通讯股份有限公司 协议配置选项传输方法及系统、用户终端
US9563616B2 (en) * 2008-11-07 2017-02-07 Workiva Inc. Method and system for generating and utilizing persistent electronic tick marks and use of electronic support binders
KR101556906B1 (ko) * 2008-12-29 2015-10-06 삼성전자주식회사 선인증을 통한 이종 무선 통신망 간의 핸드오버 방법
US8867428B2 (en) * 2009-04-13 2014-10-21 Qualcomm Incorporated Split-cell relay application protocol
CN102056157B (zh) * 2009-11-04 2013-09-11 电信科学技术研究院 一种确定密钥和密文的方法、系统及装置
CN102056347B (zh) * 2009-11-09 2014-07-09 华为终端有限公司 一种转移核心网ip业务的方法、设备及系统
CN102215474B (zh) * 2010-04-12 2014-11-05 华为技术有限公司 对通信设备进行认证的方法和装置
CN102238146B (zh) 2010-04-27 2014-10-08 中国移动通信集团公司 认证方法、装置、认证中心及系统
CN101835156B (zh) * 2010-05-21 2014-08-13 中兴通讯股份有限公司南京分公司 一种用户接入安全保护的方法及系统
CN102625306A (zh) * 2011-01-31 2012-08-01 电信科学技术研究院 认证方法、系统和设备
CN102833742B (zh) * 2011-06-17 2016-03-30 华为技术有限公司 机器类通信设备组算法的协商方法和设备
CN102404329A (zh) * 2011-11-28 2012-04-04 苏州英福迈升信息技术有限公司 用户终端与虚拟社区平台间交互的认证加密方法
CN102438330A (zh) * 2011-12-06 2012-05-02 大唐移动通信设备有限公司 一种附着到e-tran的方法及移动性管理实体
CN103428690B (zh) * 2012-05-23 2016-09-07 华为技术有限公司 无线局域网络的安全建立方法及系统、设备
US9503927B2 (en) * 2012-06-13 2016-11-22 All Purpose Networks LLC Multiple-use wireless network
US9801055B2 (en) 2015-03-30 2017-10-24 Qualcomm Incorporated Authentication and key agreement with perfect forward secrecy
EP3319354B1 (en) * 2015-07-31 2020-12-30 Huawei Technologies Co., Ltd. V2x communication methods and related apparatuses
WO2017035699A1 (zh) * 2015-08-28 2017-03-09 华为技术有限公司 接入网络和获取客户识别模块信息的方法、终端及核心网
WO2017076891A1 (en) * 2015-11-02 2017-05-11 Telefonaktiebolaget Lm Ericsson (Publ) Wireless communications
US10142956B2 (en) * 2015-12-23 2018-11-27 Acer Incorporated Apparatuses and methods for providing assistance information for calls under isolated E-UTRAN operation for public safety (IOPS)
JP6598225B2 (ja) * 2016-01-05 2019-10-30 華為技術有限公司 モバイル通信方法、装置、およびデバイス
EP3989620A1 (en) * 2016-01-14 2022-04-27 Nokia Solutions and Networks Oy Flexible selection of security features in mobile networks
US10334435B2 (en) * 2016-04-27 2019-06-25 Qualcomm Incorporated Enhanced non-access stratum security
US9589397B1 (en) 2016-06-06 2017-03-07 American Megatrends, Inc. Securing internet of things (IoT) based entrance/exit with multi-factor authentication
CN106888092B (zh) * 2016-09-12 2019-06-25 中国移动通信有限公司研究院 信息处理方法及装置
CN106899410B (zh) * 2016-09-13 2019-06-25 中国移动通信有限公司研究院 一种设备身份认证的方法及装置
WO2018089442A2 (en) * 2016-11-09 2018-05-17 Intel IP Corporation Ue and devices for detach handling
CN106790034B (zh) 2016-12-15 2019-04-19 中国电子技术标准化研究院（（工业和信息化部电子工业标准化研究院）（工业和信息化部电子第四研究院）） 一种物联网设备认证和安全接入的方法
CN106856604A (zh) * 2016-12-29 2017-06-16 努比亚技术有限公司 Nas附着系统和方法
CN106878974A (zh) * 2017-01-18 2017-06-20 努比亚技术有限公司 一种网络附着方法、用户设备及移动管理实体
US9998896B1 (en) * 2017-08-18 2018-06-12 Verizon Patent And Licensing Inc. Dedicated APN access using default network access key for profile download

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102333386A (zh) * 2011-10-20 2012-01-25 大唐移动通信设备有限公司 终端附着方法和设备
EP2713664A1 (en) * 2012-09-28 2014-04-02 Alcatel-Lucent Network attachment
CN104852994A (zh) * 2014-02-13 2015-08-19 普天信息技术研究院有限公司 一种终端侧分组数据网服务器地址管理方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "Corrections to EASE", 3GPP TSG-SA WG3 MEETING #84 S 3-161180, 29 July 2016 (2016-07-29), XP051139406 *
See also references of EP3697144A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022082667A1 (zh) * 2020-10-22 2022-04-28 华为技术有限公司 一种数据安全传输的方法及装置

Also Published As

Publication number Publication date
EP3697144B1 (en) 2023-03-01
US20200260285A1 (en) 2020-08-13
EP3697144A4 (en) 2020-12-02
CN109756451B (zh) 2022-04-22
EP3697144A1 (en) 2020-08-19
CN109756451A (zh) 2019-05-14
US11647390B2 (en) 2023-05-09

Similar Documents

Publication Publication Date Title
US11178584B2 (en) Access method, device and system for user equipment (UE)
CN101926151B (zh) 建立安全关联的方法和通信网络系统
US10305684B2 (en) Secure connection method for network device, related apparatus, and system
CN102843687B (zh) 智能手机便携式热点安全接入的方法及系统
US11647390B2 (en) Information exchange method and apparatus
RU2683853C1 (ru) Способ улучшения ключа системы gprs, устройство sgsn, пользовательское устройство, hlr/hss и система gprs
EP3661241A1 (en) Method and device for protecting privacy
CN109923830A (zh) 用于配置无线网络接入设备的系统和方法
CN105814859B (zh) 一种网络配置方法、相关装置及系统
CN109922474A (zh) 触发网络鉴权的方法及相关设备
WO2018137351A1 (zh) 一种网络密钥处理的方法、相关设备及系统
WO2014180296A1 (zh) 一种设备之间建立连接的方法、配置设备和无线设备
CN103297224B (zh) 密钥信息分发方法及相关设备
WO2014127751A1 (zh) 无线终端配置方法及装置和无线终端
CN102420642B (zh) 蓝牙设备及其通信方法
CN106888092A (zh) 信息处理方法及装置
TWI619371B (zh) Communication information transmission method and system
JP2019016841A (ja) 基地局装置、通信システム、及び通信方法
WO2022109941A1 (zh) 应用于WiFi的安全认证的方法和装置
KR101172876B1 (ko) 사용자 단말기와 서버 간의 상호 인증 방법 및 시스템
WO2018076299A1 (zh) 数据传输方法及装置
CN109151816B (zh) 一种网络鉴权方法及系统
WO2016112860A1 (zh) 无线设备的通讯方法、无线设备和服务器
CN102487505A (zh) 一种传感器节点的接入认证方法、装置及系统
CN109688581A (zh) 一种数据的安全传输方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18872011

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018872011

Country of ref document: EP

Effective date: 20200512

WWG Wipo information: grant in national office

Ref document number: 202037019883

Country of ref document: IN