WO2021227964A1 - 安全通信方法、相关装置及系统 - Google Patents

安全通信方法、相关装置及系统 Download PDF

Info

Publication number
WO2021227964A1
WO2021227964A1 PCT/CN2021/092229 CN2021092229W WO2021227964A1 WO 2021227964 A1 WO2021227964 A1 WO 2021227964A1 CN 2021092229 W CN2021092229 W CN 2021092229W WO 2021227964 A1 WO2021227964 A1 WO 2021227964A1
Authority
WO
WIPO (PCT)
Prior art keywords
sepp
certificate
security
message
server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/092229
Other languages
English (en)
French (fr)
Inventor
邵国强
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP21805135.7A priority Critical patent/EP4135380A4/en
Priority to JP2022568509A priority patent/JP7485788B2/ja
Priority to KR1020227043017A priority patent/KR20230008824A/ko
Publication of WO2021227964A1 publication Critical patent/WO2021227964A1/zh
Priority to US17/982,958 priority patent/US20230059030A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup

Definitions

  • This application relates to the field of communication technology, and in particular to secure communication methods, related communication devices, systems, and related computer-readable storage media.
  • the 3rd Generation Partnership Project (3rd Generation Partner Project, 3GPP) defines security and edge protection proxy (Security and Edge Protection Proxy, SEPP equipment) devices as a kind of edge security gateway for the 5G core network (5G Core, 5GC) .
  • the SEPP device is a proxy device for docking between networks of different operators.
  • the signaling interaction between the network function (Network Function, NF) device within the 5G core network and the roaming network is forwarded by the SEPP device.
  • Network Function Network Function
  • the prior art has not yet provided a specific solution for realizing secure communication between SEPP devices of different operator networks.
  • the signaling messages transferred between the SEPP devices may be obtained illegally.
  • an embodiment of the present application provides a secure communication method, including:
  • the first security and border protection agent SEPP device receives the first message from the security server, and the first message carries the security certificate corresponding to the second SEPP device. Subsequently, the first SEPP device receives the device certificate sent by the second SEPP device, and uses the security certificate corresponding to the second SEPP device to verify the device certificate of the second SEPP device. If the verification is successful, the first SEPP device establishes a secure connection with the second SEPP device.
  • the first SEPP device can use the security certificate corresponding to the second SEPP device to verify the validity of the device certificate of the second SEPP device, thereby improving the first SEPP device and the second SEPP device Security of communication between.
  • the second SEPP device may also use a similar secure communication method to verify the device certificate of the first SEPP device.
  • the security certificate sent by the security server has a higher credibility.
  • this embodiment provides a solution for mutual verification of device certificates between two SEPP devices, which improves the security of communication between the two.
  • the security certificate corresponding to the second SEPP device is the root certificate of the certificate server of the second SEPP device.
  • the first SEPP device may use the root certificate of the certificate server of the second SEPP device sent by the security server to verify the security of the device certificate sent by the second SEPP device.
  • the security certificate corresponding to the second SEPP device is the device certificate of the second SEPP device.
  • the first SEPP device may use the device certificate of the second SEPP device sent by the security server to verify the security of the device certificate sent by the second SEPP device. Compared with using the root certificate to verify the device certificate, it is more efficient to directly use the device certificate obtained from the security server to verify the device certificate sent by the second SEPP device.
  • the security certificate of the second SEPP device received by the first SEPP device is the public key of the second SEPP device.
  • the first SEPP device may use the device certificate of the second SEPP device sent by the security server to verify the security of the public key sent by the second SEPP device.
  • the first SEPP device before the first SEPP device receives the first message from the security server, the first SEPP device sends a certificate request message to the security server, and the certificate request message carries the information of the second SEPP device. Identifies that the certificate request message is used to request the security certificate corresponding to the second SEPP device.
  • the security server is a domain name system DNS server
  • the certificate request message sent by the first SEPP device is a DNS query request.
  • the security server may send the security certificate corresponding to the second SEPP device to the first SEPP device through the DNS query response.
  • obtaining the security certificate corresponding to the second SEPP device is combined with the DNS query process, and the security certificate can be obtained at the same time when the DNS query is performed, which saves message resources and improves communication efficiency.
  • the DNS server may be configured with the correspondence between the host name of the first SEPP device and the root certificate of the certificate server of the first SEPP device, the host name of the second SEPP device and the certificate server of the second SEPP device. The corresponding relationship of the root certificate.
  • the first SEPP device before the first SEPP device receives the first message from the security server, the first SEPP device also sends a second message to the security server.
  • the second message carries the information corresponding to the first SEPP device.
  • Security certificate In addition, the second message also carries the identity of the first SEPP device.
  • the first SEPP device uploads the security certificate corresponding to the first SEPP device to the security server through the second message, so that the security server can save the security certificate.
  • the second message may be a hypertext transfer protocol message or a hypertext transfer protocol security message.
  • the first SEPP device when the first SEPP device successfully verifies the device certificate of the second SEPP device by using the security certificate, it sends a verification success message to the second SEPP device. Therefore, the second SEPP device can generate a session key for communicating with the first SEPP device in response to the verification success message.
  • establishing a secure connection between the first SEPP device and the second SEPP device includes: the first SEPP device calculates a session key for secure communication with the second SEPP device, and then the first SEPP device uses the session The key establishes a secure connection with the second SEPP device.
  • the SEPP device in this embodiment calculates the session key and then uses the session key to establish a secure connection, which can enhance the security of communication between the first SEPP device and the second SEPP device.
  • the embodiments of the present application provide another secure communication method, which mainly includes:
  • the security server before the security server obtains the root certificate of the certificate server of the second SEPP device, the security server receives a certificate request message sent by the first SEPP device, and the certificate request message carries the second SEPP device Of the logo. Wherein, the certificate request message is used to request the security certificate corresponding to the second SEPP device.
  • the second message also carries the identifier of the second SEPP device.
  • the security server before the security server obtains the security certificate corresponding to the second SEPP device, the security server receives a second message sent by the first SEPP device, and the second message carries the security certificate corresponding to the first SEPP device .
  • an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it can complete any one of the first aspect or the second aspect. method.
  • an embodiment of the present application provides a security and boundary protection proxy SEPP device, which includes: at least one processor and a memory coupled to each other, the memory stores computer program code, and the processor calls and executes all The computer program code in the memory causes the SEPP device to execute the method described in the first aspect above.
  • an embodiment of the present application provides a secure communication system, which includes:
  • a core network function device and a first SEPP device where the core network function device is configured to send a signaling message to the first SEPP device;
  • the first SEPP device is configured to perform the method of the first aspect described above, and sends the received signaling message to the second SEPP device through a secure connection.
  • the above-mentioned signaling message is a roaming signaling message.
  • an embodiment of the present application provides a first SEPP device, and the first SEPP device mainly includes:
  • the communication unit is configured to receive a first message from the security server, and the first message carries a security certificate corresponding to the second SEPP device; in addition, the communication unit is also configured to receive a device certificate sent by the second SEPP device.
  • the first SEPP device provided in this embodiment can be used in the secure communication methods provided in the foregoing first and second aspects. For specific details and beneficial effects, reference may be made to the foregoing embodiment.
  • the communication unit is further configured to send a certificate request message to the security server, where the certificate request message carries the identifier of the second SEPP device.
  • the security certificate corresponding to the second SEPP device may be the root certificate of the certificate server of the second SEPP device, or may be the device certificate of the second SEPP device.
  • the communication unit is further configured to send a second message to the security server, where the second message carries the security certificate corresponding to the first SEPP device. Therefore, the second SEPP device can obtain the security certificate corresponding to the first SEPP device from the security server, and verify the device certificate of the first SEPP device, which enhances the security of communication between the first SEPP device and the second SEPP device.
  • the communication unit is further configured to send a verification success message to the second SEPP device to notify the second SEPP device when the verification unit uses the security certificate to verify the device certificate of the second SEPP device successfully The device certificate is successfully verified.
  • the establishment of a secure connection between the connection establishment unit and the second SEPP device may specifically include:
  • connection establishment unit calculates a session key used for secure communication with the second SEPP device, and then the connection establishment unit uses the session key to establish a secure connection with the second SEPP device.
  • an embodiment of the present application provides a security server, which mainly includes an acquisition unit and a communication unit.
  • the obtaining unit is used to obtain the security certificate corresponding to the second security and border protection agent SEPP device; the communication unit is used to send a first message to the first SEPP device, and the first message carries the security certificate corresponding to the second SEPP device.
  • the security server provided in this embodiment can be used in the secure communication method provided above, and the specific details and beneficial effects can be referred to the foregoing embodiment.
  • the communication unit is further configured to receive a certificate request message sent by the first SEPP device, where the certificate request message carries the identifier of the second SEPP device.
  • the communication unit before the obtaining unit obtains the security certificate corresponding to the second SEPP device, the communication unit further receives a second message sent by the second SEPP device, and the second message carries the security corresponding to the second SEPP device. Certificate.
  • an embodiment of the present application provides an SEPP device, including: a processor and a memory coupled to each other; the processor is used to call a computer program stored in the memory to execute the SEPP device in the embodiment of the present application Part or all of the steps of any one of the methods.
  • an embodiment of the present application provides a security server, including: a processor and a memory coupled to each other; wherein the processor is used to call a computer program stored in the memory to execute the security server in the embodiment of the present application. Part or all of the steps of any method executed by the server device.
  • an embodiment of the present application provides a computer-readable storage medium that stores a computer program, and when the computer program is executed by a processor, it can complete the SEPP device or security in the embodiment of the present application. Part or all of the steps of any method executed by the server.
  • an embodiment of the present application provides a communication device, including: at least one input, a signal processor, and at least one output; Or part or all of the steps of any method executed by the security server.
  • an embodiment of the present application provides a communication device, including: an input interface circuit, a logic circuit, and an output interface circuit.
  • the logic circuit is used to execute any of the SEPP devices or security servers in the embodiments of the present application. Part or all of the steps of a method.
  • the embodiments of the present application provide a computer program product including instructions.
  • the computer program product runs on a computer device, the computer device can execute any one of the SEPP device or the security server. Part or all of the steps of the method.
  • the security server may be a DNS server
  • the first message received by the first SEPP device may be a DNS response message
  • the secure connection established by the first SEPP device and the second SEPP device is a transport layer secure connection.
  • Fig. 1-A is a schematic diagram of a 5G network architecture exemplified in an embodiment of the present application.
  • Fig. 1-B is a schematic diagram of a network architecture in a roaming scenario as an example of an embodiment of the present application.
  • Fig. 1-C is a schematic diagram of a network architecture in another roaming scenario exemplified by an embodiment of the present application.
  • Fig. 1-D is a schematic diagram of a network architecture in another roaming scenario exemplified by an embodiment of the present application.
  • Fig. 1-E is a schematic diagram of a network architecture in another roaming scenario exemplified by an embodiment of the present application.
  • Fig. 2 is a schematic flowchart of a communication method provided by an embodiment of the present application.
  • Fig. 3 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Fig. 4 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • Fig. 5 is a functional schematic diagram of an SEPP device provided by an embodiment of the present application.
  • Fig. 6 is a functional schematic diagram of a security server provided by an embodiment of the present application.
  • Fig. 7 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of an interface of a single board in a communication device provided by an embodiment of the present application.
  • Fig. 9 is a hardware structure diagram of the SEPP device and the security server provided by an embodiment of the present application.
  • FIG. 1-A is a schematic diagram of a 5G network architecture exemplified in an embodiment of the present application.
  • the 5G network splits some functional devices of the 4G network (such as Mobility Management Entity (MME), etc.) to a certain extent, and defines an architecture based on a service-oriented architecture.
  • MME Mobility Management Entity
  • the functions similar to the MME in the 4G network are split into the Access and Mobility Management Function (AMF) and the Session Management Function (Session Management Function, SMF) and so on.
  • AMF Access and Mobility Management Function
  • SMF Session Management Function
  • the User Equipment accesses the data network and so on by accessing the operator's network, and uses the service provided by the operator or a third party on the DN.
  • the user terminal, user equipment, terminal device, mobile terminal, or terminal in the embodiments of the present application may be collectively referred to as UE. That is, unless otherwise specified, the UE described later in the embodiments of the present application can be replaced with a user terminal, user equipment, terminal device, mobile terminal, or terminal, and of course they can also be interchanged.
  • the Access and Mobility Management Function is a control plane function in the 3GPP network, which is mainly responsible for the access control and mobility management of the UE's access to the operator's network.
  • the security anchor function SEAF may be deployed in the AMF, or the SEAF may also be deployed in another device different from the AMF.
  • the SEAF is deployed in the AMF as an example.
  • SEAF and AMF can be collectively referred to as AMF.
  • the session management function is a control plane function in the 3GPP network. Among them, the SMF is mainly used to manage the packet data unit (PDU) session of the UE.
  • the PDU session is a channel used to transmit PDUs, and the UE can send PDUs to each other through the PDU session and the DN.
  • SMF is responsible for management work such as the establishment, maintenance and deletion of PDU sessions.
  • DN Packet Data Network
  • PDN Packet Data Network
  • the 3GPP network can access multiple DNs, and multiple services provided by operators or third parties can be deployed on the DNs.
  • a certain DN is a private network of a smart factory, sensors installed on the smart factory workshop play the role of UE, and a control server for the sensors is deployed in the DN.
  • the UE communicates with the control server, and after obtaining the instruction of the control server, the UE can transmit the collected data to the control server according to the instruction.
  • a DN is a company's internal office network, and the terminal used by the company's employees can play the role of a UE, and this UE can access the company's internal information and other resources.
  • UDM Unified Data Management
  • UDM is also a control plane function in the 3GPP network.
  • UDM is mainly responsible for storing the subscription data, credential and persistent identity of the subscriber (UE) in the 3GPP network. Subscriber Permanent Identifier, SUPI), etc. These data can be used to authenticate and authorize the UE to access the operator's 3GPP network.
  • SUPI Subscriber Permanent Identifier
  • the authentication server function (Authentication Server Function, AUSF) is also a control plane function in the 3GPP network, and the AUSF is mainly used for the first-level authentication (that is, the 3GPP network authenticates its subscribers).
  • the Network Exposure Function is also a control plane function in the 3GPP network.
  • NEF is mainly responsible for opening the external interface of the 3GPP network to third parties in a safe manner.
  • SMF and other functions need to communicate with third-party network elements, NEF can be used as a communication relay.
  • NEF can translate internal and external logos. For example, when the SUPI of the UE is sent from the 3GPP network to a third party, the NEF can translate the SUPI into its corresponding external identity (Identity, ID). Conversely, NEF can translate the external identity ID into the corresponding SUPI when it is sent to the 3GPP network.
  • the User Plane Function is the gateway for the communication between the 3GPP network and the DN.
  • the policy control function (Policy Control Function, PCF) is a control plane function in the 3GPP network, which is used to provide a PDU session policy to the SMF.
  • Policies may include charging, Quality of Service (QoS), authorization-related policies, and so on.
  • the access network (Access Network, AN) is a sub-network of the 3GPP network. To access the 3GPP network, the UE first needs to go through the AN.
  • AN is also called a radio access network (Radio Access Network, RAN), so the two terms RAN and AN are often mixed without distinction.
  • RAN Radio Access Network
  • 3GPP network refers to a network that complies with 3GPP standards. Among them, the part except UE and DN in Figure 1-A can be regarded as a 3GPP network.
  • 3GPP networks are not limited to 5G networks defined by 3GPP, but can also include 2G, 3G, and 4G networks. Usually 3GPP networks are operated by operators.
  • N1, N2, N3, N4, N6, etc. in the architecture shown in FIG. 1-A respectively represent reference points between related entities/network functions. Nausf, Namf... etc. respectively represent service-oriented interfaces of related network functions.
  • 3GPP networks and non-3GPP networks may coexist, and some network elements in the 5G network may also be used in some non-5G networks.
  • the SEPP device serves as a border security gateway of the 5G core network (5GC).
  • the SEPP device acts as an agent for the docking between operator networks, and signaling messages between the internal network function (NF) of the 5G core network and the roaming network are forwarded through the SEPP device.
  • the SEPP device supports the IPX device (IPX for short) to identify and modify the content of the non-sensitive transmission message.
  • the above architecture also includes a security server, which can communicate with the SEPP device, and the security server can store some security information, such as the security certificate of the SEPP device or the root certificate of the issuing authority of the security certificate of the SEPP device.
  • the security server can also be called a third-party server, which can be deployed by industry organizations or government agencies such as the Global Mobile Communications Association (GSM Association, GSMA), or it can be an IP exchange service (IPX) network.
  • the device that is, the device in the IPX network, implements the function of the security server in the embodiment of the present application.
  • the equipment in the IPX network may include Diameter routing agent (Diameter routing agent, DRA) equipment and domain name server (domain name server, DNS).
  • the SEPP device may also be referred to as SEPP for short (for example, the first SEPP device is referred to as the first SEPP, the second SEPP device is referred to as the second SEPP, and so on), that is, SEPP and SEPP devices can be mixed.
  • SEPP SEPP
  • the IPX device is referred to as IPX (for example, the first IPX device is referred to as the first IPX, the second IPX device is referred to as the second IPX, and so on), that is, the IPX device and the IPX can be mixed.
  • the SEPP device can be divided into a visit SEPP device (visit SEPP, vSEPP) and a home SEPP device (home SEPP, hSEPP).
  • SEPP devices of different operator networks can be connected through the N32 interface.
  • the vSEPP device and the hSEPP device are directly connected through the N32-C interface.
  • the vSEPP device can also be connected to the IPX through the N32-f interface, and the IPX can then be connected to the hSEPP device through the N32-f interface.
  • There may be one IPX between SEPP devices for example, as shown in Figure 1-D), or there may be multiple IPX (for example, as shown in Figure 1-C).
  • SEPP equipment can be divided into SEPP equipment (consumer's SEPP, cSEPP) serving consumers and SEPP equipment (producer's SEPP, pSEPP) from the perspective of providing services and consuming services.
  • SEPP equipment consumer's SEPP, cSEPP
  • SEPP equipment producer's SEPP, pSEPP
  • the vSEPP device may be a pSEPP device and the hSEPP device may be a cSEPP device.
  • the vSEPP device may also be a cSEPP device and the hSEPP device may be a pSEPP device.
  • IPX network directly connected to the pSEPP device is called pIPX
  • IPX network directly connected to the cSEPP device is called cIPX.
  • the IPX network may include DRA equipment and DNS.
  • the IPX device can be a DRA device or DNS in an IPX network.
  • FIG. 2 is a schematic flowchart of a secure communication method provided by an embodiment of this application.
  • the security certificate of the SEPP device is the root certificate of the certificate server of the SEPP device as an example.
  • a communication method in this embodiment may include:
  • the first SEPP device uploads the root certificate of the certificate server of the first SEPP device to the security server.
  • the certificate server of the first SEPP device allocates a device certificate to the first SEPP device, and the first SEPP device also obtains the root certificate of the certificate server.
  • the root certificate can be used to verify the validity of the device certificate of the first SEPP device.
  • the certificate server may specifically be a trusted certificate issuing server.
  • the security certificate uploaded by the first SEPP device to the security server is specifically the root certificate of the certificate server of the first SEPP device (referred to as the root certificate of the first SEPP device).
  • the first SEPP device may upload the root certificate to the secure server through a Hypertext Transfer Protocol (Hypertext Transfer Protocol, http) message or an encrypted Hypertext Transfer Protocol (Hypertext Transfer Protocol Secure, https) message.
  • the message may also carry operator information of the first SEPP device, such as one or more of the operator's domain name, operator's identity, and public land mobile network identity (PLMN ID).
  • PLMN ID public land mobile network identity
  • the message may also carry the identity of the first SEPP device.
  • the security server may receive the security certificate uploaded by the first SEPP device through the message, and save the security certificate locally. In this embodiment.
  • the second SEPP device uploads the root certificate of the certificate server of the second SEPP device to the security server.
  • the certificate server of the second SEPP device allocates a device certificate to the second SEPP device, and the second SEPP device also obtains the root certificate of the certificate server.
  • the root certificate can be used to verify the validity of the device certificate of the second SEPP device.
  • the second SEPP device may upload the root certificate to the secure server through an http message or an https message.
  • the security server may receive the security certificate corresponding to the second SEPP device uploaded by the second SEPP device through a message.
  • the security certificate is the root certificate of the certificate server of the second SEPP device (referred to as the root certificate of the second SEPP device).
  • steps 201 and 202 may be time-independent, that is, step 202 may be performed before step 201.
  • the first SEPP device receives a first message from the security server, where the first message carries the root certificate of the certificate server of the second SEPP device.
  • the first SEPP device may actively send a request message (get message) to the security server to obtain the root certificate of the certificate server of the second SEPP device.
  • the security server may also use the first message to actively push the root certificate of the certificate server of the second SEPP device to the first SEPP device.
  • the first message may be a notification message.
  • the first message may also carry the identity of the second SEPP device and/or operator information.
  • the identifier of the second SEPP device may be the address or host name of the second SEPP device.
  • the second SEPP device receives the first message from the security server, where the first message carries the root certificate of the certificate server of the first SEPP device.
  • the second SEPP device may also actively obtain the root certificate of the certificate server of the first SEPP device from the security server.
  • the security server may also use the first message to actively push the root certificate of the certificate server of the first SEPP device to the second SEPP device.
  • steps 203 and 204 may be time-independent, that is, step 204 may be performed before step 203.
  • the type of the first message in step 203 and step 204 is the same, but the carried content is different.
  • the root certificate of the certificate server of the second SEPP device is stored in the first SEPP device, and the root certificate of the certificate server of the first SEPP device is also stored in the second SEPP device.
  • the first SEPP device receives the device certificate of the second SEPP device, and the second SEPP device receives the device certificate sent by the first SEPP device.
  • both the first SEPP device and the second SEPP device exchange their respective device certificates.
  • both the first SEPP device and the second SEPP device can also exchange their public keys.
  • the first SEPP device uses the root certificate of the certificate server of the second SEPP device to verify the device certificate of the second SEPP device.
  • the first SEPP device uses the previously saved root certificate of the certificate server of the second SEPP device to verify the device certificate sent by the second SEPP device.
  • the verification process includes verifying whether the issuing organization of the device certificate of the second SEPP device is the issuing organization in the root certificate.
  • the root certificate can also include user information.
  • the first SEPP device can verify whether the second SEPP device is a qualified user.
  • the first SEPP device can also verify the validity period of the device certificate of the second SEPP device, whether the device certificate is revoked, and so on.
  • the first SEPP device uses the public key in the device certificate of the second SEPP device to send an encrypted message to the second SEPP device, and the second SEPP device can use its own private key to decrypt the encrypted message , So as to obtain the parameters in the encrypted message, such as the random number RAND1. If the verification fails, a failure notification message is sent to the second SEPP device.
  • the first SEPP device uses the previously saved root certificate of the certificate server of the second SEPP device to verify the second SEPP device The public key sent.
  • the verification process at this time specifically includes verifying whether the issuing authority of the public key of the second SEPP device is the issuing authority in the root certificate.
  • the second SEPP device uses the root certificate of the certificate server of the first SEPP device to verify the device certificate of the first SEPP device.
  • the second SEPP device uses the previously saved root certificate of the certificate server of the first SEPP device to verify the device certificate sent by the first SEPP device.
  • the verification process includes verifying whether the issuing organization of the device certificate of the first SEPP device is the issuing organization corresponding to the root certificate.
  • the second SEPP device can also verify the validity period of the device certificate, whether the device certificate has been revoked, and so on.
  • the first SEPP device may associate the device certificate of the second SEPP device with the root certificate of the certificate server of the second SEPP device through the identifier of the second SEPP device.
  • the second SEPP device uses the public key in the device certificate of the first SEPP device to send an encrypted message to the first SEPP device, and the first SEPP device can use its own private key to decrypt the encrypted message , So as to obtain the parameters in the encrypted message, such as the random number RAND2. If the verification fails, a failure notification message is sent to the first SEPP device.
  • the second SEPP device uses the previously saved root certificate of the certificate server of the first SEPP device to verify the first SEPP device The public key sent.
  • the verification process at this time specifically includes verifying whether the issuing authority of the public key of the first SEPP device is the issuing authority in the root certificate.
  • the first SEPP device and the second SEPP device calculate the session key, and use the session key for secure communication.
  • the first SEPP device After the first SEPP device sends a verification success message to the second SEPP device, it uses RAND1 and RAND2 to calculate the session key for secure communication. Correspondingly, after the second SEPP device sends a verification success message to the first SEPP device, it can also use RAND1 and RAND2 to calculate the session key for secure communication.
  • the first SEPP device and the second SEPP device calculate the session key
  • other parameters and encryption algorithms may be combined, which is not limited in this embodiment.
  • the first SEPP device and the second SEPP device forward the signaling message to each other, they can use the session key for encryption.
  • the receiver After receiving the signaling message, the receiver can also use the session key for decryption, that is, a secure connection is established between the first SEPP device and the second SEPP device.
  • the first SEPP device can obtain the root certificate of the certificate server of the peer SEPP device (the second SEPP device) from the security server, and then after receiving the device certificate of the second SEPP device, The root certificate of the certificate server can be used to verify the validity of the device certificate of the second SEPP device, thereby improving the security of communication between the first SEPP device and the second SEPP device.
  • the second SEPP device may also use a similar secure communication method to verify the device certificate of the first SEPP device.
  • this embodiment provides a solution for mutual verification of device certificates between two SEPP devices, which improves the security of communication between the two.
  • a secure connection (or called a secure transmission channel, a secure link, a secure data forwarding channel, etc.) is established between the first SEPP device and the second SEPP device.
  • the foregoing secure connection may specifically be a Transport Layer Security (TLS) connection or an Internet Protocol Security (IPsec) connection or other underlying security connections.
  • TLS Transport Layer Security
  • IPsec Internet Protocol Security
  • the connection in each embodiment of the present application may also be referred to as a tunnel or channel, for example, a TLS connection may also be referred to as a TLS tunnel or a TLS channel, and an IPsec connection may also be referred to as an IPsec tunnel or an IPsec channel.
  • the first SEPP device can directly obtain the root certificate of the certificate server of the peer SEPP device from the connected security server, and then when the first SEPP device receives the device certificate from the peer SEPP device, The obtained root certificate is used to perform security verification on the device certificate of the peer SEPP device, thereby improving the communication security between the first SEPP device and the second SEPP device.
  • the above-mentioned solution facilitates the automatic distribution of the root certificate of the certificate server of the SEPP device without manual intervention, thereby helping to reduce the risk of human error in the root certificate distribution process and the risk of being attacked during the transmission process.
  • the above-mentioned root certificate distribution process is relatively simplified, which is conducive to cost saving.
  • the first SEPP device and the second SEPP device may update the root certificate of the certificate server to the security server after the root certificate is updated.
  • the first SEPP device is taken as an example to illustrate the root certificate update process.
  • the first SEPP device may send the updated root certificate to the security server through the second message, and the security server may update the root certificate of the security server of the first SEPP device stored locally. Subsequently, the security server may send the updated root certificate of the security server of the first SEPP device to the second SEPP device through the first message.
  • the second SEPP device and the first SEPP device will re-execute the process of steps 204-208 to establish a new secure connection between the first SEPP device and the second SEPP device, and use the new session key to encrypt the signaling information.
  • FIG. 3 is a schematic flowchart of another secure communication method provided by an embodiment of this application.
  • the security certificate of the SEPP device is the root certificate of the certificate server of the SEPP device as an example.
  • the security server in the example solution of this embodiment is specifically a DNS server, and the DNS server may be located in an IPX network.
  • the secure communication method of this embodiment may include:
  • the first SEPP device sends a TLSA RR message to the DNS server, which carries the host name of the first SEPP device and the root certificate of the certificate server.
  • the first SEPP device uploads the security certificate corresponding to the first SEPP device to the DNS server through a TLS Authentication Resource Record (TLSA RR) message.
  • the security certificate is the root certificate of the certificate server of the first SEPP device.
  • the TLSA RR message also includes the host name of the first SEPP device.
  • the content of the TLS RR message can be as follows: _443._tcp.www.example.com.IN TLSA(1 1 292003ba34942dc74152e2f2c408d29eca5a520e7f2e06bb944f4dca346baf63c1b177615d466f6c4b71c216a26a50292bd74c9fedd2f433433.
  • the content in the brackets includes the root certificate of the certificate server of the first SEPP device.
  • the second SEPP device sends a TLSA RR message to the DNS server, which carries the host name of the second SEPP device and the root certificate of the certificate server.
  • the DNS server may be configured with the host name of the first SEPP device and the root certificate of the certificate server of the first SEPP device, the host name of the second SEPP device, and the root certificate of the certificate server of the second SEPP device. . Therefore, the secure communication method provided in this embodiment can directly start from step 303 below.
  • the first SEPP device sends a DNS request message to the DNS server, which carries the host name of the second SEPP device.
  • the first SEPP device actively obtains the root certificate of the certificate server of the second SEPP device from the DNS server through the DNS request message.
  • the message body of the DNS request message carries the identifier of the second SEPP device, which is the host name of the second SEPP device in this embodiment.
  • the DNS request message may specifically be a DNS query request.
  • the DNS server sends a DNS response message to the first SEPP device, which carries the root certificate and time to live (TTL) of the certificate server of the second SEPP device.
  • TTL time to live
  • the DNS server After receiving the DNS request sent by the first SEPP device, the DNS server obtains the root certificate corresponding to the identifier of the second SEPP device carried in the DNS request, and then returns a DNS response message to the first SEPP device.
  • the DNS response message carries the root certificate and the lifetime of the certificate server of the second SEPP device.
  • the DNS response message may also carry the IP address of the second SEPP device.
  • the DNS response message may specifically be a DNS query response.
  • the first SEPP device After receiving the DNS response message, the first SEPP device caches the root certificate of the certificate server of the second SEPP device.
  • the DNS response message may specifically be a DNS query response.
  • the second SEPP device sends a DNS request message to the DNS server, which carries the host name of the first SEPP device.
  • the DNS server sends a DNS response message to the second SEPP device, which carries the root certificate and the lifetime of the certificate server of the first SEPP device.
  • the second SEPP device also sends a DNS request message to the DNS server, and the DNS server returns a DNS response message to the second SEPP device.
  • the specific execution process of steps 305-306 is similar to the above-mentioned steps 303-304, and will not be repeated here.
  • step 305 can also be performed before step 303.
  • the first SEPP device receives the device certificate of the second SEPP device, and the second SEPP device receives the device certificate sent by the first SEPP device.
  • the first SEPP device uses the root certificate of the certificate server of the second SEPP device to verify the device certificate of the second SEPP device.
  • the second SEPP device uses the root certificate of the certificate server of the first SEPP device to verify the device certificate of the first SEPP device.
  • the first SEPP device and the second SEPP device calculate the session key, and use the session key for secure communication.
  • steps 307-310 is similar to the foregoing steps 205-208. For details, refer to the description of the foregoing embodiment.
  • the DNS response message received by the first SEPP device carries TTL. After determining that the TTL has expired, the first SEPP device re-executes the steps of sending the DNS request message above to retrieve the security corresponding to the second SEPP device. Certificate (in this embodiment, it is the root certificate of the certificate server). After obtaining the updated security certificate, the first SEPP device re-executes the above-mentioned process 307-310 to establish a new security connection with the second SEPP device.
  • the second SEPP device may also re-execute the step of sending the DNS request message, that is, the process of step 305.
  • the first SEPP device obtains the root certificate of the certificate server of the second SEPP device from the DNS server when performing a DNS query, and then subsequently receives the device certificate of the second SEPP device,
  • the root certificate of the certificate server can be used to verify the validity of the device certificate of the second SEPP device, thereby improving the security of communication between the first SEPP device and the second SEPP device.
  • the second SEPP device may also use a similar secure communication method to verify the device certificate of the first SEPP device.
  • the technical solution of this embodiment combines the DNS query process, further simplifies the process of mutual verification of the device certificate between two SEPP devices, and improves the verification efficiency.
  • FIG. 4 is a schematic flowchart of a secure communication method provided by an embodiment of the application.
  • the security certificate of the SEPP device is the device certificate of the SEPP device as an example for description.
  • a communication method in this embodiment may include:
  • the first SEPP device uploads the device certificate of the first SEPP device to the security server.
  • the certificate server of the first SEPP device allocates a device certificate to the first SEPP device, and the device certificate may include the public key and private key of the first SEPP device, and may also include the signature of the certificate server.
  • the security certificate uploaded by the first SEPP device to the security server is the device certificate of the first SEPP device, and the first SEPP device may upload its device certificate to the security server through an http message or an https message.
  • the first SEPP device may also delete the private key in the device certificate, and then upload the device certificate with the deleted private key to the security server to prevent the private key from being leaked.
  • the device certificate received by the security server includes the public key of the first SEPP device, but does not include the private key of the first SEPP device.
  • the second SEPP device uploads the device certificate of the second SEPP device to the security server.
  • the second SEPP device can use a similar method to upload its device certificate to the security server.
  • the specific process refer to the description of step 401 above.
  • steps 401 and 402 may be time-independent, that is, step 402 may be performed before step 401.
  • the first SEPP device receives a first message from the security server, where the first message carries the device certificate of the second SEPP device.
  • the first SEPP device may actively send a request message to the security server to obtain the device certificate of the second SEPP device.
  • the security server may also use the first message to actively push the device certificate of the second SEPP device to the first SEPP device.
  • the first message may also carry the identifier of the second SEPP device.
  • the identifier of the second SEPP device may be the address or host name of the second SEPP device.
  • the second SEPP device receives the first message from the security server, and the first message carries the device certificate of the first SEPP device.
  • steps 403 and 404 may be time-independent, that is, step 404 may be executed before step 403.
  • the device certificate of the second SEPP device is saved in the first SEPP device, and the device certificate of the first SEPP device is also saved in the second SEPP device.
  • the first SEPP device receives the device certificate sent by the second SEPP device, and the second SEPP device receives the device certificate sent by the first SEPP device.
  • both the first SEPP device and the second SEPP device exchange their respective device certificates.
  • both the first SEPP device and the second SEPP device can also exchange their public keys.
  • the first SEPP device uses the device certificate of the second SEPP device sent by the security server to verify the device certificate sent by the second SEPP device.
  • the first SEPP device uses the previously saved device certificate of the second SEPP device to verify the device certificate sent by the second SEPP device. If they are the same, the verification is successful. If they are different, the verification fails.
  • the first SEPP device uses the public key in the device certificate of the second SEPP device to send an encrypted message to the second SEPP device, and the second SEPP device can use its own private key to decrypt the encrypted message, thereby Obtain the parameters in the encrypted message, such as the random number RAND1. If the verification fails, a failure notification message is sent to the second SEPP device.
  • the first SEPP device uses the previously saved device certificate of the second SEPP device to verify the public key sent by the second SEPP device. key.
  • the verification process at this time specifically includes verifying whether the issuing authority of the public key of the second SEPP device is the issuing authority in the root certificate.
  • the second SEPP device uses the device certificate of the first SEPP device sent by the security server to verify the device certificate sent by the first SEPP device.
  • the second SEPP device uses the previously saved device certificate of the first SEPP device to verify the device certificate sent by the first SEPP device.
  • the second SEPP device uses the public key in the device certificate of the first SEPP device to send an encrypted message to the first SEPP device, and the first SEPP device can use its own private key to decrypt the encrypted message to obtain The parameters in the encrypted message, such as the random number RAND2. If the verification fails, a failure notification message is sent to the first SEPP device.
  • the second SEPP device uses the previously saved device certificate of the first SEPP device to verify the public key sent by the first SEPP device. key.
  • the verification process at this time specifically includes verifying whether the issuing authority of the public key of the first SEPP device is the issuing authority in the root certificate.
  • the first SEPP device and the second SEPP device calculate the session key, and use the session key for secure communication.
  • step 408 is similar to step 208 in the foregoing embodiment. For details, refer to the foregoing embodiment, and details are not described herein again.
  • the first SEPP device can obtain the device certificate of the peer SEPP device (the second SEPP device) from the security server, and then after receiving the device certificate of the second SEPP device, it can use the security
  • the device certificate of the second SEPP device sent by the server is used to verify the validity of the device certificate sent by the second SEPP device, thereby improving the security of communication between the first SEPP device and the second SEPP device.
  • the second SEPP device may also use a similar secure communication method to verify the security certificate of the first SEPP device.
  • the above-mentioned solution facilitates the automatic distribution of the device certificate of the SEPP device without manual intervention, thereby helping to reduce the risk of human error in the device certificate distribution process and the risk of being attacked during the transmission process.
  • the first SEPP device and the second SEPP device may perform steps 409 and 410, respectively, that is, after the device certificate is updated, the device certificate is updated to the security server.
  • the first SEPP device is used as an example to illustrate the device certificate update process.
  • the first SEPP device may send the updated device certificate to the security server through the second message, and the security server may update the device certificate of the first SEPP device stored locally.
  • the security server may send the updated device certificate of the first SEPP device to the second SEPP device through the first message.
  • the second SEPP device and the first SEPP device will re-execute the process of steps 404-408 to establish a new secure connection between the first SEPP device and the second SEPP device, and use the new session key to encrypt the signaling information.
  • a functional schematic diagram of the SEPP device provided in an embodiment of the present application.
  • the first SEPP device 500 is taken as an example to illustrate the functions of the SEPP device, and the second SEPP device may also include similar functional modules.
  • the first SEPP device 500 mainly includes a communication unit 510, a verification unit 520, and a connection establishment unit 530.
  • the communication unit 510 is configured to receive a first message from the security server, and the first message carries a security certificate corresponding to the second SEPP device; in addition, the communication unit 510 is also configured to receive a device certificate sent by the second SEPP device.
  • the verification unit 520 is configured to use the received security certificate to verify the device certificate of the second SEPP device.
  • the connection establishment unit 530 is configured to establish a secure connection with the second SEPP device after the verification is successful.
  • the first SEPP device provided in this embodiment may be used in the secure communication method provided in the foregoing method embodiment, and for specific details and beneficial effects, reference may be made to the foregoing embodiment.
  • the first SEPP device in this embodiment through the cooperation between the communication unit 510, the verification unit 520, and the connection establishment unit 530, the first SEPP device and the second SEPP device can perform security verification, which improves the security of the first SEPP device and The security of the second SEPP device communication.
  • the communication unit 510 is further configured to send a certificate request message to the security server, where the certificate request message carries the identifier of the second SEPP device.
  • the security certificate corresponding to the second SEPP device may be the root certificate of the certificate server of the second SEPP device, or may be the device certificate of the second SEPP device.
  • the security server interacting with the first SEPP device may be a DNS server.
  • the certificate request message sent by the first SEPP device is a DNS query request.
  • the above-mentioned first message is a DNS query response.
  • the communication unit 510 is further configured to send a second message to the security server, where the second message carries the security certificate corresponding to the first SEPP device. Therefore, the second SEPP device can obtain the security certificate corresponding to the first SEPP device from the security server, and verify the device certificate of the first SEPP device, which enhances the security of communication between the first SEPP device and the second SEPP device. In addition, the second message also carries the identity of the first SEPP device.
  • the communication unit 510 is further configured to send a verification to the second SEPP device when the verification unit 520 uses the security certificate to verify the device certificate of the second SEPP device successfully.
  • a successful message informs the second SEPP device that the certificate verification is successful.
  • connection establishment unit 530 establishing a secure connection with the second SEPP device may specifically include:
  • connection establishment unit 530 calculates a session key used for secure communication with the second SEPP device, and then the connection establishment unit 530 uses the session key to establish a secure connection with the second SEPP device.
  • Fig. 6 is a functional schematic diagram of the security server provided in this embodiment.
  • the security server 600 mainly includes an obtaining unit 610 and a communication unit 620.
  • the obtaining unit 610 is used to obtain the security certificate corresponding to the second security and border protection agent SEPP device; the communication unit 620 is used to send a first message to the first SEPP device, and the first message carries the security certificate corresponding to the second SEPP device .
  • the security server provided in this embodiment can be used in the secure communication method provided in the foregoing method embodiments. For specific details and beneficial effects, reference may be made to the foregoing embodiments.
  • the security server in this embodiment can send the security certificate corresponding to the second SEPP device to the first SEPP device through the cooperation between the communication unit 620 and the obtaining unit 610, so that the first SEPP device can use the security certificate to communicate with the second SEPP device. Perform verification to improve the security of communication.
  • the above-mentioned obtaining unit 610 may also obtain the security certificate corresponding to the first SEPP device, and then the communication unit 620 sends a first message to the second SEPP device, and the first message carries the security certificate corresponding to the first SEPP device. Therefore, the second SEPP device uses the security certificate to verify the first SEPP device, which improves the security of communication.
  • the communication unit 620 is further configured to receive a certificate request message sent by the first SEPP device, and the certificate request message carries the identifier of the second SEPP device.
  • the communication unit 620 before the obtaining unit 610 obtains the security certificate corresponding to the second SEPP device, the communication unit 620 also receives a second message sent by the second SEPP device, and the second message carries the second SEPP The security certificate corresponding to the device. At this time, the obtaining unit 610 obtains the security certificate corresponding to the second SEPP device from the received second message.
  • the second message may also carry an identifier of the second SEPP device, and the identifier is used to associate the second SEPP device with a security certificate corresponding to the second SEPP device.
  • FIG. 7 is a schematic structural diagram of a communication device 700 according to an embodiment of the application
  • FIG. 8 is a schematic diagram of an interface of a single board 730 in the communication device 700.
  • the communication device mainly includes a cabinet 720 and a single board 730 installed in the cabinet.
  • the single board is composed of chips and electronic components, and can provide communication services.
  • the number of single boards 730 can be increased or decreased according to actual needs, and this embodiment does not limit the number of single boards 730.
  • the cabinet 720 is also installed with a cabinet door 721.
  • the single board 730 includes multiple input/output interfaces, such as a display interface 731 for an external display, a network interface 732 for connecting to a communication network, a universal serial bus (USB) interface 733, and the like.
  • the single board 730 also includes a power interface 733 for connecting a power source, a heat dissipation port 734 for heat dissipation, and the like.
  • the foregoing communication device implements different functions by installing different single boards 730, for example, may implement the functions of the SEPP device or the security server in the embodiment of the present application.
  • Control elements such as general-purpose processors/control chips/logic circuits are installed on the single board 730.
  • a memory may also be installed in the single board 730.
  • the foregoing processor and memory may cooperate with related communication interfaces to execute part or all of the steps of any method that can be executed by the SEPP device or the security server in the embodiment of the present application.
  • FIG. 9 is a hardware structure diagram of the SEPP device and the security server provided by an embodiment of the present invention.
  • Both the SEPP device and the security server provided in this embodiment can use general computer hardware, which includes a processor 901, a memory 902, a bus 903, an input device 904, an output device 905, and a network interface 906.
  • the memory 902 may include a computer storage medium in the form of a volatile and/or nonvolatile memory, such as a read-only memory and/or a random access memory.
  • the memory 902 can store an operating system, application programs, other program modules, executable codes, and program data.
  • the input device 904 can be used to input commands and information to an AMF device or MSC.
  • the input device 904 is a keyboard or pointing device, such as a mouse, trackball, touchpad, microphone, joystick, game pad, satellite TV antenna, scanner or the like equipment. These input devices can be connected to the processor 901 through the bus 903.
  • the output device 905 can be used to output information from an AMF device or MSC. In addition to a monitor, the output device 905 can also provide other peripheral output devices, such as speakers and/or printing devices. These output devices can also be connected to the processor through the bus 903. ⁇ 901.
  • the SEPP device or the security server may be connected to a communication network through the network interface 906, for example, connected to a local area network (LAN).
  • LAN local area network
  • the computer-executed instructions stored in the SEPP device and the security server can be stored in a remote storage device, not limited to local storage.
  • the SEPP device device can execute the method steps on the SEPP device side in the above method embodiments, for example, execute steps 201, 203, 303, 307, 405, etc.
  • steps 201, 203, 303, 307, 405, etc. For the specific execution process, refer to the foregoing method embodiment, which will not be repeated here.
  • the security server can execute the method steps on the security server side in the above method embodiments, for example, execute steps 203-204, 403, etc.
  • the specific execution process refer to the foregoing method embodiment, which will not be repeated here.
  • the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and the computer program can be completed when executed by hardware (such as a processor).
  • the SEPP device or Part or all of the steps of any method executed by the security server are provided.
  • the embodiment of the present application also provides a computer program product including instructions.
  • the computer program product runs on a computer device, the computer device is caused to execute part of any method that can be executed by the SEPP device or the security server. Or all steps.
  • the computer may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (such as a floppy disk, a hard disk, and a magnetic tape), an optical medium (such as an optical disk), or a semiconductor medium (such as a solid-state hard disk).
  • the disclosed device may also be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated. To another system, or some features can be ignored or not implemented.
  • the displayed or discussed indirect coupling or direct coupling or communication connection between each other may be through some interfaces, indirect coupling or communication connection between devices or units, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • the functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may also be implemented in the form of software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium.
  • a number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供一种安全通信方法和相关装置及系统。在本实施例提供的技术方案中，第一 SEPP 设备可以使用第二 SEPP 设备对应的安全证书来校验第二 SEPP 设备的设备证书的有效性，从而提升了第一 SEPP 设备和第二 SEPP 设备之间通信的安全性。第二 SEPP 设备也可以采用类似的安全通信方法来校验第一 SEPP 设备的设备证书。相对于第二 SEPP 设备发送的设备证书，安全服务器发送的安全证书可信度更高。

Description

安全通信方法、相关装置及系统
本申请要求于2020年5月11日提交中国国家知识产权局、申请号为202010394218.5、申请名称为“安全通信方法、相关装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及安全通信方法、相关的通信装置、系统及相关的计算机可读存储介质。
背景技术
目前，第三代合作伙伴计划(3rd Generation Partner Project，3GPP)定义了安全和边界保护代理(Security and Edge Protection Proxy，SEPP设备)设备作为5G核心网(5G Core，5GC)的一种边界安全网关。SEPP设备是不同运营商网络之间对接的一种代理设备，5G核心网内部的网络功能(Network Function，NF)设备与漫游网络之间的信令交互通过SEPP设备转发。
现有技术还没有提供不同运营商网络的SEPP设备之间实现安全通信的具体方案，这种情况下，可能导致SEPP设备之间传递的信令消息被非法获取。
发明内容
本申请实施例提供了通信方法、系统和相关装置及计算机可读存储介质。
第一方面，本申请实施例提供一种安全通信方法，包括：
第一安全和边界保护代理SEPP设备接收来自于安全服务器的第一消息，该第一消息中携带第二SEPP设备对应的安全证书。随后，第一SEPP设备接收第二SEPP设备发送的设备证书，并使用第二SEPP设备对应的安全证书来校验第二SEPP设备的设备证书。如果校验成功，则第一SEPP设备与所述第二SEPP设备建立安全连接。
在本实施例提供的技术方案中，第一SEPP设备可以使用第二SEPP设备对应的安全证书来校验第二SEPP设备的设备证书的有效性，从而提升了第一SEPP设备和第二SEPP设备之间通信的安全性。第二SEPP设备也可以采用类似的安全通信方法来校验第一SEPP设备的设备证书。相对于第二SEPP设备发送的设备证书，安全服务器发送的安全证书可信度更高。与现有技术相比，本实施例提供了一种两个SEPP设备之间相互校验设备证书的方案，提高了两者之间通信的安全性。
在一个可能的实施例中，第二SEPP设备对应的安全证书为第二SEPP设备的证书服务器的根证书。此时，第一SEPP设备可以使用安全服务器发送的第二SEPP设备的证书服务器的根证书来校验第二SEPP设备发送的设备证书的安全性。
在一个可能的实施例中，第二SEPP设备对应的安全证书为第二SEPP设备的设备证书。此时，第一SEPP设备可以使用安全服务器发送的第二SEPP设备的设备证书来校验第二SEPP设备发送的设备证书的安全性。相对于使用根证书来校验设备证书，直接使用从安全服务器获取的设备证书来校验第二SEPP设备发送的设备证书的效率更高。
在一个可能的实施例中，第一SEPP设备接收到的第二SEPP设备的安全证书为第二SEPP设备的公钥。此时，第一SEPP设备可以使用安全服务器发送的第二SEPP设备的设备证书来校验第二SEPP设备发送的公钥的安全性。
在一个可能的实施例中，在第一SEPP设备接收来自于安全服务器的第一消息之前，第一SEPP设备向安全服务器发送证书请求消息，所述证书请求消息中携带所述第二SEPP设备的标识，该证书请求消息用于请求第二SEPP设备对应的安全证书。
在一个可能的实施例中，安全服务器为域名系统DNS服务器，第一SEPP设备发送的证书请求消息为DNS查询请求。此时，安全服务器可以通过DNS查询响应向第一SEPP设备发送第二SEPP设备对应的安全证书。本实施例将获取第二SEPP设备对应的安全证书与DNS查询过程结合，在进行DNS查询的时候同时可以获得上述安全证书，节省了消息资源，提高了通信效率。
在一个可能的实施例中，DNS服务器上可以配置有上述第一SEPP设备的主机名和第一SEPP设备的证书服务器的根证书的对应关系、第二SEPP设备的主机名和第二SEPP设备的证书服务器的根证书的对应关系。
在一个可能的实施例中，在第一SEPP设备接收来自于安全服务器的第一消息之前，第一SEPP设备还向安全服务器发送第二消息，第二消息中携带所述第一SEPP设备对应的安全证书。此外，第二消息中还携带第一SEPP设备的标识。本实施例中第一SEPP设备通过第二消息向安全服务器上传第一SEPP设备对应的安全证书，便于安全服务器保存该安全证书。
在一个可能的实施例中，第二消息可以为超文本传输协议消息或超文本传输协议安全消息。
在一个可能的实施例中，第一SEPP设备在使用安全证书校验第二SEPP设备的设备证书成功时，向所述第二SEPP设备发送校验成功的消息。从而第二SEPP设备可以响应于该校验成功的消息，生成与第一SEPP设备进行通信的会话密钥。
在一个可能的实施例中，第一SEPP设备与第二SEPP设备建立安全连接包括：第一SEPP设备计算用于和第二SEPP设备进行安全通信的会话密钥，随后第一SEPP设备使用该会话密钥和第二SEPP设备建立安全连接。本实施例中的SEPP设备通过计算会话密钥，进而使用会话密钥建立安全连接，可以增强第一SEPP设备与第二SEPP设备通信的安全。
第二方面，本申请实施例提供另外一种安全通信方法，其主要包括：
安全服务器获取第二安全和边界保护代理SEPP设备对应的安全证书，随后安全服务器向第一SEPP设备发送第一消息，该第一消息中携带第二SEPP设备对应的安全证书。
在本实施例提供的方案中，安全服务器向第一SEPP设备发送的安全证书的可信度高于第二SEPP设备向第一SEPP设备发送的设备证书，因而第一SEPP设备可以使用安全服务器发送的安全证书来校验第一SEPP设备发送的设备证书，从而提高第一SEPP设备和第二SEPP设备之间通信的安全性。
在一个可能的实施例中，在安全服务器获取第二SEPP设备的证书服务器的根证书之前，安全服务器接收第一SEPP设备发送的证书请求消息，所述证书请求消息中携带所述第二SEPP设备的标识。其中，该证书请求消息用于请求第二SEPP设备对应的安全证书。
在一个可能的实施例中，在安全服务器获取第二SEPP设备对应的安全证书之前，安全服务器接收第二SEPP设备发送的第二消息，第二消息中携带所述第二SEPP设备对应的安全证 书。
在一个可能的实施例中，第二消息中还携带所述第二SEPP设备的标识。
在一个可能的实施例中，在安全服务器获取第二SEPP设备对应的安全证书之前，安全服务器接收第一SEPP设备发送的第二消息，第二消息中携带所述第一SEPP设备对应的安全证书。
第三方面，本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，计算机程序被处理器执行时能够完成第一方面或第二方面任意一项所述的方法。
第四方面，本申请实施例提供一种安全和边界保护代理SEPP设备，其包括：至少一个处理器和相互耦合的存储器，所述存储器中存储了计算机程序代码，所述处理器调用并执行所述存储器中的计算机程序代码，使得所述SEPP设备执行以上第一方面所述的方法。
第五方面，本申请实施例提供一种安全通信的系统，其包括：
核心网网络功能设备和第一SEPP设备，核心网网络功能设备配置于向所述第一SEPP设备发送信令消息；
所述第一SEPP设备配置于执行上述第一方面的方法，并将接收到的信令消息通过安全连接向第二SEPP设备发送。
在一个可能的实施例中，上述信令消息为漫游信令消息。
第六方面，本申请实施例提供一种第一SEPP设备，该第一SEPP设备主要包括：
通信单元，用于接收来自于安全服务器的第一消息，第一消息中携带第二SEPP设备对应的安全证书；此外，通信单元还用于接收第二SEPP设备发送的设备证书。
第一SEPP设备还包括校验单元和连接建立单元，校验单元用于使用接收到的安全证书校验第二SEPP设备的设备证书，连接建立单元用于在校验成功后，与所述第二SEPP设备建立安全连接。
本实施例提供的第一SEPP设备可以使用在前述第一方面和第二方面提供的安全通信方法中，具体细节和有益效果可以参考上述实施例。
在一个可能的实施例中，通信单元还用于向安全服务器发送证书请求消息，所述证书请求消息中携带所述第二SEPP设备的标识。
在一个可能的实施例中，第二SEPP设备对应的安全证书可以为第二SEPP设备的证书服务器的根证书，还可以为第二SEPP设备的设备证书。
在一个可能的实施例中，通信单元还用于向安全服务器发送第二消息，所述第二消息中携带所述第一SEPP设备对应的安全证书。从而，第二SEPP设备可以从安全服务器获得第一SEPP设备对应的安全证书，并对第一SEPP设备的设备证书进行校验，增强了第一SEPP设备和第二SEPP设备通信的安全性。
在一个可能的实施例中，通信单元还用于在校验单元使用安全证书校验所述第二SEPP设备的设备证书成功时，向第二SEPP设备发送校验成功的消息，通知第二SEPP设备证书校验成功。
在一个可能的实施例中，连接建立单元与第二SEPP设备建立安全连接具体可以包括：
连接建立单元计算用于和所述第二SEPP设备进行安全通信的会话密钥，随后连接建立单元使用所述会话密钥和所述第二SEPP设备建立安全连接。
第七方面，本申请实施例提供一种安全服务器，该安全服务器主要包括获取单元和通信 单元。
其中，获取单元用于获取第二安全和边界保护代理SEPP设备对应的安全证书；通信单元用于向第一SEPP设备发送第一消息，第一消息中携带第二SEPP设备对应的安全证书。
本实施例提供的安全服务器可以使用在前面提供的安全通信方法中，具体细节和有益效果可以参考上述实施例。
在一个可能的实施例中，通信单元还用于接收第一SEPP设备发送的证书请求消息，该证书请求消息中携带所述第二SEPP设备的标识。
在一个可能的实施例中，在获取单元获取第二SEPP设备对应的安全证书之前，通信单元还接收第二SEPP设备发送的第二消息，第二消息中携带所述第二SEPP设备对应的安全证书。
第八方面，本申请实施例提供一种SEPP设备，包括：相互耦合的处理器和存储器；所述处理器用于调用所述存储器中存储的计算机程序，以执行本申请实施例中由SEPP设备执行的任意一种方法的部分或全部步骤。
第九方面，本申请实施例提供一种安全服务器，包括：相互耦合的处理器和存储器；其中，所述处理器用于调用所述存储器中存储的计算机程序，以执行本申请实施例中由安全服务器设备执行的任意一种方法的部分或全部步骤。
第十方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时能够完成本申请实施例中由SEPP设备或安全服务器执行的任意一种方法的部分或全部步骤。
第十一方面，本申请实施例提供一种通信装置，包括：至少一个输入端、信号处理器和至少一个输出端；其中，所述信号处理器，用于执行本申请实施例中由SEPP设备或安全服务器执行的任意一种方法的部分或全部步骤。
第十二方面，本申请实施例提供一种通信装置，包括：输入接口电路，逻辑电路和输出接口电路，所述逻辑电路用于执行执行本申请实施例中由SEPP设备或安全服务器执行的任意一种方法的部分或全部步骤。
第十三方面，本申请实施例提供一种包括指令的计算机程序产品，当所述计算机程序产品在计算机设备上运行时，使得所述这个计算机设备执行可由SEPP设备或安全服务器执行的任意一种方法的部分或者全部步骤。
在以上任一方面提供的实施例中，安全服务器可以为DNS服务器，第一SEPP设备接收到的第一消息可以为DNS响应消息。
在以上任一方面提供的实施例中，第一SEPP设备和第二SEPP设备建立的安全连接为传输层安全连接。
附图说明
下面将对本申请实施例中所需要使用的附图作简单地介绍。
图1-A是本申请实施例举例的一种5G网络架构的示意图。
图1-B是本申请实施例举例的一种漫游场景下的网络架构的示意图。
图1-C是本申请实施例举例的另一种漫游场景下的网络架构的示意图。
图1-D是本申请实施例举例的另一种漫游场景下的网络架构的示意图。
图1-E是本申请实施例举例的另一种漫游场景下的网络架构的示意图。
图2是本申请实施例提供的一种通信方法的流程示意图。
图3是本申请实施例提供的另一种通信方法的流程示意图。
图4是本申请实施例提供的另一种通信方法的流程示意图。
图5是本申请实施例提供的一种SEPP设备的功能示意图。
图6是本申请实施例提供的一种安全服务器的功能示意图。
图7是本申请实施例提供的一种通信装置的结构示意图。
图8是本申请实施例提供的一种通信装置中单板的接口示意图。
图9是本申请实施例提供的SEPP设备和安全服务器的硬件结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别不同对象，而不是用于描述特定顺序。
参见图1-A，图1-A是本申请实施例举例的一种5G网络架构的示意图。5G网络对4G网络的某些功能设备(例如移动性管理实体(Mobility Management Entity，MME)等等)进行了一定拆分，并定义了基于服务化架构的架构。在图1-A所示网络架构中，类似4G网络中的MME的功能，被拆分成了接入与移动性管理功能(Access and Mobility Management Function，AMF)和会话管理功能(Session Management Function，SMF)等等。
下面对其他一些相关设备/网元/实体进行介绍。
用户终端(User Equipment,UE)通过接入运营商网络来访问数据网络等等，使用DN上的由运营商或第三方提供的业务。
为方便说明，本申请实施例中用户终端、用户设备、终端设备、移动终端或终端等可统称为UE。即，若无特别的说明，本申请实施例后文所描述的UE均可替换为用户终端、用户设备、终端设备、移动终端或终端，当然它们之间也可互换。
接入与移动性管理功能(AMF)是3GPP网络中的一种控制面功能，主要负责UE接入运营商网络的接入控制和移动性管理。其中，安全锚点功能(Security Anchor Function，SEAF)可以部署于AMF之中，或SEAF也可能部署于不同于AMF的另一设备中，图1-A中以SEAF被部署于AMF中为例。当SEAF被部署于AMF中时，SEAF和AMF可合称为AMF。
会话管理功能(SMF)是3GPP网络中的一种控制面功能，其中，SMF主要用于负责管理UE的分组数据单元(Packet Data Unit，PDU)会话。PDU会话是一个用于传输PDU的通道，UE可以通过PDU会话与DN互相发送PDU。SMF负责PDU会话的建立、维护和删除等管理工作。
数据网络(Data Network，DN)也称为分组数据网络(Packet Data Network，PDN)，它是位于3GPP网络之外的网络。其中，3GPP网络可接入多个DN，DN上可部署运营商或第三方提供的多种业务。例如，某个DN是一个智能工厂的私有网络，安装在智能工厂车间的传感器扮演UE的角色，DN中部署了传感器的控制服务器。UE与控制服务器通信，UE在获取控制服务器的指令之后，可根据这个指令将采集的数据传递给控制服务器。又例如，DN是一个公司的内部办公网络，该公司员工所使用的终端则可扮演UE的角色，这个UE可以访问公司内部的信息和其他资源。
其中，统一数据管理实体(Unified Data Management,UDM)也是3GPP网络中的一种控制 面功能，UDM主要负责存储3GPP网络中签约用户(UE)的签约数据、信任状(credential)和持久身份标识(Subscriber Permanent Identifier，SUPI)等。这些数据可以被用于UE接入运营商3GPP网络的认证和授权。
认证服务器功能(Authentication Server Function，AUSF)也是3GPP网络中的一种控制面功能，AUSF主要用于第一级认证(即3GPP网络对其签约用户的认证)。
其中，网络开放功能(Network Exposure Function，NEF)也是3GPP网络之中的一种控制面功能。NEF主要负责以安全的方式对第三方开放3GPP网络的对外接口。其中，在SMF等功能需要与第三方网元通信时，可以以NEF为通信的中继。其中，中继时，NEF可以进行内外部标识的翻译。比如将UE的SUPI从3GPP网络发送到第三方时，NEF可将SUPI翻译成其对应的外部身份标识(Identity,ID)。反之，NEF可将外部身份ID在发送到3GPP网络时，将其翻译成对应的SUPI。
其中，网络存储功能(Network Repository Function，NRF)也是3GPP网络中的一种控制面功能，主要负责存储可被访问的网络功能(NF)的配置与服务资料(profile)，为其他网元提供网络功能的发现服务。
用户面功能(User Plane Function，UPF)是3GPP网络与DN通信的网关。
策略控制功能(Policy Control Function，PCF)是3GPP网络中的一种控制面功能，用于向SMF提供PDU会话的策略。策略可包括计费、服务质量(Quality of Service，QoS)、授权相关策略等。
接入网(Access Network，AN)是3GPP网络的一个子网络，UE要接入3GPP网络，首先需要经过AN。在无线接入场景下AN也称无线接入网(Radio Access Network，RAN),因此RAN和AN这两个术语经常不做区分的混用。
3GPP网络是指符合3GPP标准的网络。其中，图1-A中除了UE和DN以外的部分可看作是3GPP网络。3GPP网络不只局限于3GPP定义的5G网络，还可包括2G、3G、4G网络。通常3GPP网络由运营商来运营。此外，在图1-A所示架构中的N1、N2、N3、N4、N6等分别代表相关实体/网络功能之间的参照点(Reference Point)。Nausf、Namf...等分别代表相关网络功能的服务化接口。
当然，3GPP网络和非3GPP网络可能共存，5G网络的中的一些网元也可能被运用到一些非5G网络中。
参见图1-B，SEPP设备作为5G核心网(5GC)的一种边界安全网关。在漫游场景下，SEPP设备作为运营商网络之间对接的代理，5G核心网的内部网络功能(NF)与漫游网络之间的信令消息通过SEPP设备转发。SEPP设备在支持对传输消息进行完整性和机密性保护的同时，支持IPX设备(简称IPX)识别并修改非敏感的传输消息内容。
上述架构中还包括安全服务器，安全服务器可以与SEPP设备通信，安全服务器上可以存储一些安全信息，例如SEPP设备的安全证书或SEPP设备的安全证书的颁发机构的根证书等。
其中，安全服务器也可以称为第三方服务器，其可以由全球移动通信协会(GSM Association，GSMA)等行业组织或政府机构来部署，也可以为IP交换服务(IP exchange service，IPX)网络中的设备，即IPX网络中的设备来实现本申请实施例中安全服务器的功能。IPX网络中的设备可包括Diameter路由代理(Diameter routing agent,DRA)设备和域名服务器(domain name server,DNS)。
本申请实施例中，也可以将SEPP设备简称SEPP(例如第一SEPP设备简称第一SEPP，第二SEPP设备简称第二SEPP，以此类推)，即SEPP和SEPP设备可混用。将IPX设备简称IPX(例如第一IPX设备简称第一IPX，第二IPX设备简称第二IPX，以此类推)，即，IPX设备和IPX可混用。
其中，当UE在不同运营商网络之间漫游时，SEPP设备可以分为拜访SEPP设备(visit SEPP,vSEPP)和归属SEPP设备(home SEPP，hSEPP)。
参见图1-C和图1-D，不同运营商网络的SEPP设备之间，可以通过N32接口连接。例如，vSEPP设备和hSEPP设备通过N32-C接口直连，vSEPP设备也可以通过N32-f接口连接到IPX，IPX再通过N32-f接口连接到hSEPP设备。SEPP设备之间可能存在一个IPX(例如图1-D举例所示)，也可能存在多个IPX(例如图1-C举例所示)。
参见图1-E，如果按照提供服务和消费服务的角度来看，SEPP设备又可以分为服务消费者的SEPP设备(consumer's SEPP，cSEPP)和服务生产者的SEPP设备(producer's SEPP,pSEPP)。其中，vSEPP设备可能是pSEPP设备而hSEPP设备可能是cSEPP设备。或vSEPP设备也可能是cSEPP设备而hSEPP设备可能是pSEPP设备。
其中，当SEPP设备之间存在多个IPX网络，那么与pSEPP设备直连的IPX网络称为pIPX；与cSEPP设备直连的IPX网络称为cIPX。
其中，IPX网络中可包括DRA设备和DNS。IPX设备可为IPX网络中的DRA设备或DNS。
基于以上的网络架构，下面介绍两个SEPP设备之间进行安全通信的实施方案。参见图2，图2为本申请实施例提供的一种安全通信方法的流程示意图。
本实施例以SEPP设备的安全证书为SEPP设备的证书服务器的根证书为例来说明。本实施例中的一种通信方法可包括：
201.第一SEPP设备向安全服务器上传第一SEPP设备的证书服务器的根证书。
在本实施例中，第一SEPP设备的证书服务器向第一SEPP设备分配了设备证书，第一SEPP设备也获取了该证书服务器的根证书。其中，该根证书可以用来验证第一SEPP设备的设备证书的有效性。证书服务器具体可以为信任的证书签发服务器。
在本实施例中，第一SEPP设备向安全服务器上传的安全证书具体为第一SEPP设备的证书服务器的根证书(简称第一SEPP设备的根证书)。
第一SEPP设备可以通过超文本传输协议(Hypertext Transfer Protocol，http)消息或加密的超文本传输协议(Hypertext Transfer Protocol Secure，https)消息向安全服务器上传该根证书。该消息中还可以携带第一SEPP设备的运营商信息，例如运营商的域名、运营商的标识、公共陆地移动网络标识(public land mobile network identity，PLMN ID)中的一个或多个。该消息中也可以携带第一SEPP设备的标识。
安全服务器可以接收第一SEPP设备通过消息上传的安全证书，在本地保存该安全证书。在本实施例中。
202.第二SEPP设备向安全服务器上传第二SEPP设备的证书服务器的根证书。
在本实施例中，第二SEPP设备的证书服务器向第二SEPP设备分配了设备证书，第二SEPP设备也获取了该证书服务器的根证书。其中，该根证书可以用来验证第二SEPP设备的设备证书的有效性。
第二SEPP设备可以通过http消息或https消息向安全服务器上传根证书。安全服务器可以接收第二SEPP设备通过消息上传的第二SEPP设备对应的安全证书。在本实施例中，该安全证书为第二SEPP设备的证书服务器的根证书(简称第二SEPP设备的根证书)。
另外，步骤201和202可以是时序无关的，即步骤202可以先于步骤201执行。
203.第一SEPP设备接收来自于安全服务器的第一消息，所述第一消息中携带第二SEPP设备的证书服务器的根证书。
在本实施例中，第一SEPP设备可以主动向安全服务器发送请求消息(get message)来获取第二SEPP设备的证书服务器的根证书。此外，安全服务器也可以使用第一消息主动向第一SEPP设备推送第二SEPP设备的证书服务器的根证书。
其中，第一消息可以为通知(notification)消息。第一消息中还可以携带第二SEPP设备的标识和/或运营商信息。第二SEPP设备的标识可以为第二SEPP设备的地址或主机名。
204.第二SEPP设备接收来自于安全服务器的第一消息，第一消息中携带第一SEPP设备的证书服务器的根证书。
对应的，第二SEPP设备也可以主动向安全服务器获取第一SEPP设备的证书服务器的根证书。安全服务器也可以使用第一消息主动向第二SEPP设备来推送第一SEPP设备的证书服务器的根证书。
另外，步骤203和204可以是时序无关的，即步骤204可以先于步骤203执行。步骤203和步骤204中的第一消息的类型相同，但携带的内容不同。
在完成上述步骤201-204之后，第一SEPP设备中保存了第二SEPP设备的证书服务器的根证书，第二SEPP设备中也保存了第一SEPP设备的证书服务器的根证书。
205.第一SEPP设备接收第二SEPP设备的设备证书，第二SEPP设备接收第一SEPP设备发送的设备证书。
在本实施例中，第一SEPP设备在与所述第二SEPP设备建立数据传输(转发)通道时，第一SEPP设备和第二SEPP设备双方交换各自的设备证书。
在本实施例中，第一SEPP设备和第二SEPP设备双方也可以交换其公钥。
206.第一SEPP设备使用第二SEPP设备的证书服务器的根证书校验第二SEPP设备的设备证书。
在本实施例中，第一SEPP设备使用之前保存的第二SEPP设备的证书服务器的根证书校验第二SEPP设备发送的设备证书。其中，校验过程包括校验第二SEPP设备的设备证书的签发机构是否为根证书中的签发机构。根证书中还可以包括使用者信息。第一SEPP设备可以校验第二SEPP设备是否为合格的使用者。
此外，第一SEPP设备还可以校验第二SEPP设备的设备证书的有效期、设备证书是否被吊销等。
如果上述校验成功，第一SEPP设备使用所述第二SEPP设备的设备证书中的公钥向所述第二SEPP设备发送加密消息，第二SEPP设备可以使用自己的私钥对加密消息进行解密，从而获得加密消息中的参数，例如随机数RAND1。如果校验失败，则向第二SEPP设备发送失败通知消息。
在本实施例中，如果第一SEPP设备和第二SEPP设备双方交换的是各自的公钥，则第一SEPP设备使用之前保存的第二SEPP设备的证书服务器的根证书校验第二SEPP设备发送的公 钥。此时的校验过程具体包括校验第二SEPP设备的公钥的签发机构是否为根证书中的签发机构。
207.第二SEPP设备使用第一SEPP设备的证书服务器的根证书校验第一SEPP设备的设备证书。
与步骤206对应的，第二SEPP设备使用之前保存的第一SEPP设备的证书服务器的根证书校验第一SEPP设备发送的设备证书。其中，校验过程包括校验第一SEPP设备的设备证书的签发机构是否为根证书对应的签发机构。
此外，第二SEPP设备还可以校验设备证书的有效期、设备证书是否被吊销等。在具体实现时，第一SEPP设备可以通过第二SEPP设备的标识来关联第二SEPP设备的设备证书和第二SEPP设备的证书服务器的根证书。
如果上述校验成功，第二SEPP设备使用所述第一SEPP设备的设备证书中的公钥向所述第一SEPP设备发送加密消息，第一SEPP设备可以使用自己的私钥对加密消息进行解密，从而获得加密消息中的参数，例如随机数RAND2。如果校验失败，则向第一SEPP设备发送失败通知消息。
在本实施例中，如果第一SEPP设备和第二SEPP设备双方交换的是各自的公钥，则第二SEPP设备使用之前保存的第一SEPP设备的证书服务器的根证书校验第一SEPP设备发送的公钥。此时的校验过程具体包括校验第一SEPP设备的公钥的签发机构是否为根证书中的签发机构。
208.在校验成功后，第一SEPP设备和第二SEPP设备计算会话密钥，使用会话密钥进行安全通信。
在第一SEPP设备向第二SEPP设备发送校验成功的消息后，其使用RAND1和RAND2来计算进行安全通信的会话密钥。对应的，第二SEPP设备向第一SEPP设备发送校验成功的消息后，也可以使用RAND1和RAND2来计算进行安全通信的会话密钥。
其中，第一SEPP设备、第二SEPP设备在计算会话密钥时，可以结合其他的参数和加密算法，本实施例对此不进行限定。
第一SEPP设备和第二SEPP设备在转发信令消息给对方时，可以使用会话密钥进行加密。接收方在接收到信令消息后，也可以使用会话密钥进行解密，即第一SEPP设备和第二SEPP设备之间建立了安全连接。
在本实施例提供的技术方案中，第一SEPP设备可以从安全服务器获取对端SEPP设备(第二SEPP设备)的证书服务器的根证书，进而在随后接收到第二SEPP设备的设备证书后，可以使用该证书服务器的根证书来校验第二SEPP设备的设备证书的有效性，从而提升了第一SEPP设备和第二SEPP设备之间通信的安全性。第二SEPP设备也可以采用类似的安全通信方法来校验第一SEPP设备的设备证书。与现有技术相比，本实施例提供了两个SEPP设备之间相互校验设备证书的方案，提高了两者之间通信的安全性。
在本申请实施例中，第一SEPP设备和第二SEPP设备在计算得到会话密钥后，可以使用会话密钥进行安全通信。此时第一SEPP设备和第二SEPP设备之间建立了安全连接(或称为安全的传输通道、安全链路、安全的数据转发通道等)。上述安全连接具体可以为传输层安全(Transport Layer Security，TLS)连接或者互联网安全协议(Internet Protocol Security，IPsec)连接或者其它的底层安全连接等。本申请各实施例中的连接也可能称为隧道或通道等， 例如TLS连接也可能称为TLS隧道或TLS通道，IPsec连接也可能称为IPsec隧道或IPsec通道。
可以看出，上述举例方案中，第一SEPP设备可直接从连接的安全服务器获取对端SEPP设备的证书服务器的根证书，进而在第一SEPP设备接收到来自对端SEPP设备的设备证书时，使用获取到的根证书对对端SEPP设备的设备证书进行安全校验，从而提高第一SEPP设备和第二SEPP设备之间的通信安全性。并且，上述方案有利于实现SEPP设备的证书服务器的根证书的自动分发，无需人工干预，进而有利于减少根证书分发过程中的人因差错及传输过程中被攻击的风险。并且上述根证书分发流程较简化，有利于节约成本。
在本申请的实施例中，第一SEPP设备和第二SEPP设备可以在其证书服务器的根证书发生更新后，向安全服务器更新该根证书。本实施例以第一SEPP设备为例来说明根证书更新流程。
例如，第一SEPP设备可以通过第二消息将更新的根证书发送到安全服务器，安全服务器可以更新本地保存的第一SEPP设备的安全服务器的根证书。随后，安全服务器可以通过第一消息将更新的第一SEPP设备的安全服务器的根证书发给第二SEPP设备。第二SEPP设备和第一SEPP设备之间将重新执行步骤204-208的流程，从而在第一SEPP设备和第二SEPP设备之间建立新的安全连接，使用新的会话密钥来加密信令消息。
参见图3，图3为本申请实施例提供的另一种安全通信方法的流程示意图。
本实施例以SEPP设备的安全证书为SEPP设备的证书服务器的根证书为例来说明。本实施例举例方案中安全服务器具体为DNS服务器，该DNS服务器可以位于IPX网络中。
具体的，本实施例的安全通信方法可以包括：
301.第一SEPP设备向DNS服务器发送TLSA RR消息，其中携带第一SEPP设备的主机名和证书服务器的根证书。
在本实施例中，第一SEPP设备通过TLS验证资源记录(TLS Authentication resource record，TLSA RR)消息向DNS服务器上传第一SEPP设备对应的安全证书。在本实施例中，该安全证书为第一SEPP设备的证书服务器的根证书。
此外，TLSA RR消息中还包括第一SEPP设备的主机名。
TLS RR消息的内容可以如下：_443._tcp.www.example.com.IN TLSA(1 1 292003ba34942dc74152e2f2c408d29eca5a520e7f2e06bb944f4dca346baf63c1b177615d466f6c4b71c216a50292bd58c9ebdd2f74e38fe51ffd48c43326cbc)。其中，上述括号内的内容包括第一SEPP设备的证书服务器的根证书。
302.第二SEPP设备向DNS服务器发送TLSA RR消息，其中携带第二SEPP设备的主机名和证书服务器的根证书。
第二SEPP设备向DNS服务器发送TLSA RR消息的具体细节可以参考上述步骤301的描述。步骤301和302可以是时序无关的，即步骤302可以先于步骤301执行。
在一个可能的实施例中，DNS服务器上可以配置有上述第一SEPP设备的主机名和第一SEPP设备的证书服务器的根证书、第二SEPP设备的主机名和第二SEPP设备的证书服务器的根证书。从而，本实施例提供的安全通信方法可以直接从下面的步骤303开始。
303.第一SEPP设备向DNS服务器发送DNS请求消息，其中携带第二SEPP设备的主机名。
在本实施例中，第一SEPP设备通过DNS请求消息主动向DNS服务器获取第二SEPP设备的证书服务器的根证书。DNS请求消息的消息体中携带第二SEPP设备的标识，本实施例中为第二SEPP设备的主机名。DNS请求消息具体可以为DNS查询请求。
304.DNS服务器向第一SEPP设备发送DNS响应消息，其中携带第二SEPP设备的证书服务器的根证书和生存时间(time to live，TTL)。
DNS服务器接收到第一SEPP设备发送的DNS请求后，获取与DNS请求中携带的第二SEPP设备的标识对应的根证书，然后向第一SEPP设备返回DNS响应消息。
DNS响应消息中携带上述第二SEPP设备的证书服务器的根证书和生存时间。此外，DNS响应消息中还可以携带第二SEPP设备的IP地址。DNS响应消息具体可以为DNS查询响应。
第一SEPP设备接收到DNS响应消息后，缓存其中的第二SEPP设备的证书服务器的根证书。DNS响应消息具体可以为DNS查询响应。
305.第二SEPP设备向DNS服务器发送DNS请求消息，其中携带第一SEPP设备的主机名。
306.DNS服务器向第二SEPP设备发送DNS响应消息，其中携带第一SEPP设备的证书服务器的根证书和生存时间。
对应的，第二SEPP设备也向DNS服务器发送DNS请求消息，DNS服务器向第二SEPP设备返回DNS响应消息。步骤305-306的具体执行过程和上述步骤303-304类似，在此不再赘述。
另外，第二SEPP设备向DNS服务器发送DNS请求消息与第一SEPP设备向DNS服务器发送DNS请求消息是时序无关的，即步骤305也可以先于步骤303执行。
307.第一SEPP设备接收第二SEPP设备的设备证书，第二SEPP设备接收第一SEPP设备发送的设备证书。
308.第一SEPP设备使用第二SEPP设备的证书服务器的根证书校验第二SEPP设备的设备证书。
309.第二SEPP设备使用第一SEPP设备的证书服务器的根证书校验第一SEPP设备的设备证书。
310.在校验成功后，第一SEPP设备和第二SEPP设备计算会话密钥，使用会话密钥进行安全通信。
其中，步骤307-310的执行过程和上述步骤205-208类似，详情参见上述实施例的描述。
311.第一SEPP设备在TTL过期后，重新向DNS服务器发送DNS请求消息，其中携带第二SEPP设备的主机名。
在本实施例中，第一SEPP设备接收到的DNS响应消息中携带TTL，第一SEPP设备在确定TTL过期后，重新执行上述发送DNS请求消息的步骤，以重新获取第二SEPP设备对应的安全证书(本实施例中为证书服务器的根证书)。第一SEPP设备在获取了更新的安全证书之后，重新执行上述307-310的流程，与第二SEPP设备建立新的安全连接。
其中，第二SEPP设备在确定TTL过期后，也可以重新执行上述发送DNS请求消息的步骤，即上述步骤305的流程。
在本实施例提供的技术方案中，第一SEPP设备在进行DNS查询的时候，从DNS服务器获取第二SEPP设备的证书服务器的根证书，进而在随后接收到第二SEPP设备的设备证书后，可以使用该证书服务器的根证书来校验第二SEPP设备的设备证书的有效性，从而提升了第一 SEPP设备和第二SEPP设备之间通信的安全性。第二SEPP设备也可以采用类似的安全通信方法来校验第一SEPP设备的设备证书。本实施例的技术方案结合了DNS查询过程，进一步简化了两个SEPP设备之间相互校验设备证书的流程，提高了校验效率。
参见图4，图4为本申请实施例提供的一种安全通信方法的流程示意图。
本实施例以SEPP设备的安全证书为SEPP设备的设备证书为例来说明。其中，本实施例中的一种通信方法可包括：
401.第一SEPP设备向安全服务器上传第一SEPP设备的设备证书。
在本实施例中，第一SEPP设备的证书服务器向第一SEPP设备分配了设备证书，设备证书中可以包括第一SEPP设备的公钥和私钥，还可以包括证书服务器的签名。
在本实施例中，第一SEPP设备向安全服务器上传的安全证书为第一SEPP设备的设备证书，第一SEPP设备可以通过http消息或https消息向安全服务器上传其设备证书。
此外，第一SEPP设备也可以删除设备证书中的私钥，然后向安全服务器上传删除了私钥的设备证书，避免私钥被泄露。此时，安全服务器接收到的设备证书中包括第一SEPP设备的公钥，不包含第一SEPP设备的私钥。
402.第二SEPP设备向安全服务器上传第二SEPP设备的设备证书。
在本实施例中，第二SEPP设备可以采用类似的方法向安全服务器上传其设备证书，具体过程可以参考上述步骤401的描述。
另外，步骤401和402可以是时序无关的，即步骤402可以先于步骤401执行。
403.第一SEPP设备接收来自于安全服务器的第一消息，所述第一消息中携带第二SEPP设备的设备证书。
在本实施例中，第一SEPP设备可以主动向安全服务器发送请求消息来获取第二SEPP设备的设备证书。此外，安全服务器也可以使用第一消息主动向第一SEPP设备推送第二SEPP设备的设备证书。
其中，第一消息中还可以携带第二SEPP设备的标识。第二SEPP设备的标识可以为第二SEPP设备的地址或主机名。
404.第二SEPP设备接收来自于安全服务器的第一消息，第一消息中携带第一SEPP设备的设备证书。
其中，步骤403和404可以是时序无关的，即步骤404可以先于步骤403执行。
在完成上述步骤401-404之后，第一SEPP设备中保存了第二SEPP设备的设备证书，第二SEPP设备中也保存了第一SEPP设备的设备证书。
405.第一SEPP设备接收第二SEPP设备发送的设备证书，第二SEPP设备接收第一SEPP设备发送的设备证书。
在本实施例中，第一SEPP设备在与所述第二SEPP设备建立安全连接(数据传输通道)之前，第一SEPP设备和第二SEPP设备双方交换各自的设备证书。
在本实施例中，第一SEPP设备和第二SEPP设备双方也可以交换其公钥。
406.第一SEPP设备使用安全服务器发送的第二SEPP设备的设备证书校验第二SEPP设备发送的设备证书。
在本实施例中，第一SEPP设备使用之前保存的第二SEPP设备的设备证书校验第二SEPP 设备发送的设备证书。如果相同，则校验成功。若不同，则校验失败。
如果上述校验成功，第一SEPP设备使用所述第二SEPP设备的设备证书中的公钥向第二SEPP设备发送加密消息，第二SEPP设备可以使用自己的私钥对加密消息进行解密，从而获得加密消息中的参数，例如随机数RAND1。如果校验失败，则向第二SEPP设备发送失败通知消息。
在本实施例中，如果第一SEPP设备和第二SEPP设备双方交换的是各自的公钥，则第一SEPP设备使用之前保存的第二SEPP设备的设备证书校验第二SEPP设备发送的公钥。此时的校验过程具体包括校验第二SEPP设备的公钥的签发机构是否为根证书中的签发机构。
407.第二SEPP设备使用安全服务器发送的第一SEPP设备的设备证书校验第一SEPP设备发送的设备证书。
与步骤406对应的，第二SEPP设备使用之前保存的第一SEPP设备的设备证书校验第一SEPP设备发送的设备证书。
如果校验成功，第二SEPP设备使用所述第一SEPP设备的设备证书中的公钥向第一SEPP设备发送加密消息，第一SEPP设备可以使用自己的私钥对加密消息进行解密，从而获得加密消息中的参数，例如随机数RAND2。如果校验失败，则向第一SEPP设备发送失败通知消息。
在本实施例中，如果第一SEPP设备和第二SEPP设备双方交换的是各自的公钥，则第二SEPP设备使用之前保存的第一SEPP设备的设备证书校验第一SEPP设备发送的公钥。此时的校验过程具体包括校验第一SEPP设备的公钥的签发机构是否为根证书中的签发机构。
408.在校验成功后，第一SEPP设备和第二SEPP设备计算会话密钥，使用会话密钥进行安全通信。
其中，步骤408的实现过程和上述实施例中的步骤208类似，详情参见上述实施例，在此不再赘述。
在本实施例提供的技术方案中，第一SEPP设备可以从安全服务器获取对端SEPP设备(第二SEPP设备)的设备证书，进而在随后接收到第二SEPP设备的设备证书后，可以使用安全服务器发送的第二SEPP设备的设备证书来校验第二SEPP设备发送的设备证书的有效性，从而提升了第一SEPP设备和第二SEPP设备之间通信的安全性。第二SEPP设备也可以采用类似的安全通信方法来校验第一SEPP设备的安全证书。并且，上述方案有利于实现SEPP设备的设备证书的自动分发，无需人工干预，进而有利于减少设备证书分发过程中的人因差错及传输过程中被攻击的风险。
在本申请的实施例中，第一SEPP设备和第二SEPP设备可以分别执行步骤409和410，即在其设备证书发生更新后，向安全服务器更新该设备证书。本实施例以第一SEPP设备为例来说明设备证书更新流程。
例如，第一SEPP设备可以通过第二消息将更新的设备证书发送到安全服务器，安全服务器可以更新本地保存的第一SEPP设备的设备证书。安全服务器可以通过第一消息将更新的第一SEPP设备的设备证书发给第二SEPP设备。第二SEPP设备和第一SEPP设备之间将重新执行步骤404-408的流程，从而在第一SEPP设备和第二SEPP设备之间建立新的安全连接，使用新的会话密钥来加密信令消息。
下面介绍一些装置实施例。
参见图5，本申请实施例提供的SEPP设备的功能示意图。本实施例以第一SEPP设备500为例来说明SEPP设备的功能，第二SEPP设备也可以包括类似的功能模块。
如图所示，第一SEPP设备500主要包括通信单元510、校验单元520以及连接建立单元530。
其中，通信单元510，用于接收来自于安全服务器的第一消息，第一消息中携带第二SEPP设备对应的安全证书；此外，通信单元510还用于接收第二SEPP设备发送的设备证书。
校验单元520，用于使用接收到的安全证书校验第二SEPP设备的设备证书。
连接建立单元530，用于在校验成功后，与所述第二SEPP设备建立安全连接。
本实施例提供的第一SEPP设备可以使用在前述方法实施例提供的安全通信方法中，具体细节和有益效果可以参考上述实施例。本实施例中的第一SEPP设备通过通信单元510、校验单元520以及连接建立单元530之间的配合，第一SEPP设备和第二SEPP设备可以进行安全校验，提高了第一SEPP设备和第二SEPP设备通信的安全性。
在本实施例提供的第一SEPP设备中，通信单元510还用于向安全服务器发送证书请求消息，所述证书请求消息中携带所述第二SEPP设备的标识。
在本实施例中，第二SEPP设备对应的安全证书可以为第二SEPP设备的证书服务器的根证书，还可以为第二SEPP设备的设备证书。
在本实施例提供的第一SEPP设备中，与第一SEPP设备交互的安全服务器可以为DNS服务器。此时，第一SEPP设备发送的证书请求消息为DNS查询请求。对应的，上述第一消息为DNS查询响应。
在本实施例提供的第一SEPP设备中，通信单元510还用于向安全服务器发送第二消息，所述第二消息中携带所述第一SEPP设备对应的安全证书。从而，第二SEPP设备可以从安全服务器获得第一SEPP设备对应的安全证书，并对第一SEPP设备的设备证书进行校验，增强了第一SEPP设备和第二SEPP设备通信的安全性。此外，第二消息中还携带所述第一SEPP设备的标识。
在本实施例提供的第一SEPP设备中，通信单元510还用于在校验单元520使用安全证书校验所述第二SEPP设备的设备证书成功时，向所述第二SEPP设备发送校验成功的消息，通知第二SEPP设备证书校验成功。
在本实施例提供的第一SEPP设备中，连接建立单元530与第二SEPP设备建立安全连接具体可以包括：
连接建立单元530计算用于和所述第二SEPP设备进行安全通信的会话密钥，随后连接建立单元530使用所述会话密钥和所述第二SEPP设备建立安全连接。
以上以第一SEPP设备500为例来介绍SEPP设备的功能模块。第二SEPP设备也可以包括对应的功能模块。此时，第二SEPP设备中的通信单元用于接收来自于安全服务器的第一消息，第一消息中携带第一SEPP设备对应的安全证书；此外，通信单元还用于接收第一SEPP设备发送的设备证书。第二SEPP设备中的校验单元用于使用接收到的安全证书校验第一SEPP设备的设备证书。第二SEPP设备中的连接建立单元用于在校验成功后，与所述第一SEPP设备建立安全连接。
参见图6，图6是本实施例提供的安全服务器的功能示意图。
如图所示，安全服务器600主要包括获取单元610和通信单元620。
其中，获取单元610用于获取第二安全和边界保护代理SEPP设备对应的安全证书；通信单元620用于向第一SEPP设备发送第一消息，第一消息中携带第二SEPP设备对应的安全证书。
本实施例提供的安全服务器可以使用在前述方法实施例提供的安全通信方法中，具体细节和有益效果可以参考上述实施例。本实施例中的安全服务器通过通信单元620以及获取单元610之间的配合，可以向第一SEPP设备发送第二SEPP设备对应的安全证书，便于第一SEPP设备使用该安全证书对第二SEPP设备进行校验，提高了通信的安全性。
此外，上述获取单元610也可以获取第一SEPP设备对应的安全证书，然后由通信单元620向第二SEPP设备发送第一消息，第一消息中携带该第一SEPP设备对应的安全证书。从而第二SEPP设备使用该安全证书对第一SEPP设备进行校验，提高了通信的安全性。
在本实施例提供的安全服务器中，通信单元620还用于接收第一SEPP设备发送的证书请求消息，该证书请求消息中携带所述第二SEPP设备的标识。
在本实施例提供的安全服务器中，在获取单元610获取第二SEPP设备对应的安全证书之前，通信单元620还接收第二SEPP设备发送的第二消息，第二消息中携带所述第二SEPP设备对应的安全证书。此时，获取单元610从接收到的第二消息中获取第二SEPP设备对应的安全证书。其中，第二消息中还可以携带第二SEPP设备的标识，该标识用于关联第二SEPP设备和第二SEPP设备对应的安全证书。
参见图7-8，图7为本申请实施例提供的通信装置700的结构示意图，图8为通信装置700中的单板730的接口示意图。
如图所示，该通信装置主要包括机柜720以及安装在机柜内的单板730。其中，单板由芯片及电子元器件组成，可以提供通信业务。单板730的数量可以根据实际需要增加或减少，本实施例不限定单板730的数量。此外，机柜720还安装有柜门721。
单板730包括多个输入/输出接口，例如用于外接显示器的显示接口731、连接通信网络的网络接口732、通用串行总线(Universal Serial Bus，USB)接口733等。
此外，单板730中还包括连接电源的电源接口733、用于散热的散热口734等。
上述通信装置通过安装不同的单板730实现不同的功能，例如可以实现本申请实施例中SEPP设备或安全服务器的功能。单板730上安装有通用处理器/控制芯片/逻辑电路之类的控制元件。单板730中也可以安装有存储器。上述处理器、存储器可以和相关的通信接口配合以执行本申请实施例中可由SEPP设备或安全服务器执行的任意一种方法的部分或全部步骤。
参见图9，图9是本发明实施例提供的SEPP设备和安全服务器的硬件结构图。
本实施例提供的SEPP设备和安全服务器均可以采用通用的计算机硬件，其包括处理器901、存储器902、总线903、输入设备904、输出设备905以及网络接口906。
具体的，存储器902可以包括以易失性和/或非易失性存储器形式的计算机存储媒体，如只读存储器和/或随机存取存储器。存储器902可以存储操作系统、应用程序、其他程序模块、可执行代码和程序数据。
输入设备904可以用于向AMF设备或MSC输入命令和信息，输入设备904如键盘或指向 设备，如鼠标、轨迹球、触摸板、麦克风、操纵杆、游戏垫、卫星电视天线、扫描仪或类似设备。这些输入设备可以通过总线903连接至处理器901。
输出设备905可以用于AMF设备或MSC输出信息，除了监视器之外，输出设备905还可以为其他外围输出设各，如扬声器和/或打印设备，这些输出设备也可以通过总线903连接到处理器901。
SEPP设备或安全服务器可以通过网络接口906连接到通信网络中，例如连接到局域网(Local Area Network，LAN)。在联网环境下，SEPP设备和安全服务器中存储的计算机执行指令可以存储在远程存储设备中，而不限于在本地存储。
当SEPP设备中的处理器901执行存储器902中存储的可执行代码或应用程序时，SEPP设备设备可以执行以上方法实施例中的SEPP设备一侧的方法步骤，例如执行步骤201、203、303、307、405等。具体执行过程参见上述方法实施例，在此不再赘述。
当安全服务器中的处理器901执行存储器902中存储的可执行代码或应用程序时，安全服务器可以执行以上方法实施例中的安全服务器一侧的方法步骤，例如执行步骤203-204、403等。具体执行过程参见上述方法实施例，在此不再赘述。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被硬件(如处理器)执行时能够完成本申请实施例中可由SEPP设备或安全服务器执行的任意一种方法的部分或全部步骤。
本申请实施例还提供了一种包括指令的计算机程序产品，当所述计算机程序产品在计算机设备上运行时，使得所述这个计算机设备执行可由SEPP设备或安全服务器执行的任意一种方法的部分或者全部步骤。
在上述实施例中，可全部或部分地通过软件、硬件、固件、或其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如光盘)、或者半导体介质(例如固态硬盘)等。在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，也可以通过其它的方式实现。例如以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可结合或者可以集成 到另一个系统，或一些特征可以忽略或不执行。另一点，所显示或讨论的相互之间的间接耦合或者直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者，也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例的方案的目的。
另外，在本申请各实施例中的各功能单元可集成在一个处理单元中，也可以是各单元单独物理存在，也可两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，或者也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。

Claims (16)

  1. 一种安全通信方法，其特征在于，包括：
    第一安全和边界保护代理SEPP设备接收来自于安全服务器的第一消息，所述第一消息中携带第二SEPP设备对应的安全证书；
    所述第一SEPP设备接收所述第二SEPP设备发送的设备证书；
    所述第一SEPP设备使用所述安全证书校验所述第二SEPP设备的设备证书；
    所述第一SEPP设备在校验成功后，与所述第二SEPP设备建立安全连接。
  2. 根据权利要求1所述的方法，其特征在于，在所述第一SEPP设备接收来自于安全服务器的第一消息之前，还包括：
    所述第一SEPP设备向所述安全服务器发送证书请求消息，所述证书请求消息中携带所述第二SEPP设备的标识。
  3. 根据权利要求1所述的方法，其特征在于，所述第二SEPP设备对应的安全证书为第二SEPP设备的证书服务器的根证书。
  4. 如权利要求2所述的方法，其特征在于，所述安全服务器为域名系统DNS服务器，所述证书请求消息为DNS查询请求。
  5. 如权利要求1所述的方法，其特征在于，在所述第一SEPP设备接收来自于安全服务器的第一消息之前，还包括：
    所述第一SEPP设备向所述安全服务器发送第二消息，所述第二消息中携带所述第一SEPP设备对应的安全证书。
  6. 如权利要求5所述的方法，其特征在于，所述第二消息中还携带所述第一SEPP设备的标识。
  7. 如权利要求1所述的方法，其特征在于，还包括：
    所述第一SEPP设备在使用所述安全证书校验所述第二SEPP设备的设备证书成功时，向所述第二SEPP设备发送校验成功的消息。
  8. 如权利要求1或7所述的方法，其特征在于，所述第一SEPP设备与所述第二SEPP设备建立安全连接包括：
    所述第一SEPP设备计算用于和所述第二SEPP设备进行安全通信的会话密钥；
    所述第一SEPP设备使用所述会话密钥和所述第二SEPP设备建立安全连接。
  9. 一种安全通信方法，其特征在于，包括：
    安全服务器获取第二安全和边界保护代理SEPP设备对应的安全证书；
    所述安全服务器向第一SEPP设备发送第一消息，所述第一消息中携带所述第二SEPP设备对应的安全证书。
  10. 如权利要求9所述的方法，其特征在于，在所述安全服务器获取第二SEPP设备对应的安全证书之前，还包括：
    所述安全服务器接收所述第一SEPP设备发送的证书请求消息，所述证书请求消息中携带所述第二SEPP设备的标识。
  11. 如权利要求9所述的方法，其特征在于，在所述安全服务器获取第二SEPP设备对应的安全证书之前，还包括：
    所述安全服务器接收所述第二SEPP设备发送的第二消息，所述第二消息中携带所述第二SEPP设备对应的安全证书。
  12. 如权利要求10所述的方法，其特征在于，所述第二消息中还携带所述第二SEPP设备的标识。
  13. 一种计算机可读存储介质，其特征在于，
    所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时能够完成权利要求1至12任意一项所述的方法。
  14. 一种安全和边界保护代理SEPP设备，其特征在于，包括：
    至少一个处理器和相互耦合的存储器，所述存储器中存储了计算机程序代码，所述处理器调用并执行所述存储器中的计算机程序代码，使得所述SEPP设备执行如权利要求1-8任意一项所述的方法。
  15. 一种安全服务器，其特征在于，包括：
    至少一个处理器和相互耦合的存储器，所述存储器中存储了计算机程序代码，所述处理器调用并执行所述存储器中的计算机程序代码，使得所述安全服务器执行如权利要求10-12任意一项所述的方法。
  16. 一种安全通信的系统，其特征在于，包括：
    核心网网络功能设备和第一安全和边界保护代理SEPP设备，所述核心网网络功能设备配置于向所述第一SEPP设备发送信令消息；
    所述第一SEPP设备配置于执行上述权利要求1-8任意一项所述的方法，并将接收到的信令消息通过安全连接向第二SEPP设备发送。
PCT/CN2021/092229 2020-05-11 2021-05-07 安全通信方法、相关装置及系统 Ceased WO2021227964A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP21805135.7A EP4135380A4 (en) 2020-05-11 2021-05-07 SECURE COMMUNICATION METHOD, AND ASSOCIATED APPARATUS AND SYSTEM
JP2022568509A JP7485788B2 (ja) 2020-05-11 2021-05-07 安全な通信方法と関連する装置及びシステム
KR1020227043017A KR20230008824A (ko) 2020-05-11 2021-05-07 보안 통신 방법 및 관련 장치 그리고 시스템
US17/982,958 US20230059030A1 (en) 2020-05-11 2022-11-08 Secure communication method and related apparatus and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010394218.5 2020-05-11
CN202010394218.5A CN113727341B (zh) 2020-05-11 2020-05-11 安全通信方法、相关装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/982,958 Continuation US20230059030A1 (en) 2020-05-11 2022-11-08 Secure communication method and related apparatus and system

Publications (1)

Publication Number Publication Date
WO2021227964A1 true WO2021227964A1 (zh) 2021-11-18

Family

ID=78526433

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/092229 Ceased WO2021227964A1 (zh) 2020-05-11 2021-05-07 安全通信方法、相关装置及系统

Country Status (6)

Country Link
US (1) US20230059030A1 (zh)
EP (1) EP4135380A4 (zh)
JP (1) JP7485788B2 (zh)
KR (1) KR20230008824A (zh)
CN (1) CN113727341B (zh)
WO (1) WO2021227964A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024091150A1 (en) * 2022-10-24 2024-05-02 Telefonaktiebolaget Lm Ericsson (Publ) Supporting secure communications between network functions
WO2024117489A1 (ko) * 2022-12-02 2024-06-06 삼성전자 주식회사 원격 서비스를 지원하는 장치 및 방법

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11979937B2 (en) * 2021-09-20 2024-05-07 Nokia Technologies Oy Method, apparatus and computer program
CN116260584A (zh) * 2021-12-09 2023-06-13 中国移动通信有限公司研究院 通信方法、系统、装置、相关设备及存储介质
CN114945173B (zh) * 2022-03-29 2023-05-05 广州爱浦路网络技术有限公司 跨plmn信令转发方法、电子设备及存储介质
WO2025244486A1 (ko) * 2024-05-24 2025-11-27 삼성전자 주식회사 보안 통신을 수행하는 전자 장치, 방법 및 저장 매체

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100017848A1 (en) * 2008-07-16 2010-01-21 International Business Machines Corporation Verifying certificate use
US20170302656A1 (en) * 2015-07-25 2017-10-19 Confia Systems, Inc. Device-Level Authentication with Unique Device Identifiers
US20180332003A1 (en) * 2017-05-15 2018-11-15 Vmware, Inc. Certificate pinning by a tunnel endpoint
US20190260803A1 (en) * 2018-02-16 2019-08-22 Nokia Technologies Oy Security management in communication systems with security-based architecture using application layer security
WO2019220006A1 (en) * 2018-05-16 2019-11-21 Nokia Technologies Oy Error handling framework for security management in a communication system

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7529933B2 (en) * 2002-05-30 2009-05-05 Microsoft Corporation TLS tunneling
US8862872B2 (en) 2008-09-12 2014-10-14 Qualcomm Incorporated Ticket-based spectrum authorization and access control
US8397063B2 (en) 2009-10-07 2013-03-12 Telcordia Technologies, Inc. Method for a public-key infrastructure for vehicular networks with limited number of infrastructure servers
US10009336B2 (en) * 2016-05-18 2018-06-26 Cisco Technology, Inc. Network security system to validate a server certificate
US20210250186A1 (en) * 2018-05-09 2021-08-12 Nokia Technologies Oy Security management for edge proxies on an inter-network interface in a communication system
EP3847782B1 (en) * 2018-09-06 2025-08-13 Nokia Technologies Oy Automated roaming service level agreements between network operators via security edge protection proxies in a communication system environment

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100017848A1 (en) * 2008-07-16 2010-01-21 International Business Machines Corporation Verifying certificate use
US20170302656A1 (en) * 2015-07-25 2017-10-19 Confia Systems, Inc. Device-Level Authentication with Unique Device Identifiers
US20180332003A1 (en) * 2017-05-15 2018-11-15 Vmware, Inc. Certificate pinning by a tunnel endpoint
US20190260803A1 (en) * 2018-02-16 2019-08-22 Nokia Technologies Oy Security management in communication systems with security-based architecture using application layer security
WO2019220006A1 (en) * 2018-05-16 2019-11-21 Nokia Technologies Oy Error handling framework for security management in a communication system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4135380A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024091150A1 (en) * 2022-10-24 2024-05-02 Telefonaktiebolaget Lm Ericsson (Publ) Supporting secure communications between network functions
WO2024117489A1 (ko) * 2022-12-02 2024-06-06 삼성전자 주식회사 원격 서비스를 지원하는 장치 및 방법

Also Published As

Publication number Publication date
JP2023525092A (ja) 2023-06-14
EP4135380A4 (en) 2023-10-04
EP4135380A1 (en) 2023-02-15
CN113727341B (zh) 2023-03-24
CN113727341A (zh) 2021-11-30
KR20230008824A (ko) 2023-01-16
US20230059030A1 (en) 2023-02-23
JP7485788B2 (ja) 2024-05-16

Similar Documents

Publication Publication Date Title
CN113727341B (zh) 安全通信方法、相关装置及系统
US20200021586A1 (en) Securing communication of devices in the internet of things
CN110798833A (zh) 一种鉴权过程中验证用户设备标识的方法及装置
WO2021063057A1 (zh) 漫游信令消息发送的方法、相关设备和通信系统
WO2020221219A1 (zh) 通信方法和通信设备
CN114531675B (zh) 一种通信方法、相关装置和系统
CN112997454A (zh) 经由移动通信网络连接到家庭局域网
CN109417536A (zh) 用于管理内容递送网络中的安全内容传输的技术
JP2011135583A (ja) リダイレクトを使用してネットワークへのアクセスを制御するシステム及び方法
US12388792B2 (en) Secure communication method, related apparatus, and system
CN107690138A (zh) 一种快速漫游方法、装置、系统、接入点和移动站
WO2024032226A1 (zh) 通信方法和通信装置
WO2024093923A1 (zh) 通信方法和通信装置
CN113382410B (zh) 通信方法和相关装置及计算机可读存储介质
CN104518874A (zh) 一种网络接入控制方法和系统
WO2022012355A1 (zh) 安全通信方法、相关装置及系统
GB2625993A (en) Authentication in a personal area network
CN118614099A (zh) 基于tls-psk的用于接入边缘数据网络的认证机制
CN105636033A (zh) 一种终端移动管理的方法、装置和系统
WO2025026183A1 (zh) 通信方法和通信装置
CN116321103A (zh) 一种通信方法、装置、服务器及存储介质
WO2025026232A1 (zh) 会话建立方法及相关装置
CN120546885A (zh) 一种数字证书管理方法及装置
WO2025031156A1 (zh) 通信方法和通信装置
CN116918300A (zh) 用于操作蜂窝网络的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21805135

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022568509

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021805135

Country of ref document: EP

Effective date: 20221110

ENP Entry into the national phase

Ref document number: 20227043017

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE