WO2023050373A1 - 一种通信方法、装置及系统 - Google Patents

一种通信方法、装置及系统 Download PDF

Info

Publication number
WO2023050373A1
WO2023050373A1 PCT/CN2021/122352 CN2021122352W WO2023050373A1 WO 2023050373 A1 WO2023050373 A1 WO 2023050373A1 CN 2021122352 W CN2021122352 W CN 2021122352W WO 2023050373 A1 WO2023050373 A1 WO 2023050373A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
key
service
communication technology
communication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/122352
Other languages
English (en)
French (fr)
Inventor
王勇
李明超
何青春
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to PCT/CN2021/122352 priority Critical patent/WO2023050373A1/zh
Priority to CN202180102233.0A priority patent/CN117981371A/zh
Priority to CN202411563220.5A priority patent/CN119697628A/zh
Priority to KR1020247013082A priority patent/KR20240065291A/ko
Priority to JP2024519730A priority patent/JP2024537820A/ja
Priority to EP21958945.4A priority patent/EP4391614A4/en
Publication of WO2023050373A1 publication Critical patent/WO2023050373A1/zh
Priority to US18/620,750 priority patent/US20240244681A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/15—Setup of multiple wireless link connections

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a communication method, device, and system.
  • mobile terminals such as mobile phones, tablet computers, or other portable smart terminals, etc.
  • these mobile terminals After entering the mobile Internet era, these mobile terminals are more convenient to use than traditional computers (such as desktop workstations, servers, etc.), and they are also more likely to threaten and damage personal information. Therefore, the security of communication technology is very important.
  • Embodiments of the present application provide a communication method, device, and system, which help meet security requirements of heterogeneous communication technologies in converged communication scenarios.
  • an embodiment of the present application provides a communication method, the method may be applied to a first node, and the first node may support a first communication technology and a second communication technology.
  • the method may include: acquiring first information; establishing a first communication connection with a second node according to the first information, the first communication connection is used to transmit data of the first service, and the first communication connection corresponds to the first Communication technology; wherein, the first node is a node that accesses a network corresponding to the second communication technology.
  • the first service may be a service of the first communication technology or a service of the second communication technology.
  • the first node can establish the first communication connection between the first node and the second node based on the first information associated with the first service, so that the service data between the first node and the second node
  • the communication connection corresponding to the first service can be used to transmit the data corresponding to the first service
  • different communication connections can correspond to different service data transmission, so as to meet the security requirements in the converged communication scenario and ensure the corresponding service Data Security.
  • the first communication technology may be a short-distance communication technology
  • the second communication technology may be a fifth generation mobile communication technology (the 5th generation mobile communication technology, 5G).
  • the embodiment of the present application only uses the first communication technology and the fusion scenario based on the first communication technology as an example for illustration, and the embodiment of the present application can also be applied to other converged communication scenarios, and the first service can also include Services corresponding to other communication technologies are not limited in this embodiment of the present application.
  • the first information may include a first key used for communication authentication with the second node, and the acquiring the first information may include: according to the corresponding The type of the second communication technology, and/or, according to the service type of the first service, obtain the first key.
  • the connection establishment process between the first node and the second node can be triggered by the first node, and the first node can obtain the first key according to the current communication scenario and/or business requirements, so as to The corresponding first communication connection is established between the first node and the second node to transmit data corresponding to the first service.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the first information may include a first key used for communication authentication with the second node, and the method further includes: receiving a key from the second node the first message, the first message carries key type indication information or service type indication information; the acquiring the first information includes: acquiring the said key type indication information or the service type indication information according to first key.
  • connection establishment process between the first node and the second node can be triggered by the second node, and the first node can obtain the information related to the first service according to the key type indication information or service type indication information from the second node.
  • An associated first key so that based on the acquired first key, a corresponding first communication connection is established between the first node and the second node to transmit data corresponding to the first service.
  • the establishing the first communication connection with the second node according to the first information includes: sending the information associated with the first key to the second node a second message, the second message is used for identity authentication of the first node; receiving a third message in response to the second message, the third message is used for identity authentication of the second node; When the identity authentication of the second node succeeds, sending a fourth message to the second node, where the fourth message is used to establish the first communication connection with the second node.
  • the third message may correspond to a message, for example, the message may be used for the identity authentication of the second node, and implicitly indicates that the identity authentication of the first node is successful; or, for another example, the message can be used to both explicitly indicate that the identity authentication of the first node is successful, and can also be used for the identity authentication of the second node; or, the third message can correspond to at least two messages, for example, indicating that the first node
  • the embodiment of the present application does not limit the specific implementation of the third message.
  • the fourth message may also correspond to a message, for example, the message is used to establish the first communication connection with the second node, and implicitly indicates that the identity authentication of the second node is successful; or, for example, the The message can be used to establish the first communication connection with the second node, and can also be used to explicitly indicate that the identity authentication of the second node is successful; or, the fourth message can correspond to at least two messages, for example, for A message for establishing the first communication connection with the second node, and a message for indicating that the identity authentication of the second node is successful, the embodiment of the present application does not limit the specific implementation of the fourth message.
  • the first node can perform identity authentication (or identity authentication) with the second node based on the obtained first key, and after the mutual authentication is successful, a secure A first communication connection.
  • the first key is a key used for services of the first communication technology, or is a key used for services of the second communication technology. key.
  • the first key is an encryption key used for the service of the first communication technology. and/or, in the case that the first service is a service of the second communication technology, the first key is a key for a service of the second communication technology.
  • the first node can obtain at least one key, and the first node can select at least one key according to the first service, so as to establish the first communication connection corresponding to the first service, so as to ensure that the first Security of business data of a business.
  • the key used for the service of the second communication technology includes a trusted key or an untrusted key, where the trusted key is The key that has successfully been authenticated by the network, the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than that of the untrusted key class.
  • At least one key obtained by the first node may have a corresponding priority and/or usage principle, so that the first node may, according to the first service, the priority and/or the usage principle, Selecting a key closely related to the first service from the at least one key as the first key.
  • the key corresponds to the service, and when the first service is the service of the first communication technology, the key for the service of the second communication technology is not used; Where a service is a service of the second communication technology, the key used for the service of the first communication technology is not used, and if a trusted key exists, an untrusted key is not used.
  • the method before establishing the first communication connection, the method further includes: receiving a key for a service of the second communication technology from the network.
  • the network of the second communication technology can issue the key for the service of the second communication technology to the first node, and the first node receives The key is used to establish a first communication connection between the first node and the second node based on the key in the converged communication scenario.
  • the key used for the service of the second communication technology may be a default value or a dynamically changing value, which is not limited in the embodiment of the present application.
  • the key is a key successfully authenticated by the network, the key is a trusted key, and if the key is a key that has not been authenticated by the network, the key is a trusted key key.
  • the first information includes a first security context for communicating with the second node
  • the acquiring the first information includes: receiving A fifth message of a node, where the fifth message carries an identifier associated with the first security context; the acquiring the first information includes: acquiring the first security context according to the identifier.
  • the second node may, for example, according to the type corresponding to the second communication technology, and/or, according to the service type of the first service, in the multiple sets of Selecting the first security context from the security context, and sending the fifth message to the first node to indicate the identity of the first security context.
  • the first node may obtain the first security context corresponding to the first service according to the identifier associated with the first security context indicated by the second node, so as to establish a secure connection between the two parties based on the obtained first security context.
  • a first communication connection may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the first security context is a security context used for services of the first communication technology, or is a security context used for services of the second communication technology.
  • the first security context is a security for the service of the first communication technology context; and/or, in the case that the first service is a service of a second communication technology, the first security context is a security context for a service of the second communication technology.
  • the security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, where the trusted security context is The security context that has successfully been authenticated by the network, the untrusted security context is a security context that has not passed the network authentication, and the priority of the trusted security context is higher than the priority of the untrusted security context class.
  • the at least one set of security contexts may have corresponding priorities and/or usage principles, so that the first node can , the priority and/or the usage principle, selecting a security context closely related to the first service from the at least one set of security contexts as the first security context.
  • the security context is also corresponding to the service.
  • the service for the second communication technology is not used.
  • Security context In the case that the first service is a service of the second communication technology, the security context for the service of the first communication technology is not used, and the untrusted security context is not used if there is a trusted security context.
  • the method before the acquiring the first information, further includes: sending a sixth message to the second node, where the sixth message carries a message indicating that the Information that the first node supports the second communication technology.
  • the first node supports the second communication technology. It can also be understood that the first node supports the transmission of services corresponding to the second communication technology, and the first node supports the service corresponding to the second communication technology. Service transmission of the second communication technology, or, the first node supports service transmission based on the second communication technology.
  • the first node can carry relevant indication information in the sixth message to inform the second node of the type of business it supports, so that the second node can make decisions based on the business with the first node, so that the A secure first communication connection is established between the two parties, and data of the first service is transmitted.
  • the embodiment of the present application provides a communication method, which is applied to a second node, and the second node may support the first communication technology, or the second node may support the first communication technology and the second communication technology.
  • the method may include: acquiring first information; establishing a first communication connection with the first node according to the first information, the first communication connection is used to transmit data of the first service, and the first communication connection corresponds to the first communication connection.
  • the first service may be a service of the first communication technology or a service of the second communication technology.
  • the first information includes a first key used for communication authentication with the first node
  • the acquiring the first information includes: according to the corresponding The type of the second communication technology, and/or, according to the service type of the first service, obtain the first key.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the method further includes: sending a first message to the first node, where the first message carries information associated with the first key.
  • the information associated with the first key may include key type indication information or service type indication information.
  • the information associated with the first key may also be the first key.
  • the establishing the first communication connection with the first node according to the first information includes: receiving a second message from the first node, the The second message is associated with the first key, and the second message is used for the identity authentication of the first node; if the identity authentication of the first node is successful, send the second message to the first node Three messages, the third message is used for identity authentication of the second node; receiving a fourth message in response to the third message, the fourth message is used to establish the first node with the second node communication connection.
  • the third message may correspond to a message, for example, the message may be used for the identity authentication of the second node, and implicitly indicates that the identity authentication of the first node is successful; or, for another example, the message can be used to both explicitly indicate that the identity authentication of the first node is successful, and can also be used for the identity authentication of the second node; or, the third message can correspond to at least two messages, for example, indicating that the first node
  • the embodiment of the present application does not limit the specific implementation of the third message.
  • the fourth message may also correspond to a message, for example, the message is used to establish the first communication connection with the second node, and implicitly indicates that the identity authentication of the second node is successful; or, for example, the The message can be used to establish the first communication connection with the second node, and can also be used to explicitly indicate that the identity authentication of the second node is successful; or, the fourth message can correspond to at least two messages, for example, for A message for establishing the first communication connection with the second node, and a message for indicating that the identity authentication of the second node is successful, the embodiment of the present application does not limit the specific implementation of the fourth message.
  • the first key is a key used for services of the first communication technology, or is a key used for services of the second communication technology. key.
  • the first key is an encryption key used for the service of the first communication technology. and/or, in the case that the first service is a service of the second communication technology, the first key is a key for a service of the second communication technology.
  • the key used for the service of the second communication technology includes a trusted key or an untrusted key, where the trusted key is The key that has successfully been authenticated by the network, the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than that of the untrusted key class.
  • the method before establishing the first communication connection, the method further includes: receiving a key for a service of the second communication technology from the network.
  • the first information includes a first security context
  • the first security context is used by the second node to establish the first communication with the first node
  • the connection the obtaining the first information includes: obtaining the first security context according to the type corresponding to the second communication technology, and/or according to the service type of the first service.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the first security context is a security context used for services of the first communication technology, or is a security context used for services of the second communication technology.
  • the first security context is the security used for the service of the first communication technology context; and/or, in the case that the first service is a service of a second communication technology, the first security context is a security context for a service of the second communication technology.
  • the security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, where the trusted security context is The security context that has successfully been authenticated by the network, the untrusted security context is a security context that has not passed the network authentication, and the priority of the trusted security context is higher than the priority of the untrusted security context class.
  • the method further includes: sending a fifth message to the first node, where the fifth message carries an identifier associated with the first security context.
  • the method further includes: receiving a sixth message from the first node, where the sixth message is used to indicate that the first node supports the Information about the second communication technology.
  • the first node supports the second communication technology. It can also be understood that the first node supports the transmission of services corresponding to the second communication technology, and the first node supports the service corresponding to the second communication technology. Service transmission of the second communication technology, or, the first node supports service transmission based on the second communication technology.
  • an embodiment of the present application provides a communication device, which is applied to a first node, and includes: a communication unit for communicating with a second node; a processing unit for acquiring first information; according to the The first information establishes a first communication connection with the second node, the first communication connection is used to transmit the data of the first service, and the first communication connection corresponds to the first communication technology; wherein, the first node is an access A node of the network corresponding to the second communication technology.
  • the first service is a service of the first communication technology or a service of the second communication technology.
  • the first information includes a first key used for communication authentication with the second node, and the processing unit is configured to: The type of technology, and/or, according to the service type of the first service, obtain the first key.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the first information includes a first key used for communication authentication with the second node, and the communication unit is configured to: receive a key from the second node The first message carries key type indication information or service type indication information; the processing unit is configured to: acquire the first key.
  • the communication unit is configured to: send a second message associated with the first key to the second node, where the second message is used for the Identity authentication of the first node; receiving a third message in response to the second message, the third message being used for identity authentication of the second node; when the identity authentication of the second node is successful, sending a fourth message to the second node, where the fourth message is used to establish the first communication connection with the second node.
  • the first key is a key used for services of the first communication technology, or is a key used for services of the second communication technology. key.
  • the first key is an encryption key used for the service of the first communication technology. and/or, in the case that the first service is a service of the second communication technology, the first key is a key for a service of the second communication technology.
  • the key used for the service of the second communication technology includes a trusted key or an untrusted key, where the trusted key is The key that has successfully been authenticated by the network, the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than that of the untrusted key class.
  • the communication unit before the processing unit establishes the first communication connection, is further configured to: receive a message from the network for the second communication technology business key.
  • the first information includes a first security context for communicating with the second node
  • the communication unit is configured to: receive a message from the second node A fifth message, where the fifth message carries an identifier associated with the first security context; the processing unit is configured to: acquire the first security context according to the identifier.
  • the first security context is a security context used for services of the first communication technology, or is a security context used for services of the second communication technology.
  • the first security context is the security used for the service of the first communication technology context; and/or, in the case that the first service is a service of a second communication technology, the first security context is a security context for a service of the second communication technology.
  • the security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, where the trusted security context is The security context that has successfully been authenticated by the network, the untrusted security context is a security context that has not passed the network authentication, and the priority of the trusted security context is higher than the priority of the untrusted security context class.
  • the communication unit is further configured to: send a sixth message to the second node before the processing unit obtains the first information, and the sixth message carries a information corresponding to the second communication technology indicating that the first node supports.
  • the embodiment of the present application provides a communication device, including: a communication unit, configured to communicate with a first node; a processing unit, configured to obtain first information; and establish a second node with the first node according to the first information.
  • a communication connection the first communication connection is used to transmit the data of the first service, and the first communication connection corresponds to the first communication technology; wherein, the first node is a node accessing a network corresponding to the second communication technology .
  • the first service may be a service of the first communication technology or a service of the second communication technology.
  • the first information includes a first key used for communication authentication with the first node
  • the processing unit is configured to: according to the corresponding second communication The type of technology, and/or, according to the service type of the first service, obtain the first key.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the communication unit is further configured to: send a first message to the first node, where the first message carries information associated with the first key.
  • the information associated with the first key may include, for example, key type indication information or service type indication information.
  • the communication unit is configured to: receive a second message from the first node, the second message is associated with the first key, and the second message is associated with the first key. Two messages are used for the identity authentication of the first node; when the identity authentication of the first node is successful, a third message is sent to the second node, and the third message is used for the second node identity authentication; receiving a fourth message in response to the third message, where the fourth message is used to establish the first communication connection with the second node.
  • the first key is a key used for services of the first communication technology, or is a key used for services of the second communication technology. key.
  • the first key is an encryption key used for the service of the first communication technology. and/or, in the case that the first service is a service of a second communication technology, the first key is a key for a service of the second communication technology.
  • the key used for the service of the second communication technology includes a trusted key or an untrusted key, where the trusted key is The key that has successfully been authenticated by the network, the untrusted key is a key that has not been authenticated by the network, and the priority of the trusted key is higher than that of the untrusted key class.
  • the method before the processing unit establishes the first communication connection, the method further includes: receiving a service for the second communication technology from the network key.
  • the first information includes a first security context
  • the first security context is used by the second node to establish the first communication with the first node
  • the processing unit is configured to: acquire the first security context according to the type corresponding to the second communication technology, and/or according to the service type of the first service.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the first security context is a security context used for services of the first communication technology, or is a security context used for services of the second communication technology.
  • the first security context is a security for the service of the first communication technology context; and/or, in the case that the first service is a service of a second communication technology, the first security context is a security context for a service of the second communication technology.
  • the security context used for the service of the second communication technology includes a trusted security context or an untrusted security context, where the trusted security context is The security context that has successfully been authenticated by the network, the untrusted security context is a security context that has not passed the network authentication, and the priority of the trusted security context is higher than the priority of the untrusted security context class.
  • the communication unit is further configured to: send a fifth message to the first node, where the fifth message carries an identifier associated with the first security context.
  • the communication unit is further configured to: receive a sixth message from the first node, where the sixth message is used to indicate that the first node supports the corresponding Information on the second communication technology.
  • the embodiment of the present application provides a communication device, including: a processor and a memory; the memory is used to store programs; the processor is used to execute the programs stored in the memory, so that the device realizes The method described in the above first aspect and any possible implementation manner of the first aspect, or implement the method described in the above second aspect and any possible implementation manner of the second aspect.
  • the embodiment of the present application provides a communication device, including: at least one processor and an interface circuit, the interface circuit is used to provide data or code instructions for the at least one processor, and the at least one processor uses To implement the method described in the first aspect and any possible implementation manner of the first aspect above by using a logic circuit or executing code instructions, or realize the method described in the second aspect and any possible implementation manner of the second aspect above.
  • the embodiment of the present application provides a communication system, including the communication device described in the above third aspect and any possible implementation manner of the third aspect, and, the above fourth aspect and any possible implementation manner of the fourth aspect The communication device.
  • the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores program codes, and when the program codes run on the computer, the computer executes the above-mentioned first aspect. And the method described in any possible implementation manner of the first aspect, or, when the program code is run on a computer, the computer is made to execute the method described in the second aspect and any possible implementation manner of the second aspect.
  • the embodiment of the present application provides a computer program product, which, when the computer program product is run on a computer, causes the computer to execute the above-mentioned first aspect and any possible implementation manner of the first aspect. method, or perform the method described in the second aspect and any possible implementation manner of the second aspect.
  • an embodiment of the present application provides a chip system, the chip system includes a processor, configured to call a computer program or a computer instruction stored in a memory, so that the processor executes the above-mentioned first aspect and the first aspect
  • the processor is coupled to the memory through an interface.
  • the chip system further includes a memory, where computer programs or computer instructions are stored.
  • the embodiment of the present application provides a processor, the processor is used to call a computer program or a computer instruction stored in the memory, so that the processor executes the above first aspect and any possible implementation manner of the first aspect The method described above, or perform the method described in the second aspect and any possible implementation manner of the second aspect.
  • the embodiment of the present application provides a terminal device, which can be used to implement the above-mentioned first aspect and the method described in any possible implementation manner of the first aspect, or realize the above-mentioned second aspect and the second aspect The method described in any possible implementation.
  • the terminal equipment includes but is not limited to: intelligent transportation equipment (such as automobiles, ships, drones, trains, trucks, etc.), intelligent manufacturing equipment (such as robots, industrial equipment, intelligent logistics, intelligent factories, etc.), intelligent terminal (Mobile phones, computers, tablets, PDAs, desktops, earphones, audio, wearable devices, car devices, etc.).
  • the embodiment of the present application provides a vehicle, which can be used to implement the method described in the above first aspect and any possible implementation manner of the first aspect, and/or, implement the above second aspect and The method described in any possible implementation manner of the second aspect.
  • the embodiment of the present application provides a vehicle, which may include the third aspect and the communication device described in any possible implementation manner of the third aspect, and/or implement the fourth aspect and the fourth aspect above The communication device described in any possible implementation manner.
  • FIG. 1 shows a schematic diagram of a system architecture applicable to an embodiment of the present application
  • FIG. 2 shows a schematic diagram of a system architecture applicable to an embodiment of the present application
  • FIG. 3 shows a schematic flowchart of a communication method in an embodiment of the present application
  • FIG. 4a shows a schematic flowchart of a communication method in an embodiment of the present application
  • FIG. 4b shows a schematic flowchart of a communication method in an embodiment of the present application
  • FIG. 4c shows a schematic flowchart of a communication method in an embodiment of the present application
  • Fig. 4d shows a schematic flow diagram of a communication method according to an embodiment of the present application.
  • FIG. 5 shows a schematic diagram of a communication device according to an embodiment of the present application
  • Fig. 6 shows a schematic diagram of a communication device according to an embodiment of the present application.
  • Embodiments of the present application provide a communication method, device, and system, which help meet security requirements of heterogeneous communication technologies in a converged communication scenario.
  • the method and the device are based on the same technical conception. Since the principle of solving the problem of the method and the device is similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated. For ease of understanding, the following will be introduced in conjunction with the accompanying drawings and embodiments.
  • FIG. 1 shows a schematic diagram of a system architecture applicable to an embodiment of the present application.
  • the system architecture may include a first node 110 , a second node 120 , and a third node 130 .
  • the first node 110 and the second node 120 may form a first communication system, and the first communication technology may be used for communication between the two parties.
  • the first node 110 and the third node 130 may form a second communication system, and the two parties may communicate using a second communication technology, and the first communication technology is different from the second communication technology.
  • a communication connection can be established between the first communication system and the second communication system to form a heterogeneous communication system, so as to execute in the heterogeneous communication system Corresponding traffic and/or transport traffic data.
  • the heterogeneous communication system may also be called a converged communication system, or a tightly coupled (tight interworking) communication system, or an interworking (interworking) communication system.
  • any one of the first node 110, the second node 120, or the third node 130 may be an electronic device capable of sending and receiving data.
  • the electronic device may be a terminal device, including a device that provides voice and/or data connectivity to the user, specifically, a device that provides voice to the user, or a device that provides data connectivity to the user, or includes a device that provides A device that provides voice and data connectivity to the user.
  • Examples include handheld devices with wireless connectivity, or processing devices connected to wireless modems.
  • the terminal device can communicate with the core network via a radio access network (radio access network, RAN), and exchange voice and/or data with the RAN.
  • radio access network radio access network
  • the terminal equipment may include but not limited to vehicles, user equipment (user equipment, UE), wireless terminal equipment, mobile terminal equipment, device-to-device (device-to-device, D2D) terminal equipment, vehicle-to-device Everything (vehicle to everything, V2X) terminal equipment, machine-to-machine/machine-type communications (machine-to-machine/machine-type communications, M2M/MTC) terminal equipment, Internet of things (Internet of things, IoT) terminal equipment or narrowband Internet of Things (narrow band internet of things, NB-IoT) terminal equipment, subscriber unit, subscriber station, mobile station, mobile station, remote station, Access point (access point, AP), remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user agent (user agent), or user equipment (user device), etc.
  • IoT Internet of things
  • NB-IoT narrowband Internet of Things
  • the terminal device may specifically be implemented as: a mobile phone (or called a "cellular" phone), or a computer with a mobile terminal device; a dedicated terminal device in IoT, or an industrial control (industrial control) device, or a telemedicine (remote medical) equipment, or smart grid (smart grid) equipment, or smart city (smart city) equipment, etc.; portable, pocket, handheld, computer built-in or vehicle-mounted mobile devices, etc.; personal communication service (personal communication service) , PCS) telephone, cordless telephone, Session Initiation Protocol (Session Initiation Protocol, SIP) telephone, Wireless Local Loop (Wireless Local Loop, WLL) station, Personal Digital Assistant (Personal Digital Assistant, PDA), etc.
  • a mobile phone or called a "cellular" phone
  • a computer with a mobile terminal device a dedicated terminal device in IoT, or an industrial control (industrial control) device, or a telemedicine (remote medical) equipment, or smart grid (smart grid)
  • the terminal device may also be implemented as a limited device, such as a device with low power consumption, or a device with limited storage capability, or a device with limited computing capability.
  • the terminal device may include barcodes, radio frequency identification (radio frequency identification, RFID), sensors, global positioning system (global positioning system, GPS), laser scanners and other components.
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices or smart wearable devices, etc., which is a general term for the application of wearable technology to intelligently design daily wear to develop wearable devices, such as glasses, gloves, watches, clothing and shoes etc.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not only a hardware device, but also can achieve powerful functions through software support, data interaction, and cloud interaction.
  • Generalized wearable smart devices include full-featured, large-sized, complete or partial functions without relying on smart phones, such as smart watches or smart glasses, etc., and only focus on a certain type of application functions, and need to cooperate with other devices such as smart phones Use, such as various smart bracelets, smart helmets, smart jewelry, etc. for physical sign monitoring.
  • the terminal device can also be a machine intelligent device such as self-driving (self-driving) device, transportation safety (transportation safety) device, virtual reality (virtual reality, VR) terminal device, augmented reality (augmented reality, AR) terminal equipment, etc.
  • self-driving self-driving
  • transportation safety transportation safety
  • virtual reality virtual reality
  • VR virtual reality
  • AR augmented reality
  • vehicle-mounted terminal equipment if located on the vehicle (such as being placed in the vehicle or installed in the vehicle), can be considered as vehicle-mounted terminal equipment, and the vehicle-mounted terminal equipment can also be called vehicle-mounted unit (on-board unit, for example). OBU).
  • the terminal device may also include a relay (relay).
  • the terminal device may include any device capable of performing data communication with the base station.
  • the electronic device may also be a network device, for example, including an access network (access network, AN) device, and the access network device may include a device in the access network that communicates with the wireless terminal device through one or more cells on the air interface.
  • Devices such as base stations or access points.
  • the base station can be used to convert received air frames to and from Internet Protocol (IP) packets and act as a router between the terminal device and the rest of the access network, which can include IP network.
  • IP Internet Protocol
  • the network equipment may include a base station in a second generation (2th generation, 2G) communication system, or include a base station in a third generation (3th generation, 3G) communication system, or include a fourth generation A base station in a (4th generation, 4G) communication system, such as a long term evolution (long term evolution, LTE) system or an advanced long term evolution (long term evolution-advanced, LTE-A) in an evolved base station (NodeB or eNB or e -NodeB, evolutional Node B), or may also include the next generation node B (next generation node B) in the fifth generation (the 5th generation, 5G) new wireless (new radio, NR) system (also referred to as NR system), gNB), or can also include the centralized unit (CU) and distributed unit (DU) in the cloud access network (cloud radio access network, Cloud RAN) system, as well as various communication systems in the future
  • the base station in the sixth generation (6th generation, 6G) communication system such as a long
  • RSU may include a fixed infrastructure entity that supports V2X applications, and may exchange messages with other entities that support V2X applications; for another example, the network equipment may also include core network equipment, and the core network equipment includes, for example, one or more of the following in the 5G system : access and mobility management function (access and mobility management function, AMF), session management function (session management function, SMF), user plane function (user plane function, UPF), or include the mobility management entity ( mobility management entity, MME), etc.
  • access and mobility management function access and mobility management function
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane function
  • MME mobility management entity
  • nodes the names of electronic devices with similar data sending and receiving capabilities may not be called nodes, but for the convenience of description, electronic devices with data sending and receiving capabilities are collectively referred to as nodes in this embodiment of the application.
  • the device types of the first node 110 , the second node 120 , or the third node 130 may be the same or different.
  • the first node 110, the second node 120, and the second node 130 are all terminal devices or network devices, or the first node 110 and the second node 120 may be terminal devices, and the third node 130 may be a network device.
  • the first communication technology as a short-distance communication technology
  • the second communication technology as a 5G communication technology
  • the three nodes 130 may include but are not limited to access equipment: trusted non-3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) gateway function (Trusted Non-3GPP Gateway Function, TNGF), and core network equipment: SMF, At least one of functional entities such as AMF, UPF, and Data Network (DN).
  • the first node 110 can support the first communication technology and the second communication technology, and can serve as the master control node (or called the authorization node) of the second node 120, on the one hand, conduct short-distance communication with the second node 120, on the other hand On the one hand, 5G communication is performed with the third node 130 .
  • first node 110 may support the first communication technology, and it may also be understood that the first node may support service transmission based on the first communication technology, or the first node may support services of the first communication technology;
  • a node 110 supporting the second communication technology may also be understood that the second node may support service transmission based on the second communication technology, or the second node may support services of the second communication technology.
  • Each node or functional entity can be connected through an interface.
  • the serial number of the interface or the name of the interface is not limited in the embodiment of this application. It can follow the interface defined in the 3GPP related standard protocol of the 5G system, or use the interface in the future communication system. interface.
  • the second node 120 can communicate with the first node 110 through the Yt interface
  • the first node 110 can communicate with the TNGF through the Ta interface
  • the second node 120 can communicate with the TNGF through the NWt interface.
  • the second node 120 and the first node 110 can communicate with the AMF through the next generation network (next generation, N) 1 interface (N1 for short), the network equipment (such as TNGF) communicates with the AMF through the N2 interface (N2 for short), and the TNGF communicates with the AMF through the N3
  • the interface (N3 for short) communicates with the local UPF, and the UPF communicates with the DN through the N6 interface (N6 for short).
  • the AMF communicates with the SMF through the N11 interface (N11 for short), and the SMF communicates with the UPF through the N4 interface (N4 for short).
  • the 5G network can perceive key information such as the equipment status, network status, and service status of the second node 120 through the first node 110, so as to achieve remote reachability, perception, and awareness of industry on-site networks and services. tube etc.
  • the heterogeneous communication system may include the first node 110, the second node 120, and the third node 130, as well as the communication modes between each node and its functional modules, and does not Limit the number of individual nodes and the serial number or name of the interface.
  • the number of the first node 110, the second node 120, and the third node 130 may not be limited to one.
  • the first node 110 may perform a radio resource control (radio resource control, RRC) establishment process with the third node 130, when the first node After the RRC connection is established between 110 and the third node 130, the RRC state of the first node 110 is the RRC connection state.
  • RRC radio resource control
  • the RRC state of the first node 110 can be converted in the following states: RRC idle (RRC_IDLE) state, RRC connected (RRC_CONNECTED) state and RRC inactive (RRC_INACTIVE) state, in the converged communication scenario of the embodiment of the present application,
  • the first node 110 may be in any of the aforementioned idle state, connected state, and inactive state, which is not limited in this embodiment of the present application.
  • establishing a communication connection between any two nodes means that the two nodes can interact through signal transmission to communicate between the two nodes, including but not limited to physical connection or virtual connection, which will not be distinguished one by one below.
  • the short-distance communication technology may include the technology that supports wireless short-distance communication, and the wireless short-distance communication includes that the communication parties transmit information through radio waves and the transmission distance is within a short range (for example, within 100 meters).
  • a short range for example, within 100 meters.
  • Wi-Fi wireless fidelity
  • NFC near field communication
  • Wi-Fi Aware technology Wi-Fi Aware technology
  • General Short-distance communication technology short-distance communication technology standardized by Starlight Alliance, etc.
  • Short-distance communication can be widely used in file transfer, remote control, screen projection, and perception of surrounding devices (such as smart cars, smart terminal devices, smart home devices, and smart manufacturing equipment, etc.).
  • Short-distance communication technologies are listed below.
  • Bluetooth A radio technology that enables devices to communicate over short distances, enabling the wireless exchange of information between a wide range of devices including mobile phones, wireless headsets, laptops, and related peripherals.
  • the use of "Bluetooth” technology can effectively simplify the communication between mobile communication terminal equipment, and can also successfully simplify the communication between equipment and the Internet, so that data transmission becomes faster and more efficient, and broadens the road for wireless communication.
  • Wireless fidelity technology wireless fidelity, Wi-Fi: also known as wireless local area networks (wireless local area networks, WLAN) direct connection or Wi-Fi Direct, is one of the Wi-Fi protocol clusters, enabling easy communication between devices Wireless access points that connect to each other without intermediaries. Its uses range from web browsing to file transfers and communicating with multiple devices simultaneously, taking full advantage of the speed of Wi-Fi. Devices conforming to this standard can be easily interconnected even if they come from different manufacturers.
  • Wi-Fi Aware technology responsible for the perception and discovery part of Wi-Fi technology, it can help Wi-Fi devices perceive surrounding services, such as surrounding devices, and then realize point-to-point between two devices in close range through Wi-Fi Aware (Peer to Peer, P2P) message exchange. Because WIFI-Aware can perceive the surrounding devices, it can realize various functions, such as sensing nearby people and establishing a connection, and then adding friends, playing the same game, etc.; or discovering surrounding devices to realize photo sharing or Location sharing and more; or, securely sending files to a printer without access to a network such as cellular or wireless, and more.
  • each functional entity or network element in FIG. 2 may also use a service interface for interaction.
  • the service interface provided by AMF can be a network access and mobility management function (Namf) interface
  • the service interface provided by SMF can be a network session management function (network session management function, Nsmf) interface.
  • Namf network access and mobility management function
  • Nsmf network session management function
  • each function included in the system architecture may also be called a functional entity, network element or other names.
  • SMF may be referred to as an SMF entity.
  • each function in the embodiment of this application can be realized by one device, or by multiple devices, or by one or more functional modules in one device. The embodiment does not specifically limit this. It can be understood that the various functions involved in the embodiments of the present application can be functions of network elements in hardware devices, software functions running on dedicated hardware, or a combination of hardware and software, or platforms (such as , the virtualization function instantiated on the cloud platform).
  • each function included in the above-mentioned system architecture can also correspond to any of the above-mentioned functions, or with other functions.
  • Other functional entities formed after the integration between them for example, a functional entity with two functions of session management and policy control, or a functional entity with three functions of session management, access and mobility management, and policy control, or a functional entity with network openness Functional entities for both functions and application functions.
  • FIGS. 1 to 2 do not limit the applicable system architectures of the embodiments of the present application.
  • the number of terminal devices in Figure 2 is just an example.
  • a network device can provide services for multiple terminal devices, and the network device, and all or part of the terminal devices in the multiple terminal devices, can all use this application.
  • Each function or device involved in the embodiment of the present application may also be referred to as a communication device, which may be a general-purpose device or a special-purpose device, which is not specifically limited in the embodiment of the present application.
  • At least one refers to one or more, and “multiple” refers to two or more.
  • And/or describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the contextual objects are an “or” relationship.
  • At least one of the following” or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • At least one item (piece) of a, b, or c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.
  • ordinal numerals such as “first”, “second”, and “third” mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the priority or priority of multiple objects. Importance.
  • the first node, the second node, and the third node are only for distinguishing different nodes, rather than representing the differences in priority or importance of these three nodes.
  • the business of the first communication technology can be understood as the business realized by the first communication technology (for example, the business realized by non-5G technology, further such as the business realized by short-distance services implemented by communication technologies), or services corresponding to the first communication technology (for example, non-5G services, further such as short-distance communication services).
  • the service of the second communication technology may include the service of the second communication technology in a converged communication scenario, where the service of the second communication technology can be understood as the service realized by the second communication technology (for example, the service realized by 5G), Or a service corresponding to the second communication technology (such as a 5G service).
  • the first communication connection corresponds to the first communication technology, and it can be understood that the first communication connection is a connection implemented based on the first communication technology.
  • the first communication connection is a connection realized by using the short-range communication technology.
  • services of the first communication technology or services of the second communication technology may be transmitted.
  • the network corresponding to the second communication technology can be understood as a network supporting at least the second communication technology, or at least a network supporting service transmission based on the second communication technology, such as a 5G network, or a 5G network Core Network.
  • the second node 120 can use a preset key to communicate with the first node 110 after selecting a trusted first node 110 and initially establishing a link with the first node 110.
  • the nodes 110 authenticate each other, and after successful identity authentication, establish a communication connection between the two parties based on the security context corresponding to the key.
  • the second node 120 can also initiate a new communication to the third node 130 through the first node 110.
  • Identity authentication and/or security context negotiation process to negotiate and determine a new key and corresponding security context among the three.
  • the at least two sets of keys and/or corresponding security contexts in the first node 110 and the second node 120, the at least two sets of keys and the /or select the required key or security context in the corresponding security context, so as to establish a secure communication connection with the peer node based on the selected key or security context, so as to ensure the execution of corresponding communication services and / or the security requirements for the transmission of communication service data.
  • the key is a parameter, which can be a parameter input in an algorithm for converting plaintext into ciphertext or an algorithm for converting ciphertext into plaintext.
  • the first node 110, the second Any two parties in the second node 120 and the third node 130 can initiate an identity authentication process and/or a security context (Security Context) negotiation process based on the key.
  • a security context Security Context
  • the two parties can obtain a negotiated A consistent security context, i.e. access control attributes.
  • the two parties can initiate a connection establishment process to establish a secure communication connection between the two parties.
  • connection establishment process can be initiated directly using the agreed security context to establish a secure communication connection between the two parties.
  • the first node 110, the second node 120, or the third node 130 can all support one or more key agreement algorithms, and the first node 110, the second node 120, and the third node 130 Before any two parties in the above identity authentication process and/or security context negotiation process are initiated, the key agreement between the two parties can also be completed through information exchange.
  • the key agreement algorithm may include but not limited to: asymmetric encryption algorithm: such as public key encryption (Rivest-Shamir-Adleman, RSA) algorithm, elliptic curve encryption (Elliptic Curves Cryptography, ECC) algorithm, etc.; Interactive algorithms: such as Diffie-Hellman algorithm (DH) algorithm, elliptic curve Diffie-Hellman key exchange (Elliptic Curve Diffie–Hellman key Exchange, ECDH), etc.; shared key Algorithm: Pre-shared key (Pre-shared key, PSK) algorithm, etc., which are not limited in this embodiment of the application.
  • PSK Pre-shared key
  • identity authentication is also called “identity verification” and “identity authentication”, which refers to completing the confirmation of node identity through certain means.
  • identity authentication methods based on PSK identity authentication methods based on biological characteristics
  • identity authentication methods based on public key encryption algorithms identity authentication methods based on public key encryption algorithms.
  • the identity authentication based on the pre-shared key means that at least two nodes can share one or a group of keys, such as between the first node 110 and the second node 120, or between the first node 110 and the third node 130 between, or between the first node 110 , the second node 120 and the third node 130 .
  • the first node 110 or the second node 120 or the third node 130 can send the PSK (or related parameters associated with the PSK to the peer node, the specific implementation of the related parameters in the embodiment of the present application The method is not limited), after receiving the PSK, the peer node checks whether the PSK is consistent with the key stored locally, if they are consistent, it can be determined that the identity authentication is successful, and if they are inconsistent, it can be determined that the identity authentication has failed. Only when the mutual identity authentication is successful between any two nodes, can a consensus security context be obtained, and based on the security context, a secure communication connection is established between the two parties to ensure the corresponding communication between the two parties Security requirements for business and/or transmission of communication business data.
  • a possible implementation manner is that the first node 110 and the second node 120 may select the first information associated with the first service (for example, including the first key and/or the first security context), And perform information exchange based on the first information, so as to establish a first communication connection between the first node 110 and the second node 120, the first communication connection can be used to transmit the data of the first service, so as to satisfy the converged communication scenario
  • the third node 130 can perceive the relevant information of the second node 120 through the first node 110, so as to achieve remote reachability, perception, and management of the network and services of the second node 120.
  • the process of the communication method may be triggered by the first node 110 or the second node 120, which is not limited in this embodiment of the present application.
  • the method flow may be triggered by the first node 110, and may include the following steps:
  • S310 The first node 110 acquires first information.
  • the first node 110 establishes a first communication connection with the second node 120 according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; Wherein, the first node 110 is a node that accesses a network corresponding to the second communication technology.
  • the first information is associated with the first service.
  • the first service may be a service of the first communication technology or a service of the second communication technology.
  • the first node and the second node are described in order to distinguish different nodes.
  • the first node can be the second node
  • the second node can be the first node.
  • FIG. 3 The method flow shown in may be triggered by the second node 120, that is, the second node 120 may obtain the first information, and establish a first communication connection with the first node 110 according to the first information. No limit.
  • the above-mentioned first information may include relevant information required to establish a secure communication connection between the first node 110 and the second node 120, and the first information may be pre-stored on the side of the first node 110 or the second node 120, Alternatively, it may also be obtained by the first node 110 or the second node 120 from the network side or other device side, which is not limited in this embodiment of the present application.
  • the first node 110 and the second node 120 may be in a scenario without a security context
  • the first information may include a first key used for communication authentication between the first node 110 and the second node 120
  • the first node 110 can perform identity authentication and security context negotiation process with the second node 120 according to the first key, and then, based on the first security context obtained through negotiation, the first node 110 and the second node 120 can The first communication connection is established.
  • the first node 110 and the second node 120 may be in a security context scenario, and the first information may include the first security context used for communication between the first node 110 and the second node 120.
  • the first node The first communication connection may be established between 110 and the second node 120 according to the first security context.
  • the key when the first information is a key used for communication authentication between the first node 110 and the second node 120, the key may include the first node 110 or the second node 120
  • the preset key on the node 120 side, or the key may come from the network of the second communication technology (for example, the core network on the third node 130 side), for example, the key used for the service of the second communication technology.
  • the first information includes a first key used for communication authentication between the first node 110 and the second node 120 .
  • the first node 110 and the second node 120 are not associated with the first security context of the first service, and when the first communication connection is established between the first node 110 and the second node 120, the The above first key, and then based on the obtained first key, mutual identity authentication and negotiation of the first security context are first performed.
  • the first node 110 may initiate a message for establishing a communication connection to the second node 120 based on the obtained first security context, so as to The first security context establishes a first communication connection between the first node 110 and the second node 120 .
  • the second node 120 may obtain the first key, and after the second node 120 obtains the first key, it may report key type indication information or service type indication information to the first node 110, and the first node 110 determines the first key according to the key type indication information or service type indication information reported by the second node 120, and performs an identity authentication and security context negotiation process with the second node 120, so that the first node 110 and the second A secure first communication connection is established between the nodes 120 .
  • the steps S411-S419 included in the first method example are only examples of optional steps. In some examples, the following steps may also be performed in an exchanged order, which is not specifically limited in this embodiment of the present application.
  • the communication method may include the following steps, for example:
  • the first node 110 sends a sixth message (such as a system message).
  • the second node 120 may receive the sixth message.
  • the sixth message may carry (or carry) first indication information, and the first indication information may be used to indicate the type of service supported by the first node 110 (including supporting the service corresponding to the second communication technology ).
  • the first indication information may also indicate one or more key agreement algorithms supported by the first node 110, so that the second node 120 may, according to the first indication information, obtain from its own Select a key agreement algorithm that is also supported by the first node 110 among the supported key agreement algorithms to complete the key agreement between the two parties, so that according to the negotiated key agreement algorithm (such as the aforementioned PSK algorithm), generate Authentication parameters related to node identity authentication.
  • the key agreement between the first node 110 and the second node 120 may not be limited to being implemented through the sixth message, which is not limited in this embodiment of the present application.
  • this article takes the PSK algorithm as an example for introduction.
  • the sixth message may also carry the identity of the first node 110 (such as a domain identifier (Domain ID)), and the identity may be used to uniquely identify the first node 110.
  • Domain ID domain identifier
  • the sixth message may be a unicast message, and in S411, the first node 110 may send the sixth message to the second node 120 .
  • the sixth message may be a broadcast message.
  • the first node 110 may broadcast the sixth message, and the second node 120 may be within a broadcast signal coverage range and receive the sixth message.
  • the second node 120 After receiving the sixth message, the second node 120 can learn the service type supported by the first node 110 by parsing the sixth message.
  • the second node 120 obtains the first key or the first key according to the type corresponding to the second communication technology, and/or according to the service type of the first service type.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the second node 120 may also obtain the first key or the type of the first key according to relevant instruction information input by the user, or obtain the first key or the first key type according to relevant instruction information from other devices.
  • the type of a key or the first key is not limited in this embodiment of the present application.
  • the second node 120 may obtain the first key or the type of the first key in other ways, which is not limited in the embodiment of the present application.
  • the first key in a converged communication scenario based on the first communication technology and the second communication technology, may include any of the following implementation methods:
  • Example 1 The first key is a key for services of the first communication technology.
  • the first key may be a key configured between the first node 110 and the second node 120 (for example, corresponding to the preset key mentioned above), the key corresponds to the service of the first communication technology, and can be used After identity authentication and security context negotiation are completed between the first node 110 and the second node 120, the first communication connection is established, and based on the established first communication connection, the business of the first communication technology is executed, or the first communication-based Technology for secure transmission of business data.
  • the security context corresponding to the key is the security context of the service of the first communication technology.
  • the key used for the service of the first communication technology may also be called a common key, and the security context corresponding to the common key may also be called a common security context.
  • the configuration method of the common PSK may include any of the following methods:
  • 3Third-party server authentication credential configuration method The main purpose of the third-party server authentication credential configuration method is to identify
  • the second node 120 should be able to obtain
  • the identity of the first node 110 and using the identity of the second node 120 and the identity of the first node 110
  • the verification information generated by the identification is sent to the third-party server to obtain the authentication password.
  • the first node 110 and the second node obtain
  • the common PSK is obtained based on the authentication password.
  • the same common PSK can be configured between the second node 120 and the first node 110 . It should be understood that in the embodiment of the present application, the second node 120 and the first node 110 can also complete the configuration process of the PSK for the service of the first communication technology between the two nodes through other methods, which will not be repeated here. .
  • Example 2 The first key is a key for services of the second communication technology.
  • the key used for the second communication technology may be referred to as a fusion key.
  • the fused key may include a trusted key or an untrusted key, wherein the trusted key is a key successfully authenticated by the network (such as the aforementioned In a converged communication scenario, the second node 120 initiates a new identity authentication and/or security context negotiation process to the third node 130 through the first node 110 to determine a new key between the three), the non-identifiable
  • the trust key is a key that has not been authenticated by the network (for example, the preset key used when the second node and the first node are initially established as mentioned above, and the preset key can be used for the first The node and the second node perform identity authentication on each other).
  • the network here may be understood as a network corresponding to the third node, for example, it may be a 5G core network.
  • the key that has not been authenticated by the network can be understood as: a key that has not been confirmed by the network or does not need to be confirmed by the network (such as a default key), or that has been confirmed by the network but There is no key to confirm success.
  • the first key can be a trusted key or an untrusted key, the first key corresponds to the service of the second communication technology, and can be used to ensure that the first node 110, the second The node 120 and the third node 130 securely realize the service of the second communication technology or securely transmit the service data realized by the second communication technology.
  • the first key may be, for example, the third node 130, and the key negotiated with at least one of the first node 110 and the second node 120 (for example, corresponding to the new key mentioned above, or corresponding to the trusted key key), for example, the first key may be the key negotiated between the third node 130 and the first node 110, or the first key may be the key negotiated between the third node 130 and the second node 120, and another example , the first key may be a key negotiated among the first node 110, the second node 120, and the third node 130; for another example, the first key may be an untrusted key.
  • the fusion PSK may be delivered to the first node 110 and/or the second node 120 by the core network on the side of the third node 130, or the PSK may also be issued at the first node 130
  • the default key parameters configured by the node 110 or the second node 120 may be configured in one of the three manners in Example 1 or other implementation manners, which are not limited in this embodiment of the present application.
  • the first node or the second node may receive the fused key from the network corresponding to the second communication technology.
  • the first node or the second node can receive the fused key from the network and store it locally so that the subsequent first communication connection.
  • the first node or the second node may determine the first key used in the process of establishing the first communication connection according to the type of the corresponding second communication technology and/or according to the service type of the first service.
  • the first node receives the fusion key from the network corresponding to the second communication technology before establishing the first communication connection, and it is also convenient for the first node to obtain the first key according to the received first information during the establishment of the first communication connection. key.
  • the fusion PSK is an untrusted fusion PSK. If the merged PSK passes through the authentication and/or key agreement process of the core network at the third node 130 side and reaches a consensus, the merged PSK is a trusted merged PSK.
  • the core network for example, 5G core network
  • the security context corresponding to the trusted fusion PSK is the trusted security context used for the business of the second communication technology in the converged communication scenario
  • the security context corresponding to the untrusted converged PSK is the trusted security context used in the converged communication scenario
  • an untrusted security context for services of the second communication technology may be understood as a network supporting at least the second communication technology, or at least a network supporting service transmission based on the second communication technology.
  • the second node 120 according to the type corresponding to the second communication technology, and/or, according to the service type of the first service, etc., the at least two keys mentioned in the above-mentioned example 1 or example 2 Select one of the keys as the first key.
  • the multiple keys may have priorities and use principles, wherein the first key is associated with the first service, and in the Selecting the first key among multiple keys needs to follow at least the following principles: in the case that the first service is a service of the first communication technology, the first key is a service for the first communication technology and/or, where the first service is a service corresponding to the second communication technology, the first key is a key for a service of the second communication technology.
  • the principle of using the multiple keys can be as follows: 1) In the converged communication scenario, for the business of the second communication technology, there is a trusted Fusion PSK does not use untrusted fusion PSK, but uses trusted fusion PSK, that is, the priority of trusted fusion PSK is higher than that of untrusted fusion PSK; 2) in the converged communication scenario, for the second For the business of communication technology, when there is no trusted fusion PSK, use untrusted fusion PSK instead of ordinary PSK; 3) for the business of the first communication technology, even if there is fusion PSK, ordinary PSK should be used to ensure Security of private traffic between the first node 110 and the second node 120 .
  • the second node 120 may acquire the corresponding first key or the type of the first key according to the service type of the first service. For example, if the first service is the service of the second communication technology in the converged communication scenario, then use the trusted converged PSK if there is a trusted converged PSK (further, if the connection fails to be established based on the trusted converged PSK, then use the untrusted converged PSK Fusion PSK), when there is no trusted fusion PSK, use untrusted fusion PSK. Generally, the untrusted fused PSK may be a default value.
  • the first node 110 and the second node 120 are devices supporting the second communication technology
  • the first node 110 and the second node 120 may be configured with The untrusted fused PSK.
  • the first service is a service of the first communication technology
  • the first node 110 and the second node 120 may establish the first communication connection through common PSK.
  • the second node 120 (for example, the service layer of the second node 120 ) sends the first message to the first node 110 .
  • the first node 110 may receive the first message from the second node 120 .
  • the first message may also be referred to as a key indication message, and the first message may carry information associated with the first key, such as key type indication information or service type indication information or other information .
  • the key type indication information can be used to indicate that the key type is any of the following: untrusted fusion key (such as the aforementioned untrusted fusion PSK), trusted fusion key (such as the aforementioned trusted fusion PSK), or a common key (such as the aforementioned common PSK).
  • the service type indication information may be used to indicate that the service type is any of the following: a service of the first communication technology, or, in a converged communication scenario, a service of the second communication technology.
  • the first message may also carry the identity of the second node 120 (for example, the media access layer identifier).
  • the first message may be expressed as a tuple as follows:
  • ID (ID, key type indication information or service type indication information).
  • the first node 110 acquires the first key according to the key type indication information or the service type indication information.
  • the first node 110 may store multiple keys, and when implementing S414, the first node 110 may select from multiple local keys according to the key type indication information or the service type indication information Obtain the first key in .
  • the first node 110 may obtain the first key from other devices according to the key type indication information or the service type indication information, which is not limited in this embodiment of the present application.
  • the first key may be any one of the above-mentioned ordinary PSK, untrusted fused PSK or trusted fused PSK, and the configuration process of the ordinary PSK, untrusted fused PSK or trusted fused PSK Reference may be made to related descriptions in S412, and details are not repeated.
  • the first node 110 and the second node 120 can reach an agreement on the selected first key through negotiation, and further, the first node 110 and the second node 120 can be based on the obtained first key.
  • a key is used for identity authentication and security context negotiation.
  • the identity authentication and security context negotiation process may include the following steps:
  • S415a (optional): the second node 120 sends an association request message to the first node 110 .
  • the first node 110 receives the association request message.
  • the association request message may carry the identity of the second node 120 (such as a domain identifier) and related authentication parameters used for identity authentication of the second node 120, including but not limited to the Key agreement algorithm (for example, represented by KE alg), key agreement parameters (for example, represented by KEt), security capabilities (sec capabilities) and random numbers of the second node 120 (for example, represented by NONCEt), etc.
  • the security capability may include one or more of the key derivation function (key derivation function, KDF), encryption algorithm, integrity protection algorithm, and authentication encryption algorithm supported by the second node 120, which will not be repeated here.
  • the first node 110 may process the association request message based on the relevant information carried in the association request message.
  • the first node 110 can judge whether the fixed identity of the second node 120 is in the In the white list, if not, the association request message is discarded.
  • the first node 110 may determine whether the key agreement algorithm selected by the second node 120 is included in the information carried in the aforementioned sixth message (for example, the first indication information), and if not, discard the association request message; if yes, The first node 110 can select the algorithm with the highest priority according to the security capability of the second node 120, the algorithm preference policy pre-configured by the first node 110, and the service type, including the key derivation function with the highest priority and the authentication and encryption of the signaling plane algorithm and integrity protection algorithm, and the authentication encryption algorithm and integrity protection algorithm of the user plane with the highest priority, or the authentication encryption algorithm of the user plane with the highest priority.
  • the algorithm preference policy can be implemented by a list of algorithms sorted by priority, such as the priority list of key derivation functions pre-configured by the first node 110, the priority list of signaling plane authentication and encryption algorithms, and the priority list of signaling plane integrity protection algorithms. Priority list, user plane authentication and encryption algorithm priority list, user plane integrity protection algorithm priority list, etc. Algorithms selected by the signaling plane and the user plane may be different. In an optional design, when the selected integrity algorithm or authentication encryption algorithm supports multiple message integrity code (Message Integrity Code, MIC) lengths, the first node 110 can also The MIC length supported by the protection algorithm and the MIC length for the integrity protection of the signaling plane are selected. This process can be implemented, for example, through corresponding operations specified by the Starlight Alliance, or through other methods, which are not specifically limited in this embodiment of the application.
  • MIC Message Integrity Code
  • the first node 110 may also generate an ID for identity authentication of the first node 110 according to relevant information carried in the first message and/or a relevant algorithm selected by the first node 110 itself. Related authentication parameters.
  • the first node 110 can generate a private key, and generate a corresponding public key according to the selected key agreement algorithm (for the specific key agreement algorithm, refer to the relevant description in S411), and the public key can be used as the second A key agreement parameter of a node 110 (for example, represented by KEg).
  • the first node 110 may generate a random number (eg represented by NONCEg).
  • the first node 110 may calculate the shared key (for example, represented by K KE ) according to the KEt carried in the first message and the key agreement algorithm.
  • the first node 110 may calculate the shared key (for example, represented by Kgt) using a selected key derivation function according to K KE , NONCEt and NONCEg, and the calculation method is as follows:
  • Kgt KDF( KKE , NONCEt, NONCEg).
  • the first node 110 may generate an identifier of the Kgt (for example, represented by a Kgt ID).
  • the first node 110 may calculate the authentication parameter (for example, represented by AUTHg), and the calculation method is as follows:
  • AUTHg AUF(PSK, K KE , NONCEg, association request message)
  • AUF() The upper 32 bits indicate that the parameters included in the brackets are calculated by the key derivation function AUF, and then the upper 32 bits are taken as AUTHg.
  • AUF uses the same authentication encryption algorithm as the aforementioned KDF.
  • the first node 110 may generate a security context request message (an example of the second message) based on the obtained first key and one or more items of the above-mentioned relevant authentication parameters.
  • the security context request message may include relevant authentication parameters used for identity authentication of the first node 110, including but not limited to the key negotiation parameter KEg of the first node 110, the random number NONCEg, the corresponding The identifier Kgt ID associated with the first security context, the selected algorithm (algorithm), the MIC length (MIC length) and the authentication parameter AUTHg.
  • the selected algorithm (algorithm) may include one or more of a key derivation algorithm, an encryption algorithm and an integrity protection algorithm on a signaling plane, an encryption algorithm and an integrity protection algorithm on a user plane, and an authentication encryption algorithm on a user plane.
  • the first node 110 may also use the selected signaling plane integrity protection algorithm and integrity protection key Ks.int to perform integrity protection on the security context request message, that is, calculate the MIC, and Include the MIC in the Security Context Request message.
  • the security context request message can be expressed as the following tuple:
  • the () MIC indicates that the security context request message is an integrity protected message.
  • S416 The first node 110 sends a security context request message (an example of a second message) associated with the first key to the second node.
  • the second node 120 receives the security context request message from the first node 110 .
  • the second message may be used for identity authentication of the first node 110 . It should be understood that in this embodiment of the present application, the second message can be used for identity authentication of the first node 110 , and it can be understood that the information contained or carried in the second message can be used for identity authentication of the first node 110 .
  • the second message is associated with the first key, and in an optional design, the information carried in the second message includes information generated according to the first key.
  • the second node 120 can calculate the shared key Kgt and the security key of the signaling plane in the same way as the first node 110 according to the key derivation function selected by the first node 110, User plane security keys, etc.
  • the second node 120 may check the integrity of the second message, that is, check whether the MIC is correct. If the integrity verification fails, the second node 120 discards the message, and may resend the association request message.
  • the second node 120 may also verify whether the AUTHg is correct based on the agreed first key. If the AUTHg verification fails, the second node 120 discards the second message, and may resend the association request message. It should be understood that in this embodiment of the present application, checking the integrity of the message may include checking the integrity of the information included or carried in the message.
  • the second node 120 may also generate relevant authentication parameters for identity authentication of the second node 120 according to relevant information carried in the security context request message and/or its own relevant algorithm.
  • the second node 120 can calculate the authentication parameter AUTHt, and the calculation method conforms to the following expression:
  • AUTHt AUF(PSK, K KE , security context request message, NONCEt, key agreement algorithm capability of the first node 110, first indication information)
  • high-order 32-bit bits indicate that the parameters included in the brackets are operated by the key derivation function AUF, and then the high-order 32-bit bit information is taken as AUTHt.
  • AUF and the aforementioned KDF use the same authentication encryption algorithm.
  • the second node 120 may generate a security context response message (an example of the third message) based on the relevant authentication parameters generated above.
  • the second node 120 sends a security context response message (an example of a third message) to the first node 110 .
  • the first node 110 receives the security context response message from the second node 120 .
  • the third message may be used for identity authentication of the second node, and the third message may be sent when the identity authentication of the first node 110 succeeds.
  • the third message may be used to indicate that the identity authentication of the first node 110 is successful, and for the identity authentication of the second node 120, and the third message includes or carries information indicating that the identity authentication of the first node 110 is successful. Information about successful identity authentication of the first node and information used for identity authentication of the second node.
  • the information used to indicate that the identity authentication of the first node 110 is successful and the information used for the identity authentication of the second node 120 can be passed through the same
  • the message is sent, or sent through different messages.
  • the third message may correspond to one message, or may correspond to multiple messages, which is not limited in this embodiment of the present application.
  • the third message may include AUTHt.
  • the second node 120 may use the integrity protection algorithm and the integrity protection key Ks.int of the signaling plane to perform integrity protection on the security context response message.
  • the second node 120 can use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the security context response message. It can be understood that the second node 120 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the information contained in or carried in the security context response message. The MIC generated by the integrity protection can be carried in the security context response message. When the signaling plane encryption protection is enabled, the second node 120 may use the signaling plane encryption algorithm and the encryption key Ks.enc to perform encryption protection on the security context response message.
  • security context response message may be expressed as follows:
  • AUTHt is an example of relevant authentication parameters carried in the security context response message
  • MIC indicates that the security context response message is an integrity-protected message
  • the second node 120 may Decrypt the security context response message (or, decrypt the information included or carried in the security context response message).
  • the first node 110 may check the integrity of the security context response message (or check the integrity of the message included or carried in the security context response message), and verify whether the AUTHt carried in the security context response message is correct. If the integrity or AUTHt verification fails, that is, the identity authentication of the second node 120 is unsuccessful, the first node 110 may send an association establishment failure message to the second node 120 . If the integrity and AUTHt verifications pass, the first node 110 may generate a temporary ID (for example, a physical layer identifier) for identifying the identity of the second node 120 for the second node 120 .
  • a temporary ID for example, a physical layer identifier
  • the first node 110 can perform identity authentication on the second node 120 according to the relevant information carried in the security context response message. This process can be implemented, for example, through the corresponding operation of the Star Alliance specification, or it can also be implemented in other ways.
  • the application examples do not make specific limitations.
  • the first node 110 may send an association establishment message (an example of a fourth message) to the second node when the identity authentication of the second node 120 succeeds.
  • the second node 120 receives the association establishment message from the first node 110 .
  • the fourth message may be used to establish the first communication connection with the second node, and the fourth request message may be sent when the identity authentication of the second node 120 is successful .
  • the fourth message may be used to indicate that the identity authentication of the second node is successful, and to request to establish a first communication connection with the second node
  • the third message includes or carries information for Information indicating successful identity authentication of the second node and information for requesting establishment of a first communication connection with the second node.
  • the information used to indicate that the identity authentication of the second node is successful and the information used to request the establishment of the first communication connection with the second node may be
  • the fourth message may be sent by the same message or by different messages.
  • the fourth message may correspond to one message or may correspond to multiple messages, which is not limited in this embodiment of the present application.
  • the fourth message may include one or more of the following parameters generated by the first node 110 for the second node 120: Temporary ID (T-ID) (for example, a physical layer identifier), validity period of the shared key Kgt (Kgt expiration), [GKc/GK], [GK ID], [Galgorithm], [GK expiration date (GK expiration)].
  • T-ID Temporary ID
  • Kgt expiration for example, a physical layer identifier
  • Kgt expiration validity period of the shared key
  • [GKc/GK] [GK ID]
  • Galgorithm [GK expiration date (GK expiration)].
  • [GKc/GK] indicates that when the encryption protection of the unicast signaling plane is enabled, it carries the group key of the group where the second node 120 belongs to (for example, represented by GK), and when the encryption protection of the unicast signaling plane is not enabled, it carries GKc, GKc is obtained by XOR processing of GK and the key (for example, represented by Kg) that protects the confidentiality of the group key GK:
  • Kg KDF(Kgt, COUNTERg, "group key”);
  • [GK ID] is the identifier of GK
  • Galgorithm is the group algorithm of the group where the second node 120 belongs.
  • the first node 110 may use the integrity protection algorithm and the integrity protection key Ks.int of the signaling plane to perform integrity protection on the association establishment message.
  • the first node 110 can use the integrity protection algorithm and the integrity protection key Ks.int of the signaling plane to perform integrity protection on the association establishment message, which can be understood as, the first node 110
  • the integrity protection algorithm and the integrity protection key Ks.int of the signaling plane can be used to perform integrity protection on the information contained or carried in the association establishment message.
  • the MIC generated by the integrity protection can be carried in the association establishment message.
  • the first node 110 may use the encryption algorithm and the encryption key Ks.enc on the signaling plane to perform encryption protection on the association establishment message.
  • the first node 110 can use the encryption algorithm of the signaling plane and the encryption key Ks.enc to encrypt and protect the association establishment message. It can be understood that the first node 110 can use the signaling plane The encryption algorithm and the encryption key Ks.enc encrypt and protect the information contained in or carried in the association establishment message.
  • association establishment message can be expressed as the following tuples:
  • () MIC indicates that the association establishment message is a message processed by integrity protection.
  • the second node 120 may re-initiate the association request message when receiving the association establishment failure message.
  • the second node 120 when the second node 120 receives the association establishment message, if the association establishment message is encrypted (or the information contained or carried in the association establishment message is encrypted), the second node 120 The association establishment message (or information contained or carried in the association establishment message) may be decrypted. The second node 120 may also check the integrity of the association establishment message (or, check the integrity of the information contained or carried in the association establishment message).
  • the second node 120 discards the message.
  • the second node 120 may send an association completion message to the first node 110 .
  • the first node 110 may receive an association completion message from the second node 120, and the association completion message may be used to indicate that the establishment of the first communication connection is completed.
  • the second node 120 may use the integrity protection algorithm and the integrity protection key Ks.int of the signaling plane to perform integrity protection on the association complete message.
  • the second node 120 can use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the association completion message. It can be understood that the second node 120 The integrity protection algorithm and the integrity protection key Ks.int of the signaling plane can be used to perform integrity protection on the information contained or carried in the association complete message.
  • the second node 120 may use the encryption algorithm and the encryption key Ks.enc on the signaling plane to perform encryption protection on the association completion message.
  • the second node 120 can encrypt and protect the association completion message by using the encryption algorithm of the signaling plane and the encryption key Ks.enc. It can be understood that the second node 120 can use the signaling plane The encryption algorithm and encryption key Ks.enc encrypt and protect the information contained or carried in the association completion message.
  • association completion message may be expressed as follows:
  • () MIC indicates that the association completion message is an integrity protected message.
  • the first node 110 may process the received association completion message.
  • the first node 110 may decrypt the association complete message (or, decrypt the information contained in or carried in the association complete message) .
  • the first node 110 may check the integrity of the association completion message (or, check the integrity of the information contained or carried in the association completion message). If the integrity verification fails, the message is discarded. If the integrity verification passes, the subsequent process is executed, which will not be repeated here.
  • the first node 110 and the second node 120 may save the negotiated first security context.
  • the first security context may include but not limited to the aforementioned identity ID, temporary ID, Kgt, Kgt validity period, Kgt ID, key agreement algorithm, encryption algorithm and integrity protection algorithm of the signaling plane, encryption key and integrity protection key, user plane encryption algorithm and integrity protection algorithm or user plane authentication encryption algorithm, user plane encryption key and integrity protection key or user plane authentication encryption key, [ GK], [GK ID], [Group Algorithm], [GK Validity Period], etc.
  • the first node 110 and the second node 120 can also support the security context expiration deletion mechanism, and the nodes that need to save the security context can be configured with a clock to support this mechanism. This will not be repeated here.
  • the first node 110 may also store the correspondence between the identity of the second node 120 and the first key
  • the second node 120 may also store the correspondence between the identity of the first node 110 and the first key.
  • the business scope of the first communication connection can be determined according to the key type or business type, and the business corresponding to the business scope can be transmitted .
  • the communication connection (including the security context) established based on the trusted converged PSK can only be used for services of the second communication technology in the converged communication scenario.
  • the communication connection (including the security context) established based on the common PSK is used for the service of the first communication technology (for example, it may be other services except the service of the second communication technology in the converged communication scenario).
  • the first key can be obtained by the second node 120.
  • the second node 120 After the second node 120 obtains the first key, it can synchronously obtain relevant parameters for identity authentication of the second node 120, and send the same message (for example, the association request message) carries key type indication information or service type indication information, and related parameters for identity authentication of the second node 120, so that the first node 110 can use the key type indication information reported by the second node 120 or service type indication information to determine the first key, and based on the relevant parameters reported by the second node 120 to perform identity authentication and security context negotiation process with the second node 120, so that between the first node 110 and the second node 120 A secure first communication connection is established.
  • the steps S411-S419 included in the second method example are only examples of optional steps, and in some examples, the implementation order of the following steps can also be exchanged, which is not specifically limited in this embodiment of the present application.
  • the communication method may include the following steps:
  • S411 (optional): the first node 110 sends a sixth message (such as a system message).
  • the second node 120 may receive the sixth message.
  • a sixth message such as a system message
  • the second node 120 may receive the sixth message.
  • the second node 120 obtains the first key or the first key according to the type corresponding to the second communication technology, and/or according to the service type of the first service type.
  • S412 For detailed implementation, reference may be made to the relevant description of S412 introduced above in conjunction with FIG. 4a , which will not be repeated here.
  • the second node 120 sends an association request message to the first node 110 .
  • the first node 110 may receive the association request message from the second node 120 .
  • the key type indication information or the service type indication information is carried in the association request message sent by the second node 120, that is, the association request message in the second method example
  • the association request message may carry the ID of the first node 110, the key type indication information or the service type indication information, and the information for the second node 120 Authentication parameters related to the identity authentication, including but not limited to KEalg, KEt selected by the second node 120, the security capability of the second node 120 and NONCEt, etc.
  • the security capability may include one or more of KDF, encryption algorithm, integrity protection algorithm, and authentication encryption algorithm supported by the second node 120 .
  • KDF Kerbefin Secure Function
  • encryption algorithm encryption algorithm
  • integrity protection algorithm integrity protection algorithm
  • authentication encryption algorithm supported by the second node 120 .
  • S414 The first node 110 acquires the first key according to the key type indication information or the service type indication information. For detailed implementation, reference may be made to S414 described above in conjunction with FIG. 4a , which will not be repeated here.
  • S416 The first node 110 sends a security context request message (an example of a second message) associated with the first key to the second node.
  • the second node 120 receives the security context request message from the first node 110 .
  • S416 For detailed implementation, reference may be made to the relevant description of S416 introduced above in conjunction with FIG. 4a , which will not be repeated here.
  • S417 The second node 120 sends a security context response message (an example of a third message) to the first node 110 .
  • the first node 110 receives the security context response message from the second node 120 .
  • S417 For detailed implementation, reference may be made to the relevant description of S417 introduced above in conjunction with FIG. 4a , which will not be repeated here.
  • the first node 110 may send an association establishment message (an example of a fourth message) to the second node when the identity authentication of the second node 120 succeeds.
  • the second node 120 receives the association establishment message from the first node 110 .
  • association establishment message an example of a fourth message
  • S419 The second node 120 may send an association completion message to the first node 110.
  • the first node 110 may receive an association complete message from the second node 120 .
  • the first key can be obtained by the first node 110, and the first node 110 can perform identity authentication and security context negotiation process with the second node 120 according to the first key, so that the first node 110 A secure first communication connection is established with the second node 120 .
  • the steps S421-S427 included in the third method example are only examples of optional steps. In some examples, the implementation order of the following steps can also be exchanged, which is not specifically limited in this embodiment of the present application.
  • the communication method may include the following steps, for example:
  • the first node 110 sends a sixth message (for example, a system message).
  • the second node 120 may receive the sixth message.
  • the second node 120 sends an association request message to the first node 110.
  • the first node 110 may receive the association request message from the second node 120 .
  • the association request message may carry the ID of the second node 120 (such as the media access layer identifier) and related parameters used to indicate the capabilities of the second node 120, including but not limited to the second
  • the key agreement algorithm for example, represented by KE alg
  • the key agreement parameter for example, represented by KEt
  • the security capabilities sec capabilities
  • the security capability may include one or more of the key derivation function KDF, encryption algorithm, integrity protection algorithm, and authentication encryption algorithm supported by the second node 120, which will not be repeated here.
  • association request message can be expressed as the following tuple:
  • the first node 110 acquires the first key according to the type corresponding to the second communication technology and/or according to the service type of the first service.
  • the first node 110 may also obtain the first key according to relevant instruction information input by the user or obtain the first key according to relevant instruction information from other devices. There is no limit to this.
  • S423 reference may be made to S412 described above in conjunction with FIG. 4a , which will not be repeated here.
  • S424 The first node 110 sends a security context request message (an example of a second message) to the second node according to the first key.
  • the second node 120 receives a security context request message from the first node 110, where the security context request message is associated with the first key.
  • S425 The second node 120 sends a security context response message (an example of a third message) to the first node 110 .
  • the first node 110 receives the security context response message from the second node 120 .
  • S417 in FIG. 4a For detailed implementation details, reference may be made to the relevant description of S417 in FIG. 4a , which will not be repeated here.
  • S426 When the identity authentication of the second node 120 succeeds, the first node 110 sends an association establishment message (an example of a fourth message) to the second node. Correspondingly, the second node 120 receives the association establishment message from the first node 110 .
  • association establishment message an example of a fourth message
  • the second node 120 receives the association establishment message from the first node 110 .
  • the second node 120 may send an association completion message to the first node 110 .
  • the first node 110 may receive an association complete message from the second node.
  • S419 in FIG. 4a For detailed implementation details, reference may be made to the relevant description of S419 in FIG. 4a , which will not be repeated here.
  • the first node 110 and the second node 120 can select the first key associated with the first service. key, and complete the identity authentication and security context negotiation process between the two parties according to the first key, so as to establish a secure first communication connection between the two parties, so that the first node 110 and the second node 120
  • the corresponding business data can be transmitted according to the secure communication connection established using different keys, so as to meet the security requirements in the converged communication scenario and ensure the security of the corresponding business data.
  • the first node 110 can be based on the relevant capabilities of the second node 120, such as the service type and service characteristics reported during registration. , communication capabilities, etc., actively select the key for the second node 120 as the first key, thus, there is no need to exchange the first message (that is, the key indication message) between the second node 120 and the first node 110, which can reduce Signaling overhead.
  • the first information includes the first security context used for communication between the first node 110 and the second node 120 .
  • both the first node 110 and the second node 120 have at least two sets of security contexts, such as the aforementioned normal security context, trusted security context and untrusted security context, between the first node 110 and the second node 120
  • a required first security context may be determined through negotiation among the at least two sets of security contexts, and a secure first communication connection is established based on the first security context.
  • the steps S431-S435 included in the second scenario are only examples of optional steps. In some examples, the following steps may also be performed in an exchanged order, which is not specifically limited in this embodiment of the present application.
  • the communication method may include the following steps, for example:
  • the first node 110 sends a sixth message (for example, a system message).
  • the second node 120 may receive the sixth message.
  • S411 described above in conjunction with FIG. 4a , which will not be repeated here.
  • the second node 120 acquires the first security context or the type of the first security context according to the type corresponding to the second communication technology and/or according to the service type of the first service.
  • the second node 120 may also obtain the first security context or the type of the first security context according to relevant instruction information input by the user, or obtain the first security context according to relevant instruction information from other devices.
  • the first security context or the type of the first security context is not limited in this embodiment of the present application. It should be understood that, in the embodiment of the present application, the second node 120 may obtain the first security context or the type of the first security context in other ways, which is not limited in the embodiment of the present application.
  • the first security context may include any of the following implementations:
  • Example 3 the first security context is a security context for services of the second communication technology.
  • the security context used for the service of the second communication technology includes a trusted security context or a non-trusted security context, wherein the trusted security context is a security context successfully authenticated by the network, and the non-trusted security context
  • a trusted security context is a security context that has not been authenticated by the network.
  • the network here may be understood as a network corresponding to the third node, for example, it may be a 5G core network.
  • the security context that has not been authenticated by the network can be understood as: a security context that has not passed the network or does not need to be confirmed by the network (such as the security context corresponding to the default key), or although A security context that has been confirmed by the network but has not been successfully confirmed (for example, a security context corresponding to the aforementioned key that has not been authenticated by the network).
  • the security context is The untrusted security context corresponds to the aforementioned untrusted fusion PSK. If the security context is obtained through the authentication and key agreement process of the core network at the third node 130 side and is agreed upon, the security context is a trusted security context, corresponding to the aforementioned trusted fusion PSK.
  • the first security context is a security context for services of the first communication technology.
  • the at least two sets of security contexts may also have security context priorities and usage principles, wherein the first security context and the first The business is associated, and the selection of the first security context among the at least two sets of security contexts needs to follow at least the following principles: in the case that the first business is the business of the first communication technology, the first security context is used for The security context of the business of the first communication technology; and/or, in the case that the first business is the business of the second communication technology, the first security context is for the second communication technology The security context of the business.
  • the trusted security context is used, that is, the priority of the trusted security context is higher than that of the untrusted security context;
  • the security context of the business of the second communication technology in the converged communication scenario does not use the security context of the business of the first communication technology, that is, the untrusted security context of the business of the second communication technology used in the converged communication scenario The priority is higher than that of the security context for the business of the first communication technology;
  • 3) For the business of the first communication technology even if there is a security context for the business of the second communication technology in the converged communication scenario, it must be used The security context used for the traffic of the first communication technology, so as to ensure the security of the private traffic between the first node 110 and the second node 120 .
  • the second node 120 may obtain the first security context according to the type corresponding to the second communication technology, and/or, according to the service type of the first service, based on the above usage principle, for example, for The security context of the service of the first communication technology, or the untrusted security context in the converged communication scenario, or the trusted security context in the converged communication scenario.
  • the type corresponding to the second communication technology may refer to a type of communication standard adopted by the second communication technology, such as 5G technology.
  • the second node 120 sends an association request message (an example of a fifth message) to the first node 110 .
  • the first node 110 receives the association request message.
  • the association request message may include the temporary ID (such as a physical layer identifier) of the second node 120, and/or the identifier associated with the first security context, for example, Kgt ID.
  • the temporary ID such as a physical layer identifier
  • the second node 120 can also use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the association request message, and the calculated MIC can be carried in the in the association request message.
  • association request message can be expressed as the following tuple:
  • () MIC indicates that the association request message is an integrity protected message.
  • the first node 110 acquires the first security context according to the temporary ID and/or the Kgt ID.
  • the first node 110 may check the integrity of the association request message according to the first security context.
  • the first node 110 can send a failure message to the second node 120 and carry the reason value (not shown in the figure).
  • the second node 120 may initiate an identity authentication process and a security context negotiation process without a security context, for example, refer to the method steps in FIG. 4a or FIG. 4b , which will not be repeated here.
  • the first node 110 may generate a new temporary ID (T-ID) for the second node 120 .
  • the first node 110 sends an association establishment message (ie, a seventh message) to the second node 120 .
  • the second node 120 may receive the seventh message from the first node.
  • the association establishment message may include that the first node 110 generates a new temporary ID (T-ID) for the second node 120 .
  • the first node 110 may also use the integrity protection algorithm and the integrity protection key Ks.int on the signaling plane to perform integrity protection on the association establishment message.
  • the first node 110 may use the encryption algorithm and the encryption key Ks.enc on the signaling plane to perform encryption protection on the association establishment message.
  • association establishment message can be expressed as the following tuples:
  • () MIC indicates that the association establishment message is a message processed by integrity protection.
  • the second node 120 may decrypt the association establishment message.
  • the second node 120 may also check the integrity of the association establishment message. If the integrity verification fails, the message is discarded. If the integrity verification passes, then S436: the second node 120 may send an association completion message (that is, an eighth message) to the first node 110 .
  • the second node 120 may use the integrity protection algorithm of the signaling plane and the integrity protection key Ks.int to perform integrity protection on the association complete message.
  • the second node 120 may use the encryption algorithm and the encryption key Ks.enc on the signaling plane to perform encryption protection on the association completion message.
  • association completion message may be expressed as follows:
  • () MIC indicates that the association completion message is an integrity protected message.
  • the first security context associated with the first service can be selected between the first node 110 and the second node 120, and according to the set
  • the above-mentioned first security context establishes a first communication connection between the two parties, so that when the business is carried out between the first node 110 and the second node 120, the corresponding business can be transmitted according to the first communication connection established based on different security contexts Data to meet the security requirements in converged communication scenarios and ensure the security of corresponding business data.
  • the second node 120 can try to delete the saved security context, and use the aforementioned Figure 4a Or in the method shown in FIG. 4 b , an association process without a security context is initiated between the second node 120 and the first node 110 , which will not be repeated here.
  • the embodiment of the present application also provides a communication device, configured to execute the method performed by the first node in the above method embodiment.
  • a communication device configured to execute the method performed by the first node in the above method embodiment.
  • the apparatus 500 may include: a communication unit 501, configured to communicate with a second node; a processing unit 502, configured to obtain first information; and establish a first communication connection with the second node according to the first information , the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to a first communication technology; wherein, the first node is a node accessing a network corresponding to a second communication technology.
  • the first service may be a service of the first communication technology or a service of the second communication technology.
  • the communication device 500 shown in FIG. 5 can also be used to execute the method performed by the second node in the above method embodiment, for example, the communication unit 501 is used to communicate with the first node; processing A unit 502, configured to acquire first information; establish a first communication connection with a first node according to the first information, the first communication connection is used to transmit data of a first service, and the first communication connection corresponds to the first Communication technology; wherein, the first node is a node that accesses a network corresponding to the second communication technology.
  • the first service may be a service of the first communication technology or a service of the second communication technology.
  • each functional unit in the embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the computer software product is stored in a storage medium and includes several instructions. It is used to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (processor) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .
  • the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores program codes, and when the program codes are run on the computer, the computer Execute the above method embodiment.
  • an embodiment of the present application provides a computer program product, which causes the computer to execute the foregoing method embodiments when the computer program product is run on a computer.
  • the apparatus 600 shown in FIG. 6 includes at least one processor 610 and a communication interface 630 .
  • a memory 620 may also be included.
  • connection medium between the processor 610 and the memory 620 is not limited in this embodiment of the present application.
  • the processor 610 when the processor 610 communicates with other devices, it can perform data transmission through the communication interface 630 .
  • the processor 610 in FIG. 6 can invoke the computer-executed instructions stored in the memory 620 , so that the device 600 can execute the method performed by the communication device in any of the above method embodiments.
  • the embodiment of the present application also relates to a chip system, the chip system includes a processor, configured to call a computer program or a computer instruction stored in a memory, so that the processor executes the method of any one of the above embodiments.
  • the processor may be coupled to the memory through an interface.
  • the chip system may also directly include a memory, where computer programs or computer instructions are stored.
  • memory can be either volatile memory or nonvolatile memory, or can include both volatile and nonvolatile memory.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM enhanced synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • the embodiments of the present application also relate to a processor, where the processor is configured to call a computer program or a computer instruction stored in a memory, so that the processor executes the method described in any one of the above embodiments.
  • the processor is an integrated circuit chip and has a signal processing capability.
  • the processor can be a field programmable gate array (field programmable gate array, FPGA), a general processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC) Or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, system on chip (SoC), central processor unit (CPU), or network processing device (network processor, NP), can also be a microcontroller (micro controller unit, MCU), can also be a programmable controller (programmable logic device, PLD) or other integrated chips, can realize or execute the application embodiment
  • FPGA field programmable gate array
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • programmable logic devices discrete gate or transistor logic devices, discrete hardware components, system on chip (SoC), central processor unit (CPU), or network processing device (network processor, NP)
  • SoC system on chip
  • CPU central processor unit
  • NP
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种通信方法、装置及系统，涉及通信技术领域。该方法包括：第一节点/第二节点获取第一信息；根据所述第一信息与第二节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点，所述第一业务为所述第一通信技术的业务或者所述第二通信技术的业务。通过该方案，有助于满足异构式通信技术在融合通信场景中的安全需求。

Description

一种通信方法、装置及系统 技术领域
本申请实施例涉及通信技术领域，特别涉及一种通信方法、装置及系统。
背景技术
随着信息化飞速发展，移动终端(例如手机、平板电脑、或其他可携带式智能终端等)已成为个人不可缺少的重要智能工具。进入移动互联网时代后，这些移动终端和传统的计算机(例如台式工作站、服务器等)相比，使用更加便利，同时也更加容易威胁与损害个人的信息，因此通信技术的安全性至关重要。
随着智能汽车、智能终端、智能家居和智能制造等新兴产业的快速发展，创新需求和应用不断涌现，在一些场景中，提出基于不同通信技术进行融合通信的设计，而如何保障异构式通信技术在融合通信场景中的安全需求仍为亟需解决的重要问题。
发明内容
本申请实施例提供了一种通信方法、装置及系统，有助于满足异构式通信技术在融合通信场景中的安全需求。
第一方面，本申请实施例提供一种通信方法，该方法可应用于第一节点，该第一节点可以支持第一通信技术和第二通信技术。该方法可以包括：获取第一信息；根据所述第一信息与第二节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点。示例地，所述第一业务可以为所述第一通信技术的业务或者所述第二通信技术的业务。
通过上述方法，第一节点可基于与第一业务关联的第一信息，来建立第一节点与第二节点之间的第一通信连接，进而使得第一节点和第二节点之间进行业务数据传输时，可以使用与所述第一业务对应的通信连接传输该第一业务对应的数据，不同的通信连接可以对应不同的业务数据传输，以满足融合通信场景下的安全需求，并保障相应业务数据的安全性。示例地，该第一通信技术可为短距离通信技术，第二通信技术可为第五代移动通信技术(the 5th generation mobile communication technology，5G)。
需要说明的是，本申请实施例仅是以基于第一通信技术和第一通信技术的融合场景为例进行说明，本申请实施例还可以应用于其它融合通信场景中，第一业务也可以包括对应其它通信技术的业务，本申请实施例对此不做限定。
结合第一方面，在一种可能的实现方式中，所述第一信息可以包括用于与所述第二节点通信认证的第一密钥，所述获取第一信息，可以包括：根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一密钥。
通过上述方法，可由第一节点触发第一节点与第二节点之间的连接建立过程，该第一节点可以根据当前所处的通信场景和/或业务需求获取第一密钥，以便根据所获取的第一密钥，在第一节点和第二节点之间建立相应的第一通信连接，来传输对应于第一业务的数据。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。
结合第一方面，在一种可能的实现方式中，所述第一信息可以包括用于与所述第二节点通信认证的第一密钥，所述方法还包括：接收来自所述第二节点的第一消息，所述第一消息承载密钥类型指示信息或业务类型指示信息；所述获取第一信息，包括：根据所述密钥类型指示信息或所述业务类型指示信息，获取所述第一密钥。
通过上述方法，可由第二节点触发第一节点与第二节点之间的连接建立过程，第一节点可以根据来自第二节点的密钥类型指示信息或业务类型指示信息，来获取与第一业务关联的第一密钥，以便基于所获取的第一密钥，在第一节点和第二节点之间建立相应的第一通信连接，来传输对应于第一业务的数据。
结合第一方面，在一种可能的实现方式中，所述根据所述第一信息与第二节点建立第一通信连接，包括：向所述第二节点发送与所述第一密钥关联的第二消息，所述第二消息用于所述第一节点的身份认证；接收响应于所述第二消息的第三消息，所述第三消息用于所述第二节点的身份认证；在所述第二节点的身份认证成功的情况下，向所述第二节点发送第四消息，所述第四消息用于与所述第二节点建立所述第一通信连接。
需要说明的是，本申请实施例中，该第三消息可以对应一个消息，例如该消息可用于所述第二节点的身份认证，以及隐式地指示所述第一节点身份认证成功；或者，又例如该消息既可用于显示地指示所述第一节点身份认证成功、又可用于所述第二节点的身份认证；或者，该第三消息可以对应至少两个消息，例如指示所述第一节点身份认证成功的消息，和用于所述第二节点的身份认证的消息，本申请实施例对该第三消息的具体实现方式不做限定。相似地，第四消息也可以对应一个消息，例如该消息用于与所述第二节点建立所述第一通信连接，以及隐式地指示所述第二节点身份认证成功；或者，又例如该消息既可以用于与所述第二节点建立所述第一通信连接，又可用于显示地指示所述第二节点身份认证成功；或者，该第四消息可以对应至少两个消息，例如用于与所述第二节点建立所述第一通信连接的消息，和用于指示所述第二节点身份认证成功的消息，本申请实施例对该第四消息的具体实现方式不做限定。
通过上述方法，第一节点可以基于所获取的第一密钥，来与第二节点之间相互进行身份认证(或者说身份鉴权)，并在相互认证成功后，在双方之间建立安全的第一通信连接。
结合第一方面，在一种可能的实现方式中，所述第一密钥为用于所述第一通信技术的业务的密钥，或者，为用于所述第二通信技术的业务的密钥。
结合第一方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；和/或，在所述第一业务为所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
通过上述方法，第一节点可以获得至少一个密钥，该第一节点可以根据第一业务在至少一个密钥中进行选择，以便建立与所述第一业务对应的第一通信连接，以保障第一业务的业务数据的安全性。
结合第一方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的密钥包括可信密钥或非可信密钥，其中，所述可信密钥为经过所述网络鉴权成功的密钥，所述非可信密钥为未经过所述网络鉴权的密钥，所述可信密钥的优先级高于所述非可信密钥的优先级。
通过上述方法，第一节点所获得的至少一个密钥可以具有相应的优先级和/或使用原则，使得第一节点可以根据第一业务、所述优先级和/或所述使用原则，在所述至少一个密钥中 选择与该第一业务密切相关的密钥作为所述第一密钥。
需要说明的是，本申请实施例中，密钥和业务是对应的，在第一业务为第一通信技术的业务的情况下，不使用用于第二通信技术的业务的密钥；在第一业务为第二通信技术的业务的情况下，不使用用于第一通信技术的业务的密钥，并且在存在可信密钥的情况下，不使用非可信密钥。
结合第一方面，在一种可能的实现方式中，在建立所述第一通信连接之前，所述方法还包括：接收来自所述网络的用于所述第二通信技术的业务的密钥。
通过上述方法，在基于第一通信技术和第二通信技术的融合通信场景下，第二通信技术的网络可以向第一节点下发用于第二通信技术的业务的密钥，第一节点接收该密钥，以便在所述融合通信场景下，基于该密钥在所述第一节点和第二节点之间建立第一通信连接。应理解，本申请实施例中，用于第二通信技术的业务的密钥可以是默认值也可以是动态变化的数值，本申请实施例对此不做限定。并且，若该密钥为经过所述网络鉴权成功的密钥，该密钥为可信密钥，若该密钥为未经过所述网络鉴权的密钥，该密钥为可信密钥。
结合第一方面，在一种可能的实现方式中，所述第一信息包括用于与所述第二节点通信的第一安全上下文，所述获取第一信息，包括：接收来自所述第二节点的第五消息，所述第五消息承载与所述第一安全上下文关联的标识；所述获取第一信息，包括：根据所述标识，获取所述第一安全上下文。
通过上述方法，第二节点中可以存在多套安全上下文，第二节点例如可以根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，在所述多套安全上下文中选择第一安全上下文，并向第一节点发送所述第五消息，以指示所述第一安全上下文的标识。第一节点可以根据第二节点指示的与第一安全上下文关联的标识，获取对应于所述第一业务的第一安全上下文，从而基于所获取的第一安全上下文，在双方之间建立安全的第一通信连接。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。
结合第一方面，在一种可能的实现方式中，所述第一安全上下文为用于第一通信技术的业务的安全上下文，或者，为用于所述第二通信技术的业务的安全上下文。
结合第一方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一安全上下文为用于所述第一通信技术的业务的安全上下文；和/或，在所述第一业务为第二通信技术的业务的情况下，所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
结合第一方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的安全上下文包括可信安全上下文或非可信安全上下文，其中，所述可信安全上下文为经过所述网络鉴权成功的安全上下文，所述非可信安全上下文为未经过所述网络鉴权的安全上下文，所述可信安全上下文的优先级高于所述非可信安全上下文的优先级。
通过上述方法，第一节点与第二节点之间可以具有至少一套安全上下文，且所述至少一套安全上下文可以具有相应的优先级和/或使用原则，使得第一节点可以根据第一业务、所述优先级和/或使用原则，在所述至少一套安全上下文中选择与该第一业务密切相关的安全上下文作为所述第一安全上下文。
需要说明的是，本申请实施例中，与密钥相似，安全上下文也是与业务对应的，在第一业务为第一通信技术的业务的情况下，不使用用于第二通信技术的业务的安全上下文； 在第一业务为第二通信技术的业务的情况下，不使用用于第一通信技术的业务的安全上下文，并且在存在可信安全上下文的情况下不使用非可信安全上下文。
结合第一方面，在一种可能的实现方式中，所述获取第一信息之前，所述方法还包括：向所述第二节点发送第六消息，所述第六消息承载用于指示所述第一节点支持所述第二通信技术的信息。需要说明的是，在本申请实施例中，第一节点支持所述第二通信技术，也可以理解为，第一节点支持所述第二通信技术的业务的传输，第一节点支持对应于所述第二通信技术的业务传输，或者，第一节点支持基于所述第二通信技术实现的业务传输。
通过上述方法，第一节点可以在第六消息中携带相关指示信息，来向第二节点告知自身支持的业务类型，以便第二节点根据与第一节点之间进行的业务来进行决策，以便在双方之间建立安全的第一通信连接、传输第一业务的数据。
第二方面，本申请实施例提供了一种通信方法，应用于第二节点，该第二节点可支持第一通信技术，或者，该第二节点可支持第一通信技术和第二通信技术。所述方法可以包括：获取第一信息；根据所述第一信息与第一节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点。示例地，所述第一业务可以为所述第一通信技术的业务或者所述第二通信技术的业务。
结合第二方面，在一种可能的实现方式中，所述第一信息包括用于与所述第一节点通信认证的第一密钥，所述获取第一信息，包括：根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一密钥。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。结合第二方面，在一种可能的实现方式中，所述方法还包括：向所述第一节点发送第一消息，所述第一消息承载与所述第一密钥相关联的信息。示例地，与所述第一密钥相关联的信息可以包括密钥类型指示信息或业务类型指示信息。在一种可选的实现方式中，与所述第一密钥相关联的信息也可以是所述第一密钥。
结合第二方面，在一种可能的实现方式中，所述根据第一信息与所述第一节点建立所述第一通信连接，包括：接收来自所述第一节点的第二消息，所述第二消息关联于所述第一密钥，所述第二消息用于所述第一节点的身份认证；在所述第一节点的身份认证成功的情况下，向所述第一节点发送第三消息，所述第三消息用于所述第二节点的身份认证；接收响应于所述第三消息的第四消息，所述第四消息用于与所述第二节点建立所述第一通信连接。
需要说明的是，本申请实施例中，该第三消息可以对应一个消息，例如该消息可用于所述第二节点的身份认证，以及隐式地指示所述第一节点身份认证成功；或者，又例如该消息既可用于显示地指示所述第一节点身份认证成功、又可用于所述第二节点的身份认证；或者，该第三消息可以对应至少两个消息，例如指示所述第一节点身份认证成功的消息，和用于所述第二节点的身份认证的消息，本申请实施例对该第三消息的具体实现方式不做限定。相似地，第四消息也可以对应一个消息，例如该消息用于与所述第二节点建立所述第一通信连接，以及隐式地指示所述第二节点身份认证成功；或者，又例如该消息既可以用于与所述第二节点建立所述第一通信连接，又可用于显示地指示所述第二节点身份认证成功；或者，该第四消息可以对应至少两个消息，例如用于与所述第二节点建立所述第一通信连接的消息，和用于指示所述第二节点身份认证成功的消息，本申请实施例对该第四 消息的具体实现方式不做限定。
结合第二方面，在一种可能的实现方式中，所述第一密钥为用于所述第一通信技术的业务的密钥，或者，为用于所述第二通信技术的业务的密钥。
结合第二方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；和/或，在所述第一业务为所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
结合第二方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的密钥包括可信密钥或非可信密钥，其中，所述可信密钥为经过所述网络鉴权成功的密钥，所述非可信密钥为未经过所述网络鉴权的密钥，所述可信密钥的优先级高于所述非可信密钥的优先级。
结合第二方面，在一种可能的实现方式中，在建立所述第一通信连接之前，所述方法还包括：接收来自所述网络的用于所述第二通信技术的业务的密钥。
结合第二方面，在一种可能的实现方式中，所述第一信息包括第一安全上下文，所述第一安全上下文用于所述第二节点与所述第一节点建立所述第一通信连接，所述获取第一信息，包括：根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一安全上下文。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。
结合第二方面，在一种可能的实现方式中，所述第一安全上下文为用于第一通信技术的业务的安全上下文，或者，为用于所述第二通信技术的业务的安全上下文。
结合第二方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一安全上下文为用于所述第一通信技术的业务的安全上下文；和/或，在所述第一业务为第二通信技术的业务的情况下，所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
结合第二方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的安全上下文包括可信安全上下文或非可信安全上下文，其中，所述可信安全上下文为经过所述网络鉴权成功的安全上下文，所述非可信安全上下文为未经过所述网络鉴权的安全上下文，所述可信安全上下文的优先级高于所述非可信安全上下文的优先级。结合第二方面，在一种可能的实现方式中，所述方法还包括：向所述第一节点发送第五消息，所述第五消息承载与所述第一安全上下文关联的标识。
结合第二方面，在一种可能的实现方式中，所述方法还包括：接收来自所述第一节点的第六消息，所述第六消息承载用于指示所述第一节点支持对应于所述第二通信技术的信息。需要说明的是，在本申请实施例中，第一节点支持所述第二通信技术，也可以理解为，第一节点支持所述第二通信技术的业务的传输，第一节点支持对应于所述第二通信技术的业务传输，或者，第一节点支持基于所述第二通信技术实现的业务传输。
第三方面，本申请实施例提供了一种通信装置，该通信装置应用于第一节点，包括：通信单元，用于与第二节点通信；处理单元，用于获取第一信息；根据所述第一信息与第二节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点。示例地，所述第一业务为所述第一通信技术的业务或者所述第二通信技术的业务。
结合第三方面，在一种可能的实现方式中，所述第一信息包括用于与所述第二节点通 信认证的第一密钥，所述处理单元用于：根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一密钥。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。结合第三方面，在一种可能的实现方式中，所述第一信息包括用于与所述第二节点通信认证的第一密钥，所述通信单元用于：接收来自所述第二节点的第一消息，所述第一消息承载密钥类型指示信息或业务类型指示信息；所述处理单元用于：根据所述密钥类型指示信息或所述业务类型指示信息，获取所述第一密钥。
结合第三方面，在一种可能的实现方式中，所述通信单元用于：向所述第二节点发送与所述第一密钥关联的第二消息，所述第二消息用于所述第一节点的身份认证；接收响应于所述第二消息的第三消息，所述第三消息用于所述第二节点的身份认证；在所述第二节点的身份认证成功的情况下，向所述第二节点发送第四消息，所述第四消息用于与所述第二节点建立所述第一通信连接。
结合第三方面，在一种可能的实现方式中，所述第一密钥为用于所述第一通信技术的业务的密钥，或者，为用于所述第二通信技术的业务的密钥。
结合第三方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；和/或，在所述第一业务为所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
结合第三方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的密钥包括可信密钥或非可信密钥，其中，所述可信密钥为经过所述网络鉴权成功的密钥，所述非可信密钥为未经过所述网络鉴权的密钥，所述可信密钥的优先级高于所述非可信密钥的优先级。
结合第三方面，在一种可能的实现方式中，在所述处理单元建立所述第一通信连接之前，所述通信单元还用于：接收来自所述网络的用于所述第二通信技术的业务的密钥。
结合第三方面，在一种可能的实现方式中，所述第一信息包括用于与所述第二节点通信的第一安全上下文，所述通信单元用于：接收来自所述第二节点的第五消息，所述第五消息承载与所述第一安全上下文关联的标识；所述处理单元用于：根据所述标识，获取所述第一安全上下文。
结合第三方面，在一种可能的实现方式中，所述第一安全上下文为用于第一通信技术的业务的安全上下文，或者，为用于所述第二通信技术的业务的安全上下文。
结合第三方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一安全上下文为用于所述第一通信技术的业务的安全上下文；和/或，在所述第一业务为第二通信技术的业务的情况下，所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
结合第三方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的安全上下文包括可信安全上下文或非可信安全上下文，其中，所述可信安全上下文为经过所述网络鉴权成功的安全上下文，所述非可信安全上下文为未经过所述网络鉴权的安全上下文，所述可信安全上下文的优先级高于所述非可信安全上下文的优先级。结合第三方面，在一种可能的实现方式中，所述通信单元还用于：在所述处理单元获取第一信息之前向所述第二节点发送第六消息，所述第六消息承载用于指示所述第一节点支持对应于所述第二通信技术的信息。
第四方面，本申请实施例提供了一种通信装置，包括：通信单元，用于与第一节点通信；处理单元，用于获取第一信息；根据所述第一信息与第一节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点。示例地，所述第一业务可以为所述第一通信技术的业务或者所述第二通信技术的业务。
结合第四方面，在一种可能的实现方式中，所述第一信息包括用于与所述第一节点通信认证的第一密钥，所述处理单元用于：根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一密钥。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。结合第四方面，在一种可能的实现方式中，所述通信单元还用于：向所述第一节点发送第一消息，所述第一消息承载与所述第一密钥关联的信息。示例地，与所述第一密钥关联的信息例如可以包括密钥类型指示信息或业务类型指示信息。
结合第四方面，在一种可能的实现方式中，所述通信单元用于：接收来自所述第一节点的第二消息，所述第二消息关联于所述第一密钥，所述第二消息用于所述第一节点的身份认证；在所述第一节点的身份认证成功的情况下，向所述第二节点发送第三消息，所述第三消息用于所述第二节点的身份认证；接收响应于所述第三消息的第四消息，所述第四消息用于与所述第二节点建立所述第一通信连接。
结合第四方面，在一种可能的实现方式中，所述第一密钥为用于所述第一通信技术的业务的密钥，或者，为用于所述第二通信技术的业务的密钥。
结合第四方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；和/或，在所述第一业务为第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
结合第四方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的密钥包括可信密钥或非可信密钥，其中，所述可信密钥为经过所述网络鉴权成功的密钥，所述非可信密钥为未经过所述网络鉴权的密钥，所述可信密钥的优先级高于所述非可信密钥的优先级。
结合第四方面，在一种可能的实现方式中，在所述处理单元建立所述第一通信连接之前，所述方法还包括：接收来自所述网络的用于所述第二通信技术的业务的密钥。
结合第四方面，在一种可能的实现方式中，所述第一信息包括第一安全上下文，所述第一安全上下文用于所述第二节点与所述第一节点建立所述第一通信连接，所述处理单元用于：根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一安全上下文。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。
结合第四方面，在一种可能的实现方式中，所述第一安全上下文为用于第一通信技术的业务的安全上下文，或者，为用于所述第二通信技术的业务的安全上下文。
结合第四方面，在一种可能的实现方式中，在所述第一业务为第一通信技术的业务的情况下，所述第一安全上下文为用于所述第一通信技术的业务的安全上下文；和/或，在所述第一业务为第二通信技术的业务的情况下，所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
结合第四方面，在一种可能的实现方式中，所述用于所述第二通信技术的业务的安全 上下文包括可信安全上下文或非可信安全上下文，其中，所述可信安全上下文为经过所述网络鉴权成功的安全上下文，所述非可信安全上下文为未经过所述网络鉴权的安全上下文，所述可信安全上下文的优先级高于所述非可信安全上下文的优先级。
结合第四方面，在一种可能的实现方式中，所述通信单元还用于：向所述第一节点发送第五消息，所述第五消息承载与所述第一安全上下文关联的标识。
结合第四方面，在一种可能的实现方式中，所述通信单元还用于：接收来自所述第一节点的第六消息，所述第六消息承载用于指示所述第一节点支持对应于所述第二通信技术的信息。
第五方面，本申请实施例提供了一种通信装置，包括：处理器和存储器；所述存储器用于存储程序；所述处理器用于执行所述存储器所存储的程序，以使所述装置实现如上第一方面以及第一方面的任一可能实现方式所述的方法，或者，实现如上第二方面以及第二方面的任一可能实现方式所述的方法。
第六方面，本申请实施例提供了一种通信装置，包括：至少一个处理器和接口电路，所述接口电路用于为所述至少一个处理器提供数据或者代码指令，所述至少一个处理器用于通过逻辑电路或执行代码指令实现如上第一方面以及第一方面的任一可能实现方式所述的方法，或者，实现如上第二方面以及第二方面的任一可能实现方式所述的方法。
第七方面，本申请实施例提供了一种通信系统，包括如上第三方面以及第三方面任一可能实现方式所述的通信装置，和，如上第四方面以及第四方面任一可能实现方式所述的通信装置。
第八方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质存储有程序代码，当所述程序代码在所述计算机上运行时，使得计算机执行上述第一方面以及第一方面的任一可能实现方式所述的方法，或者，当所述程序代码在计算机上运行时，使得计算机执行上述第二方面以及第二方面的任一可能实现方式所述的方法。
第九方面，本申请实施例提供了一种计算机程序产品，当所述计算机程序产品在计算机上运行时，使得所述计算机执行上述第一方面以及第一方面的任一可能实现方式所述的方法，或执行上述第二方面以及第二方面的任一可能实现方式所述的方法。
第十方面，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，用于调用存储器中存储的计算机程序或计算机指令，以使得该处理器执行上述第一方面以及第一方面的任一可能实现方式所述的方法，或执行上述第二方面以及第二方面任一可能实现方式所述的方法。
结合第十方面，在一种可能的实现方式中，该处理器通过接口与存储器耦合。
结合第十方面，在一种可能的实现方式中，该芯片系统还包括存储器，该存储器中存储有计算机程序或计算机指令。
第十一方面，本申请实施例提供了一种处理器，该处理器用于调用存储器中存储的计算机程序或计算机指令，以使得该处理器执行上述第一方面以及第一方面任一可能实现方式所述的方法，或执行上述第二方面以及第二方面任一可能实现方式所述的方法。
第十二方面，本申请实施例提供了一种终端设备，该终端设备可用于实现上述第一方面以及第一方面任一可能实现方式所述的方法，或者实现上述第二方面以及第二方面任一可能实现方式所述的方法。示例地，该终端设备包括但不限于：智能运输设备(诸如汽车、轮船、无人机、火车、货车等)、智能制造设备(诸如机器人、工业设备、智能物流、智 能工厂等)、智能终端(手机、计算机、平板电脑、掌上电脑、台式机、耳机、音响、穿戴设备、车载设备等)。
第十三方面，本申请实施例提供了一种车辆，该车辆可用于实现如上述第一方面以及第一方面任一可能实现方式所述的方法，和/或，实现如上述第二方面以及第二方面任一可能实现方式所述的方法。
第十四方面，本申请实施例提供了一种车辆，该车辆可以包括上述第三方面以及第三方面任一可能实现方式所述的通信装置，和/或实现上述第四方面以及第四方面任一可能实现方式所述的通信装置。
本申请实施例在上述各方面提供的实现的基础上，还可以进行进一步组合以提供更多实现。
上述第二方面至第十四方面中任一方面中的任一可能实现方式可以达到的技术效果，可以相应参照上述第一方面中任一方面中的任一可能实现方式可以达到的技术效果描述，重复之处不予论述。
附图说明
图1示出了本申请实施例适用的系统架构的示意图；
图2示出了本申请实施例适用的系统架构的示意图；
图3示出了本申请实施例的通信方法的流程示意图；
图4a示出了本申请实施例的通信方法的流程示意图；
图4b示出了本申请实施例的通信方法的流程示意图；
图4c示出了本申请实施例的通信方法的流程示意图；
图4d示出了本申请实施例的通信方法的流程示意图；
图5示出了本申请实施例的通信装置的示意图；
图6示出了本申请实施例的通信装置的示意图。
具体实施方式
本申请实施例提供了一种通信方法、装置及系统，有助于满足异构式通信技术在融合通信场景下的安全需求。其中，方法和装置是基于同一技术构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。为了便于理解，下面结合附图及实施例进行介绍。
图1示出了本申请实施例适用的系统架构的示意图。
参阅图1所示，该系统架构中可以包括第一节点110、第二节点120、第三节点130。其中，第一节点110和第二节点120可以组成第一通信系统，双方之间可以采用第一通信技术进行通信。第一节点110和第三节点130可以组成第二通信系统，双方之间可以采用第二通信技术进行通信，第一通信技术与第二通信技术不同。在该第一通信技术和第二通信技术的融合通信场景中，第一通信系统与第二通信系统之间可以建立通信连接，组成异构式通信系统，以便在该异构式通信系统中执行相应的通信业务和/或传输通信业务数据。示例地，该异构式通信系统还可以称为融合后的通信系统，或者紧耦合(tight interworking)的通信系统，或者互相配合(interworking)的通信系统。
本申请实施例中，第一节点110、第二节点120、或第三节点130中的任一个节点，可以是具有数据收发能力的电子设备。
示例地，该电子设备可以为终端设备，包括向用户提供语音和/或数据连通性的设备，具体地，包括向用户提供语音的设备，或包括向用户提供数据连通性的设备，或包括向用户提供语音和数据连通性的设备。例如，包括具有无线连接功能的手持式设备、或连接到无线调制解调器的处理设备。该终端设备比如可以经无线接入网(radio access network，RAN)与核心网进行通信，与RAN交换语音和/或数据。
在具体实施过程中，该终端设备可以包括但不限于车辆、用户设备(user equipment，UE)、无线终端设备、移动终端设备、设备到设备(device-to-device，D2D)终端设备、车到一切(vehicle to everything，V2X)终端设备、机器到机器/机器类通信(machine-to-machine/machine-type communications，M2M/MTC)终端设备、物联网(internet of things，IoT)终端设备或窄带物联网(narrow band internet of things，NB-IoT)终端设备、签约单元(subscriber unit)、签约站(subscriber station)、移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点(access point，AP)、远程终端设备(remote terminal)、接入终端设备(access terminal)、用户终端设备(user terminal)、用户代理(user agent)、或用户装备(user device)等。又例如，该终端设备具体可以实现为：移动电话(或称为“蜂窝”电话)，或具有移动终端设备的计算机；IoT中的专用终端设备、或工业控制(industrial control)设备、或远程医疗(remote medical)设备、或智能电网(smart grid)设备、或智慧城市(smart city)设备等；便携式、袖珍式、手持式、计算机内置的或者车载的移动装置等；个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(Session Initiation Protocol，SIP)话机、无线本地环路(Wireless Local Loop，WLL)站、个人数字助理(Personal Digital Assistant，PDA)等。在一种可选的设计中，该终端设备还可以实现为受限设备，例如功耗较低的设备，或存储能力有限的设备，或计算能力有限的设备等。在一种可选的设计中，该终端设备可以包括条码、射频识别(radio frequency identification，RFID)、传感器、全球定位系统(global positioning system，GPS)、激光扫描器等部件。
在一种可选的设计中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备或智能穿戴式设备等，是应用穿戴式技术对日常穿戴进行智能化设计，以开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更可以通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能头盔、智能首饰等。
在一种可选的设计中，该终端设备还可以是机器智能设备如无人驾驶(self-driving)设备、运输安全(transportation safety)设备、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备等。
而如上介绍的各种终端设备，如果位于车辆上(例如放置在车辆内或安装在车辆内)，都可以认为是车载终端设备，车载终端设备例如也可以称为车载单元(on-board unit，OBU)。
在一种可选的设计中，终端设备还可以包括中继(relay)。或者理解为，终端设备可 以包括能够与基站进行数据通信的任一设备。
示例地，该电子设备也可以为网络设备，例如包括接入网(access network，AN)设备，该接入网设备可以包括接入网中在空口通过一个或多个小区与无线终端设备通信的设备，比如基站或接入点。其中，基站可用于将收到的空中帧与互联网协议(Internet Protocol，IP)分组进行相互转换，作为终端设备与接入网的其余部分之间的路由器，其中接入网的其余部分可包括IP网络。在一种可选的设计中，网络设备可以包括第二代(2th generation，2G)通信系统中的基站，或者包括第三代(3th generation，3G)通信系统中的基站，或者包括第四代(4th generation，4G)通信系统中的基站，比如，长期演进(long term evolution，LTE)系统或高级长期演进(long term evolution-advanced，LTE-A)中的演进型基站(NodeB或eNB或e-NodeB，evolutional Node B)，或者也可以包括第五代(the 5th generation，5G)新无线(new radio，NR)系统(也简称为NR系统)中的下一代节点B(next generation node B，gNB)，或者也可以包括云接入网(cloud radio access network，Cloud RAN)系统中的集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)，以及未来的各种通信系统中的基站，例如第六代(6th generation，6G)通信系统中的基站，本申请实施例对此不做限定；又例如网络设备可以包括V2X中的网络设备即路侧单元(road side unit，RSU)。RSU可以包括支持V2X应用的固定基础设施实体，可以与支持V2X应用的其他实体交换消息；再例如，网络设备还可以包括核心网设备，核心网设备例如包括5G系统中的如下一项或多项：接入和移动性管理功能(access and mobility management function，AMF)、会话管理功能(session management function，SMF)、用户面功能(user plane function，UPF)，或者包括4G系统中的移动管理实体(mobility management entity，MME)等。
应理解，在某些技术场景中，具备相类似数据收发能力的电子设备的名称也可能不称为节点，但是为了方便描述，本申请实施例中将具有数据收发能力的电子设备统称为节点。
本申请实施例中，在图1所示的异构式通信系统中，该第一节点110、第二节点120、或第三节点130的设备类型可以相同或不同。例如，第一节点110、第二节点120、第二节点130均是终端设备或网络设备，或者，第一节点110、第二节点120可以是终端设备、第三节点130可以是网络设备。以第一通信技术为短距离通信技术、第二通信技术为5G通信技术为例，如图2所示，该第一节点110、第二节点120可以为具备短距通信功能的终端设备，第三节点130可以包括但不限于接入设备：可信的非第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)网关功能(Trusted Non-3GPP Gateway Function，TNGF)、以及核心网设备：SMF、AMF、UPF以及数据网络(Data Network，DN)等功能实体中的至少一项。其中，该第一节点110可支持第一通信技术和第二通信技术，可以作为第二节点120的主控节点(或者称为授权节点)，一方面与第二节点120进行短距离通信，另一方面与第三节点130进行5G通信。需要说明的是，第一节点110可支持第一通信技术，也可以理解为，第一节点可以支持基于第一通信技术实现的业务传输，或者第一节点可以支持第一通信技术的业务；第一节点110支持第二通信技术，也可以理解为，第二节点可以支持基于第二通信技术实现的业务传输，或者第二节点可以支持第二通信技术的业务。
各个节点或功能实体之间可以通过接口连接，接口的序列号或接口的名称本申请实施例中不作限定，可以按照5G系统的3GPP相关标准协议中定义的接口，也可以使用未来通信系统中的接口。例如，第二节点120可以通过Yt接口与第一节点110通信，第一节点 110可以通过Ta接口与TNGF通信，第二节点120可以通过NWt接口与TNGF通信。第二节点120、第一节点110可以通过下一代网络(next generation，N)1接口(简称N1)与AMF通信，网络设备(例如TNGF)通过N2接口(简称N2)与AMF通信，TNGF通过N3接口(简称N3)与本地UPF通信，UPF通过N6接口(简称N6)与DN通信。AMF通过N11接口(简称N11)与SMF通信，SMF通过N4接口(简称N4)与UPF通信。由此，使得5G网络能够透过该第一节点110来感知该第二节点120的设备状态、网络状态、业务状态等关键信息，达到远程对行业现场网络和业务的可达、可感、可管等。
需要说明的是，上述仅是示意性表示该异构式通信系统中可以包括第一节点110、第二节点120和第三节点130，以及各个节点及其功能模块之间的通信方式，并不限定各个节点的数量以及接口的序列号或名称。在具体实施时，第一节点110、第二节点120、第三节点130的数量可以不限于1个。
另外，需要说明的是，本申请实施例中，在一种可选的设计中，第一节点110可以和第三节点130进行无线资源控制(radio resource control，RRC)建立过程，当第一节点110和第三节点130建立了RRC连接后，该第一节点110的RRC状态即为RRC连接态。随后，第一节点110的RRC状态可以在以下状态中进行转换：RRC空闲(RRC_IDLE)态、RRC连接(RRC_CONNECTED)态和RRC非激活(RRC_INACTIVE)态，在本申请实施例的融合通信场景中，该第一节点110可以是处于上述的空闲态、连接态、非激活态中的任一状态，本申请实施例对此不做限定。并且，本申请实施例中，任意两个节点之间建立通信连接是指，该两个节点之间可以通过信号的传输交互，以在所述两个节点之间进行通信，包括但不限于物理连接或虚拟连接，下文中将不再逐一区分。
本申请实施例中，短距离通信技术可以包括支持无线短距通信的技术，无线短距通信包括通信双方通过无线电波传输信息并且传输距离在较短的范围内(例如百米以内)，都可以称为短距离无线通信，包括但是不限于是蓝牙(bluetooth)技术、无线保真(wireless fidelity，Wi-Fi)技术、近场通讯(near field communication，NFC)技术、Wi-Fi Aware技术、通用短距通信技术、星闪联盟规范的短距通信技术等。短距离通信可以在文件传输、远程控制、投屏、周围设备(例如智能汽车、智能终端设备、智能家居设备和智能制造设备等)的感知等各方面有大量应用。下面列举几种短距离通信技术的示例。
蓝牙：一种支持设备短距离通信的无线电技术，能在包括移动电话、无线耳机、笔记本电脑、相关外设等众多设备之间进行无线信息交换。利用“蓝牙”技术，能够有效地简化移动通信终端设备之间的通信，也能够成功地简化设备与因特网之间的通信，从而使得数据传输变得更加迅速高效，为无线通信拓宽道路。
无线保真技术(wireless fidelity，Wi-Fi)：又称为无线局域网(wireless local area networks，WLAN)直连或Wi-Fi Direct，是Wi-Fi协议簇中的一个，使设备之间能够轻松连接彼此而不再需要中介性质的无线接入点。其使用范围从网页浏览到文件传输，以及同时与多个设备进行通信，能够充分发挥Wi-Fi的速度优势。符合此标准的设备即使来自不同的生产厂商，亦可实现轻松互联。
Wi-Fi Aware技术：在Wi-Fi技术中负责感知和发现部分，能够帮助Wi-Fi设备感知周边的服务，比如，周边的设备，进而通过Wi-Fi Aware实现近距离的两个设备的点对点(Peer to Peer，P2P)消息交互。由于WIFI-Aware可以感知周围的设备，所以可实现多种功能，比如，感知的附近的人并建立连接，进而加好友、玩同一款游戏等等；或者，发现周围的 设备，实现照片分享或地点分享等等；或者，无需接入网络(比如蜂窝或无线)，就可以向打印机安全地发送文件，等等。
需要说明的是，除了上面列举的短距离通信技术之外，现有的其它短距离通信技术，或者，随着通信技术的演进，未来可能出现的其他的短距离通信技术，也可以适用于本方案。
此外，需要说明的是，图2中各个功能实体或网元也可以采用服务化接口进行交互。比如，AMF对外提供的服务化接口可以为网络接入和移动性管理功能(network access and mobility management function，Namf)接口；SMF对外提供的服务化接口可以为网络会话管理功能(network session management function，Nsmf)接口。相关描述可以参考第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)-23501标准中定义的5G系统架构(5G system architecture)，在此不予赘述。
系统架构中包括的各个功能也可以称为功能实体、网元或其他名称。例如，SMF可以称为SMF实体。在一种可选的设计中，本申请实施例中的各个功能可以由一个设备实现，也可以由多个设备共同实现，还可以是由一个设备内的一个或多个功能模块实现，本申请实施例对此不作具体限定。可以理解的是，本申请实施例涉及的各个功能既可以是硬件设备中的网络元件的功能，也可以是在专用硬件上运行的软件功能，或者是硬件与软件的结合，或者是平台(例如，云平台)上实例化的虚拟化功能。
需要说明的是，本申请实施例并不限定各个功能的分布形式，在一种可选的设计中，上述系统架构中包括的各个功能还可以对应上述任意多种功能之间、或与其他功能之间融合后形成的其他功能实体，例如，具有会话管理和策略控制两种功能的功能实体，或者具有会话管理、接入与移动性管理和策略控制三种功能的功能实体，或者具有网络开放和应用功能两种功能的功能实体。
需要说明的是，图1～图2所示的系统架构并不构成本申请实施例能够适用的系统架构的限定。图2中的终端设备的数量只是举例，在实际应用中，网络设备可以为多个终端设备提供服务，网络设备，以及多个终端设备中的全部终端设备或者部分终端设备，都可以采用本申请实施例提供的通信方法。本申请实施例中涉及的各个功能或设备也可以称之为通信装置，其可以是一个通用设备或者是一个专用设备，本申请实施例对此不作具体限定。
需要说明的是，本申请实施例中“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a和b,a和c,b和c,或a和b和c，其中a,b,c可以是单个，也可以是多个。
以及，除非有特别说明，本申请实施例提及“第一”、“第二”、“第三”等序数词是用于对多个对象进行区分，不用于限定多个对象的优先级或者重要程度。例如，第一节点、第二节点、第三节点，只是为了区分不同的节点，而不是表示这三个节点的优先级或者重要程度等的不同。
此外，需要说明的是，在本申请各个实施例中，第一通信技术的业务，可以理解为，通过第一通信技术实现的业务(例如通过非5G技术实现的业务，进一步地比如通过短距 离通信技术实现的业务)，或者第一通信技术对应的业务(例如非5G业务，进一步地比如短距离通信业务)。第二通信技术的业务可以包括融合通信场景下的第二通信技术的业务，其中，第二通信技术的业务，可以理解为，通过第二通信技术实现的业务(例如通过5G实现的业务)，或者第二通信技术对应的业务(例如5G业务)。在本申请各个实施例中，第一通信连接对应第一通信技术，可以理解为，第一通信连接是基于第一通信技术实现的连接。例如当第一通信技术为短距离通信技术时，第一通信连接是通过使用短距离通信技术实现的连接。进一步可选地，通过该通信连接，可以传输第一通信技术的业务，或者可以传输第二通信技术的业务。下文中将不再对此逐一进行说明。在本申请各个实施例中，对应第二通信技术的网络，可以理解为，至少支持第二通信技术的网络，或者至少支持基于第二通信技术实现的业务传输的网络，例如5G网络，或者5G核心网。
基于图1和图2所示的系统架构，在本申请实施例的融合通信场景中，在一种可选的设计中，对于第一节点110和第二节点120组成的第一通信系统，为保障第一通信系统的通信安全性，第二节点120可以在选择好可信的第一节点110后、在与该第一节点110进行初始建链时，采用一个预置密钥与该第一节点110相互进行身份认证，并在身份认证成功后，基于该密钥相应的安全上下文建立双方之间的通信连接。进一步地，为保障第一节点110、第二节点120与第三节点130组成的异构式通信系统的通信安全性，第二节点120还可以通过第一节点110发起到第三节点130的新的身份认证和/或安全上下文协商流程，以协商确定三者之间的新的密钥和相应的安全上下文。
在第一节点110和第二节点120中存在至少两套密钥和/或相应的安全上下文的情况下，第一节点110和第二节点120之间还可以从所述至少两套密钥和/或相应的安全上下文中选择所需的密钥或安全上下文，以便基于所选择的密钥或安全上下文，来与对端节点建立安全的通信连接，从而保障双方之间执行相应的通信业务和/或传输通信业务数据的安全需求。
需要说明的是，本申请实施例中，密钥是一种参数，可以是在将明文转换为密文的算法中或将密文转换为明文的算法中输入的参数，第一节点110、第二节点120、第三节点130中的任意两方之间可以基于密钥发起身份认证流程和/或安全上下文(Security Context)协商流程，在双方之间身份认证成功后，双方之间能够获得协商一致的安全上下文，即访问控制属性。基于该安全上下文，双方之间可以发起连接建立流程，以在双方之间建立安全的通信连接。应理解，若第一节点110、第二节点120、第三节点130中的任意两方之间已经存在协商一致的安全上下文，双方之间无需进行上述身份认证流程和/或安全上下文协商流程，可直接使用协商一致的安全上下文发起连接建立流程，以在双方之间建立安全的通信连接。
应理解，本申请实施例中，第一节点110、第二节点120或第三节点130均可以支持一种或多种密钥协商算法，第一节点110、第二节点120、第三节点130中的任意两方之间在发起上述身份认证流程和/或安全上下文协商流程之前，还可以通过信息交互，完成双方之间的密钥协商。示例地，该密钥协商算法可以包括但不限于：非对称加密算法：如公钥加密(Rivest-Shamir-Adleman，RSA)算法、椭圆曲线加密(Elliptic Curves Cryptography，ECC)算法等；专用密钥交互算法：如迪菲-赫尔曼密钥协商(Diffie-Hellman algorithm，DH)算法、椭圆曲线迪菲-赫尔曼秘钥交换(Elliptic Curve Diffie–Hellman key Exchange，ECDH)等；共享密钥算法：预共享密钥(Pre-shared key，PSK)算法等，本申请实施例对此不做限定。为了便于描述，下文中将以采用PSK算法为例，来对本申请实施例的通信 方法的具体实现过程进行介绍，在此暂不赘述。
其中，身份认证又称为“身份验证”、“身份鉴权”，是指通过一定的手段，完成对节点身份的确认。身份认证的方法有很多实现方式，例如，基于PSK的身份认证方法、基于生物学特征的身份认证方法和基于公开密钥加密算法的身份认证方法等。其中，基于预共享密钥的身份认证是指至少两个节点可共同拥有一个或一组密钥，例如第一节点110和第二节点120之间、或第一节点110与第三节点130之间、或第一节点110、第二节点120与第三节点130之间。在需要进行身份认证时，第一节点110或第二节点120或第三节点130可向对端节点发送该PSK(或与该PSK关联的相关参数，本申请实施例对该相关参数的具体实现方式不做限定)，对端节点接收到该PSK后，检查该PSK是否与本地保存的密钥一致，如果一致，则可判定身份认证成功，如果不一致则可判定身份认证失败。任意两方节点之间在相互进行身份认证成功的情况下，方可获得协商一致的安全上下文，并基于该安全上下文，在双方之间建立安全的通信连接，以保障双方之间执行相应的通信业务和/或传输通信业务数据的安全需求。
在具体实施过程中，一种可能的实现方式是，第一节点110和第二节点120可以选择关联于第一业务的第一信息(例如包括第一密钥和/或第一安全上下文)，并基于该第一信息进行信息交互，以在第一节点110和第二节点120之间建立第一通信连接，该第一通信连接可用于传输第一业务的数据，以在满足融合通信场景下的安全需求的同时，实现第三节点130透过该第一节点110感知第二节点120的相关信息，从而达到远程对第二节点120的网络和业务的可达、可感、可管等。在实施时，在不同的场景中，该通信方法的流程可由第一节点110或第二节点120触发，本申请实施例对此不做限定。
为便于理解，下面结合附图及实施例介绍该通信方法。其中，需要说明的是，本申请述及的各个方法实施例中所包括的步骤仅是对该通信方法的可选步骤的示例，并不限定该通信方法的具体实现过程，在一些可选的实现方式中，任一个方法实施例中的步骤还可以交换实施顺序。
如图3所示，在一个示例中，该方法流程可由第一节点110触发，可以包括以下步骤：
S310：第一节点110获取第一信息。
S320：第一节点110根据所述第一信息与第二节点120建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点110为接入对应第二通信技术的网络的节点。
可以理解的是，该第一信息与所述第一业务相关联。示例地，所述第一业务可以为所述第一通信技术的业务或者所述第二通信技术的业务。
应理解，本申请实施例中，第一节点和第二节点是为了区分不同节点而加以描述，在一些示例中，第一节点可以为第二节点，第二节点可以为第一节点，图3中示出的方法流程，可以是第二节点120触发的，即第二节点120可以获取第一信息，根据所述第一信息与第一节点110建立第一通信连接，本申请实施例对此不做限定。
其中，上述第一信息可以包括第一节点110和第二节点120之间建立安全的通信连接所需的相关信息，该第一信息可以预先存储在该第一节点110或第二节点120侧，或者，也可由该第一节点110或第二节点120从网络侧或其它设备侧获取的，本申请实施例对此不做限定。
本申请实施例中，该第一节点110和第二节点120可以处于无安全上下文场景，该第 一信息可以包括用于第一节点110与第二节点120通信认证的第一密钥，实施S320时，第一节点110可以根据该第一密钥与第二节点120进行身份认证和安全上下文协商流程，进而，基于协商获得的第一安全上下文，第一节点110与第二节点120之间可以建立所述第一通信连接。或者，该第一节点110和第二节点120可以处于有安全上下文场景，该第一信息可以包括用于第一节点110与第二节点120通信的第一安全上下文，实施S320时，第一节点110与第二节点120之间可以根据该第一安全上下文建立所述第一通信连接。
在一个可能的设计中，在所述第一信息为用于第一节点110与第二节点120通信认证的密钥的情况下，该密钥可以包括所述第一节点110或所述第二节点120侧的预置密钥，或者该密钥可以来自第二通信技术的网络(例如第三节点130侧的核心网)，例如用于所述第二通信技术的业务的密钥。
本申请实施例中，在不同的情形下，S310-S320的具体实现过程有所不同，为了便于理解，下面结合方法流程图进行介绍。
情形一：第一信息包括用于第一节点110与第二节点120通信认证的第一密钥。
在该情形中，第一节点110和第二节点120无关联于第一业务的第一安全上下文，第一节点110和第二节点120之间建立所述第一通信连接时，可以首先获取所述第一密钥，之后基于所获取的第一密钥，先相互进行身份认证和协商第一安全上下文。在双方之间身份认证成功并获得所述第一安全上下文的情况下，该第一节点110可以基于所获得的第一安全上下文向第二节点120发起用于建立通信连接的消息，以基于该第一安全上下文在该第一节点110和该第二节点120之间建立第一通信连接。
方法示例一：
在方法示例一中，可由第二节点120获取第一密钥，第二节点120获取第一密钥后，可向第一节点110上报密钥类型指示信息或业务类型指示信息，由第一节点110根据第二节点120上报的密钥类型指示信息或业务类型指示信息确定所述第一密钥，并与第二节点120进行身份认证和安全上下文协商流程，从而在第一节点110和第二节点120之间建立安全的第一通信连接。需要说明的是，方法示例一中所包括的步骤S411-S419仅为可选步骤的示例，在一些示例中，下述步骤还可以交换实施顺序，本申请实施例不做具体限定。如图4a所示，该通信方法例如可以包括以下步骤：
S411(可选)：第一节点110发送第六消息(例如系统消息)。相应地，第二节点120可以接收该第六消息。
示例地，该第六消息中可以携带(或者说承载)第一指示信息，该第一指示信息可以用于指示所述第一节点110支持的业务类型(包括支持对应于第二通信技术的业务)。
在一种可选的设计中，该第一指示信息还可以指示第一节点110支持的一种或多种密钥协商算法，以便第二节点120可以根据所述第一指示信息，从自身所支持的密钥协商算法中选择第一节点110同样支持的密钥协商算法，以完成双方之间的密钥协商，以便根据协商确定的密钥协商算法(例如前述的PSK算法)，生成用于节点身份认证的相关认证参数。应理解，第一节点110和第二节点120节点之间进行密钥协商可以不限于是通过该第六消息实现的，本申请实施例对此不做限定。为便于理解和说明，本文中以PSK算法为例进行介绍。
进一步地，该第六消息中还可以携带所述第一节点110的身份标识(例如域标识(Domain ID))，该身份标识可用于唯一标识所述第一节点110。
示例地，该第六消息可以是单播消息，S411中，第一节点110可以向该第二节点120发送该第六消息。或者，该第六消息可以是广播消息，S411中，第一节点110可以广播该第六消息，第二节点120可以处于广播信号覆盖的范围内，且可以接收到该第六消息。
第二节点120接收到所述第六消息后，通过解析该第六消息，可以获知第一节点110支持的业务类型。
S412：该第二节点120(例如第二节点120的服务层)根据对应所述第二通信技术的类型，和/或，根据第一业务的业务类型，获取第一密钥或第一密钥的类型。
示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。
应理解，实施S412时，该第二节点120还可以是根据用户输入的相关指示信息获取所述第一密钥或第一密钥的类型，或者根据来自其它设备的相关指示信息获取所述第一密钥或第一密钥的类型，本申请实施例对此不做限定。
应理解，本申请实施例中，对于第二节点120获取第一密钥或第一密钥的类型还可以通过其他方式，本申请实施例对此不做限定。
本申请实施例中，在基于第一通信技术和第二通信技术的融合通信场景下，该第一密钥可以包括以下任一种实现方式：
示例1：第一密钥为用于第一通信技术的业务的密钥。
该第一密钥可以是在第一节点110和第二节点120之间配置的密钥(例如对应前文中述及的预置密钥)，该密钥对应于第一通信技术的业务，可用于在第一节点110和第二节点120之间完成身份认证和安全上下文协商后建立第一通信连接，并基于所建立的第一通信连接执行第一通信技术的业务，或者对基于第一通信技术的业务数据进行安全传输。相应地，该密钥对应的安全上下文为第一通信技术的业务的安全上下文。本申请实施例中，为便于区分，该用于第一通信技术的业务的密钥也可称为普通密钥，与普通密钥对应的安全上下文也可称为普通安全上下文。
其中，以该普通密钥为普通PSK为例，该普通PSK的配置方法可以包括以下方法中的任一种：
①配置密钥方法：通过预配置的方法，将该普通PSK预配置在第一节点110侧和第二
节点120侧。预配置方法的详细实现在此不再赘述。
②配置口令方法：用户在第一节点110和第二节点120上输入相同的口令。该口令可
以转换为该普通PSK，例如可以通过节点内的算法实现(比如密钥协商算法实现)转
换为普通PSK。应理解，不同的第二节点120可以使用不同口令接入同一个第一节点110，在此不再赘述。
③第三方服务器认证凭证配置方法：第三方服务器认证凭证配置方法的主要目的是识
别第二节点120是否和第一节点110满足预设的绑定关系。第二节点120应可以获取
第一节点110的身份标识，并利用第二节点120的身份标识和第一节点110的身份标
识生成校验信息发送给第三方服务器，以获取认证口令。第一节点110和第二节点获
取到第三方服务器发送的认证口令后，基于认证口令获得该普通PSK。
通过以上任一种配置方法，第二节点120和第一节点110之间可以配置相同的普通PSK。应理解，本申请实施例中，第二节点120和第一节点110之间也可以通过其他方法完成两节点之间的用于第一通信技术的业务的PSK的配置过程，在此不再赘述。
示例2：第一密钥为用于第二通信技术的业务的密钥。
为便于区分，用于所述第二通信技术的密钥可称为融合密钥。其中，在具体实现时，该融合密钥可以包括可信密钥或非可信密钥，其中，所述可信密钥为经过所述网络鉴权成功的密钥(例如前文中述及的在融合通信场景下，第二节点120通过第一节点110发起到第三节点130的新的身份认证和/或安全上下文协商流程确定的三者之间的新的密钥)，所述非可信密钥为未经过所述网络鉴权的密钥(例如前述所述及的第二节点与第一节点进行初始建链时采用的预置密钥，该预置密钥可以用于第一节点和第二节点相互进行身份认证)。这里的网络可以理解为第三节点所对应的网络，例如可以为5G核心网。应理解，在本申请实施例中，未经过所述网络鉴权的密钥，可以理解为：没有经过网络或者无需经过网络确认的密钥(例如默认的密钥)，或者虽然经过网络确认但是没有确认成功的密钥。第一密钥相应地可以为可信密钥或非可信密钥，该第一密钥对应于第二通信技术的业务，可用于在融合通信场景下，保障在第一节点110、第二节点120以及第三节点130之间安全地实现第二通信技术的业务或安全地传输通过第二通信技术实现的业务数据。该第一密钥例如可以是第三节点130，和第一节点110与第二节点120中的至少一个节点协商的密钥(例如对应前文中述及的新的密钥，或者对应可信密钥)，比如该第一密钥可以是第三节点130和第一节点110协商的密钥，又比如该第一密钥可以是第三节点130和第二节点120协商的密钥，再比如，该第一密钥可以是第一节点110、第二节点120和第三节点130之间协商的密钥；又例如，第一密钥可以是非可信密钥。
以该融合密钥为融合PSK为例，该融合PSK可以是第三节点130侧的核心网下发至第一节点110和/或第二节点120的，或者，该PSK也可以是在第一节点110或第二节点120配置的默认密钥参数，配置实现可以是示例1中的三种方式之一或其它实现方式，本申请实施例对此不做限定。第一节点或第二节点可以接收来自对应第二通信技术的网络的融合密钥。例如，第一节点和第二节点之间在建立第一通信连接之前，第一节点或第二节点可以接收来自网络的融合密钥，并将其保存在本地，以便于在后续第一通信连接建立过程中，第一节点或第二节点可以根据对应第二通信技术的类型，和/或根据第一业务的业务类型，确定在第一通信连接建立过程中所使用的第一密钥。第一节点在建立第一通信连接之前接收来自对应第二通信技术的网络的融合密钥，还便于第一节点在第一通信连接建立过程中，根据接收到的第一信息，获取第一密钥。
其中，若该PSK未经过第三节点130侧的核心网(例如5G核心网)的鉴权和密钥协商过程或未协商达成一致，该融合PSK为非可信融合PSK。若该融合PSK经过第三节点130侧的核心网的鉴权和/或密钥协商过程且达成一致，该融合PSK为可信融合PSK。相应地，与可信融合PSK对应的安全上下文，为在融合通信场景下，用于第二通信技术的业务的可信安全上下文，与非可信融合PSK对应的安全上下文，为在融合通信场景下，用于第二通信技术的业务的非可信安全上下文。应理解，在本申请实施例中，对应第二通信技术的网络，可以理解为，至少支持第二通信技术的网络，或者至少支持基于第二通信技术实现的业务传输的网络。
实施例S412时，该第二节点120根据对应所述第二通信技术的类型，和/或，根据第一业务的业务类型等，在上述示例1或示例2中述及的至少两个密钥中选择一个密钥作为该第一密钥。
需要说明的是，本申请实施例中，在存在多个密钥的情况下，该多个密钥可以具有优 先级和使用原则，其中，第一密钥与第一业务相关联，在所述多个密钥中选择第一密钥至少需要遵循以下原则：在所述第一业务为第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；和/或，在所述第一业务为对应于所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
以上述的普通PSK、可信融合PSK和非可信融合PSK为例，该多个密钥的使用原则具体可以是：1)在融合通信场景下，针对第二通信技术的业务，存在可信融合PSK，则不使用非可信融合PSK，而是使用可信融合PSK，即可信融合PSK的优先级高于非可信融合PSK的优先级；2)在融合通信场景下，针对第二通信技术的业务，当不存在可信融合PSK时，使用非可信融合PSK，而不使用普通PSK；3)针对第一通信技术的业务，即使存在融合PSK，也要使用普通PSK，以确保第一节点110和第二节点120之间的私有业务的安全性。
基于上述密钥使用原则，第二节点120可以根据第一业务的业务类型获取相应的第一密钥或第一密钥的类型。比如，如果第一业务为融合通信场景下第二通信技术的业务，那么存在可信融合PSK则使用可信融合PSK(进一步地，如果基于可信融合PSK建立连接失败，则再使用非可信融合PSK)，没有可信融合PSK时则使用非可信融合PSK。一般地，非可信融合PSK可以为默认值，示例地，当第一节点110和第二节点120为支持第二通信技术的设备时，该第一节点110和第二节点120中可以配置有该非可信融合PSK。又比如，如果第一业务为第一通信技术的业务，那么第一节点110和第二节点120可以通过普通PSK来建立第一通信连接。
S413a：第二节点120(例如第二节点120的服务层)向第一节点110发送第一消息。相应地，第一节点110可以接收来自所述第二节点120的第一消息。
本申请实施例中，该第一消息也可称为密钥指示消息，该第一消息可以承载与所述第一密钥关联的信息，例如密钥类型指示信息或业务类型指示信息或其他信息。
在本申请实施例中，该密钥类型指示信息可用于指示密钥类型为以下任一种：非可信融合密钥(例如前述的非可信融合PSK)、可信融合密钥(例如前述的可信融合PSK)、或者普通密钥(例如前述的普通PSK)。该业务类型指示信息可用于指示业务类型为以下任一种：第一通信技术的业务，或者，融合通信场景下，第二通信技术的业务。
在一些设计中，该第一消息中还可以携带该第二节点120的身份标识(例如媒体接入层标识)，示例地，该第一消息可以表示为如下多元组：
(ID,密钥类型指示信息或业务类型指示信息)。
S414：第一节点110根据所述密钥类型指示信息或所述业务类型指示信息，获取所述第一密钥。
本申请实施例中，第一节点110可以存储有多个密钥，实施S414时，第一节点110可以根据所述密钥类型指示信息或所述业务类型指示信息，从本地的多个密钥中获取所述第一密钥。或者，实施S414时，第一节点110可以根据所述密钥类型指示信息或所述业务类型指示信息，从其它设备获取该第一密钥，本申请实施例对此不做限定。示例地，该第一密钥可以为如前所述的普通PSK、非可信融合PSK或可信融合PSK中的任一个，该普通PSK、非可信融合PSK或可信融合PSK的配置过程可以参考S412中的相关描述，不做具体赘述。
由此，第一节点110和第二节点120之间可以通过协商，对所选择的第一密钥达成一 致，进一步地，第一节点110和第二节点120之间即可基于所获得的第一密钥进行身份认证和安全上下文协商流程。
示例地，如图4a所示，该身份认证和安全上下文协商流程可以包括以下步骤：
S415a(可选)：第二节点120向第一节点110发送关联请求消息。相应地，第一节点110接收该关联请求消息。
示例地，该关联请求消息中可以承载所述第二节点120的身份标识(例如域标识)、以及用于第二节点120的身份认证的相关认证参数，包括但不限于第二节点120选择的密钥协商算法(例如用KE alg表示)、密钥协商参数(例如用KEt表示)、第二节点120的安全能力(sec capabilities)和随机数(例如用NONCEt表示)等。安全能力可以包括第二节点120支持的密钥派生函数(key derivation function，KDF)、加密算法、完整性保护算法和认证加密算法中的一项或多项，在此不再赘述。
第一节点110可基于该关联请求消息中携带的相关信息，处理该关联请求消息。
比如，对于使用配置密钥方式接入的第二节点120，若第一节点110配置了白名单，第一节点110可以根据第二节点120的身份标识，判断第二节点120的固定身份是否在该白名单中，如果不在，则丢弃该关联请求消息。
又比如，第一节点110可以判断第二节点120选择的密钥协商算法是否在前述的第六消息承载的信息(例如第一指示信息)中，如果不在则丢弃该关联请求消息；如果在，第一节点110可根据第二节点120的安全能力、第一节点110预配置的算法优选策略和业务类型选择优先级最高的算法，包括优先级最高的密钥派生函数以及信令面的认证加密算法和完整性保护算法，以及优先级最高的用户面的认证加密算法和完整性保护算法，或者，优先级最高的用户面的认证加密算法。其中，算法优选策略可以通过按照优先级排序的算法列表来实现，如第一节点110预配置的密钥派生函数优先级列表、信令面认证加密算法优先级列表、信令面完整性保护算法优先级列表、用户面认证加密算法优先级列表、用户面完整性保护算法优先级列表等。信令面和用户面选择的算法可以不同。在一种可选的设计中，当选择的完整性算法或认证加密算法支持多个消息完整性代码(Message Integrity Code,MIC)长度时，第一节点110还可以根据选择的信令面完整性保护算法支持的MIC长度，选择信令面完整性保护的MIC长度，该过程例如可以通过星闪联盟规范的相应操作实现，或者也可以通过其他方式，本申请实施例不做具体限定。
在一种可选的设计中，该第一节点110还可根据所述第一消息中携带的相关信息和/或第一节点110自身选择的相关算法生成用于第一节点110的身份认证的相关认证参数。
示例地，第一节点110可产生私钥，并根据所选择的密钥协商算法(具体的密钥协商算法例如可以参照S411中的相关描述)，生成相应的公钥，该公钥可作为第一节点110的密钥协商参数(例如用KEg表示)。或者，第一节点110可生成随机数(例如用NONCEg表示)。或者，第一节点110可根据第一消息中携带的KEt和密钥协商算法，计算出共享密钥(例如用K KE表示)。或者，第一节点110可根据K KE、NONCEt和NONCEg，使用选择的密钥派生函数计算出共享密钥(例如用Kgt表示)，计算方式如下：
Kgt＝KDF(K KE,NONCEt,NONCEg)。
或者，第一节点110可生成Kgt的标识(例如用Kgt ID表示)。或者，第一节点110可计算认证参数(例如用AUTHg表示)，计算方式如下：
AUTHg＝AUF(PSK，K KE,NONCEg,关联请求消息)| 高32位比特。
其中，AUF()| 高32位比特，表示通过密钥派生函数AUF对括号内包括的参数进行运算，然后取高32位比特信息作为AUTHg。AUF与前述的KDF使用相同的认证加密算法。
第一节点110可以基于所获取的第一密钥、上述相关认证参数中的一种或多项，生成安全上下文请求消息(第二消息的一个示例)。
示例地，该安全上下文请求消息中可以包括用于第一节点110的身份认证的相关认证参数，包括但不限于第一节点110的密钥协商参数KEg、随机数NONCEg、第一密钥对应的第一安全上下文关联的标识Kgt ID、选择的算法(algorithm)、MIC长度(MIC length)和认证参数AUTHg。选择的算法(algorithm)可以包括密钥派生算法、信令面的加密算法和完整性保护算法、用户面的加密算法和完整性保护算法、用户面的认证加密算法中的一项或多项。
在一种可选的设计中，第一节点110还可以使用选择的信令面的完整性保护算法和完整性保护密钥Ks.int对安全上下文请求消息做完整性保护，即计算MIC，并将MIC包含在安全上下文请求消息中。
示例地，该安全上下文请求消息可以表示为如下多元组：
(KEg,NONCEg,Kgt ID,algorithm,MIC length,AUTHg) MIC。
其中，该() MIC表示该安全上下文请求消息为经过完整性保护处理的消息。
S416：第一节点110向所述第二节点发送与所述第一密钥关联的安全上下文请求消息(第二消息的一个示例)。相应地，第二节点120接收来自所述第一节点110的安全上下文请求消息。
本申请实施例中，该第二消息可用于第一节点110的身份认证。应理解，在本申请实施例中，该第二消息可用于第一节点110的身份认证，可以理解为，该第二消息包含的或者携带的信息可用于第一节点110的身份认证。
本申请实施例中，第二消息与第一密钥相关联，在一种可选的设计中，第二消息承载的信息中包括根据第一密钥生成的信息。
在一种可选的设计中，第二节点120可根据第一节点110选择的密钥派生函数，使用和第一节点110相同的方式计算出共享密钥Kgt、信令面的安全密钥，用户面的安全密钥等。
在一种可选的设计中，第二节点120可检查第二消息的完整性，即校验MIC是否正确。如果完整性验证不通过，第二节点120丢弃该消息，并可重新发送关联请求消息。
在一种可选的设计中，第二节点120还可基于协商一致的第一密钥，验证AUTHg是否正确。如果AUTHg验证不通过，第二节点120丢弃该第二消息，并可重新发送关联请求消息。应理解，在本申请实施例中，检查消息的完整性，可以包括检查消息包括或者承载的信息的完整性。
进一步地，该第二节点120还可根据安全上下文请求消息中携带的相关信息和/或自身的相关算法生成用于第二节点120的身份认证的相关认证参数。
示例地，第二节点120可计算认证参数AUTHt，计算方法符合以下表达式：
AUTHt＝AUF(PSK，K KE,安全上下文请求消息,NONCEt,第一节点110的密钥协商算法能力，第一指示信息)| 高32位比特；
其中，AUF()| 高32位比特，表示通过密钥派生函数AUF对括号内包括的参数进行运算，然后取高32位比特信息作为AUTHt。AUF和前述的KDF使用相同的认证加密算法。
在一种可选的设计中，第二节点120可以在对第一节点110的身份认证成功后，基于上述生成的相关认证参数生成安全上下文响应消息(第三消息的一个示例)。
S417：第二节点120向第一节点110发送安全上下文响应消息(第三消息的一个示例)。相应地，第一节点110接收来自所述第二节点120的安全上下文响应消息。
本申请实施例中，该第三消息可用于所述第二节点的身份认证、且该第三消息可以是在所述第一节点110的身份认证成功的情况下发送的。
应理解，在本申请实施例中，第三消息可用于指示所述第一节点110的身份认证成功、以及用于所述第二节点120的身份认证，第三消息包含或者携带用于指示所述第一节点身份认证成功的信息和用于所述第二节点的身份认证的信息。此外，作为一种可选的设计，在本申请实施例中，用于指示所述第一节点110身份认证成功的信息和用于所述第二节点120的身份认证的信息，可以通过相同的消息发送，或者通过不同的消息发送，相应地，第三消息可以对应一个消息，也可以对应多个消息，本申请实施例对此不做限定。示例地，该第三消息中可以包含AUTHt。
示例地，第二节点120可使用信令面的完整性保护算法和完整性保护密钥Ks.int对安全上下文响应消息做完整性保护。
应理解，在本申请实施例中，第二节点120可使用信令面的完整性保护算法和完整性保护密钥Ks.int对安全上下文响应消息做完整性保护，可以理解为，第二节点120可使用信令面的完整性保护算法和完整性保护密钥Ks.int对安全上下文响应消息包含的或携带的信息做完整性保护。完整性保护生成的MIC可以携带在安全上下文响应消息中。当信令面加密保护启动时，第二节点120可以使用信令面的加密算法和加密密钥Ks.enc对安全上下文响应消息做加密保护。
示例地，该安全上下文响应消息可以表示如下：
(AUTHt) MIC。
其中，AUTHt为该安全上下文响应消息中携带的相关认证参数的示例，() MIC表示该安全上下文响应消息为经过完整性保护处理的消息。
此外，如果第二节点120对安全上下文响应消息进行了加密(或者，对安全上下文响应消息中包含的或携带的信息进行了加密)，则第一节点110接收到该安全上下文响应消息后，可解密该安全上下文响应消息(或者，解密该安全上下文响应消息中包含的或携带的信息)。
第一节点110可以检查该安全上下文响应消息的完整性(或检查安全上下文响应消息包含的或携带的消息的完整性)，并验证该安全上下文响应消息中携带的AUTHt是否正确。如果完整性或AUTHt验证不通过，即第二节点120的身份认证不成功，第一节点110可向第二节点120发送关联建立失败消息。如果完整性和AUTHt验证通过，第一节点110可为第二节点120生成用于标识该第二节点120的身份的临时ID(例如为物理层标识)。
第一节点110可以根据所述安全上下文响应消息中携带的相关信息，对第二节点120进行身份认证，该过程例如可以通过星闪联盟规范的相应操作实现，或者也可以通过其他方式实现，本申请实施例不做具体限定。
S418：第一节点110可在所述第二节点120的身份认证成功的情况下，向所述第二节点发送关联建立消息(第四消息的一个示例)。相应地，第二节点120接收来自第一节点110的关联建立消息。
本申请实施例中，该第四消息可用于与所述第二节点建立所述第一通信连接，所述第四请求消息可以是在所述第二节点120的身份认证成功的情况下发送的。
应理解，在本申请实施例中，第四消息可用于指示所述第二节点的身份认证成功、以及用于请求与所述第二节点建立第一通信连接，第三消息包含或者携带用于指示所述第二节点的身份认证成功的信息和用于请求与所述第二节点建立第一通信连接的信息。此外，作为一种可选的设计，在本申请实施例中，用于指示所述第二节点的身份认证成功的信息和用于请求与所述第二节点建立第一通信连接的信息，可以通过相同的消息发送，或者通过不同的消息发送，相应地，第四消息可以对应一个消息，也可以对应多个消息，本申请实施例对此不做限定。
示例地，该第四消息中可以包括第一节点110为第二节点120生成的以下一项或多项参数：临时ID(T-ID)(例如为物理层标识)、共享密钥Kgt的有效期(Kgt expiration)、[GKc/GK]，[GK ID]，[Galgorithm]，[GK的有效期(GK expiration)]。
其中，[GKc/GK]表示当单播信令面的加密保护开启时携带第二节点120所在组的组密钥(例如用GK表示)，当单播信令面的加密保护未开启时携带GKc，GKc由GK和保护组密钥GK机密性的密钥(例如用Kg表示)进行异或处理得到：
Kg＝KDF(Kgt,COUNTERg，"group key")；
Figure PCTCN2021122352-appb-000001
其中，[GK ID]为GK的标识，Galgorithm为第二节点120所在组的组算法。
在一种可选的设计中，第一节点110可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联建立消息做完整性保护。
应理解，在本申请实施例中，第一节点110可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联建立消息做完整性保护，可以理解为，第一节点110可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联建立消息包含的或者携带的信息做完整性保护。完整性保护生成的MIC可携带在关联建立消息中。当信令面加密保护启动时，第一节点110可使用信令面的加密算法和加密密钥Ks.enc对关联建立消息做加密保护。
应理解，在本申请实施例中，第一节点110可使用信令面的加密算法和加密密钥Ks.enc对关联建立消息做加密保护，可以理解为，第一节点110可使用信令面的加密算法和加密密钥Ks.enc对关联建立消息包含的信息或携带的信息做加密保护。
示例地，该关联建立消息可以表示为如下多元组：
(临时ID,Kgt expiration,[GKc/GK],[GK ID],[Galgorithm],[GK expiration]) MIC。
其中，() MIC表示该关联建立消息为经过完整性保护处理的消息。
在一种可选的设计中，第二节点120在接收到关联建立失败消息的情况下，可以重新发起关联请求消息。
在一种可选的设计中，第二节点120在接收到关联建立消息时，如果关联建立消息进行了加密(或者，关联建立消息包含的或者携带的信息进行了加密)，则第二节点120可以解密该关联建立消息(或者，解密关联建立消息包含的或携带的信息)。第二节点120还可检查关联建立消息的完整性(或者，检查关联建立消息包含的或携带的信息的完整性)。
如果完整性验证不通过，则第二节点120丢弃该消息。
如果完整性验证通过，S419：第二节点120可向第一节点110发送关联完成消息。相应地，第一节点110可接收来自第二节点120的关联完成消息，所述关联完成消息可用于 表示所述第一通信连接建立完成。
在一种可选的设计中，第二节点120可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联完成消息做完整性保护。
应理解，在本申请实施例中，第二节点120可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联完成消息做完整性保护，可以理解为，第二节点120可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联完成消息包含的或者携带的信息做完整性保护。当信令面加密保护启动时，第二节点120可使用信令面的加密算法和加密密钥Ks.enc对关联完成消息做加密保护。应理解，在本申请实施例中，第二节点120可使用信令面的加密算法和加密密钥Ks.enc对关联完成消息做加密保护，可以理解为，第二节点120可使用信令面的加密算法和加密密钥Ks.enc对关联完成消息包含的或者携带的信息做加密保护。
示例地，该关联完成消息可以表示如下：
(关联完成消息) MIC。
其中，() MIC表示该关联完成消息为经过完整性保护处理的消息。
第一节点110可以对接收到的关联完成消息进行处理。
例如，如果关联完成消息进行了加密(或者，关联完成消息包含的或者携带的信息进行了加密)，则第一节点110可解密关联完成消息(或者，解密关联完成消息包含的或者携带的信息)。或者，第一节点110可以检查关联完成消息的完整性(或者，检查关联完成消息包含的或者携带的信息的完整性)。如果完整性验证不通过，则丢弃该消息。如果完整性验证通过，则执行后续流程，在此不再赘述。
上述安全上下文协商和关联完成之后，第一节点110和第二节点120可保存协商的第一安全上下文。
示例地，该第一安全上下文可以包括但不限于前述的身份ID、临时ID、Kgt、Kgt有效期、Kgt ID、密钥协商算法、信令面的加密算法和完整性保护算法、信令面的加密密钥和完整性保护密钥、用户面的加密算法和完整性保护算法或用户面的认证加密算法、用户面的加密密钥和完整性保护密钥或用户面的认证加密密钥、[GK]、[GK ID]、[组算法]、[GK有效期]等。
在一种可选的设计中，本申请实施例中，第一节点110和第二节点120还可支持安全上下文过期删除机制，需要保存安全上下文的节点可以配置一个时钟，以支持该机制，在此不再赘述。或者，第一节点110还可保存第二节点120的身份标识与第一密钥的对应关系，第二节点120还可保存第一节点110的身份标识与第一密钥的对应关系。
在第一通信连接建立完成之后，第一节点110和第二节点120之间进行业务时，可以根据密钥类型或业务类型确定该第一通信连接的业务范围，并传输该业务范围对应的业务。
例如，基于可信融合PSK建立的通信连接(包括安全上下文)只能用于融合通信场景下第二通信技术的业务。基于普通PSK建立的通信连接(包括安全上下文)用于第一通信技术的业务(如，可以是除融合通信场景下第二通信技术的业务外的其他业务)。
方法示例二：
在该方法示例二中，可由第二节点120获取第一密钥，第二节点120获取第一密钥后，可以同步获取用于第二节点120的身份认证的相关参数，并在同一消息(例如关联请求消息)中携带密钥类型指示信息或业务类型指示信息、以及用于第二节点120的身份认证的 相关参数，以便第一节点110可以根据第二节点120上报的密钥类型指示信息或业务类型指示信息确定所述第一密钥，并基于第二节点120上报的相关参数与第二节点120进行身份认证和安全上下文协商流程，从而在第一节点110和第二节点120之间建立安全的第一通信连接。需要说明的是，方法示例二中所包括的步骤S411-S419仅为可选步骤的示例，在一些示例中，下述步骤还可以交换实施顺序，本申请实施例不做具体限定。
如图4b所示，在方法示例二中，该通信方法可以包括以下步骤：
S411(可选)：第一节点110发送第六消息(例如系统消息)。相应地，第二节点120可以接收该第六消息。详细实现可参见上文中结合图4a介绍的S411的相关描述，在此不再赘述。
S412：该第二节点120(例如第二节点120的服务层)根据对应所述第二通信技术的类型，和/或，根据第一业务的业务类型，获取第一密钥或第一密钥的类型。详细实现可参见上文中结合图4a介绍的S412的相关描述，在此不再赘述。
S413b：第二节点120向第一节点110发送关联请求消息。相应地，第一节点110可以接收来自所述第二节点120的关联请求消息。
与图4a介绍的方法示例一相比，在该方法示例二中是在第二节点120发送的关联请求消息中携带密钥类型指示信息或业务类型指示信息，即方法示例二中的关联请求消息对应方法示例一中的第一消息和关联请求消息的合并，该关联请求消息中可以承载所述第一节点110的ID、密钥类型指示信息或业务类型指示信息、以及用于第二节点120的身份认证的相关认证参数，包括但不限于第二节点120选择的KE alg、KEt、第二节点120的安全能力和NONCEt等。安全能力可以包括第二节点120支持的KDF、加密算法、完整性保护算法和认证加密算法中的一项或多项。详细实现可参见上文中结合图4a介绍的S413a、S415a的相关描述，在此不再赘述。
S414：第一节点110根据所述密钥类型指示信息或所述业务类型指示信息，获取所述第一密钥。详细实现可参见上文中结合图4a介绍的S414，在此不再赘述。
S416：第一节点110向所述第二节点发送与所述第一密钥关联的安全上下文请求消息(第二消息的一个示例)。相应地，第二节点120接收来自所述第一节点110的安全上下文请求消息。详细实现可参见上文中结合图4a介绍的S416的相关描述，在此不再赘述。
S417：第二节点120向第一节点110发送安全上下文响应消息(第三消息的一个示例)。相应地，第一节点110接收来自所述第二节点120的安全上下文响应消息。详细实现可参见上文中结合图4a介绍的S417的相关描述，在此不再赘述。
S418：第一节点110可在所述第二节点120的身份认证成功的情况下，向所述第二节点发送关联建立消息(第四消息的一个示例)。相应地，第二节点120接收来自第一节点110的关联建立消息。详细实现可参见上文中结合图4a介绍的S418的相关描述，在此不再赘述。
S419：第二节点120可向第一节点110发送关联完成消息。相应地，第一节点110可接收来自第二节点120的关联完成消息。详细实现可参见上文中结合图4a介绍的S419的相关描述，在此不再赘述。
方法示例三：
在方法示例三中，可由第一节点110获取第一密钥，第一节点110可以根据所述第一密钥，与第二节点120进行身份认证和安全上下文协商流程，从而在第一节点110和第二 节点120之间建立安全的第一通信连接。需要说明的是，方法示例三中所包括的步骤S421-S427仅为可选步骤的示例，在一些示例中，下述步骤还可以交换实施顺序，本申请实施例不做具体限定。
如图4c所示，该通信方法例如可以包括以下步骤：
S421(可选)：第一节点110发送第六消息(例如系统消息)。相应地，第二节点120可以接收该第六消息。详细实现可参见上文中结合图4a介绍的S411，在此不再赘述。
S422：第二节点120向第一节点110发送关联请求消息。相应地，第一节点110可以接收来自所述第二节点120的关联请求消息。
本申请实施例中，该关联请求消息中可以携带该第二节点120的身份ID(例如媒体接入层标识)、以及用于指示第二节点120的能力的相关参数，包括但不限于第二节点120选择的密钥协商算法(例如用KE alg表示)、密钥协商参数(例如用KEt表示)、第二节点120的安全能力(sec capabilities)和随机数NONCEt等。安全能力可以包括第二节点120支持的密钥派生函数KDF、加密算法，完整性保护算法和认证加密算法等中的一项或多项，在此不再赘述。
示例地，该关联请求消息可以表示为如下多元组：
(ID,KE alg,KEt,sec capabilities,NONCEt)。
S423：第一节点110根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一密钥。
应理解，实施S423时，该第一节点110还可以是根据用户输入的相关指示信息获取所述第一密钥或者根据来自其它设备的相关指示信息获取所述第一密钥，本申请实施例对此不做限定。S423的详细实现可参见上文中结合图4a介绍的S412，在此不再赘述。
S424：第一节点110根据所述第一密钥向所述第二节点发送安全上下文请求消息(第二消息的一个示例)。相应地，第二节点120接收来自所述第一节点110的安全上下文请求消息，该安全上下文请求消息关联于第一密钥。详细实施细节可参见图4a中S416的相关描述，在此不再赘述。
S425：第二节点120向第一节点110发送安全上下文响应消息(第三消息的一个示例)。相应地，第一节点110接收来自所述第二节点120的安全上下文响应消息。详细实施细节可参见图4a中S417的相关描述，在此不再赘述。
S426：第一节点110在所述第二节点120的身份认证成功的情况下，向所述第二节点发送关联建立消息(第四消息的一个示例)。相应地，第二节点120接收来自第一节点110的关联建立消息。详细实施细节可参见图4a中S418的相关描述，在此不再赘述。
S427：第二节点120可向第一节点110发送关联完成消息。相应地，第一节点110可接收来自第二节点的关联完成消息。详细实施细节可参见图4a中S419的相关描述，在此不再赘述。
由此，在图4a、图4b、图4c所示的通信方法中，在存在多个密钥的场景中，第一节点110和第二节点120之间可以选择与第一业务关联的第一密钥，并根据所述第一密钥完成双方之间的身份认证和安全上下文协商流程，以在双方之间建立安全的第一通信连接，进而使得第一节点110和第二节点120之间进行业务时，可以根据使用不同密钥建立的安全通信连接传输对应业务的数据，以满足融合通信场景下的安全需求，并保障相应业务数据的安全性。
其中，与图4a、图4b所示的通信方法相比，图4c所示的通信方法中，可由第一节点110根据第二节点120的相关能力，例如在注册时上报的业务类型、业务特征、通信能力等，主动为该第二节点120选择密钥作为第一密钥，由此，第二节点120与第一节点110之间无需交互第一消息(即密钥指示消息)，可以减少信令开销。
情形二：该第一信息包括用于第一节点110与第二节点120通信的第一安全上下文。
在该情形中，第一节点110和第二节点120均存在至少两套安全上下文，例如前述普通安全上下文、可信安全上下文和非可信安全上下文，第一节点110和第二节点120之间可以在所述至少两套安全上下文中协商确定所需的第一安全上下文，并基于该第一安全上下文建立安全的第一通信连接。需要说明的是，情形二中所包括的步骤S431-S435仅为可选步骤的示例，在一些示例中，下述步骤还可以交换实施顺序，本申请实施例不做具体限定。
如图4d所示，该通信方法例如可以包括以下步骤：
S431(可选)：第一节点110发送第六消息(例如系统消息)。相应地，第二节点120可以接收该第六消息。详细实现可参见上文中结合图4a介绍的S411，在此不再赘述。
S432：第二节点120根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一安全上下文或所述第一安全上下文的类型。
应理解，实施S432时，该第二节点120还可以是根据用户输入的相关指示信息获取所述第一安全上下文或所述第一安全上下文的类型，或者根据来自其它设备的相关指示信息获取所述第一安全上下文或所述第一安全上下文的类型，本申请实施例对此不做限定。应理解，本申请实施例中，对于第二节点120获取第一安全上下文或第一安全上下文的类型还可以通过其他方式，本申请实施例对此不做限定。
本申请实施例中，在融合通信场景下，该第一安全上下文可以包括以下任一种实现方式：
示例3：所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
其中，用于所述第二通信技术的业务的安全上下文包括可信安全上下文或非可信安全上下文，其中，所述可信安全上下文为经过所述网络鉴权成功的安全上下文，所述非可信安全上下文为未经过所述网络鉴权的安全上下文。这里的网络可以理解为第三节点所对应的网络，例如可以为5G核心网。应理解，在本申请实施例中，未经过所述网络鉴权的安全上下文，可以理解为：没有经过网络或者无需经过网络确认的安全上下文(例如默认的密钥对应的安全上下文)，或者虽然经过网络确认但是没有确认成功的安全上下文(例如对应于前述未经过所述网络鉴权的密钥的安全上下文)。
以前述的与PSK对应的安全上下文为例，若该安全上下文未经过第三节点130侧的核心网(例如5G核心网)的鉴权和密钥协商过程或未协商达成一致，该安全上下文为非可信安全上下文，对应前述的非可信融合PSK。若该安全上下文经过第三节点130侧的核心网的鉴权和密钥协商过程且达成一致获得的，该安全上下文为可信安全上下文，对应前述的可信融合PSK。
示例4：所述第一安全上下文为用于第一通信技术的业务的安全上下文。
其中，与前述多个密钥的优先级和使用原则相似，本申请实施例中，所述至少两套安全上下文也可以有安全上下文的优先级和使用原则，其中，第一安全上下文与第一业务相关联，在所述至少两套安全上下文中选择第一安全上下文至少需要遵循以下原则：在所述 第一业务为第一通信技术的业务的情况下，所述第一安全上下文为用于所述第一通信技术的业务的安全上下文；和/或，在所述第一业务为所述第二通信技术的业务的情况下，所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
比如，1)针对融合通信场景下第二通信技术的业务，存在用于融合通信场景下第二通信技术的业务的可信安全上下文，则不使用用于融合通信场景下第二通信技术的业务的非可信安全上下文，而是使用可信安全上下文，即可信安全上下文的优先级高于非可信安全上下文的优先级；2)针对融合通信场景下第二通信技术的业务，使用用于融合通信场景下第二通信技术的业务的安全上下文，而不使用用于第一通信技术的业务的安全上下文，即用于融合通信场景下第二通信技术的业务的非可信安全上下文的优先级高于用于第一通信技术的业务的安全上下文的优先级；3)针对第一通信技术的业务，即使存在用于融合通信场景下第二通信技术的业务的安全上下文，也要使用用于第一通信技术的业务的安全上下文，以确保第一节点110和第二节点120之间的私有业务的安全性。
实施S432时，第二节点120可以根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，基于上述使用原则，获取所述第一安全上下文，例如用于第一通信技术的业务的安全上下文、或融合通信场景下的非可信安全上下文、或融合通信场景下的可信安全上下文。示例地，对应所述第二通信技术的类型可以是指所述第二通信技术采用的通信制式的类型，例如5G技术。
S433：第二节点120向第一节点110发送关联请求消息(第五消息的一个示例)。相应地，第一节点110接收所述关联请求消息。
示例地，该关联请求消息中可包含该第二节点120的临时ID(例如物理层标识)、和/或，与所述第一安全上下文关联的标识，例如表示为Kgt ID。
在一种可选的设计中，第二节点120还可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联请求消息做完整性保护，计算得到的MIC可携带在该关联请求消息中。
示例地，该关联请求消息可表示为如下多元组：
(临时ID,Kgt ID) MIC。
其中，() MIC表示该关联请求消息为经过完整性保护处理的消息。
S434：第一节点110根据临时ID和/或所述Kgt ID，获取所述第一安全上下文。
在一种可选的设计中，第一节点110可以根据所述第一安全上下文检查所述关联请求消息的完整性。
如果第一节点110无第二节点120的临时ID，或无相应的第一安全上下文，或第一节点110校验MIC失败，则第一节点110可向第二节点120发送失败消息并携带原因值(图中未示出)。第二节点120收到该失败消息后，可发起无安全上下文情况下的身份认证流程和安全上下文协商流程，例如可参见图4a或图4b的方法步骤，在此不再赘述。
如果第一节点110检查关联请求消息的完整性成功，则第一节点110可为第二节点120生成新的临时ID(T-ID)。
S435：第一节点110向第二节点120发送关联建立消息(即第七消息)。相应地，第二节点120可接收来自所述第一节点的第七消息。
在一种可选的设计中，该关联建立消息中可包括第一节点110为第二节点120生成新的临时ID(T-ID)。
在一种可选的设计中，第一节点110还可使用信令面的完整性保护算法和完整性保护 密钥Ks.int对关联建立消息做完整性保护。当信令面加密保护启动时，第一节点110可使用信令面的加密算法和加密密钥Ks.enc对关联建立消息做加密保护。
示例地，该关联建立消息可以表示为如下多元组：
(新临时ID) MIC。
其中，() MIC表示该关联建立消息为经过完整性保护处理的消息。
其中，如果第一节点110对该关联建立消息进行了加密，则第二节点120可解密该关联建立消息。第二节点120还可检查关联建立消息的完整性。如果完整性验证不通过，则丢弃该消息。如果完整性验证通过，则S436：第二节点120可第一节点110发送关联完成消息(即第八消息)。
其中，第二节点120可使用信令面的完整性保护算法和完整性保护密钥Ks.int对关联完成消息做完整性保护。当信令面加密保护启动时，第二节点120可使用信令面的加密算法和加密密钥Ks.enc对关联完成消息做加密保护。
示例地，该关联完成消息可以表示如下：
(关联完成消息) MIC。
其中，() MIC表示该关联完成消息为经过完整性保护处理的消息。
由此，在图4d所示的通信方法中，在存在多套安全上下文的场景中，第一节点110和第二节点120之间可以选择与第一业务关联的第一安全上下文，并根据所述第一安全上下文在双方之间建立第一通信连接，进而使得第一节点110和第二节点120之间进行业务时，可以根据使用基于不同的安全上下文建立的第一通信连接传输对应业务的数据，以满足融合通信场景下的安全需求，并保障相应业务数据的安全性。
需要说明的是，本申请实施例中，若第二节点120多次无法使用保存的安全上下文和第一节点110建立关联时，第二节点120可尝试删除保存的安全上下文，并采用前述图4a或图4b所示的方法，在第二节点120和第一节点110之间发起无安全上下文的关联流程，在此不再赘述。
本申请实施例还提供了一种通信装置，用于执行上述方法实施例中第一节点所执行的方法，相关特征可参见上述方法实施例，在此不再赘述。
如图5所示，该装置500可以包括：通信单元501，用于与第二节点通信；处理单元502，用于获取第一信息；根据所述第一信息与第二节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点。示例地，所述第一业务可以为所述第一通信技术的业务或者所述第二通信技术的业务。具体实现方式，请参考图1至图4d所示实施例中的详细描述，这里不再赘述。
在一种可选的设计中，图5所示的通信装置500，还可用于执行上述方法实施例中第二节点所执行的方法，例如，通信单元501，用于与第一节点通信；处理单元502，用于获取第一信息；根据所述第一信息与第一节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点。示例地，所述第一业务可以为所述第一通信技术的业务或者所述第二通信技术的业务。相关特征可参见上述方法实施例，在此不再赘述。
需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。在本申请的实施例中的各功能单元可以集成在一个处 理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
在一种可能的实现方式中，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质存储有程序代码，当所述程序代码在所述计算机上运行时，使得计算机执行上述方法实施例。
在一种可能的实现方式中，本申请实施例提供了一种计算机程序产品，当所述计算机程序产品在计算机上运行时，使得所述计算机执行上述方法实施例。
在一个简单的实施例中，本领域的技术人员可以想到上述实施例中的通信装置均可采用图6所示的形式。
如图6所示的装置600，包括至少一个处理器610和通信接口630。在一种可选的设计中，还可以包括存储器620。
本申请实施例中不限定上述处理器610以及存储器620之间的具体连接介质。
在如图6的装置中，处理器610在与其他设备进行通信时，可以通过通信接口630进行数据传输。
当通信装置采用图6所示的形式时，图6中的处理器610可以通过调用存储器620中存储的计算机执行指令，使得装置600可以执行上述任一方法实施例中通信装置执行的方法。
本申请实施例还涉及一种芯片系统，该芯片系统包括处理器，用于调用存储器中存储的计算机程序或计算机指令，以使得该处理器执行上述任一实施例的方法。
在一种可能的实现方式中，该处理器可以通过接口与存储器耦合。
在一种可能的实现方式中，该芯片系统还可以直接包括存储器，该存储器中存储有计算机程序或计算机指令。
示例地，存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存 储器(direct rambus RAM，DR RAM)。
本申请实施例还涉及一种处理器，该处理器用于调用存储器中存储的计算机程序或计算机指令，以使得该处理器执行上述任一实施例所述的方法。
示例地，在本申请实施例中，处理器是一种集成电路芯片，具有信号的处理能力。例如，该处理器可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种通信方法，其特征在于，应用于第一节点，所述方法包括：
    获取第一信息；
    根据所述第一信息与第二节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；
    其中，所述第一节点为接入对应第二通信技术的网络的节点，所述第一业务为所述第一通信技术的业务或者所述第二通信技术的业务。
  2. 根据权利要求1所述的方法，其特征在于，所述第一信息包括用于与所述第二节点通信认证的第一密钥，所述获取第一信息，包括：
    根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述第一信息包括用于与所述第二节点通信认证的第一密钥，所述方法还包括：
    接收来自所述第二节点的第一消息，所述第一消息承载密钥类型指示信息或业务类型指示信息；
    所述获取第一信息，包括：
    根据所述密钥类型指示信息或所述业务类型指示信息，获取所述第一密钥。
  4. 根据权利要求2或3所述的方法，其特征在于，所述根据所述第一信息与第二节点建立第一通信连接，包括：
    向所述第二节点发送与所述第一密钥关联的第二消息，所述第二消息用于所述第一节点的身份认证；
    接收响应于所述第二消息的第三消息，所述第三消息用于所述第二节点的身份认证；
    在所述第二节点的身份认证成功的情况下，向所述第二节点发送第四消息，所述第四消息用于与所述第二节点建立所述第一通信连接。
  5. 根据权利要求2-4中任一项所述的方法，其特征在于，
    在所述第一业务为所述第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；或者，
    在所述第一业务为所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
  6. 根据权利要求5所述的方法，其特征在于，所述用于所述第二通信技术的业务的密钥包括可信密钥或非可信密钥，其中，所述可信密钥为经过所述网络鉴权成功的密钥，所述非可信密钥为未经过所述网络鉴权的密钥，所述可信密钥的优先级高于所述非可信密钥的优先级。
  7. 根据权利要求1-6中任一项所述的方法，其特征在于，在建立所述第一通信连接之前，所述方法还包括：
    接收来自所述网络的用于所述第二通信技术的业务的密钥。
  8. 根据权利要求1所述的方法，其特征在于，所述第一信息包括用于与所述第二节点通信的第一安全上下文，所述获取第一信息，包括：
    接收来自所述第二节点的第五消息，所述第五消息承载与所述第一安全上下文关联的 标识；
    所述获取第一信息，包括：
    根据所述标识，获取所述第一安全上下文。
  9. 根据权利要求8所述的方法，其特征在于，
    在所述第一业务为所述第一通信技术的业务的情况下，所述第一安全上下文为用于所述第一通信技术的业务的安全上下文；或者，
    在所述第一业务为所述第二通信技术的业务的情况下，所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
  10. 根据权利要求9所述的方法，其特征在于，所述用于所述第二通信技术的业务的安全上下文包括可信安全上下文或非可信安全上下文，其中，所述可信安全上下文为经过所述网络鉴权成功的安全上下文，所述非可信安全上下文为未经过所述网络鉴权的安全上下文，所述可信安全上下文的优先级高于所述非可信安全上下文的优先级。
  11. 根据权利要求1-10中任一项所述的方法，其特征在于，所述获取第一信息之前，所述方法还包括：
    向所述第二节点发送第六消息，所述第六消息承载用于指示所述第一节点支持所述第二通信技术的信息。
  12. 一种通信方法，其特征在于，应用于第二节点，所述方法包括：
    获取第一信息；
    根据所述第一信息与第一节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；
    其中，所述第一节点为接入对应第二通信技术的网络的节点，所述第一业务为所述第一通信技术的业务或者所述第二通信技术的业务。
  13. 根据权利要求12所述的方法，其特征在于，所述第一信息包括用于与所述第一节点通信认证的第一密钥，所述获取第一信息，包括：
    根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一密钥。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    向所述第一节点发送第一消息，所述第一消息承载与所述第一密钥相关联的信息。
  15. 根据权利要求13或14所述的方法，其特征在于，所述根据第一信息与所述第一节点建立所述第一通信连接，包括：
    接收来自所述第一节点的第二消息，所述第二消息关联于所述第一密钥，所述第二消息用于所述第一节点的身份认证；
    在所述第一节点的身份认证成功的情况下，向所述第一节点发送第三消息，所述第三消息用于所述第二节点的身份认证；
    接收响应于所述第三消息的第四消息，所述第四消息用于与所述第二节点建立所述第一通信连接。
  16. 根据权利要求13-15中任一项所述的方法，其特征在于，
    在所述第一业务为所述第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；或者，
    在所述第一业务为所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二 通信技术的业务的密钥。
  17. 根据权利要求16所述的方法，其特征在于，所述用于所述第二通信技术的业务的密钥包括可信密钥或非可信密钥，其中，所述可信密钥为经过所述网络鉴权成功的密钥，所述非可信密钥为未经过所述网络鉴权的密钥，所述可信密钥的优先级高于所述非可信密钥的优先级。
  18. 根据权利要求12-17中任一项所述的方法，其特征在于，在建立所述第一通信连接之前，所述方法还包括：
    接收来自所述网络的用于所述第二通信技术的业务的密钥。
  19. 根据权利要求12所述的方法，其特征在于，所述第一信息包括第一安全上下文，所述第一安全上下文用于所述第二节点与所述第一节点建立所述第一通信连接，所述获取第一信息，包括：
    根据对应所述第二通信技术的类型，和/或，根据所述第一业务的业务类型，获取所述第一安全上下文。
  20. 根据权利要求19所述的方法，其特征在于，
    在所述第一业务为所述第一通信技术的业务的情况下，所述第一安全上下文为用于所述第一通信技术的业务的安全上下文；或者，
    在所述第一业务为所述第二通信技术的业务的情况下，所述第一安全上下文为用于所述第二通信技术的业务的安全上下文。
  21. 根据权利要求20所述的方法，其特征在于，所述用于所述第二通信技术的业务的安全上下文包括可信安全上下文或非可信安全上下文，其中，所述可信安全上下文为经过所述网络鉴权成功的安全上下文，所述非可信安全上下文为未经过所述网络鉴权的安全上下文，所述可信安全上下文的优先级高于所述非可信安全上下文的优先级。
  22. 根据权利要求19-21中任一项所述的方法，其特征在于，所述方法还包括：
    向所述第一节点发送第五消息，所述第五消息承载与所述第一安全上下文关联的标识。
  23. 根据权利要求12-22中任一项所述的方法，其特征在于，所述方法还包括：
    接收来自所述第一节点的第六消息，所述第六消息承载用于指示所述第一节点支持所述第二通信技术的信息。
  24. 一种通信装置，其特征在于，应用于第一节点，包括：
    通信单元，用于与第二节点通信；
    处理单元，用于获取第一信息；根据所述第一信息与所述第二节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点，所述第一业务为所述第一通信技术的业务或者所述第二通信技术的业务。
  25. 根据权利要求24所述的装置，其特征在于，
    所述第一信息包括用于与所述第二节点通信认证的第一密钥，在所述第一业务为所述第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；或者，在所述第一业务为所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
  26. 一种通信装置，其特征在于，包括：
    通信单元，用于与第一节点通信；
    处理单元，用于获取第一信息；根据所述第一信息与所述第一节点建立第一通信连接，所述第一通信连接用于传输第一业务的数据，所述第一通信连接对应第一通信技术；其中，所述第一节点为接入对应第二通信技术的网络的节点，所述第一业务为所述第一通信技术的业务或者所述第二通信技术的业务。
  27. 根据权利要求26所述的装置，其特征在于，所述第一信息包括用于与所述第一节点通信认证的第一密钥，在所述第一业务为所述第一通信技术的业务的情况下，所述第一密钥为用于所述第一通信技术的业务的密钥；或者，在所述第一业务为所述第二通信技术的业务的情况下，所述第一密钥为用于所述第二通信技术的业务的密钥。
  28. 一种通信装置，其特征在于，包括至少一个处理器和接口电路，所述接口电路用于为所述至少一个处理器提供数据或者代码指令，所述至少一个处理器用于通过逻辑电路或执行代码指令实现如所述权利要求1-11或12-23中任一项所述的方法。
  29. 一种通信系统，其特征在于，包括用于实现如权利要求1-11中任一项所述方法的通信装置，和，实现如权利要求12-23中任一项所述方法的通信装置。
  30. 一种计算机可读存储介质，其特征在于，所述计算机可读介质存储有程序代码，当所述程序代码在计算机上运行时，使得计算机执行如权利要求1至11中任一项所述的方法；或者，当所述程序代码在计算机上运行时，使得计算机执行如权利要求12至23中任一项所述的方法。
PCT/CN2021/122352 2021-09-30 2021-09-30 一种通信方法、装置及系统 Ceased WO2023050373A1 (zh)

Priority Applications (7)

Application Number Priority Date Filing Date Title
PCT/CN2021/122352 WO2023050373A1 (zh) 2021-09-30 2021-09-30 一种通信方法、装置及系统
CN202180102233.0A CN117981371A (zh) 2021-09-30 2021-09-30 一种通信方法、装置及系统
CN202411563220.5A CN119697628A (zh) 2021-09-30 2021-09-30 一种通信方法、装置及系统
KR1020247013082A KR20240065291A (ko) 2021-09-30 2021-09-30 통신 방법, 장치, 및 시스템
JP2024519730A JP2024537820A (ja) 2021-09-30 2021-09-30 通信方法、装置およびシステム
EP21958945.4A EP4391614A4 (en) 2021-09-30 2021-09-30 COMMUNICATION METHOD, APPARATUS AND SYSTEM
US18/620,750 US20240244681A1 (en) 2021-09-30 2024-03-28 Communication method, apparatus, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/122352 WO2023050373A1 (zh) 2021-09-30 2021-09-30 一种通信方法、装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/620,750 Continuation US20240244681A1 (en) 2021-09-30 2024-03-28 Communication method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2023050373A1 true WO2023050373A1 (zh) 2023-04-06

Family

ID=85781181

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/122352 Ceased WO2023050373A1 (zh) 2021-09-30 2021-09-30 一种通信方法、装置及系统

Country Status (6)

Country Link
US (1) US20240244681A1 (zh)
EP (1) EP4391614A4 (zh)
JP (1) JP2024537820A (zh)
KR (1) KR20240065291A (zh)
CN (2) CN119697628A (zh)
WO (1) WO2023050373A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2025025075A1 (zh) * 2023-07-31 2025-02-06 华为技术有限公司 信息传输的方法、通信系统和通信装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118230135B (zh) * 2024-05-23 2024-08-09 北京大学 一种基于时空信息对的人工智能系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107820247A (zh) * 2016-09-06 2018-03-20 励智识别技术有限公司 将安全数据包发送到通信设备的方法和设备
CN109906624A (zh) * 2016-10-31 2019-06-18 瑞典爱立信有限公司 支持无线通信网络中的认证的方法以及相关网络节点和无线终端
US20200314841A1 (en) * 2019-03-25 2020-10-01 Cisco Technology, Inc. Systems and methods for scaling short range local area networks using dual interfaced first hub nodes and transmission schedule mapping
CN112491533A (zh) * 2019-09-12 2021-03-12 华为技术有限公司 一种密钥生成方法及装置
CN112740733A (zh) * 2020-12-24 2021-04-30 华为技术有限公司 一种安全接入方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9655012B2 (en) * 2012-12-21 2017-05-16 Qualcomm Incorporated Deriving a WLAN security context from a WWAN security context
JP2016096452A (ja) * 2014-11-14 2016-05-26 凸版印刷株式会社 移動端末及び無線通信システム
CN107005927B (zh) * 2015-09-22 2022-05-31 华为技术有限公司 用户设备ue的接入方法、设备及系统
WO2020072652A1 (en) * 2018-10-03 2020-04-09 Intel Corporation Systems, methods, and apparatuses for enabling relay services for user equipment to access 5gc via a residential gateway
WO2020095938A1 (en) * 2018-11-06 2020-05-14 Nec Corporation Apparatus and method

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107820247A (zh) * 2016-09-06 2018-03-20 励智识别技术有限公司 将安全数据包发送到通信设备的方法和设备
CN109906624A (zh) * 2016-10-31 2019-06-18 瑞典爱立信有限公司 支持无线通信网络中的认证的方法以及相关网络节点和无线终端
US20200314841A1 (en) * 2019-03-25 2020-10-01 Cisco Technology, Inc. Systems and methods for scaling short range local area networks using dual interfaced first hub nodes and transmission schedule mapping
CN112491533A (zh) * 2019-09-12 2021-03-12 华为技术有限公司 一种密钥生成方法及装置
CN112740733A (zh) * 2020-12-24 2021-04-30 华为技术有限公司 一种安全接入方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4391614A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2025025075A1 (zh) * 2023-07-31 2025-02-06 华为技术有限公司 信息传输的方法、通信系统和通信装置

Also Published As

Publication number Publication date
US20240244681A1 (en) 2024-07-18
CN119697628A (zh) 2025-03-25
KR20240065291A (ko) 2024-05-14
JP2024537820A (ja) 2024-10-16
EP4391614A1 (en) 2024-06-26
CN117981371A (zh) 2024-05-03
EP4391614A4 (en) 2024-09-11

Similar Documents

Publication Publication Date Title
KR102398221B1 (ko) 무선 직접통신 네트워크에서 비대칭 키를 사용하여 아이덴티티를 검증하기 위한 방법 및 장치
CN108886685B (zh) 一种终端匹配方法、装置
US11283770B2 (en) Deriving a security key for relayed communication
KR102094216B1 (ko) 이동 통신 시스템 환경에서 프락시미티 기반 서비스 단말 간 발견 및 통신을 지원하기 위한 보안 방안 및 시스템
WO2021047276A1 (zh) 一种密钥生成方法及装置
CN109891932B (zh) 在移动通信网络中接收加密信息的系统、方法和存储介质
CN115885496B (zh) 一种通信方法及相关装置
WO2022237561A1 (zh) 一种通信方法及装置
WO2021196051A1 (zh) 一种通信方法、装置及系统
CN113841366B (zh) 通信方法及装置
US20240244681A1 (en) Communication method, apparatus, and system
WO2017133021A1 (zh) 一种安全处理方法及相关设备
CN113795024B (zh) 一种获取密钥的方法及装置
CN109791590A (zh) 安全性过程
WO2022027476A1 (zh) 密钥管理方法及通信装置
WO2020238957A1 (zh) 验证方法及装置
WO2023159603A1 (zh) 一种安全实现方法及装置、终端设备、网元
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
CN113228722B (zh) 一种配对方法及装置
WO2023143022A1 (zh) 用于随机接入过程中数据处理的方法和装置
CN103200191B (zh) 通信装置和无线通信方法
WO2024087071A1 (zh) 一种通信方法、装置及系统
WO2023000318A1 (zh) 一种地址验证方法及相应的装置
WO2022133912A1 (zh) 侧行链路通信方法、装置和系统
CN115801388B (zh) 报文传输方法、装置及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21958945

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202180102233.0

Country of ref document: CN

WWE Wipo information: entry into national phase

Ref document number: 2021958945

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2024519730

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2021958945

Country of ref document: EP

Effective date: 20240322

WWE Wipo information: entry into national phase

Ref document number: 202417027506

Country of ref document: IN

ENP Entry into the national phase

Ref document number: 20247013082

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: KR1020247013082

Country of ref document: KR

NENP Non-entry into the national phase

Ref country code: DE