KEY MATERIAL SENDING METHOD, KEY MATERIAL OBTAINING METHOD, INFORMATION TRANSMISSION METHOD, AND DEVICE

A key material sending method, a key material obtaining method, and an information transmission method are provided. The key material sending method includes: receiving, by a first network function, first information. The first information is used to determine a first mapping relationship between a first terminal and a second terminal. The method further includes sending, by the first network function, a key material of the first terminal according to the first mapping relationship. The key material of the first terminal includes: security information required by the first terminal for communication.

TECHNICAL FIELD

This application belongs to the technical field of communication, and in particular, relates to a key material sending method, a key material obtaining method, an information transmission method, and a device.

BACKGROUND

With the popularity of the Internet of Things and smart homes, there may be multiple smart homes in one family. Smart home connects various devices in the home (such as audio and video equipment, lighting system, curtain control, air conditioning control, security system) for mutual communication, to form a communication topology network to provide various functions and means such as home appliance control, lighting control, telephone remote control, indoor and outdoor remote control, anti-theft alarm, environmental monitoring, and HVAC control.

In order to utilize the 5thGeneration (5G) network services, all devices in the smart home need to access the 5G network during networking in the smart home network. However, many smart IoT devices have only limited functions (also known as restricted functions), and how to provide relevant security materials for these smart IoT devices with limited functions is an urgent problem to be solved.

SUMMARY

The embodiments of this application provide a key material sending method, a key material obtaining method, an information transmission method, and a device.

According to a first aspect, a key material sending method is provided, including.receiving, by a first network function, first information, where the first information is used to determine a first mapping relationship between a first terminal and a second terminal; andsending, by the first network function, a key material of the first terminal according to the first mapping relationship;where the key material of the first terminal includes: security information required by the first terminal for communication.

According to a second aspect, a key material obtaining method is provided, including.receiving, by a first terminal, a key material of a first terminal determined by a first network function, where the key material of the first terminal includes: security information required by the first terminal for communication.

According to a third aspect, an information transmission method is provided, including:sending, by a second terminal or a third-party function, first information to a first network function, so that after receiving the first information, the first network function determines that there is a first mapping relationship between a first terminal and the second terminal and sends a key material of the first terminal;where the key material of the first terminal includes security information required by the first terminal for communication.

According to a fourth aspect, a key material sending apparatus is provided, includinga first receiving module, configured to receive first information, where the first information is used to determine a first mapping relationship between a first terminal and a second terminal; anda first execution module, configured to send a key material of the first terminal according to the first mapping relationship;where the key material of the first terminal includes security information required by the first terminal for communication.

According to a fifth aspect, a key material obtaining apparatus is provided, including:a second receiving module, configured to receive a key material of a first terminal determined by a first network function, where the key material of the first terminal includes: security information required by the first terminal for communication.

According to a sixth aspect, an information transmission apparatus is provided, including:a first sending module, configured to send first information to a first network function, so that after receiving the first information, the first network function determines that there is a first mapping relationship between a first terminal and the second terminal and sends a key material of the first terminal;where the key material of the first terminal includes: security information required by the first terminal for communication.

According to a seventh aspect, a communication device is provided, including a processor, a memory, and a program or an instruction stored in the memory and executable on the processor, and when the program or the instruction is executed by the processor, the steps of the method according to the first aspect, the steps of the method according to the second aspect, or the steps of the method according to the third aspect are implemented.

According to an eighth aspect, a communication device is provided, including a processor and a communication interface, where the communication interface is configured to receive first information, where the first information is used to determine a first mapping relationship between a first terminal and a second terminal; and send a key material of the first terminal according to the first mapping relationship; where the key material of the first terminal includes: security information required by the first terminal for communication.

In some alternative embodiments, the communication interface is configured to receive the key material of the first terminal determined by the first network function, where the key material of the first terminal includes the security information required by the first terminal for communication. In some alternative embodiments, the communication interface is configured to send the first information to the first network function, so that after receiving the first information, the first network function determines that there is a first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal, where the key material of the first terminal includes: the security information required by the first terminal for communication.

According to a ninth aspect, a readable storage medium is provided. The readable storage medium stores a program or an instruction. When the program or the instruction is executed by a processor, the steps of the method according to the first aspect are implemented, the steps of the method according to the second aspect are implemented, or the steps of the method according to the third aspect are implemented.

According to a tenth aspect, a chip is provided, where the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is configured to run programs or instructions, so as to implement the method according to the first aspect, the method according to the second aspect, or the method according to the third aspect.

According to an eleventh aspect, a computer program/program product is provided, stored in a non-volatile storage medium, the program/program product is executed by at least one processor to implement the steps of the method according to the first aspect, the steps of the method according to the second aspect, or the steps of the method according to the third aspect.

According to a twelfth aspect, a communication device is provided, configured to perform the steps of the method according to the first aspect, or to perform the steps of the method according to the second aspect, or to perform the steps of the method according to the third aspect steps of the method.

In the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship; so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

DETAILED DESCRIPTION

It should be noted that, the technologies described in the embodiments of this application are not limited to a Long Term Evolution (LTE)/LTE-Advanced (LTE-A) system, and can also be used in other wireless communication systems such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-Carrier Frequency-Division Multiple Access (SC-FDMA), and another system. The terms “system” and “network” in the embodiments of this application may be used interchangeably. The technologies described can be applied to both the systems and the radio technologies mentioned above as well as to other systems and radio technologies. A New Radio (NR) system is described in the following description for illustrative purposes, and the NR terminology is used in most of the following description, although these technologies can also be applied to applications other than the NR system application, such as the 6thGeneration (6G) communication system.

FIG.1is a block diagram of a wireless communication system to which embodiments of this application can be applied. The wireless communication system includes a terminal11and a network side device12. The terminal11may also be called a terminal device or a User Equipment (UE), and the terminal11may be a mobile phone, a tablet personal computer, a laptop computer or a notebook computer, a Personal Digital Assistant (PDA), a palmtop computer, a netbook, an Ultra-Mobile Personal Computer (UMPC), a Mobile Internet Device (MID), a wearable device or a Vehicle User Equipment (VUE), a Pedestrian User Equipment (PUE), and other terminal side devices. The wearable device includes: smart watches, bracelets, earphones, glasses, etc. It should be noted that a specific type of the terminal11is not limited in the embodiments of this application. The network side device12may be a base station or a core network. The base station may be referred to as a node B, an evolved node B, an access point, a Base Transceiver Station (BTS), a radio base station, a radio transceiver, a Basic Service Set (BSS), an Extended Service Set (ESS), a node B, an evolved Node B (eNB), a home node B, a home evolved node B, a Wireless Local Area Network (WLAN) access point, a Wireless Fidelity (WiFi) node, a Transmission and Reception Point (TRP), or other appropriate terms in the art. As long as a same technical effect is achieved, the base station is not limited to a specified technical term. It should be noted that, in embodiments of this application, only a base station in the NR system is used as an example, but a specific type of the base station is not limited.

The key material sending method, the key material obtaining method, the information transmission method, and the device provided in the embodiments of this application will be described in detail below through some embodiments and application scenarios with reference to the accompanying drawings.

As shown inFIG.2, at least one embodiment of this application provides a key material sending method, executed by a first network function, including:

Step201: A first network function receives first information, where the first information is used to determine a first mapping relationship between a first terminal and a second terminal.

Step202: The first network function sends a key material of the first terminal according to the first mapping relationship.

The key material of the first terminal includes: security information required by the first terminal for communication.

It should be noted that the first network function may be an access network function or a core network function, which is not specifically limited herein.

In this embodiment of this application, the first network function receives the first information, determines that there is a first mapping relationship between the first terminal and the second terminal, and then generates and sends the key material of the first terminal based on the first mapping relationship.

In an embodiment, the first information includes at least one of the following.a first identifier; where the first identifier is a device identifier and/or a user identifier of the first terminal; and the first identifier can uniquely identify the first terminal; anda second identifier; where the second identifier is a device identifier and/or a user identifier of the second terminal; and the second identifier can uniquely identify the second terminal.

As an embodiment, the method further includes at least one of the following.determining, by the first network function according to the first information, that there is the first mapping relationship between the first terminal and the second terminal; for example, the first information includes the first identifier and the second identifier, and then the first network function determines that there is the first mapping relationship between the first terminal and the second terminal; for another example, the first information is sent by the first terminal and the first information only includes the second identifier, and then the first network function may also determine that there is the first mapping relationship between the first terminal and the second terminal; and

The first network function determines, according to a pre-stored mapping relationship and the first information, that there is the first mapping relationship between the first terminal and the second terminal; where the “pre-stored mapping relationship” may be locally stored in the first network function or stored in third-party functions. For example, the first terminal sends the first information, where the first information is the second identifier, and the first network function obtains the first mapping relationship through local storage.

As an embodiment, if the first information does not include the first identifier, the method further includes:sending, by the first network function, the first identifier of the first terminal to the first terminal. For example, the first identifier is determined by the first network function or a third-party function, which is not specifically limited herein.

As an embodiment, the first mapping relationship includes at least one of the following:an mapping relationship between a device identifier of the first terminal and a device identifier of the second terminal;an mapping relationship between a device identifier of the first terminal and a user identifier of the second terminal,an mapping relationship between a user identifier of the first terminal and a user identifier of the second terminal; andan mapping relationship between a user identifier of the first terminal and a device identifier of the second terminal.

As another embodiment, the security information includes at least one of the following:a security key;a security parameter; andsigning credential information, for example, the signing credential information includes at least one of the following:signing credential long-term key;a user identifier;a UE Route Selection Policy (URSP); anda Key Set Identifier in 5G (ngKSI).

In at least one embodiment of this application, the method further includes:deriving, by the first network function, the key material of the first terminal based on a key material of the second terminal;where the key material of the second terminal includes security information required by the second terminal for communication.

In at least one embodiment of this application, the receiving first information in step201includes at least one of the following:receiving, by the first network function, the first information sent by the first terminal;receiving, by the first network function, the first information sent by the second terminal;receiving, by the first network function, the first information sent by a third-party function; for example, the third-party function is an application server, and the third-party function can be set as a separate entity or can be a module or a unit set on another network entity, which is not specifically limited herein;receiving, by the first network function, the first information through a Network Exposure Function (NEF); andreceiving, by the first network function, the first information through a Non Access Stratum (NAS) message.

In some embodiments, the NAS message is at least one of the following: a service request message, a registration request message; and a Protocol Data Unit (PDU) session establishment request message.

In at least one embodiment of this application, before the first network function sends the key material of the first terminal, the method further includes:sending an inquiry indication to the second terminal, for example, the inquiry indication may be: bit information, an NAS message (for example, a configuration update command or a PDU session modification message), and a new NAS message; andreceiving an authorization indication sent by the second terminal, for example, the authorization indication may be: a success or failure indication (ACK/NACK), bit information, an NAS message (for example, a service request message or a PDU session modification message), or a new NAS message:

Correspondingly, in step202, the sending, by the first network function, the key material of the first terminal includes:sending, by the first network function, the key material of the first terminal according to the authorization indication. In other words, in this embodiment, the first network function can send the key material of the first terminal only after receiving the authorization indication from the second terminal.

As an embodiment, in step202, the sending, by the first network function, the key material of the first terminal includes any one of the followingsending, by the first network function, the key material of the first terminal to the first terminal;sending, by the first network function, the key material of the first terminal to the second terminal, and sending the key material of the first terminal to the first terminal through the second terminal; in this case, the first terminal and the second terminal need to establish direct connection communication, and the first information and the key material of the first terminal are transmitted through the direct connection communication; andsending, by the first network function, the key material of the first terminal to a third-party function, and sending the key material of the first terminal to the first terminal through the third-party function; for example, the third-party function is an application server.

As an embodiment, the method further includes at least one of the following:starting, by the first network function, a first timer, where a timing period of the first timer is a valid time of the security information of the first terminal; and after the valid time is exceeded, the security information of the first terminal becomes invalid.

It should be noted that an existing timer can be reused as the first timer, and relevant parameters of the first timer (such as a start occasion and a timing period) can be obtained by both the first terminal and the first network function.

In some embodiments, the key material further includes: a valid time, where the valid time is the valid time of the security information. After the valid time is exceeded, the security information becomes invalid.

As another embodiment, before sending the key material of the first terminal in step202, the method further includes:receiving, by the first network function, the key material of the first terminal from a second network function.

For example, the first network function is an Access and Mobility Management Function (AMF) or a Radio Access Network (RAN), and the second network function is an AMF or an Authentication Server Function (AUSF).

To sum up, in the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship; so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

As shown inFIG.3, the embodiment of this application also provides a key material obtaining method, executed by a first terminal, including:

Step301: A first terminal receives a key material of a first terminal determined by a first network function, where the key material of the first terminal includes: security information required by the first terminal for communication.

It should be noted that the first network function is an access network function or a core network function, which is not specifically limited herein.

As an embodiment, the key material of the first terminal is obtained by deriving a key material of the second terminal;where the key material of the second terminal includes: security information required by the second terminal for communication.

As another embodiment, the security information includes at least one of the following.a security key;a security parameter; andsigning credential information, for example, the signing credential information includes at least one of the following:signing credential long-term key;a user identifier;a URSP; andan ngKSI.

As an embodiment, before step301, the method further includes.

The first terminal sends an initial verification message to the third-party function, where the initial verification message is used for the third-party function to verify and authorize the first terminal.

The initial verification message includes at least one of the following.an identifier of the first terminal; where the identifier can uniquely identify the first terminal;a default credential of the first terminal; where the default credential is the only credential that can be identified and can verify security before the first terminal accesses a bearer; anda network identifier of a local network of the first terminal, where the network identifier of the local network is a non-public network identifier different from that of a Public Land Mobile Network (PLMN).

In at least one embodiment of this application, step301includes any one of the following:receiving, by the first terminal, the key material of the first terminal sent by the first network function; that is, the first network function directly gives the key material of the first terminal to the first terminal;receiving, by the first terminal, the key material of the first terminal sent by the second terminal, where the key material of the first terminal is sent to the second terminal by the first network function; that is, the first network function sends the key material of the first terminal to the second terminal, so that the second terminal forwards the key material of the first terminal to the first terminal; in this case, the first terminal and the second terminal need to establish direct connection communication; andreceiving, by the first terminal, the key material of the first terminal sent by a third-party function, where the key material of the first terminal is sent by the first network function to the third-party function; that is, the first network function sends the key material of the first terminal to the third-party function; so that the third-party function forwards the key material of the first terminal to the first terminal. For example, the third-party function is an application server, and the third-party function can be set as a separate entity or can be a module or a unit set on another network entity, which is not specifically limited herein.

As an embodiment, the key material further includes:a valid time, where the valid time is the valid time of the security information. After the valid time is exceeded, the security information becomes invalid.

As another embodiment, the method further includes.after the valid time is exceeded, sending, by the first terminal, first update indication information to the first network function, where the first update indication information is used to indicate the first network function to update the key material of the first terminal.

To sum up, in the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship; so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

As shown inFIG.4, the embodiment of this application further provides an information transmission method, including.

Step401: A second terminal or a third-party function sends first information to a first network function, so that after receiving the first information, the first network function determines that there is a first mapping relationship between a first terminal and the second terminal and sends a key material of the first terminal.

The key material of the first terminal includes: security information required by the first terminal for communication.

In the embodiment of this application, the third-party function or the second terminal sends the first information to the first network function, and the first network function determines that there is a first mapping relationship between the first terminal and the second terminal, and then the first network function generates and sends the key material of the first terminal. In other words, the first information implicitly indicates the first network function to generate the key material of the first terminal.

It should be noted that the third-party function is an application server, and the third-party function can be set as a separate entity or can be a module or a unit set on another network entity.

In an embodiment, the first information includes at least one of the following.a first identifier; where the first identifier is a device identifier and/or a user identifier of the first terminal; anda second identifier; where the second identifier is a device identifier and/or a user identifier of the second terminal.

In an embodiment, after step401, the method further includes:receiving, by the second terminal or the third-party function, the key material of the first terminal sent by the first network function and determined by the first network function; andsending, by the second terminal or the third-party function, the key material of the first terminal to the first terminal, where in at least one embodiment of this application, the key material of the first terminal is derived based on a key material of the second terminal;where the key material of the second terminal includes: security information required by the second terminal for communication.

In at least one embodiment of this application, the method further includes:receiving, by the second terminal, an inquiry indication sent by the first network function; for example, the inquiry indication may be bit information, an NAS message (for example, a configuration update command or a PDU session modification message), and a new NAS message; andsending, by the second terminal, an authorization indication to the first network function; for example, the authorization indication may be: a success or failure indication (ACK/NACK), bit information, an NAS message (for example, a service request message or a PDU session modification message), or a new NAS message. In this embodiment, the first network function can send the key material of the first terminal only after receiving the authorization indication from the second terminal.

As an embodiment, before step401, the method further includesreceiving, by the third-party function, an initial verification message sent by the first terminal, where the initial verification message is used for the third-party function to verify and authorize the first terminal.

The initial verification message includes at least one of the following:an identifier of the first terminal, where the identifier can uniquely identify the first terminal;a default credential of the first terminal, where the default credential is the only credential that can be identified and can verify security before the first terminal accesses a bearer, anda network identifier of a local network of the first terminal, where the network identifier of the local network is a non-public network identifier different from that of a PLMN.

To sum up, in the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship; so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

In order to describe the method provided by the embodiment of this application more clearly, several examples are used for description below.

Example 1: the second terminal sends the first information, to indicate the first network function to generate the key material of the first terminal; as shown inFIG.5:

Step51: The second terminal sends the first information to the first network function.

Step52: The first network function determines the key material of the first terminal according to the first mapping relationship between the first terminal and the second terminal.

Step53: The first network function sends the key material of the first terminal to the first terminal.

Example 2: the second terminal sends the first information, to indicate the first network function to generate the key material of the first terminal; the first terminal and the second terminal establish direct connection communication, and the first terminal receives the key material of the first terminal through the direct connection communication. As shown inFIG.6, the following steps are included.

Step61: The second terminal sends the first information to the first network function.

Step62: The first network function determines the key material of the first terminal according to the first mapping relationship between the first terminal and the second terminal.

Step63: The first network function sends the key material of the first terminal to the second terminal.

Step64: The first terminal establishes direct connection communication with the second terminal.

Step65: The second terminal sends the key material of the first terminal to the first terminal through direct connection communication.

Example 3: the first terminal and the second terminal establish a direct connection communication, the first terminal sends the first identifier through the direct connection communication, and the second terminal sends the first information, to indicate the first network function to generate the key material of the first terminal; as shown inFIG.7:

Step71: The first terminal establishes direct connection communication with the second terminal.

Step72: The first terminal sends the first identifier to the second terminal through direct connection communication.

Step73: The second terminal sends the first information to the first network function according to the first identifier.

Step74: The first network function determines the key material of the first terminal according to the first mapping relationship between the first terminal and the second terminal.

Step75: The first network function sends the key material of the first terminal to the second terminal.

Step76: The second terminal sends the key material of the first terminal to the first terminal through direct connection communication.

Example 4: the application server (that is, the third-party function) sends the first information, to indicate the first network function to generate the key material of the first terminal; as shown inFIG.8:

Step81(in some embodiments): The first terminal sends an initial verification message to the application server, so that the application server implements verification and authorization of the first terminal.

Step82: The application server sends the first information to the first network function.

Step83(in some embodiments): The first network function performs authorization indication acknowledgment with the second terminal.

Step84: After receiving an authorization indication acknowledgment from the second terminal, the first network function determines the key material of the first terminal according to the first mapping relationship between the first terminal and the second terminal.

Step85: The first network function sends the key material of the first terminal to the application server.

Step86: The application server sends the key material of the first terminal to the first terminal.

Example 5, the first information is sent by the first terminal, and the first information includes the second identifier; as shown inFIG.9:

Step91: The first terminal sends the first information to the first network function; where the first information includes the second identifier.

Step92: The first network function assigns the first identifier to the first terminal.

Step93: The first network function sends the first identifier to the first terminal.

Step94: After the first network function determines that there is a first mapping relationship between the first terminal and the second terminal, determine a key material of the first terminal.

Step95: The first network function sends the key material of the first terminal to the first terminal.

It should be noted that there is no absolute sequence of step93, step94and step95. In some embodiments, step93and step95may be performed together or separately, which is not specifically limited herein.

Example 5: the first terminal sends the first information, to indicate the first network function to generate the key material of the first terminal; as shown inFIG.10:

Step101: The first terminal sends first information to the first network function, where the first information includes a first identifier and a second identifier.

Step102: After the first network function determines the first mapping relationship according to the first information and network configuration, determine a key material of the first terminal.

Step103: The first network function sends the key material of the first terminal to the first terminal.

Step104: The first network function starts a first timer, where the key material of the first terminal becomes invalid after the first timer expires.

Step105: After a valid time is exceeded, the first terminal sends first update indication information to the first network function, to indicate the first network function to update the key material of the first terminal.

It should be noted that, for the method provided in the embodiment of this application, the execution subject may be an apparatus, or a control module in the apparatus for executing the method. In the embodiment of this application, the apparatus executing the method is taken as an example to describe the apparatus provided in the embodiment of this application.

As shown inFIG.11, the embodiment of this application also provides a key material sending apparatus900, including:a first receiving module901, configured to receive first information, where the first information is used to determine a first mapping relationship between a first terminal and a second terminal; anda first execution module902, configured to send a key material of the first terminal according to the first mapping relationship.

The key material of the first terminal includes: security information required by the first terminal for communication.

In an embodiment, the first information includes at least one of the followinga first identifier; where the first identifier is a device identifier and/or a user identifier of the first terminal; anda second identifier, where the second identifier is a device identifier and/or a user identifier of the second terminal.

As an embodiment, if the first information does not include the first identifier, the apparatus further includes:an identifier sending module, configured to send the first identifier of the first terminal to the first terminal.

As an embodiment, the apparatus further includes at least one of the following:a first determining submodule, configured to determine, according to the first information, that there is a first mapping relationship between the first terminal and the second terminal; anda second determining submodule, configured to determine, according to a pre-stored mapping relationship and the first information, that there is a first mapping relationship between the first terminal and the second terminal.

As an embodiment, the first mapping relationship includes at least one of the following.an mapping relationship between a device identifier of the first terminal and a device identifier of the second terminal;an mapping relationship between a device identifier of the first terminal and a user identifier of the second terminal;an mapping relationship between a user identifier of the first terminal and a user identifier of the second terminal; andan mapping relationship between a user identifier of the first terminal and a device identifier of the second terminal.

As an embodiment, the first mapping relationship is obtained through at least one of the following:obtaining the first mapping relationship according to first information, where the first information indicates the first mapping relationship; andobtaining, by the first network function, the first mapping relationship according to configuration.

As an embodiment, the security information includes at least one of the following.a security key;a security parameter; andsigning credential information.

In an embodiment, the apparatus further includes:a derivation module, configured to derive the key material of the first terminal according to a key material of the second terminal;where the key material of the second terminal includes security information required by the second terminal for communication.

As an embodiment, the first receiving module includes at least one of the following:a first receiving submodule, configured to receive the first information sent by the first terminal;a second receiving submodule, configured to receive the first information sent by the second terminal;a third receiving submodule, configured to receive the first information sent by a third-party function;a fourth receiving submodule, configured to receive the first information through a network exposure function; anda fifth receiving submodule, configured to receive the first information through a non-access stratum message.

In an embodiment, the apparatus further includes:an inquiry sending module, configured to send an inquiry indication to the second terminal; andan authorization receiving module, configured to receive an authorization indication sent by the second terminal.

The first execution module includes:a material sending submodule, configured to send the key material of the first terminal according to the authorization indication.

As an embodiment, the first execution module includes any one of the following:a first sending submodule, configured to send the key material of the first terminal to the first terminal;a second sending submodule, configured to send the key material of the first terminal to a second terminal, and send the key material of the first terminal to the first terminal through the second terminal; anda third sending submodule, configured to send the key material of the first terminal to a third-party function, and send the key material of the first terminal to the first terminal through the third-party function.

As an embodiment, the apparatus further includes any one of the following:a timing processing module, configured to start a first timer, where a timing period of the first timer is a valid time of the security information of the first terminal; and after the valid time is exceeded, the security information of the first terminal becomes invalid.

As an embodiment, the key material further includes:a valid time, where the valid time is the valid time of the security information.

In an embodiment, the apparatus further includes:a material receiving module, configured to receive the key material of the first terminal from the second network function.

In the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship; so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

It should be noted that the key material sending apparatus provided in the embodiment of this application is an apparatus capable of executing the above key material sending method, and all the embodiments of the above key material sending method are applicable to this apparatus, and can achieve the same or similar effects.

As shown inFIG.12, the embodiment of this application also provides a key material obtaining apparatus1000, including:a second receiving module1001, configured to receive a key material of a first terminal determined by a first network function, where the key material of the first terminal includes: security information required by the first terminal for communication.

As an embodiment, the key material of the first terminal is obtained by deriving a key material of the second terminal;where the key material of the second terminal includes: security information required by the second terminal for communication.

As an embodiment, the security information includes at least one of the following.a security key;a security parameter; andsigning credential information.

In an embodiment, the apparatus further includesa verification sending module, configured to send an initial verification message to the third-party function, where the initial verification message is used for the third-party function to verify and authorize the first terminal.

As an embodiment, the initial verification message includes at least one of the following:an identifier of the first terminal;a default credential of the first terminal; anda network identifier of a local network of the first terminal.

As an embodiment, the second receiving module includes any one of the following:a sixth receiving submodule, configured to receive the key material of the first terminal sent by the first network function;a seventh receiving submodule, configured to receive the key material of the first terminal sent by the second terminal, where the key material of the first terminal is sent to the second terminal by the first network function; andan eighth receiving submodule, configured to receive the key material of the first terminal sent by a third-party function, where the key material of the first terminal is sent to the third-party function by the first network function.

As an embodiment, the key material of the second terminal includes: security information required by the second terminal for communication.

In an embodiment, the apparatus further includes:a first update module, configured to: after the valid time is exceeded, send first update indication information to the first network function, where the first update indication information is used to indicate the first network function to update the key material of the first terminal.

In the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship, so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

It should be noted that the key material obtaining apparatus provided in the embodiment of this application is an apparatus capable of executing the above key material obtaining method, and all the embodiments of the above key material obtaining method are applicable to this apparatus, and can achieve the same or similar effects.

As shown inFIG.13, the embodiment of this application further provides an information transmission apparatus1100, including:a first sending module1101, configured to send first information to a first network function, so that after receiving the first information, the first network function determines that there is a first mapping relationship between a first terminal and the second terminal and sends a key material of the first terminal.

The key material of the first terminal includes: security information required by the first terminal for communication.

In an embodiment, the first information includes at least one of the following.a first identifier; where the first identifier is a device identifier and/or a user identifier of the first terminal; anda second identifier; where the second identifier is a device identifier and/or a user identifier of the second terminal.

In an embodiment, the apparatus further includes:a third receiving module, configured to receive the key material of the first terminal determined by the first network function and sent by the first network function; anda second sending module, configured to send the key material of the first terminal to the first terminal.

As an embodiment, the key material of the first terminal is obtained by deriving a key material of the second terminal;where the key material of the second terminal includes: security information required by the second terminal for communication.

In an embodiment, the apparatus further includes:an inquiry receiving module, configured to receive an inquiry indication sent by the first network function; andan authorization sending module, configured to send an authorization indication to the first network function.

In an embodiment, the apparatus further includesa verification module, configured to receive an initial verification message sent by the first terminal, where the initial verification message is used for the third-party function to verify and authorize the first terminal.

As an embodiment, the initial verification message includes at least one of the following:an identifier of the first terminal;a default credential of the first terminal; anda network identifier of a local network of the first terminal.

In the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship; so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

It should be noted that the information transmission apparatus provided in the embodiment of this application is an apparatus capable of executing the above information transmission method, and all the embodiments of the above information transmission method are applicable to the apparatus, and can achieve the same or similar effects.

The sending apparatus, the obtaining apparatus or the information transmission apparatus in the embodiment of this application may be an apparatus, an apparatus with an operating system or an electronic device, or it may be a component, an integrated circuit, or a chip in a terminal. The apparatus or electronic device may be a mobile terminal, or a non-mobile terminal. Exemplarily, mobile terminals may include, but are not limited to, the types of terminals11listed above, and non-mobile terminals may be servers, network attached storage, Personal Computers (PCs), Televisions (TVs), teller machines or self-service machines, etc., which are not specifically limited in this embodiment of this application.

The sending apparatus, the obtaining apparatus or the information transmission apparatus according to embodiments of the present disclosure can implement the processes in the method embodiments inFIG.1toFIG.8, and achieve the same technical effect. To avoid duplication, details are not described herein again.

For example, as shown inFIG.14, an embodiment of this application further provides a communication device1200, including a processor1201, a memory1202, and a program or an instruction stored in the memory1202and executable on the processor1201. For example, when the communication device1200is a first network function, when the program or instruction is executed by the processor1201, each process of the embodiment of the foregoing key material sending method is performed, and the same technical effect can be achieved. When the communication device1200is the first terminal, when the program or instruction is executed by the processor1201, each process of the above embodiment of the key material obtaining method can be performed, and the same technical effect can be achieved. When the communication device1200is a second terminal or a third-party function, when the program or instruction is executed by the processor1201, each process of the above embodiment of the information transmission method can be achieved, and the same technical effect can be achieved. To avoid repetition, it is not repeated here repeat.

The embodiment of this application also provides a terminal, including a processor and a communication interface, such as a first terminal. The communication interface is configured to receive the key material of the first terminal determined by the first network function, where the key material of the first terminal includes: the security information required by the first terminal for communication. The communication interface is configured to send the first information to the first network function, so that after receiving the first information, the first network function determines that there is a first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal; where the key material of the first terminal includes: the security information required by the first terminal for communication. This terminal embodiment corresponds to the foregoing method embodiment on the terminal side. Each implementation process and implementation of the foregoing method embodiment may be applicable to this terminal embodiment, and a same technical effect can be achieved. For example,FIG.15is a schematic diagram of a hardware structure of a terminal according to an embodiment of this application.

A terminal1300includes but is not limited to at least a part of components such as a radio frequency unit1301, a network module1302, an audio output unit1303, an input unit1304, a sensor1305, a display unit1306, a user input unit1307, an interface unit1308, a memory1309, and a processor1310.

A person skilled in the art can understand that the terminal1300may further include a power supply (such as a battery) that supplies power to each component. The power supply may be logically connected to the processor1310by using a power supply management system, to implement functions such as charging and discharging management, and power consumption management by using the power supply management system. The terminal structure shown inFIG.15constitutes no limitation on the terminal, and the terminal may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements. Details are not described herein.

It should be understood that, in this embodiment of this application, the input unit1304may include a Graphics Processing Unit (GPU)13041and a microphone13042, and the graphics processing unit13041processes image data of a still picture or a video obtained by an image capture apparatus (such as a camera) in a video capture mode or an image capture mode. The display unit1306may include a display panel13061. In some embodiments, the display panel13061may be configured in a form such as a liquid crystal display or an organic light-emitting diode. The user input unit1307includes a touch panel13071and another input device13072. The touch panel13071is also referred to as a touchscreen. The touch panel13071may include two parts: a touch detection apparatus and a touch controller. The another input device13072may include but is not limited to a physical keyboard, a functional button (such as a volume control button or a power on/off button), a trackball, a mouse, and a joystick. Details are not described herein.

In this embodiment of this application, the radio frequency unit1301receives downlink data from a network side device and then sends the downlink data to the processor1310for processing; and sends uplink data to the network side device. Usually, the radio frequency unit1301includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like.

The memory1309may be configured to store a software program or an instruction and various data. The memory1309may mainly include a program or instruction storage area and a data storage area. The program or instruction storage area may store an operating system, and an application or an instruction required by at least one function (for example, a sound playing function or an image playing function). In addition, the memory1309may include a high-speed random access memory, and may further include a non-volatile memory. The non-volatile memory may be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory, for example, at least one disk storage device, a flash memory device, or another non-volatile solid-state storage device.

The processor1310may include one or more processing units. In some embodiments, an application processor and a modem processor may be integrated into the processor1310. The application processor mainly processes an operating system, a user interface, an application, an instruction, or the like. The modem processor mainly processes wireless communication, for example, a baseband processor. It can be understood that, in some alternative embodiments, the modem processor may not be integrated into the processor1310.

The radio frequency unit1301is configured to receive a key material of a first terminal determined by a first network function, where the key material of the first terminal includes: security information required by the first terminal for communication.

In some alternative embodiments, the radio frequency unit1301is configured to send first information to a first network function, so that after receiving the first information, the first network function determines that there is a first mapping relationship between a first terminal and the second terminal and sends a key material of the first terminal.

The key material of the first terminal includes: security information required by the first terminal for communication.

In the embodiment of this application, the first core network device receives the first information used to determine the first mapping relationship between the first terminal and the second terminal, and sends the key material of the first terminal according to the first mapping relationship; so that the first terminal can obtain the key material determined by the first core network device for it. Therefore, even if the function of the first terminal is limited, the security of the first terminal in the process of accessing the network can be guaranteed.

The embodiment of this application also provides a network side device, such as a first network function, including a processor and a communication interface. The communication interface is configured to receive the first information, where the first information is used to determine a first mapping relationship between the first terminal and the second terminal. The processor is further configured to send the key material of the first terminal through the communication interface according to the first mapping relationship; where the key material of the first terminal includes: security information required by the first terminal for communication. This network side device embodiment corresponds to the foregoing method embodiment on the network side device. Each implementation process and implementation of the foregoing method embodiment may be applicable to this network side device embodiment, and a same technical effect can be achieved.

For example, an embodiment of this application further provides a network side device. As shown inFIG.16, a network device1400includes an antenna141, a radio frequency apparatus142, and a baseband apparatus143. The antenna141is connected to the radio frequency apparatus142. In an uplink direction, the radio frequency apparatus142receives information by using the antenna141, and sends the received information to the baseband apparatus143for processing. In a downlink direction, the baseband apparatus143processes to-be-sent information, and sends the information to the radio frequency apparatus142. The radio frequency apparatus142processes the received information and then sends the information by using the antenna141.

The foregoing radio frequency apparatus may be located in the baseband apparatus143, and the method performed by the network side device in the foregoing embodiment may be implemented in the baseband apparatus143. The baseband apparatus143includes a processor144and a memory145.

The baseband apparatus143may include, for example, at least one baseband board, where a plurality of chips are disposed on the baseband board. As shown inFIG.16, one chip is, for example, the processor144, which is connected to the memory145, so as to invoke a program in the memory145to perform operations of the network device shown in the foregoing method embodiment.

The baseband device143may further include a network interface146for exchanging information with the radio frequency device142, and the interface is, for example, a Common Public Radio Interface (CPRI).

For example, the network side device in this embodiment of the present disclosure further includes an instruction or a program that is stored in the memory145and that can be run on the processor144. The processor144invokes the instruction or the program in the memory145to perform the method performed by the modules shown inFIG.16, and a same technical effect is achieved. To avoid repetition, details are not described herein again.

The embodiments of this application also provide a readable storage medium, the readable storage medium may be nonvolatile or volatile, and a program or instruction is stored on the readable storage medium, and when the program or instruction is executed by the processor, the processes of the above embodiment of the key material sending method or the embodiment of the key material obtaining method or the embodiment of the information transmission method, and the same technical effect can be achieved. To avoid repetition, details are not repeated herein.

The processor is a processor in the terminal in the foregoing embodiment. The readable storage medium includes a computer-readable storage medium such as an ROM, a Random Access Memory (RAM), a magnetic disk, an optical disc, or the like.

The embodiments of this application further provide a computer program product, the computer program product is stored in a non-transient storage medium, and the computer program product is executed by at least one processor to implement the processes of the above embodiment of the key material sending method or the embodiment of the key material obtaining method or the embodiment of the information transmission method, and the same technical effects can be achieved. To avoid repetition, details are not described herein again.

An embodiment of this application further provides a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is configured to run programs or instructions to implement the processes of the above embodiment of the key material sending method or the embodiment of the key material obtaining method or the embodiment of the information transmission method and the same technical effects can be achieved. To avoid repetition, details are not described herein again.

The embodiment of this application also provides a computer program product, the computer program product is stored in a non-volatile storage medium, and the program product is executed by at least one processor to implement the steps of the various methods described above.