Patent Description:
Single radio voice call continuity (single radio voice call continuity, SRVCC) is a solution for implementing voice service continuity in a long term evolution (long term evolution, LTE) network. To prevent a terminal that is performing a voice service from encountering voice service interruption after the terminal moves out of a coverage area of the LTE network, the SRVCC solution may be used for handing over the voice service from a packet switched (packet switched, PS) domain to a circuit switched (circuit switched, CS) domain, to ensure that the voice service is not interrupted.

In a next-generation communications network, for example, a 5th generation (5th Generation, <NUM>) network, to prevent a terminal that is performing a voice service from encountering voice service interruption after the terminal moves out of a coverage area of the <NUM> network, the SRVCC solution may also be used for handing over the voice service from a PS domain to a CS domain. In a voice service handover process, an access and mobility management function (access and mobility management function, AMF) node sends a handover request to an MME, and the MME further generates an encryption key and an integrity protection key. However, before the voice service handover process, the MME does not serve the terminal that needs to perform a voice service handover in the <NUM> network. Therefore, the MME does not have a non-access stratum security context of the terminal, that is, the MME does not have a downlink non-access stratum count used for generating an encryption key and an integrity protection key. Consequently, the MME cannot generate an encryption key or an integrity protection key, thereby failing to implement security protection for the voice service.

S3-<NUM> provides handover from 5GC to EPC for a connected mode SR UE over N26.

<CIT> discloses a method of handling handover security configuration and related communication device.

Embodiments of this application provide a key generation method, an apparatus, and a system, to resolve a problem that security protection for a voice service cannot be implemented in a process of handing over the voice service from a PS domain to a CS domain after a terminal that is performing the voice service moves out of a <NUM> network.

According to a first aspect, an embodiment of this application provides a key generation method. The method includes: receiving, by a mobility management entity MME, a redirection request message from an access and mobility management function AMF node, where the redirection request message includes key-related information; and generating, by the MME, an encryption key and an integrity protection key based on the key-related information. The redirection request message is used to request to hand over a voice service from a packet switched PS domain to a circuit switched CS domain. In the solution of this embodiment of this application, the AMF node adds the key-related information to the redirection request message sent to the MME, and the MME may further generate the encryption key and the integrity protection key based on the key-related information. Further, in a voice service handover process, the encryption key and the integrity protection key may be used to perform security protection for the voice service, thereby improving security.

In a possible design, the key-related information includes an anchor key. A method for generating, by the MME, the encryption key and the integrity protection key based on the key-related information includes: determining, by the MME, one part of the anchor key as the encryption key, and determining the other part of the anchor key as the integrity protection key. By using the method, the MME may directly determine the encryption key and the integrity protection key based on the anchor key. In this way, security protection for the voice service can be implemented without obtaining a downlink non-access stratum count, and the implementation is simple.

In an example, the anchor key includes <NUM> bits. The MME may determine the first <NUM> bits of the anchor key as the encryption key, and determine the last <NUM> bits of the anchor key as the integrity protection key; or determine the last <NUM> bits of the anchor key as the encryption key, and determine the first <NUM> bits of the anchor key as the integrity protection key.

In another possible design, the key-related information includes an anchor key and a downlink non-access stratum count. A method for generating, by the MME, the encryption key and the integrity protection key based on the key-related information includes: generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count. By using the method, the AMF node may send the downlink non-access stratum count to the MME, and the MME may further generate the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count, thereby implementing security protection for the voice service.

The MME may generate a new key (KASME1') based on the anchor key (KASME) and the downlink non-access stratum count, and further use a part of KASME1' as the encryption key, and use the other part of KASME1' as the integrity protection key.

Optionally, the MME first performs an operation on the downlink non-access stratum count to obtain an input parameter, generates a new key (KASME2') by using the input parameter and the anchor key, and further uses a part of KASME2' as the encryption key, and uses the other part of KASME2' as the integrity protection key.

In a possible design, the MME may send first instruction information to the AMF node. The first instruction information is used to instruct a terminal to generate an encryption key and an integrity protection key based on the downlink non-access stratum count.

In another possible design, the key-related information includes an anchor key and a preset value, or the key-related information includes an anchor key and a random number. A method for generating, by the MME, the encryption key and the integrity protection key based on the key-related information includes: generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the preset value; or generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the random number. By using the method, the MME may generate the encryption key and the integrity protection key based on the anchor key and the preset value or the random number that is generated by the AMF node, thereby implementing security protection for the voice service. Because the MME receives no downlink non-access stratum count, even if the MME is cracked by an attacker, a root key of the AMF node cannot be reversely deduced based on the anchor key, thereby ensuring security of the AMF node.

The MME may use the preset value or the random number as an input parameter for generating a new key. Optionally, the MME generates a new key (KASME') based on the anchor key and the preset value (or based on the anchor key and the random number), and further uses a part of KASME' as the encryption key, and uses the other part of KASME' as the integrity protection key.

In still another possible design, the key-related information includes an anchor key. A method for generating, by the MME, the encryption key and the integrity protection key based on the key-related information includes: generating, by the MME, the encryption key and the integrity protection key based on the anchor key and a preset value; or generating, by the MME, the encryption key and the integrity protection key based on the anchor key and a random number.

In a possible design, the MME may send second instruction information to the AMF node. The second instruction information includes the preset value or the random number. The second instruction information is used to instruct a terminal to generate an encryption key and an integrity protection key based on the preset value or the random number. By using the method, the MME may generate the encryption key and the integrity protection key based on the anchor key and the preset value or the random number that is generated by the MME, thereby implementing security protection for the voice service. Because the MME receives no downlink non-access stratum count, even if the MME is cracked by an attacker, a root key of the AMF node cannot be reversely deduced based on the anchor key, thereby ensuring security of the AMF node.

According to a second aspect, an embodiment of this application provides a key generation method. The method includes: determining, by an access and mobility management function AMF node, key-related information, where the key-related information is used for generating an encryption key and an integrity protection key; and sending, by the AMF node, a redirection request message to a mobility management entity MME, where the redirection request message includes the key-related information, and the redirection request message is used to request to hand over a voice service from a packet switched PS domain to a circuit switched CS domain. By using the method, the AMF node adds the key-related information to the redirection request message sent to the MME. This avoids a case in which the MME cannot generate an encryption key or an integrity protection key due to a lack of a necessary parameter, thereby improving security.

In a possible design, the key-related information includes an anchor key and a downlink non-access stratum count. The AMF node may send first instruction information to a terminal. The first instruction information is used to instruct the terminal to generate an encryption key and an integrity protection key based on the downlink non-access stratum count.

In a possible implementation, before the AMF node sends the first instruction information to the terminal, the AMF node may generate the first instruction information, or the AMF node receives the first instruction information from the MME.

In another possible design, the key-related information includes an anchor key. The AMF node may receive second instruction information from the MME, where the second instruction information includes a preset value or a random number, and the second instruction information is used to instruct a terminal to generate an encryption key and an integrity protection key based on the preset value or the random number; and then the AMF node sends the second instruction information to the terminal.

In still another possible design, the key-related information includes an anchor key and a preset value, or the key-related information includes an anchor key and a random number. The AMF node may send third instruction information to a terminal. The third instruction information includes the preset value or the random number. The third instruction information is used to instruct the terminal to generate an encryption key and an integrity protection key based on the preset value or the random number.

According to a third aspect, an embodiment of this application provides a key generation method. The method includes: receiving, by a terminal, a downlink non-access stratum count; generating, by the terminal, an anchor key based on a root key of an access and mobility management function AMF node and the downlink non-access stratum count; and determining, by the terminal, one part of the anchor key as an encryption key, and determining the other part of the anchor key as an integrity protection key. The terminal may negotiate with an MME in advance on a method for generating the encryption key and the integrity protection key. In this case, by using the method, the terminal may generate a same encryption key and integrity protection key as the MME, so that the terminal may decrypt data received from a network side, thereby implementing security protection for a voice service.

According to a fourth aspect, an embodiment of this application provides a key generation method. The method includes: receiving, by a terminal, a downlink non-access stratum count and first instruction information, where the first instruction information is used to instruct the terminal to generate an encryption key and an integrity protection key based on the downlink non-access stratum count; generating, by the terminal, an anchor key based on a root key of an access and mobility management function AMF node and the downlink non-access stratum count; and generating, by the terminal, the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count. By using the method, the terminal may determine, based on the first instruction information, a method for generating the encryption key and the integrity protection key. Further, the terminal may generate a same encryption key and integrity protection key as an MME based on the first instruction information, so that the terminal may decrypt data received from a network side, thereby implementing security protection for a voice service.

According to a fifth aspect, an embodiment of this application provides a key generation method. The method includes: receiving, by a terminal, a downlink non-access stratum count and second instruction information, where the second instruction information includes a preset value or a random number, and the second instruction information is used to instruct the terminal to generate an encryption key and an integrity protection key based on the preset value or the random number; generating, by the terminal, an anchor key based on a root key of an access and mobility management function AMF node and the downlink non-access stratum count; and generating, by the terminal, the encryption key and the integrity protection key based on the anchor key and the preset value; or generating, by the terminal, the encryption key and the integrity protection key based on the anchor key and the random number. By using the method, the terminal may determine, based on the second instruction information, a method for generating the encryption key and the integrity protection key. Further, the terminal may generate a same encryption key and integrity protection key as an MME based on the second instruction information, so that the terminal may decrypt data received from a network side, thereby implementing security protection for a voice service.

According to a sixth aspect, an embodiment of this application provides a key generation method. The method includes: generating, by an AMF node, an encryption key and an integrity protection key based on key-related information; and sending, by the AMF node, a redirection request message to an MME, where the redirection request message includes the encryption key and the integrity protection key, and the redirection request message is used to request to hand over a voice service from a packet switched PS domain to a circuit switched CS domain. Compared with the prior art in which an MME cannot generate an encryption key or an integrity protection key due to a lack of a necessary parameter, in this embodiment of this application, by using the method, the AMF node may generate the encryption key and the integrity protection key, and further send the encryption key and the integrity protection key to the MME. The MME does not need to generate an encryption key or an integrity protection key, but may directly use the received encryption key and integrity protection key, thereby implementing security protection for the voice service.

In a possible design, the key-related information includes an anchor key. A method for generating, by the AMF node, the encryption key and the integrity protection key based on the key-related information includes: generating, by the AMF node, the anchor key based on a root key of the AMF node and a downlink non-access stratum count; and determining, by the AMF node, one part of the anchor key as the encryption key, and determining the other part of the anchor key as the integrity protection key.

In another possible design, the key-related information includes an anchor key and a downlink non-access stratum count. A method for generating, by the AMF node, the encryption key and the integrity protection key based on the key-related information includes: generating, by the AMF node, the anchor key based on a root key of the AMF node and the downlink non-access stratum count; and generating, by the AMF node, the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count.

In a possible design, the AMF node may send first instruction information to a terminal. The first instruction information is used to instruct the terminal to generate an encryption key and an integrity protection key based on the downlink non-access stratum count.

In another possible design, the key-related information includes an anchor key and a preset value, or the key-related information includes an anchor key and a random number. A method for generating, by the AMF node, the encryption key and the integrity protection key based on the key-related information includes: generating, by the AMF node, the anchor key based on a root key of the AMF node and a downlink non-access stratum count; and generating, by the AMF node, the encryption key and the integrity protection key based on the anchor key and the preset value; or generating, by the AMF node, the encryption key and the integrity protection key based on the anchor key and the random number.

In a possible design, the AMF node may send third instruction information to a terminal. The third instruction information includes a preset value or a random number. The third instruction information is used to instruct the terminal to generate an encryption key and an integrity protection key based on the preset value or the random number.

According to a seventh aspect, an embodiment of this application provides an apparatus. The apparatus has functions of implementing behavior of the MME in the foregoing method design. The functions may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or the software includes one or more modules corresponding to the foregoing functions. For example, the apparatus may be an MME, or may be a chip in an MME.

In a possible design, the apparatus is an MME. The MME includes a processor. The processor is configured to support the MME in performing a corresponding function in the foregoing method. Further, the MME may further include a communications interface. The communications interface is configured to support the MME in communicating with an MSC server or an AMF node. Further, the MME may further include a memory. The memory is coupled with the processor. The memory stores a program instruction and data required by the MME.

According to an eighth aspect, an embodiment of this application provides an apparatus. The apparatus has functions of implementing behavior of the AMF node in the foregoing method designs. The functions may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or the software includes one or more modules corresponding to the foregoing functions. For example, the apparatus may be the AMF node, or may be a chip in the AMF node.

In a possible design, the apparatus is an AMF node. The AMF node includes a processor. The processor is configured to support the AMF node in performing a corresponding function in the foregoing method. Further, the AMF node may include a communications interface. The communications interface is configured to support communication between the AMF node and an MME or a gNB. Further, the AMF node may include a memory. The memory is configured to couple to the processor, and store a program instruction and data that are necessary for the AMF node.

According to a ninth aspect, an embodiment of this application provides an apparatus. The apparatus has functions of implementing behavior of the terminal in the foregoing method design. The functions may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or the software includes one or more modules corresponding to the foregoing functions. For example, the apparatus may be a terminal, or may be a chip in a terminal.

In a possible design, the apparatus is a terminal, and the terminal includes a processor. The processor is configured to support the terminal in performing the corresponding function in the foregoing method. Further, the terminal may further include a transmitter and a receiver. The transmitter and the receiver are configured to support communication between the terminal and the gNB. Further, the terminal may further include a memory. The memory is configured to couple to the processor, and the memory stores a program instruction and data that are necessary to the terminal.

According to a tenth aspect, an embodiment of this application provides a communications system. The system includes the AMF node, the MME, and the terminal in the foregoing aspects; or the system may include a gNB, an MSC server, and the AMF node, the MME, and the terminal in the foregoing aspects.

According to an eleventh aspect, an embodiment of this application provides a computer storage medium. The computer storage medium is configured to store a computer software instruction used by the foregoing MME. The computer software instruction includes a program designed to perform the first aspect.

According to a twelfth aspect, an embodiment of this application provides a computer storage medium. The computer storage medium is configured to store a computer software instruction used by the foregoing MME. The computer software instruction includes a program designed to perform the second aspect or the sixth aspect.

According to a thirteenth aspect, an embodiment of this application provides a computer storage medium, configured to store a computer software instruction used by the foregoing terminal. The computer software instruction includes a program designed to perform the third aspect, the fourth aspect, or the fifth aspect.

According to a fourteenth aspect, an embodiment of this application provides a computer program product including an instruction. When the computer program product runs on a computer, the computer is enabled to perform the method according to the first aspect.

According to a fifteenth aspect, an embodiment of this application provides a computer program product including an instruction. When the computer program product runs on a computer, the computer is enabled to perform the method according to the second aspect or the sixth aspect.

According to a sixteenth aspect, an embodiment of this application provides a computer program product including an instruction. When the computer program product runs on a computer, the computer is enabled to perform the method according to the third aspect, the fourth aspect, or the fifth aspect.

According to a seventeenth aspect, an embodiment of this application provides a chip system, applied to an MME. The chip system includes at least one processor, a memory, and a transceiver circuit. The memory, the transceiver circuit, and the at least one processor are connected to each other by using a line. The at least one memory stores an instruction. The instruction is executed by the processor, to perform the operations of the MME in the method according to the first aspect.

According to an eighteenth aspect, an embodiment of this application provides a chip system, applied to an AMF node. The chip system includes at least one processor, a memory, and a transceiver circuit. The memory, the transceiver circuit, and the at least one processor are connected to each other by using a line. The at least one memory stores an instruction. The instruction is executed by the processor, to perform the operations of the AMF node in the method according to the second aspect or the sixth aspect.

According to a nineteenth aspect, an embodiment of this application provides a chip system, applied to a terminal. The chip system includes at least one processor, a memory, and a transceiver. The memory, the transceiver, and the at least one processor are connected to each other by using a line. The at least one memory stores an instruction. The instruction is executed by the processor, to perform the operations of the terminal according to the third aspect, the fourth aspect, or the fifth aspect.

Compared with the prior art in which security protection for a voice service cannot be implemented because an MME cannot generate an encryption key or an integrity protection key due to a lack of a parameter for generating a user-plane encryption key and integrity protection key, the AMF node adds the key-related information to the redirection request message sent to the MME, and the MME may further generate the encryption key and the integrity protection key based on the key-related information. Further, in the voice service handover process, the encryption key and the integrity protection key may be used to perform security protection for the voice service, thereby improving security.

The following further describes in detail this application with reference to the accompanying drawings. A specific operation method in a method embodiment may also be applied to an apparatus embodiment or a system embodiment. In the description of this application, unless otherwise stated, "multiple" means two or more than two.

A system architecture and a service scenario that are described in this application are intended to describe the technical solutions of this application more clearly, but constitute no limitation on the technical solutions provided in this application. A person of ordinary skill in the art may know that, with evolution of the system architecture and emergence of new service scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

<FIG> is a schematic diagram of a possible network architecture according to this application. The network architecture includes an AMF node and a radio access network node (for example, a next generation base station node (gNB)) in a <NUM> communications system, an MME and a radio access network node (for example, an evolved NodeB (evolved NodeB, eNB)) in a 4th generation (4th generation, <NUM>) communications system, a mobile switching center (mobile switching center, MSC) server and a radio access network node (for example, an access network node of a universal mobile telecommunications system terrestrial radio access network (UMTS terrestrial radio access network, UTRAN) or an access network node of a GSM/EDGE radio access network (GSM/EDGE radio access network, GERAN)) in a 2nd generation (2nd generation, <NUM>) or 3rd generation (3rd generation, <NUM>) communications system, and a terminal supporting <NUM> communication, <NUM> communication, <NUM> communication, and <NUM> communication.

It should be noted that a quantity of devices shown in <FIG> is not limited in this application. For example, <FIG> shows three terminals that wirelessly communicate with a radio access network node in a <NUM> or <NUM> communications system, an eNB in an LTE communications system, and a gNB in a <NUM> communications system respectively. Certainly, this application is not limited thereto. An access network may be determined for each terminal based on a network coverage status.

The terminal mentioned in this application is a device with a wireless sending/receiving function; and may be deployed on land, including an indoor, outdoor, handheld, or in-vehicle scenario, or may be deployed on water (for example, on a steamship), or may be deployed in the air (for example, on an airplane, a balloon, or a satellite). The terminal may include various types of devices, for example, user equipment (user equipment, UE), a mobile phone (mobile phone), a tablet computer (pad), a computer with a wireless sending/receiving function, a virtual reality (virtual reality, VR) terminal device, an augmented reality (augmented reality, AR) terminal device, a machine type communication (machine type communication, MTC) terminal device, a terminal device in industrial control (industrial control), a terminal device with a voice call function in remote medical (remote medical), a terminal device with a voice call function in transportation safety (transportation safety), a terminal device with a voice call function in a smart city (smart city), and a wearable device (for example, a smart watch with a voice call function, and a smart band with a voice call function). For example, the terminal mentioned in the embodiments of this application may be a device with a wireless sending/receiving function and a voice call function.

The AMF node is a network element responsible for mobility management in the <NUM> communications system, and may be configured to implement functions, for example, lawful interception and access authorization, of MME functions other than session management. The AMF node in the embodiments of this application may be an AMF node with a security anchor function (security anchor function, SEAF), or may be a node without a SEAF function. A SEAF node may be disposed independently.

The MME is a network element responsible for mobility management in the <NUM> communications system, and is further configured to implement functions such as bearer management, user authentication, and selection of a serving gateway (serving gateway, SGW) and a packet data network gateway (packet data network gateway, PGW).

The MSC server has a call control and processing function. The MSC server in the embodiments of this application is an enhanced MSC server supporting SRVCC.

The radio access network nodes in <NUM>, <NUM>, <NUM>, and <NUM> each are a node that can provide a wireless communication function for a terminal.

The embodiments of this application are applied to an SRVCC scenario in <NUM>. Based on the schematic diagram of the network architecture shown in <FIG>, in a process of performing a voice service by a terminal in the <NUM> communications system, if the terminal moves out of a coverage area of a <NUM> network, the voice service of the terminal may be handed over from a PS domain to a CS domain, to ensure that the voice service of the terminal is not interrupted. However, there is no direct communications interface between the <NUM> communications system and the <NUM> or <NUM> communications system. Therefore, the voice service needs to be handed over from the <NUM> communications system to the <NUM> communications system, and then handed over from the <NUM> communications system to the <NUM> or <NUM> communications system.

In the prior art, in a process of performing a voice service by a terminal in the <NUM> communications system, if the terminal moves out of a coverage area of a <NUM> network, the voice service of the terminal may be handed over from a PS domain to a CS domain, to ensure that the voice service of the terminal is not interrupted. In a handover process, the MME may generate an encryption key and an integrity protection key based on a downlink non-access stratum count (downlink non-access stratum count, DL NAS count) maintained by the MME, and send the encryption key and the integrity protection key to the MSC server. Likewise, the terminal may generate an encryption key and an integrity protection key based on the same downlink non-access stratum count.

In a process of handing over a terminal from the <NUM> network to the <NUM> network and then to a <NUM> or <NUM> network, the AMF node in the <NUM> communications system may send a redirection request message to the MME in the <NUM> communications system, and the MME further generates an encryption key and an integrity protection key, and sends the generated encryption key and integrity protection key to the MSC server. However, in a voice service handover process, the AMF hands over a voice service of the terminal from the <NUM> network to the <NUM> or <NUM> network through the MME, and the terminal performing the voice service does not communicate with the MME before the handover process. Therefore, the MME does not store a same downlink non-access stratum count as the terminal does, that is, the MME lacks a necessary parameter for generating an encryption key and an integrity key. Consequently, the MME cannot generate an encryption key or an integrity protection key, thereby failing to perform security protection for the voice service.

To resolve the foregoing problem, a solution provided in an embodiment of this application includes: sending, by an AMF node, a redirection request message to an MME, where the redirection request message includes key-related information; and generating, by the MME, an encryption key and an integrity protection key based on the key-related information. By using the solution, the AMF node sends, to the MME in a handover request, the key-related information used for generating the encryption key and the integrity protection key, and the MME may further generate the encryption key and the integrity protection key. This resolves a prior-art problem that security protection for a voice service cannot be performed because an MME cannot generate an encryption key or an integrity protection key.

The following describes in detail the technical solutions provided in this application.

<FIG> shows a key generation method provided in an embodiment of this application. The method includes step <NUM> to step <NUM>.

Step <NUM>. An AMF node determines key-related information.

The key-related information is information used for generating an encryption key and an integrity protection key.

The key-related information includes an anchor key. For example, the AMF node may generate the anchor key based on a root key of the AMF node and a downlink non-access stratum count.

In an example, the key-related information includes an anchor key and a downlink non-access stratum count.

It should be noted that the downlink non-access stratum count is the same as a downlink non-access stratum count used by the AMF node to generate the anchor key.

In another example, the key-related information includes an anchor key and a preset value, or the key-related information includes an anchor key and a random number.

The preset value may be a fixed value, or may not be a fixed value. For example, the preset value may be increased by <NUM> each time the AMF node sends a handover request to an MME. The random number included in the key-related information is a random number generated by the AMF node.

Step <NUM>. The AMF node sends a redirection request message to the MME, where the redirection request message includes the key-related information. Correspondingly, the MME receives the key-related information.

The redirection request message is used to request to hand over a voice service from a PS domain to a CS domain. Optionally, the redirection request message further includes SRVCC instruction information. The SRVCC instruction information is used to instruct the MME to request, by sending a handover request message, to hand over the voice service from the PS domain to the CS domain.

Step <NUM>. The MME generates an encryption key and an integrity protection key based on the key-related information.

Compared with the prior art in which security protection for a voice service cannot be implemented because an MME cannot generate an encryption key or an integrity protection key due to a lack of a parameter for generating a user-plane encryption key and integrity protection key, in the key generation method provided in this embodiment of this application, the AMF node adds the key-related information to the redirection request message sent to the MME, and the MME may further generate the encryption key and the integrity protection key based on the key-related information. Further, in a voice service handover process, the encryption key and the integrity protection key may be used to perform security protection for the voice service, thereby improving security.

It can be understood that there are a plurality of possibilities for content included in the key-related information determined by the AMF node in step <NUM>. For each possibility, a method for generating, by the MME node, the encryption key and the integrity protection key based on the key-related information in step <NUM> also varies. With reference to four implementations provided in this embodiment of this application, the following describes four methods for generating, by the MME node, the encryption key and the integrity protection key based on the key-related information.

In a first possible implementation, the key-related information includes an anchor key. As shown in <FIG>, the method includes step <NUM> to step <NUM>.

For steps <NUM> to <NUM>, refer to related descriptions in steps <NUM> to <NUM>. Certainly, this application is not limited thereto. The key-related information in step <NUM> and step <NUM> includes an anchor key.

Step <NUM>. The MME determines one part of the anchor key as an encryption key, and determines the other part of the anchor key as an integrity protection key.

For example, the anchor key may include <NUM> bits. The MME may determine the first <NUM> bits of the anchor key as the encryption key, and determine the last <NUM> bits of the anchor key as the integrity protection key; or the MME determines the first <NUM> bits of the anchor key as the integrity protection key, and determines the last <NUM> bits of the anchor key as the encryption key. This is not limited in this embodiment of this application.

After the MME generates the encryption key and the integrity protection key, a terminal also needs to generate an encryption key and an integrity protection key. The encryption key and the integrity protection key generated by the terminal are the same as the encryption key and the integrity protection key generated by the MME. Based on this, after step <NUM>, step <NUM> to step <NUM> may be performed.

Step <NUM>. The MME sends a handover response message to the AMF node. Correspondingly, the AMF node receives the handover request message.

After generating the encryption key and the integrity protection key, the MME may send a handover request message to an MSC server based on SVRRC instruction information, and send the handover response message to the AMF node after receiving a handover response message from the MSC server, to trigger the AMF node to perform step <NUM>.

Step <NUM>. The AMF node sends a downlink non-access stratum count to the terminal.

Optionally, the AMF node may add the downlink non-access stratum count to a handover command. The AMF node sends the handover command to a gNB, and the gNB further forwards the handover command to the terminal.

It should be noted that the downlink non-access stratum count sent by the AMF node to the terminal in this embodiment of this application may be a complete downlink non-access stratum count; or to reduce overheads, the AMF node may send four least significant bits of a downlink non-access stratum count to the terminal, and the terminal may restore a complete downlink non-access stratum count after receiving the downlink non-access stratum count.

The downlink non-access stratum count is a <NUM>-bit value. Sixteen most significant bits are overflow bits, and eight least significant bits are a sequence number. For example, the complete downlink non-access stratum count sent by the AMF node may be <NUM><NUM><NUM>. Alternatively, the AMF node sends only <NUM>, and the terminal may restore the complete downlink non-access stratum count <NUM><NUM><NUM> after receiving the downlink non-access stratum count <NUM>.

Step <NUM>. The terminal receives the downlink non-access stratum count.

Step <NUM>. The terminal generates an anchor key based on a root key of the AMF node and the downlink non-access stratum count.

Step <NUM>. The terminal determines one part of the anchor key as the encryption key, and determines the other part of the anchor key as the integrity protection key.

For example, the terminal may determine the first <NUM> bits of the anchor key as the encryption key, and determine the last <NUM> bits of the anchor key as the integrity protection key; or may determine the last <NUM> bits of the anchor key as the encryption key, and determine the first <NUM> bits of the anchor key as the integrity protection key. This is not limited in this application.

It should be noted that the terminal and the MME need to negotiate in advance on how to determine the encryption key and the integrity protection key based on the anchor key, to ensure that the encryption key and the integrity protection key determined by the terminal are the same as those determined by the MME.

By using the method, the MME may directly determine the encryption key and the integrity protection key based on the anchor key. In this way, security protection for the voice service can be implemented without obtaining a downlink non-access stratum count, and the implementation is simple.

In a second possible implementation, the key-related information includes an anchor key and a downlink non-access stratum count. As shown in <FIG>, the method includes step <NUM> to step <NUM>.

For steps <NUM> to <NUM>, refer to related descriptions in steps <NUM> to <NUM>. Certainly, this application is not limited thereto. The key-related information in step <NUM> and step <NUM> includes an anchor key and a downlink non-access stratum count.

Step <NUM>. The MME generates an encryption key and an integrity protection key based on the anchor key and the downlink non-access stratum count.

Optionally, the MME may generate a new key (KASME') based on the anchor key (KASME) and the downlink non-access stratum count, and further use a part of KASME1' as the encryption key, and use the other part of KASME1' as the integrity protection key. For example, KASME1' may include <NUM> bits. The first <NUM> bits of KASME1' may be used as the encryption key, and the last <NUM> bits of KASME1' may be used as the integrity protection key. This is not limited in this application.

Optionally, the MME does not directly use the received downlink non-access stratum count to generate the encryption key and the integrity protection key, but first performs an operation on the downlink non-access stratum count to obtain an input parameter, generates a new key (KASME2') by using the input parameter and the anchor key, and further uses a part of KASME2' as the encryption key, and uses the other part of KASME2' as the integrity protection key. For example, KASME2' may include <NUM> bits. The first <NUM> bits of KASME2' may be used as the encryption key, and the last <NUM> bits of KASME2' may be used as the integrity protection key.

Step <NUM>. The MME sends first instruction information to the AMF node, where the first instruction information is used to instruct a terminal to generate an encryption key and an integrity protection key based on the downlink non-access stratum count. Correspondingly, the AMF node receives the first instruction information.

It should be noted that if the MME does not directly use the downlink non-access stratum count to generate the encryption key and the integrity protection key, but first performs the operation on the downlink non-access stratum count to obtain the input parameter, and further generates the encryption key and the integrity protection key based on the input parameter and the anchor key. In this case, the first instruction information sent by the MME may indicate a manner of obtaining, by the terminal, an input parameter based on the downlink non-access stratum count; and further, the encryption key and the integrity protection key are generated based on the input parameter and an anchor key.

Step <NUM>. The AMF node sends first instruction information and the downlink non-access stratum count to the terminal.

Optionally, the first instruction information sent by the AMF node to the terminal may be first instruction information generated by the AMF node, or may be the first instruction information received from the MME. Step <NUM> does not need to be performed when the first instruction information is the first instruction information generated by the AMF node.

The AMF node may add the first instruction information to a handover command. Optionally, the handover command further includes the downlink non-access stratum count. The AMF node sends the handover command to a gNB, and the gNB further sends the handover command to the terminal.

Step <NUM>. The terminal receives the downlink non-access stratum count and the first instruction information.

Step <NUM>. The terminal generates the anchor key based on a root key of the AMF node and the downlink non-access stratum count.

Step <NUM>. The terminal generates the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count.

A method for generating, by the terminal, the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count is the same as the method for generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count in step <NUM>. The terminal may generate a new key (KASME1') based on the anchor key (KASME) and the downlink non-access stratum count, and further use a part of KASME1' as the encryption key, and use the other part of KASME1' as the integrity protection key. Alternatively, the terminal performs an operation on the downlink non-access stratum count based on the first instruction information to obtain an input parameter, generates a new key (KASME2') by using the input parameter and the anchor key, and further uses a part of KASME2' as the encryption key, and uses the other part of KASME2' as the integrity protection key.

Compared with the prior art in which an MME cannot generate an encryption key or an integrity protection key due to a lack of a downlink non-access stratum count, in this embodiment of this application, by using the method, the AMF node may send the downlink non-access stratum count to the MME, and the MME may further generate the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count, thereby implementing security protection for the voice service.

In a third possible implementation, the key-related information includes an anchor key and a preset value, or the key-related information includes an anchor key and a random number. As shown in <FIG>, the method includes step <NUM> to step <NUM>.

For step <NUM> and step <NUM>, refer to related descriptions in step <NUM> and step <NUM>. Certainly, this application is not limited thereto. The key-related information in step <NUM> and step <NUM> includes an anchor key and a preset value, or includes an anchor key and a random number. The preset value or the random number in the key-related information is generated by the AMF node.

Step <NUM>. The MME generates the encryption key and the integrity protection key based on the anchor key and the preset value, or the MME generates the encryption key and the integrity protection key based on the anchor key and the random number.

The MME may use the preset value or the random number as an input parameter for generating a new key. Optionally, the MME generates a new key (KASME<NUM>) based on the anchor key and the preset value (or based on the anchor key and the random number), and further uses a part of KASME' as the encryption key, and uses the other part of KASME' as the integrity protection key. For example, KASME' may include <NUM> bits. The first <NUM> bits of KASME' may be used as the encryption key, and the last <NUM> bits of KASME' may be used as the integrity protection key; or the last <NUM> bits of KASME' may be used as the encryption key, and the first <NUM> bits of KASME' may be used as the integrity protection key. This is not limited in this embodiment of this application.

Step <NUM>. The MME sends a handover response message to the AMF node. Correspondingly, the AMF node receives the handover response message.

Step <NUM>. The AMF node sends third instruction information and a downlink non-access stratum count to a terminal.

The third instruction information includes the preset value or the random number. The third instruction information is used to instruct the terminal to generate an encryption key and an integrity protection key based on the preset value or the random number.

Optionally, the AMF node adds the third instruction information to a handover command sent to the terminal. The handover command may further carry the downlink non-access stratum count. Specifically, the AMF node sends the handover command to a gNB, and the gNB further forwards the handover command to the terminal.

Step <NUM>. The terminal receives the downlink non-access stratum count and the third instruction information.

Step <NUM>. The terminal generates the encryption key and the integrity protection key based on the anchor key and the preset value, or the terminal generates the encryption key and the integrity protection key based on the anchor key and the random number.

If the MME generates the encryption key and the integrity protection key based on the anchor key and the preset value in step <NUM>, the third instruction information includes the preset value. Correspondingly, the terminal generates the encryption key and the integrity protection key based on the anchor key and the preset value. A method for generating, by the terminal, the encryption key and the integrity protection key based on the anchor key and the preset value is the same as the method for generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the preset value in step <NUM>.

If the MME generates the encryption key and the integrity protection key based on the anchor key and the random number in step <NUM>, the third instruction information includes the random number. Correspondingly, the terminal generates the encryption key and the integrity protection key based on the anchor key and the random number. A method for generating, by the terminal, the encryption key and the integrity protection key based on the anchor key and the random number is the same as the method for generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the random number in step <NUM>.

By using the method, the MME may generate the encryption key and the integrity protection key based on the anchor key and the preset value or the random number that is generated by the AMF node, thereby implementing security protection for the voice service. Because the MME receives no downlink non-access stratum count, even if the MME is cracked by an attacker, the root key of the AMF node cannot be reversely deduced based on the anchor key, thereby ensuring security of the AMF node.

In a fourth possible implementation, the key-related information includes an anchor key. A difference between the third implementation and the fourth implementation is as follows: In the third implementation, the preset value or the random number used by the MME and the terminal to generate the encryption key and the integrity protection key is generated by the AMF node; while in the fourth implementation, a preset value or a random number used by an MME and a terminal to generate an encryption key and an integrity protection key is generated by the MME. As shown in <FIG>, the method includes step <NUM> to step <NUM>.

For step <NUM> and step <NUM>, refer to related descriptions in step <NUM> and step <NUM>. Certainly, this application is not limited thereto. The key-related information in step <NUM> and step <NUM> includes an anchor key.

Step <NUM>. The MME generates the encryption key and the integrity protection key based on the anchor key and a preset value, or the MME generates the encryption key and the integrity protection key based on the anchor key and a random number.

The preset value or the random number in step <NUM> is generated by the MME. It should be noted that a specific value of the preset value or the random number generated by the MME in the embodiment corresponding to <FIG> may be the same as or different from that of the preset value or the random number generated by the AMF node in the embodiment corresponding to <FIG>. This is not limited in this application.

For a method for generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the preset value (or based on the anchor key and the random number) in step <NUM>, refer to related descriptions in step <NUM>.

Step <NUM>. The MME sends second instruction information to the AMF node. Correspondingly, the AMF node receives the second instruction information.

The second instruction information includes the preset value or the random number. The second instruction information is used to instruct a terminal to generate an encryption key and an integrity protection key based on the preset value or the random number. The preset value in the second instruction information is a preset value in the MME. The random number in the second instruction information is a random number generated by the MME.

Step <NUM>. The AMF node sends second instruction information and a downlink non-access stratum count to the terminal.

Optionally, the AMF node may add the second instruction information to a handover command sent to the terminal. The second instruction information may further include the downlink non-access stratum count. Specifically, the AMF node sends the handover command to a gNB, and the gNB forwards the handover command to the terminal.

Step <NUM>. The terminal receives the downlink non-access stratum count and the second instruction information.

For a method for generating, by the terminal, the encryption key and the integrity protection key based on the anchor key and the preset value in step <NUM>, refer to related descriptions in step <NUM>.

By using the method, the MME may generate the encryption key and the integrity protection key based on the anchor key and the preset value or the random number that is generated by the MME, thereby implementing security protection for the voice service. Because the MME receives no downlink non-access stratum count, even if the MME is cracked by an attacker, the root key of the AMF node cannot be reversely deduced based on the anchor key, thereby ensuring security of the AMF node.

As shown in <FIG>, a key generation method provided in an embodiment of this application is described in <FIG> with reference to a specific scenario in which a voice service is handed over from a PS domain to a CS domain. The method includes step <NUM> to step <NUM>.

Step <NUM>. A gNB sends a handover request (handover required) message to an AMF node. Correspondingly, the AMF node receives the handover request message.

The gNB may determine, based on a measurement report reported by a terminal, whether a voice service needs to be handed over. If determining, based on the measurement report, that a <NUM> network signal received by the terminal is relatively weak but a <NUM> or <NUM> network signal is relatively strong, the gNB may send the handover request message to the AMF node.

Step <NUM>. The AMF node generates an anchor key based on a root key of the AMF node and a downlink non-access stratum count (DL NAS count).

Optionally, the AMF node may further generate, for an MME, a key deduction parameter used for deducing an encryption key and an integrity key. The key deduction parameter may be a preset value or a random number.

Step <NUM>. The AMF node sends a redirection request (forward relocation request) message to the MME, where the redirection request message includes key-related information. Correspondingly, the MME receives the redirection request message.

The redirection request message includes SRVCC instruction information. The SRVCC instruction information is used to instruct the MME to request, by sending a PS domain to CS domain handover request (PS to CS handover request) message, to hand over the voice service from a PS domain to a CS domain.

The key-related information may include an anchor key, or the key-related information includes an anchor key and a downlink non-access stratum count, or the key-related information includes an anchor key and a preset value, or the key-related information includes an anchor key and a random number.

Optionally, the key-related information may further include a key set identifier and a terminal security capability that are corresponding to the encryption key and the integrity key.

The MME generates the encryption key and the integrity protection key based on the key-related information in four possible implementations. Refer to related descriptions in steps <NUM>, <NUM>, <NUM>, and <NUM> in the foregoing embodiments.

Step <NUM>. The MME sends a handover request message to an MSC server, where the handover request message includes the encryption key and the integrity protection key. Correspondingly, the MSC server receives the handover request message.

The handover request message is used to request to hand over the voice service from the PS domain to the CS domain.

Step <NUM>. The MSC server sends a handover response message to the MME. Correspondingly, the MME receives the handover response message.

The handover response message is a PS domain to CS domain handover response (PS to CS handover response) message.

Step <NUM>. The MME forwards the handover response message to the AMF node. Correspondingly, the AMF node receives the handover response message.

Step <NUM>. The AMF node sends a handover command (handover command) to the gNB. Correspondingly, the gNB receives the handover command.

The handover command includes a complete downlink non-access stratum count, or includes four least significant bits of a downlink non-access stratum count.

The handover command may further include the first instruction information, the second instruction information, or the third instruction information described in the foregoing embodiments.

Step <NUM>. The gNB forwards the handover command to the terminal. Correspondingly, the terminal receives the handover command.

Step <NUM>. The terminal generates an anchor key based on the root key of the AMF node and the downlink non-access stratum count.

Optionally, if receiving the four least significant bits of the downlink non-access stratum count, the terminal first restores a complete downlink non-access stratum count, and then generates the anchor key based on the root key of the AMF node and the downlink non-access stratum count.

Step <NUM>. The terminal generates an encryption key and an integrity protection key.

This embodiment of this application provides four methods for generating the encryption key and the integrity protection key by the terminal. For details, refer to descriptions in the embodiments corresponding to <FIG>.

In the foregoing embodiment, the MME generates the encryption key and the integrity protection key in a process of handing over the voice service from the PS domain to the CS domain. In another possible implementation, alternatively, the AMF node may generate an encryption key and an integrity protection key, and then send the encryption key and the integrity protection key to the MME. As shown in <FIG>, the method includes step <NUM> to step <NUM>.

Step <NUM>. A gNB sends a handover request message to an AMF node. Correspondingly, the AMF node receives the handover request message.

Step <NUM>. The AMF node generates an anchor key based on a root key of the AMF node and a downlink non-access stratum count.

Step <NUM>. The AMF node generates an encryption key and an integrity protection key.

The AMF node generates the encryption key and the integrity protection key by using the following three methods:.

Method <NUM>: The AMF node determines one part of the anchor key as the encryption key, and determines the other part of the anchor key as the integrity protection key.

The anchor key may include <NUM> bits. The AMF node may determine the first <NUM> bits of the anchor key as the encryption key, and determine the last <NUM> bits of the anchor key as the integrity protection key; or the AMF node determines the first <NUM> bits of the anchor key as the integrity protection key, and determines the last <NUM> bits of the anchor key as the encryption key. This is not limited in this embodiment of this application.

Method <NUM>: The AMF node generates the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count.

A method for generating, by the AMF node, the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count is similar to the method for generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count. For details, refer to related descriptions in step <NUM> in <FIG>.

Method <NUM>: The AMF node generates the encryption key and the integrity protection key based on the anchor key and a preset value, or the AMF node generates the encryption key and the integrity protection key based on the anchor key and a random number.

A method for generating, by the AMF node, the encryption key and the integrity protection key based on the anchor key and the preset value (or based on the anchor key and the random number) is similar to the method for generating, by the MME, the encryption key and the integrity protection key based on the anchor key and the preset value (or based on the anchor key and the random number). For details, refer to descriptions in step <NUM> in <FIG>.

Step <NUM>. The AMF node sends a redirection request message to an MME. Correspondingly, the MME receives the redirection request message.

The redirection request message includes the encryption key and the integrity protection key generated by the AMF node.

Optionally, if step <NUM> is implemented by using the method <NUM>, the handover command further includes first instruction information, where the first instruction information is used to instruct a terminal to generate an encryption key and an integrity protection key based on the downlink non-access stratum count; or if step <NUM> is implemented by using the method <NUM>, the handover command further includes third instruction information, where the third instruction information includes a preset value or a random number, and the third instruction information is used to instruct a terminal to generate an encryption key and an integrity protection key based on the preset value or the random number.

Step <NUM>. The terminal generates the encryption key and the integrity protection key.

Optionally, in the method <NUM> in step <NUM>, the AMF node may negotiate with the terminal in advance on generating the encryption key and the integrity protection key based on the anchor key. Further, after receiving the handover command, the terminal determines one part of the anchor key as the encryption key, and determines the other part of the anchor key as the integrity protection key.

If the handover command received by the terminal includes the first instruction information, the terminal generates the encryption key and the integrity protection key based on the anchor key and the downlink non-access stratum count. A specific method is the same as the method <NUM> in step <NUM>.

If the handover command received by the terminal includes the third instruction information, the terminal generates the encryption key and the integrity protection key based on the anchor key and the preset value (or based on the anchor key and the random number). A specific method is the same as the method <NUM> in step <NUM>.

Compared with the prior art in which an MME cannot generate an encryption key or an integrity protection key due to a lack of a necessary parameter, in this embodiment of this application, by using the method, the AMF node may generate the encryption key and the integrity protection key, and further send the encryption key and the integrity protection key to the MME. The MME does not need to generate an encryption key or an integrity protection key, but may directly use the received encryption key and integrity protection key, thereby implementing security protection for the voice service.

The solutions provided in the embodiments of the present invention are mainly described above from a perspective of interaction between different network elements. It may be understood that, to implement the foregoing functions, the AMF node, the MME, and the terminal include corresponding hardware structures and/or software modules for performing the functions. With reference to the units and algorithm steps described in the embodiments disclosed in the present invention, embodiments of the present invention can be implemented in a form of hardware or hardware and computer software. Whether a function is performed by hardware or hardware driven by computer software depends on particular applications and design constraints of the technical solutions. A person skilled in the art may use different methods to implement the described functions for each particular application, but it should not be considered that the implementation falls beyond the scope of the technical solutions in the embodiments of the present invention.

In the embodiments of the present invention, the AMF node, the MME, the terminal, and the like may be divided into functional units based on the foregoing method examples. For example, the functional units may be obtained through division based on corresponding functions, or two or more functions may be integrated into one processing unit. It should be noted that, in the embodiments of the present invention, unit division is an example, and is merely logical function division. During actual implementation, another division manner may be used.

When an integrated unit is used, <FIG> is a schematic block diagram of an apparatus according to an embodiment of the present invention. The apparatus may exist in a form of software, or may be an MME or a chip in an MME. The apparatus <NUM> includes a processing unit <NUM> and a communications unit <NUM>. The processing unit <NUM> is configured to control and manage an action of the apparatus <NUM>. For example, the processing unit <NUM> is configured to support the apparatus <NUM> in performing step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, and/or another process of the technology described in this specification. The communications unit <NUM> is configured to support communication between the apparatus <NUM> and another network element (for example, an AMF node or an MSC server). For example, the communications unit <NUM> is configured to support the apparatus <NUM> in performing step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, and step <NUM> and step <NUM> in <FIG>. The apparatus <NUM> may further include a storage unit <NUM>, configured to store program code and data of the apparatus <NUM>.

The processing unit <NUM> may be a processor or a controller, for example, may be a central processing unit (Central Processing Unit, CPU), a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application-Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or another programmable logical device, a transistor logical device, a hardware component, or any combination thereof. The controller/processor may implement or execute various example logical blocks, modules, and circuits described with reference to content disclosed in the present invention. The processor may be a combination of processors implementing a computing function, for example, a combination of one or more microprocessors, or a combination of a DSP and a microprocessor. The communications unit <NUM> may be a communications interface. The communications interface is a general term. During specific implementation, the communications interface may include a plurality of interfaces, for example, may include an interface between an MME and an AMF node, an interface between the MME and an MSC server, and/or another interface. The storage unit <NUM> may be a memory.

When the processing unit <NUM> is a processor, the communications unit <NUM> is a communications interface, and the storage unit <NUM> is a memory, a structure of the apparatus <NUM> in this embodiment of this application may be the structure of the MME shown in <FIG>.

<FIG> is a possible schematic structural diagram of an MME according to an embodiment of this application.

Referring to <FIG>, the MME <NUM> includes a processor <NUM>, a communications interface <NUM>, and a memory <NUM>. Optionally, the MME <NUM> may further include a bus <NUM>. The communications interface <NUM>, the processor <NUM>, and the memory <NUM> may be connected to each other by using the bus <NUM>. The bus <NUM> may be a peripheral component interconnect (Peripheral Component Interconnect, PCI for short) bus, an extended industry standard architecture (Extended Industry Standard Architecture, EISA for short) bus, or the like. The bus <NUM> may be classified into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used to represent the bus in <FIG>, but this does not mean that there is only one bus or only one type of bus.

When an integrated unit is used, <FIG> is a schematic block diagram of another apparatus according to an embodiment of the present invention. The apparatus may exist in a form of software, or may be an AMF node or a chip in an AMF node. The apparatus <NUM> includes a processing unit <NUM> and a communications unit <NUM>. The processing unit <NUM> is configured to control and manage an action of the apparatus <NUM>. For example, the processing unit <NUM> is configured to support the apparatus <NUM> in performing step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, and/or another process of the technology described in this specification. The communications unit <NUM> is configured to support communication between the apparatus <NUM> and another network element (for example, an MME or a gNB). For example, the communications unit <NUM> is configured to support the apparatus <NUM> in performing step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, and step <NUM> and step <NUM> in <FIG>. The apparatus <NUM> may further include a storage unit <NUM>, configured to store program code and data of the apparatus <NUM>.

The processing unit <NUM> may be a processor or a controller, for example, may be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or another programmable logic device, a transistor logic device, a hardware component, or any combination thereof. The controller/processor may implement or execute various example logical blocks, modules, and circuits described with reference to content disclosed in the present invention. The processor may be a combination of processors implementing a computing function, for example, a combination of one or more microprocessors, or a combination of a DSP and a microprocessor. The communications unit <NUM> may be a communications interface. The communications interface is a general term. During specific implementation, the communications interface may include a plurality of interfaces, for example, may include an interface between an AMF node and an MME, an interface between the AMF node and a gNB, and/or another interface. The storage unit <NUM> may be a memory.

When the processing unit <NUM> is a processor, the communications unit <NUM> is a communications interface, and the storage unit <NUM> is a memory, a structure of the apparatus <NUM> in this embodiment of this application may be the structure of the AMF node shown in <FIG>.

<FIG> is a possible schematic structural diagram of an AMF node according to an embodiment of this application.

Referring to <FIG>, the AMF node <NUM> includes a processor <NUM>, a communications interface <NUM>, and a memory <NUM>. Optionally, the AMF node <NUM> may further include a bus <NUM>. The communications interface <NUM>, the processor <NUM>, and the memory <NUM> may be connected to each other by using the bus <NUM>. The bus <NUM> may be a PCI bus, an EISA bus, or the like. The bus <NUM> may be classified into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used to represent the bus in <FIG>, but this does not mean that there is only one bus or only one type of bus.

When an integrated unit is used, <FIG> is a schematic block diagram of still another apparatus according to an embodiment of the present invention. An apparatus <NUM> may exist in a form of software, or may be a terminal or a chip in a terminal. The apparatus <NUM> includes a processing unit <NUM> and a communications unit <NUM>. The processing unit <NUM> is configured to control and manage an action of the apparatus <NUM>. For example, the processing unit <NUM> is configured to support the apparatus <NUM> in performing step <NUM> to step <NUM> in <FIG>, step <NUM> to step <NUM> in <FIG>, step <NUM> to step <NUM> in <FIG>, step <NUM> to step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, step <NUM> and step <NUM> in <FIG>, and/or another process of the technology described in this specification. The communications unit <NUM> is configured to support communication between the apparatus <NUM> and another network element (for example, a gNB). The apparatus <NUM> may further include a storage unit <NUM>, configured to store program code and data of the apparatus <NUM>.

The processing unit <NUM> may be a processor or a controller, for example, may be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or another programmable logic device, a transistor logic device, a hardware component, or any combination thereof. The controller/processor may implement or execute various example logical blocks, modules, and circuits described with reference to content disclosed in the present invention. The processor may be a combination of processors implementing a computing function, for example, a combination of one or more microprocessors, or a combination of a DSP and a microprocessor. The communications unit <NUM> may be a transceiver, a transceiver circuit, a communications interface, or the like. The storage unit <NUM> may be a memory.

When the processing unit <NUM> is a processor, the communications unit <NUM> is a transceiver, and the storage unit <NUM> is a memory, the apparatus <NUM> in this embodiment of this application may be the terminal shown in <FIG>.

<FIG> is a simplified schematic diagram of a possible design structure of a terminal according to an embodiment of this application. The terminal <NUM> includes a transmitter <NUM>, a receiver <NUM>, and a processor <NUM>. The processor <NUM> may alternatively be a controller, and is represented as a "controller/processor <NUM>" in <FIG>. Optionally, the terminal <NUM> may further include a modem processor <NUM>. The modem processor <NUM> may include an encoder <NUM>, a modulator <NUM>, a decoder <NUM>, and a demodulator <NUM>.

In an example, the transmitter <NUM> adjusts (for example, performs analog conversion, filtering, amplification, and up-conversion on) the output sample and generates an uplink signal, where the uplink signal is transmitted to the base station in the foregoing embodiment by using an antenna. In a downlink, the antenna receives the downlink signal transmitted by the base station in the foregoing embodiment. The receiver <NUM> adjusts (for example, performs filtering, amplification, down-conversion, and digitization on) a signal received from the antenna and provides an input sample. In the modem processor <NUM>, the encoder <NUM> receives service data and a signaling message that are to be sent on an uplink, and processes (for example, formats, encodes, and interleaves) the service data and the signaling message. The modulator <NUM> further processes (for example, performs symbol mapping and modulation on) the encoded service data and signaling message and provides an output sample. The demodulator <NUM> processes (for example, demodulates) the input sampling and provides symbol estimation. The decoder <NUM> processes (for example, de-interleaves and decodes) the symbol estimation and provides decoded data and a decoded signaling message that are to be sent to the terminal <NUM>. The encoder <NUM>, the modulator <NUM>, the demodulator <NUM>, and the decoder <NUM> may be implemented by the combined modem processor <NUM>. These units perform processing based on a radio access technology (for example, an access technology of an LTE system or another evolved system) used by a radio access network. It should be noted that when the terminal <NUM> does not include the modem processor <NUM>, the foregoing functions of the modem processor <NUM> may alternatively be completed by the processor <NUM>.

The processor <NUM> controls and manages an action of the terminal <NUM>, and is configured to perform processing processes performed by the terminal <NUM> in the foregoing embodiments of the present invention. For example, the processor <NUM> is further configured to perform the processing processes of the terminal in the methods shown <FIG> and/or another process of the technical solutions described in this application.

Further, the terminal <NUM> may further include a memory <NUM>. The memory <NUM> is configured to store program code and data of the terminal <NUM>.

Method or algorithm steps described in combination with the content disclosed in this application may be implemented by hardware, or may be implemented by a processor by executing a software instruction. The software instruction may include a corresponding software module. The software module may be stored in a random access memory (Random Access Memory, RAM for short), a flash memory, a read-only memory (Read Only Memory, ROM), an erasable programmable read only memory (Erasable Programmable ROM, EPROM), an electrically erasable programmable read only memory (Electrically EPROM, EEPROM), a register, a hard disk, a mobile hard disk, a compact disc read-only memory (CD-ROM), or any other form of storage medium well-known in the art. For example, a storage medium is coupled to a processor, so that the processor can read information from the storage medium or write information into the storage medium. Certainly, the storage medium may be a component of the processor. The processor and the storage medium may be located in the ASIC. In addition, the ASIC may be located in an MME, an AMF node, or a terminal. Certainly, the processor and the storage medium may exist in an MME, an AMF node, or a terminal as discrete components.

In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented through some interfaces.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network devices.

In addition, the functional units in the embodiments of the present invention may be integrated into one processing unit, or each of the functional units may exist independently, or two or more units are integrated into one unit. The integrated unit may be implemented in a form of hardware, or may be implemented in a form of hardware and a software functional unit.

Based on the foregoing descriptions of the implementations, a person skilled in the art may clearly understand that this application may be implemented by software and necessary universal hardware or by hardware only. In most cases, the former is a preferred implementation. Based on such understanding, the technical solutions of this application essentially or the part contributing to the prior art may be implemented in a form of a software product. The software product is stored in a readable storage medium, such as a floppy disk, a hard disk or an optical disc of a computer, and includes several instructions for instructing a computer device (which may be a personal computer, a server, or a network device) to perform the methods described in the embodiments of this application.

Claim 1:
A key generation method, comprising:
determining (<NUM>), by an access and mobility management function node, key-related information; and
sending (<NUM>), by the access and mobility management function node, a redirection request message to a mobility management entity wherein the redirection request message comprises the key-related information, and the redirection request message is used to request to hand over a voice service from a packet switched, PS, domain to a circuit switched, CS, domain;
receiving (<NUM>), by the mobility management entity, the redirection request message; and
generating (<NUM>), by the mobility management entity, an encryption key and an integrity protection key for the voice service based on the key-related information.