Communication method, apparatus, and system
A communication method, apparatus, and system are provided, to resolve problems in a conventional technology that an AKMA authentication procedure is complex and signaling overheads are large. Principles of the method are as follows: In a registration procedure of a terminal device, AKMA authentication is implicitly indicated based on primary authentication. For example, if primary authentication succeeds, it may be considered that AKMA authentication also succeeds. In addition, an AKMA temporary identifier is allocated to the terminal device after AKMA authentication succeeds. According to the method, apparatus, and system in this application, no additional AKMA authentication is required. This simplifies a procedure and reduces signaling overheads.
1. A communication system, comprising:
an authentication server function network element, wherein the authentication server function network element comprises a first memory storing instructions and a first processor; and
a unified data management network element, wherein the authentication server function network element comprises a second memory storing instructions and a second processor, wherein
the authentication server function network element is configured to send a first request message to the unified data management network element in a registration procedure of a terminal device, wherein the first request message comprises an identifier of the terminal device;
the unified data management network element is configured to: determine, based on subscription data of the terminal device, that the terminal device supports an authentication and key management for applications (AKMA) service; and send a first response message to the authentication server function network element, wherein the first response message comprises first indication information, and the first indication information indicates that the terminal device supports the AKMA service; and
the authentication server function network element is further configured to: determine, based on the first indication information, an AKMA temporary identifier of the terminal device after primary authentication on the terminal device succeeds.
2. The system according to claim 1 , wherein the AKMA temporary identifier comprises a home network identifier and a routing indicator, wherein the home network identifier indicates a home network of the terminal device, and the routing indicator is used to determine a network function entity generating a key (Kakma) for the AKMA service.
3. The system according to claim 2 , wherein the AKMA temporary identifier further comprises at least one of address information of an AKMA authentication function network element or address information of an AKMA application function network element.
4. The system according to claim 1 , wherein the first request message is a unified data management (UDM) service-based request message used for obtaining of an authentication vector, and the first response message is a UDM service-based response message used for obtaining of the authentication vector.
5. The system according to claim 1 , wherein the communication system further comprises an AKMA application function network element, wherein the AKMA application function network element comprises a third memory storing instructions and a third processor and a first AKMA authentication function network element, wherein the AKMA authentication function network element comprises a fourth memory storing instructions and a fourth processor wherein
the AKMA application function network element is configured to receive, from the terminal device, a second request message comprising the AKMA temporary identifier; and send a third request message to the AKMA authentication function network element, wherein the third request message carries the AKMA temporary identifier and an identifier of the AKMA application function network element; and
the AKMA authentication function network element is configured to: when the AKMA authentication function network element can serve the AKMA application function network element, generate, based on a key (Kakma) for the AKMA service and the identifier of the AKMA application function network element, a communication key; wherein the key (Kakma) is obtained from the authentication server function network element; and send the communication key to the AKMA application function network element.
6. The system according to claim 5 , wherein the AKMA authentication function network element is further configured to determine whether the AKMA authentication function network element serves the AKMA application function network element.
7. The system according to claim 5 , wherein the authentication server function network element is further configured to:
generate the Kakma based on a first key, wherein the first key is an intermediate key generated in a primary authentication on the terminal device, and
send the Kakma to the AKMA authentication function network element.
8. The system according to claim 7 , wherein the first key is an authentication server function network element key (Kausf).
9. A communication method, comprising:
sending, by an authentication server function network element, a first request message to a unified data management network element in a registration procedure of a terminal device, wherein the first request message comprises an identifier of the terminal device;
determining, by the unified data management network element based on subscription data of the terminal device, that the terminal device supports an authentication and key management for applications (AKMA) service;
sending, by the unified data management network element to the authentication server function network element, a first response message comprising first indication information, wherein the first indication information indicates that the terminal device supports the AKMA service; and
determining, by the authentication server function network element based on the first indication information, an AKMA temporary identifier of the terminal device after primary authentication on the terminal device succeeds.
10. The method according to claim 9 , wherein the AKMA temporary identifier comprises a home network identifier and a routing indicator, wherein the home network identifier indicates a home network of the terminal device, and the routing indicator is used to determine a network function entity generating a key (Kakma) for the AKMA service.
11. The method according to claim 10 , wherein the AKMA temporary identifier further comprises at least one of address information of an AKMA authentication function network element or address information of an AKMA application function network element.
12. The method according to claim 9 , wherein the first request message is a unified data management (UDM) service-based request message used for obtaining of an authentication vector, and a third response message is a UDM service-based response message used for obtaining of the authentication vector.
13. The method according to claim 9 , further comprising:
receiving, by an AKMA application function network element from the terminal device, a second request message comprising the AKMA temporary identifier;
sending, by the AKMA application function network element, a third request message to an AKMA authentication function network element, wherein the third request message carries the AKMA temporary identifier and an identifier of the AKMA application function network element;
when the AKMA authentication function network element can serve the AKMA application function network element, generating, by the AKMA authentication function network element, a communication key based on a key (Kakma) for the AKMA service and the identifier and the identifier of the AKMA application function network element; wherein the key (Kakma) is obtained from the authentication server function network element; and
sending, by the AKMA authentication function network element, the communication key to the AKMA application function network element.
14. The method according to claim 13 , further comprising:
determining, by the AKMA authentication function network element, whether the AKMA authentication function network element serves the AKMA application function network element.
15. The method according to claim 13 , wherein
generating, by the authentication server function network element, the Kakma based on a first key, wherein the first key is an intermediate key generated in a primary authentication on the terminal device.
16. The method according to claim 15 , wherein the first key is an authentication server function network element key (Kausf).
17. A communication method, comprising:
receiving, by a unified data management network element in a registration procedure of a terminal device, a first request message from an authentication server function network element, wherein the first request message comprises an identifier of the terminal device;
determining, by the unified data management network element based on subscription data of the terminal device, that the terminal device supports an authentication and key management for applications (AKMA) service; and
sending, by the unified data management network element to the authentication server function network element, a first response message comprising first indication information, wherein the first indication information indicates that the terminal device supports the AKMA service.
18. The method according to claim 17 , wherein the first request message is a unified data management (UDM) service-based request message used for obtaining of an authentication vector, and the first response message is a UDM service-based response message used for obtaining of the authentication vector.
19. A communication apparatus, comprising:
a processor, and a non-transitory memory, wherein the non-transitory memory is configured to store computer-executable instructions; and
the processor is configured to execute the computer-executable instructions stored in the non-transitory memory, to enable the communication apparatus to:
receive, in a registration procedure of a terminal device, a first request message from an authentication server function network element, wherein the first request message comprises an identifier of the terminal device;
determine, based on subscription data of the terminal device, that the terminal device supports an authentication and key management for applications (AKMA) service; and
send, to the authentication server function network element, a first response message comprising first indication information, wherein the first indication information indicates that the terminal device supports the AKMA service.
20. The communication apparatus according to claim 19 , wherein the first request message is a unified data management (UDM) service-based request message used for obtaining of an authentication vector, and the first response message is a UDM service-based response message used for obtaining of the authentication vector.