Communication system, method, and apparatus
This application provides a communication system, method, and apparatus. The system is applied to implement authentication and key management for applications (AKMA) service-based data transmission between a terminal device and an application function network element. The system includes an AKMA anchor function network element and a network exposure function network element. The network exposure function network element obtains first identification information from a unified data management network element, where the first identification information is used to determine an authentication server function network element corresponding to the terminal device, and sends the first identification information to the AKMA anchor function network element. The AKMA anchor function network element obtains, from the unified data management network element based on the first identification information, identification information of the authentication server function network element corresponding to the terminal device.
1. A communication system, wherein the communication system is configured to implement authentication and key management for applications (AKMA) service-based data transmission between a terminal device and an application function network element, and the communication system comprises:
an AKMA anchor function network element; and
a network exposure function network element, wherein:
the network exposure function network element is configured to:
receive second identification information from the application function network element;
in response to determining that the application function network element authorizes the network exposure function network element to request a key, send a first request message to a unified data management network element, wherein the first request message, comprising the second identification information, requests the unified data management network element to determine first identification information based on the second identification information; and
receive a first response message from the unified data management network element, wherein the first response message comprises the first identification information; wherein the first identification information is used to determine an authentication server function network element corresponding to the terminal device, and
send the first identification information to the AKMA anchor function network element; and
the AKMA anchor function network element is configured to:
obtain, from the unified data management network element based on the first identification information, identification information of the authentication server function network element corresponding to the terminal device.
2. The communication system according to claim 1 , wherein the second identification information comprises identification information of a key of the AKMA service, and the first identification information comprises a subscriber permanent identifier (SUPI) of the terminal device.
3. The communication system according to claim 1 , wherein the second identification information comprises identification information of a key of the AKMA service and temporary identity information of the terminal device, and the first identification information comprises an SUPI of the terminal device.
4. The communication system according to claim 2 , wherein when being configured to obtain, from the unified data management network element based on the first identification information, the identification information of the authentication server function network element corresponding to the terminal device, the AKMA anchor function network element is specifically configured to:
send a second request message to the unified data management network element, wherein the second request message comprises the SUPI of the terminal device, and the second request message requests the unified data management network element to determine, based on the SUPI of the terminal device, the identification information of the authentication server function network element corresponding to the terminal device; and
receive a second response message from the unified data management network element, wherein the second response message comprises the identification information of the authentication server function network element corresponding to the terminal device.
5. The communication system according to claim 1 , wherein the authentication server function network element corresponding to the terminal device is an authentication server function network element corresponding to an intermediate key of the terminal device, and the authentication server function network element stores the intermediate key generated by the authentication server function network element in a primary authentication process.
6. A communication method, wherein the method is used to implement authentication and key management for applications (AKMA) service-based data transmission between a terminal device and an application function network element, and the communication method comprises:
receiving, by an AKMA anchor function network element, first identification information from a network exposure function network element, wherein the first identification information comprises a subscriber permanent identifier (SUPI) of the terminal device; and
sending, by the AKMA anchor function network element, a second request message to a unified data management network element, wherein the second request message comprises the SUPI of the terminal device; and
receiving, by the AKMA anchor function network element, a second response message from the unified data management network element, wherein the second response message comprises identification information of an authentication server function network element corresponding to the terminal device.
7. The communication method according to claim 6 , wherein the second response message further comprises subscription data of an AKMA service of the terminal device.
8. The communication method according to claim 6 , wherein the method further comprises:
receiving, by the AKMA anchor function network element, an identifier of the application function network element from the network exposure function network element;
obtaining, by the AKMA anchor function network element from the authentication server function network element corresponding to the terminal device, a key that is of the AKMA service and that is identified by identification information of the key of the AKMA service;
generating, by the AKMA anchor function network element, a communication key between the application function network element and the terminal device based on the identifier of the application function network element and the key of the AKMA service; and
sending, by the AKMA anchor function network element, the communication key to the application function network element by using the network exposure function network element.
9. The communication method according to claim 8 , wherein the method further comprises:
performing, by the AKMA anchor function network element, authorization detection on the terminal device or the application function network element, and
when completing the authorization detection, determining the authentication server function network element identified by the identification information of the authentication server function network element corresponding to the terminal device.
10. The communication method according to claim 6 , wherein the authentication server function network element corresponding to the terminal device is an authentication server function network element corresponding to an intermediate key of the terminal device, and the authentication server function network element stores the intermediate key generated by the authentication server function network element in a primary authentication process.
11. A communication method, wherein the method is used to implement authentication and key management for applications (AKMA) service-based data transmission between a terminal device and an application function network element, and the communication method comprises:
receiving, by a network exposure function network element, second identification information from the application function network element;
when determining that the application function network element authorizes the network exposure function network element to request a key, sending, by the network exposure function network element, a first request message to a unified data management network element, wherein the first request message, comprising the second identification information, requests the unified data management network element to determine first identification information based on the second identification information;
receiving, by the network exposure function network element, a first response message from the unified data management network element, wherein the first response message comprises the first identification information; wherein the first identification information is used to determine an authentication server function network element corresponding to the terminal device; and
sending, by the network exposure function network element, the first identification information to an AKMA anchor function network element.
12. The communication method according to claim 11 , wherein the second identification information comprises identification information of a key of the AKMA service, and the first identification information comprises a subscriber permanent identifier (SUPI) of the terminal device.
13. The communication method according to claim 11 , wherein the second identification information comprises identification information of a key of the AKMA service and temporary identity information of the terminal device, and the first identification information comprises an SUPI of the terminal device.
14. The communication method according to claim 11 , wherein the communication method further comprises:
receiving, by the network exposure function network element, an identifier of the application function network element; and
sending the identifier of the application function network element to the AKMA anchor function network element.
15. The communication method according to claim 11 , wherein the authentication server function network element corresponding to the terminal device is an authentication server function network element corresponding to an intermediate key of the terminal device, and the authentication server function network element stores the intermediate key generated by the authentication server function network element in a primary authentication process.
16. The communication method according to claim 11 , wherein the method further comprises:
receiving, by the AKMA anchor function network element, the first identification information from the network exposure function network element;
sending, by the AKMA anchor function network element, a second request message to the unified data management network element, wherein the second request message comprises an SUPI of the terminal device; and
receiving, by the AKMA anchor function network element, a second response message from the unified data management network element, wherein the second response message comprises identification information of the authentication server function network element corresponding to the terminal device.
17. The communication method according to claim 16 , wherein the second response message further comprises subscription data of an AKMA service of the terminal device.
18. The communication method according to claim 16 , wherein the method further comprises:
receiving, by the AKMA anchor function network element, an identifier of the application function network element from the network exposure function network element;
obtaining, by the AKMA anchor function network element from the authentication server function network element corresponding to the terminal device, a key that is of the AKMA service and that is identified by identification information of the key of the AKMA service;
generating, by the AKMA anchor function network element, a communication key between the application function network element and the terminal device based on the identifier of the application function network element and the key of the AKMA service; and
sending, by the AKMA anchor function network element, the communication key to the application function network element by using the network exposure function network element.
19. The communication method according to claim 18 , wherein the communication method further comprises:
performing, by the AKMA anchor function network element, authorization detection on the terminal device or the application function network element, and when completing the authorization detection, determining the authentication server function network element identified by the identification information of the authentication server function network element corresponding to the terminal device.
20. The communication method according to claim 16 , wherein the authentication server function network element corresponding to the terminal device is an authentication server function network element corresponding to an intermediate key of the terminal device, and the authentication server function network element stores the intermediate key generated by the authentication server function network element in a primary authentication process.