Granted Patent B2

US 12,627,639 · App. 17/990,963 · Granted May 12, 2026

Inventors: Longhua Guo (Shanghai, CN); He Li (Shanghai, CN); Rong Wu (Shenzhen, CN)

Assignee: HUAWEI TECHNOLOGIES CO., LTD.

H04L63/0428H04L63/083

Abstract

Claims (69)

1 . A communication protection method performed by a terminal device or a chip in the terminal device, comprising:

sending an application session establishment request message to a first application function network element, wherein the application session establishment request message comprises an authentication and key management for application (AKMA) key identifier; and

receiving an application session establishment response message from the first application function network element, wherein the application session establishment response message comprises a security activation indication, wherein

the security activation indication indicates whether to activate security protection on communication between the terminal device and a second application function network element, the security protection comprises at least one of confidentiality protection or integrity protection performed based on a security key, and wherein the first application function network element and the second application function network element are different application function network elements and the method further comprises:

generating a first application function network element key based on an AKMA key corresponding to the AKMA key identifier;

generating a second application function network element key based on the first application function network element key and a key generation parameter that is shared by the terminal device and the first application function network element; and

generating the security key based on the second application function network element key, wherein the security key comprises at least one of a confidentiality protection key for the confidentiality protection or an integrity protection key for the integrity protection.

2 . The method according to claim 1 , wherein the application session establishment request message further comprises information about a security algorithm supported by the terminal device, wherein the security algorithm supported by the terminal device comprises at least one of a confidentiality protection algorithm supported by the terminal device or an integrity protection algorithm supported by the terminal device; and

the application session establishment response message further comprises information about a security algorithm selected based on the security algorithm supported by the terminal device, wherein the selected security algorithm comprises at least one of a selected confidentiality protection algorithm or a selected integrity protection algorithm.

3 . The method according to claim 2 , wherein the method further comprises:

when the security activation indication indicates to activate the security protection, activating, based on the selected security algorithm and the security key, the security protection on the communication between the terminal and the second application function network element.

4 . The method according to claim 2 , wherein the generating the security key based on the second application function network element key comprises:

generating the security key based on the second application function network element key and the selected security algorithm.

5 . The method according to claim 1 , wherein the application session establishment request message comprises the key generation parameter; and

the key generation parameter comprises at least one selected from the following:

identity information used by the terminal device in the first application function network element or the second application function network element;

a service type requested by the terminal device from the first application function network element or the second application function network element;

identification information of the second application function network element; or

a key freshness parameter.

6 . The method according to claim 1 , wherein the application session establishment response message comprises the key generation parameter, and the key generation parameter comprises a key freshness parameter.

7 . The method according to claim 1 , wherein the application session establishment response message further comprises a key identifier, the key identifier is for identifying a security context between the terminal device and the second application function network element, and the security context comprises the security key.

8 . The method according to claim 1 , wherein the application session establishment response message comprises a first integrity verification parameter, and the method further comprises:

determining, based on the security key and the first integrity verification parameter, whether the application session establishment response message is tampered with.

9 . The method according to claim 8 , wherein the method further comprises:

sending an application session establishment complete message to the second application function network element when the application session establishment response message is not tampered with, wherein the application session establishment complete message comprises a second integrity verification parameter calculated based on the security key.

10 . The method according to claim 1 , wherein the first application function network element and the second application function network element have a same application function network element identifier.

11 . A communication protection method, comprising:

receiving, by a first application function network element, an application session establishment request message from a terminal device, wherein the application session establishment request message comprises an authentication and key management for application (AKMA) key identifier; and

sending, by the first application function network element, an application session establishment response message to the terminal device, wherein the application session establishment response message comprises a security activation indication, wherein

the security activation indication indicates whether to activate security protection on communication between the terminal device and a second application function network element, the security protection comprises at least one of confidentiality protection or integrity protection performed based on a security key; wherein the first application function network element and the second application function network element are different application function network elements and the method further comprises:

generating, by the first application function network element, a first application function network element key based on an AKMA key corresponding to the AKMA key identifier;

generating, by the first application function network element, a second application function network element key based on the first application function network element key and a key generation parameter that is shared by the terminal device and the first application function network element;

generating, by the first application function network element, the security key based on the second application function network element key, wherein the security key comprises at least one of a confidentiality protection key for the confidentiality protection or an integrity protection key for the integrity protection; and

sending, by the first application function network element, a key notification message to the second application function network element, wherein the key notification message comprises the security key.

12 . The method according to claim 11 , wherein the application session establishment request message further comprises information about a security algorithm supported by the terminal device, wherein the security algorithm supported by the terminal device comprises at least one of a confidentiality protection algorithm supported by the terminal device or an integrity protection algorithm supported by the terminal device; and

the application session establishment response message further comprises information about a security algorithm selected based on the security algorithm supported by the terminal device, wherein the selected security algorithm comprises at least one of a selected confidentiality protection algorithm or a selected integrity protection algorithm.

13 . The method according to claim 12 , wherein the method further comprises:

when the security activation indication indicates to activate the security protection, triggering, by the first application function network element, the second application function network element to activate, based on the selected security algorithm and the security key, the security protection on the communication between the second application function network element and the terminal device.

14 . The method according to claim 11 , wherein the generating, by the first application function network element, the security key based on the second application function network element key, comprises:

generating, by the first application function network element, the security key and a key identifier based on the second application function network element key and the selected security algorithm, wherein

the key identifier is for identifying a security context between the terminal device and the second application function network element, the security context comprises the security key, and the application session establishment response message further comprises the key identifier.

15 . The method according to claim 12 , wherein the security activation indication is indicated by the selected security algorithm, wherein

when the selected confidentiality protection algorithm is null, it indicates that the confidentiality protection on the communication between the terminal device and the second application function network element is not activated;

when the selected confidentiality protection algorithm is non-null, it indicates that the confidentiality protection on the communication between the terminal device and the second application function network element is activated;

when the selected integrity protection algorithm is null, it indicates that the integrity protection on the communication between the terminal device and the second application function network element is not activated; and

when the selected integrity protection algorithm is non-null, it indicates that the integrity protection on the communication between the terminal device and the second application function network element is activated.

16 . The method according to claim 12 , wherein the method further comprises:

determining, by the first application function network element, whether to activate the security protection on the communication between the terminal device and the second application function network element; and

generating, by the first application function network element, the security activation indication based on a determining result.

17 . The method according to claim 16 , wherein the determining whether to activate the security protection on the communication between the terminal device and the second application function network element comprises at least one of:

determining, depending on whether the confidentiality protection algorithm supported by the terminal device comprises a confidentiality protection algorithm supported by the second application function network element, whether to activate the confidentiality protection on the communication between the terminal device and the second application function network element; or

determining, depending on whether the integrity protection algorithm supported by the terminal device comprises an integrity protection algorithm supported by the second application function network element, whether to activate the integrity protection on the communication between the terminal device and the second application function network element.

18 . The method according to claim 11 , wherein the method further comprises:

receiving, by the first application function network element, an application session establishment complete message from the terminal device, wherein the application session establishment complete message comprises a second integrity verification parameter; and

determining, by the first application function network element based on the security key and the second integrity verification parameter, whether the application session establishment complete message is tampered with.

19 . An apparatus comprising a processor configured to execute instructions stored in a memory to cause the apparatus to:

send an application session establishment request message to a first application function network element, wherein the application session establishment request message comprises an authentication and key management for application (AKMA) key identifier; and

receive an application session establishment response message from the first application function network element, wherein the application session establishment response message comprises a security activation indication, wherein

the security activation indication indicates whether to activate security protection on communication between the apparatus and a second application function network element, the security protection comprises at least one of confidentiality protection or integrity protection performed based on a security key, and wherein the first application function network element and the second application function network element are different application function network elements and the apparatus is further caused to:

generate a first application function network element key based on an AKMA key corresponding to the AKMA key identifier;

generate a second application function network element key based on the first application function network element key and a key generation parameter that is shared by the apparatus and the first application function network element; and

generate the security key based on the second application function network element key, wherein the security key comprises at least one of a confidentiality protection key for the confidentiality protection or an integrity protection key for the integrity protection.

20 . An apparatus comprising a processor configured to execute instructions stored in a memory to cause the apparatus to:

receive an application session establishment request message from a terminal device, wherein the application session establishment request message comprises an authentication and key management for application (AKMA) key identifier; and

send an application session establishment response message to the terminal device, wherein the application session establishment response message comprises a security activation indication, the security activation indication indicates whether to activate security protection on communication between the terminal device and a second application function network element, the security protection comprises at least one of confidentiality protection or integrity protection performed based on a security key; wherein the apparatus and the second application function network element are different and the apparatus is further caused to:

generate a first application function network element key based on an AKMA key corresponding to the AKMA key identifier;

generate a second application function network element key based on the first application function network element key and a key generation parameter that is shared by the terminal device and the apparatus;

generate the security key based on the second application function network element key, wherein the security key comprises at least one of a confidentiality protection key for the confidentiality protection or an integrity protection key for the integrity protection; and

send a key notification message to the second application function network element, wherein the key notification message comprises the security key.

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (63)