Identity information processing method, device, and system

1. An identity information processing method, comprising:

obtaining, by a first network element, a first parameter, wherein the first parameter is associated with a domain to which a network slice belongs;

determining, by the first network element, according to the first parameter, whether the network slice is managed by an operator; and

sending, by the first network element to a second network element in the network slice, indication information associated with whether the operator manages the network slice and indicating whether first identity information of a terminal should be hidden, wherein the indication information indicating that the network slice is not operated by the operator causes the second network element to determine to hide the first identity information by obtaining second identity information for transmission to a session management network element.

2. The identity information processing method according to claim 1 , wherein the first network element is at least one of a slice selection network element, a network repository network element, or an access and mobility management network element.

3. The identity information processing method according to claim 2 , wherein the first network element is at least one of the slice selection network element or the network repository network element; and

wherein the sending the indication information comprises:

sending, by the first network element, indication information to an access and mobility management network element.

4. The identity information processing method according to claim 1 , wherein the first parameter comprises at least one of network slice selection assistance information (NSSAI) corresponding to the network slice, a routing area identifier (TAI) of a terminal, or a service type of the terminal.

5. An identity information processing method, comprising:

receiving, by a second network element in a first network slice, indication information associated with whether an operator manages a second network slice and indicating whether first identity information of a terminal should be hidden;

determining, by the second network element, according to the indication information indicating whether the operator manages the second network slice, whether to hide the first identity information of the terminal, wherein the indication information indicating that the second network slice is not operated by the operator causes the second network element to determine to hide the first identity information;

hiding, by the second network element, in response to the second network element determining to hide the first identity information of the terminal, the first identity information to obtain second identity information; and

sending the second identity information to a session management network element in the second network slice.

6. The identity information processing method according to claim 5 , wherein the second network element at least one of an access and mobility management network element, a security edge protection proxy, or a visited session management network element.

7. The identity information processing method according to claim 5 , wherein

the indication information indicates whether first identity information of a terminal should be hidden by indicating at least one of whether a network slice is managed by the operator, whether to hide the first identity information of the terminal, or whether a domain to which a network slice belongs and an operator security domain belong to a same security domain.

8. The identity information processing method according to claim 5 , wherein the hiding the first identity information to obtain second identity information comprises performing at least one of:

encrypting, by the second network element, the first identity information of the terminal by using a public key, to obtain the second identity information; or

encrypting, by the second network element, the first identity information of the terminal by using a shared key, to obtain the second identity information; or

obtaining, by the second network element, a new key based on a shared key and a key derivation function, and encrypting the first identity information of the terminal by using the new key, to obtain the second identity information; or

randomizing, by the second network element, the first identity information of the terminal, to obtain the second identity information; or

using, by the second network element, a generalized public user identity (GPSI) corresponding to the first identity information of the terminal as the second identity information.

9. An identity information processing method, comprising:

receiving, by a first network element in a second network slice belonging to a second domain, from a session management network element in a first network slice belonging to a first domain different from the second domain, identity information of a terminal and an indication indicating that the identity information of the terminal is hidden identity information, wherein the indication indicating that the identity information of the terminal is hidden identity information is associated with the second network slice not being managed by an operator;

sending, by the first network element, according to the indication, a decryption request to a decryption functional entity, wherein the decryption request comprises the identity information of the terminal, and wherein the decryption request requests decryption of the identity information of the terminal;

receiving, by the first network element, from the decryption functional entity, decrypted identity information;

obtaining, by the first network element, data corresponding to the decrypted identity information; and

sending, by the first network element, the data to the session management network element.

10. The identity information processing method according to claim 9 , wherein the first network element is at least one of a policy control network element, a charging network element, or a data management network element.

11. The identity information processing method according to claim 9 , wherein the decryption functional entity is at least one of an access and mobility management network element, a data management network element, a network repository network element, a charging network element, a policy control network element, or an authentication network element.

12. A communications apparatus, comprising:

a processor; and

a non-transitory computer-readable storage medium storing a program to be executed by the processor, the program including instructions to:

obtain a first parameter, wherein the first parameter is associated with a domain to which a network slice belongs;

determine, according to the first parameter, whether the network slice is managed by an operator; and

send, to a second network element in the network slice, indication information associated with whether the operator manages the network slice and indicating whether first identity information of a terminal should be hidden, wherein the indication information indicating that the network slice is not operated by the operator causes the second network element to determine to hide the first identity information by obtaining second identity information for transmission to a session management network element.

13. The communications apparatus according to claim 12 , wherein the communications apparatus is at least one of a slice selection network element, a network repository network element, or an access and mobility management network element.

14. The communications apparatus according to claim 13 , wherein the communications apparatus is one of the slice selection network element or the network repository network element; and

wherein the instructions to send the indication information include instructions to:

send the indication information to an access and mobility management network element.

15. The communications apparatus according to claim 12 , wherein the first parameter comprises at least one of network slice selection assistance information (NSSAI) corresponding to the network slice, a routing area identifier (TAI) of a terminal, or a service type of the terminal.

16. A communications apparatus, wherein the communications apparatus comprises:

a processor; and

a non-transitory computer-readable storage medium storing a program to be executed by the processor, the program including instructions to:

receiving, indication information associated with whether an operator manages a second network slice and indicating whether first identity information of a terminal should be hidden, wherein the communications apparatus is in a first network slice;

determine, according to the indication information indicating whether the operator manages the second network slice, whether to hide the first identity information of the terminal, wherein the indication information indicating that the second network slice is not operated by the operator causes the communications apparatus to determine to hide the first identity information;

hide, in response to determining to hide the first identity information of the terminal, the first identity information to obtain second identity information; and

send the second identity information to a session management network element in the second network slice.

17. The communications apparatus according to claim 16 , wherein the communications apparatus is at least one of an access and mobility management network element, a security edge protection proxy, or a visited session management network element.

18. The communications apparatus according to claim 16 ,

wherein the indication information indicates whether first identity information of a terminal should be hidden by indicating at least one of whether a network slice is managed by the operator, whether to hide the first identity information of the terminal, or whether a domain to which a network slice belongs and an operator security domain belong to a same security domain.

19. The communications apparatus according to claim 16 , wherein the instructions to hide the first identity information to obtain second identity information include instructions to perform at least one of:

encrypt the first identity information of the terminal by using a public key, to obtain the second identity information; or

encrypt the first identity information of the terminal by using a shared key, to obtain the second identity information; or

obtain a new key based on a shared key and a key derivation function, and encrypt the first identity information of the terminal by using the new key, to obtain the second identity information; or

randomize the first identity information of the terminal, to obtain the second identity information; or

use a generalized public user identity (GPSI) corresponding to the first identity information of the terminal as the second identity information.

20. A communications apparatus, comprising:

a processor; and

a non-transitory computer-readable storage medium storing a program to be executed by the processor, the program including instructions for:

receive, from a session management network element in a first network slice belonging to a first domain, identity information of a terminal and an indication indicating that the identity information of the terminal is hidden identity information, wherein the communications apparatus is in a second network slice belonging to a second domain different from the first domain, and wherein the indication indicating that the identity information of the terminal is hidden identity information is associated with the second network slice not being managed by an operator;

send, according to the indication, a decryption request to a decryption functional entity, wherein the decryption request comprises the identity information of the terminal, and wherein the decryption request requests decryption of the identity information of the terminal;

receive decrypted identity information from the decryption functional entity;

obtain data corresponding to the decrypted identity information; and

send the data to the session management network element.