Extended authentication method and apparatus for generic bootstrapping architecture, and storage medium
This application provides an extended authentication method and apparatus for a generic bootstrapping architecture and a storage medium. A first network element obtains a bootstrapping transaction identifier (B-TID) and a key lifetime; and the first network element sends the B-TID and the key lifetime to the terminal, so that the terminal performs extensible authentication protocol (EAP)-based generic bootstrapping architecture (GBA) authentication and key agreement (AKA) authentication with the first network element based on the B-TID and the key lifetime.
1. A method for deriving a key, comprising:
generating, by a user equipment (UE), a second key using a key derivation function with input parameters comprising an indicator indicating a protocol type, an identity of the UE, and a first key in an authentication process; and
generating, by the UE based on the second key, a third key shared between the UE and an application function.
2. The method according to claim 1 , wherein the identity of the UE is a subscription permanent identifier (SUPI).
3. The method according to claim 1 , wherein the indicator indicates at least one of the following protocol indicators: extensible authentication protocol (EAP), EAP authentication and key agreement (AKA), EAP AKA′, 5G, 5G AKA, generic bootstrapping architecture (GBA), or 5G GBA.
4. The method according to claim 1 , wherein the generating, based on the second key, a third key shared between the UE and an application function comprises:
generating, by the UE, the third key based on an identity of bootstrapping server function and the second key.
5. The method according to claim 1 , wherein the generating, based on the second key, a third key shared between the UE and an application function comprises:
generating, by the UE, the third key based on a server name of bootstrapping server function and the second key.
6. The method according to claim 1 , wherein the first key is Kausf that is shared with an authentication server function (AUSF).
7. A user equipment (UE) for a deriving a key, comprising:
at least one processor; and
one or more memories coupled to the at least one processor and storing programming instructions for execution by the at least one processor, the programming instructions instructing the at least one processor to:
generate a second key using a key derivation function with input parameters comprising an indicator indicating a protocol type, an identity of the UE, and a first key in an authentication process; and
generate, based on the second key, a third key shared between the UE and an application function.
8. The UE according to claim 7 , wherein the identity of the UE is a subscription permanent identifier (SUPI).
9. The UE according to claim 7 , wherein indicator indicates at least one of the following protocol indicators: EAP, EAP AKA, EAP AKA′, 5G, 5G AKA, GBA, or 5G GBA.
10. The UE according to claim 7 , wherein the programming instructions instruct the at least one processor to generate the third key based on an identity of bootstrapping server function and the second key.
11. The UE according to claim 7 , wherein the programming instructions instruct the at least one processor to generate the third key based on a server name of bootstrapping server function and the second key.
12. The UE according to claim 7 , wherein the first key is Kausf that is shared with an authentication server function (AUSF).
13. A non-transitory computer-readable storage medium, comprising a program instruction, wherein the program instruction instructs at least one processor to:
generate a second key using a key derivation function with input parameters comprising an indicator indicating a protocol type, an identity of a user equipment (UE), and a first key in an authentication process; and
generate, based on the second key, a third key shared between the UE and an application function.
14. The non-transitory computer-readable storage medium according to claim 13 , wherein the identity of the UE is a subscription permanent identifier (SUPI).
15. The non-transitory computer-readable storage medium according to claim 13 , wherein indicator indicates at least one of the following protocol indicators: EAP, EAP AKA, EAP AKA′, 5G, 5G AKA, GBA, or 5G GBA.
16. The non-transitory computer-readable storage medium according to claim 13 , wherein the programming instructions instruct the at least one processor to generate the third key based on an identity of bootstrapping server function and the second key.
17. The non-transitory computer-readable storage medium according to claim 13 , wherein the programming instructions instruct the at least one processor to generate the third key based on a server name of bootstrapping server function and the second key.
18. The non-transitory computer-readable storage medium according to claim 13 , wherein the first key is Kausf that is shared with an authentication server function (AUSF).