Authentication result update method and communications apparatus
An authentication result update method and a communications apparatus, where the authentication result update method includes: determining that an authentication result of a terminal device in a first serving network needs to be updated; and sending a first service invocation request to an authentication server, where the first service invocation request is used to request to update the authentication result stored in a unified data management device, where visited network spoofing can be prevented after authentication is completed, and where network security can be improved.
1. A method, comprising:
determining, by an access and mobility management function device, that an authentication result of a terminal device needs to be removed, wherein the authentication result is a result of authentication of the terminal device from an authentication server; and
sending, by the access and mobility management function device, a request to the authentication server,
wherein the request requests the authentication server to inform a unified data management device, which is configured to receive the authentication result from the authentication server and store the authentication result, to remove the authentication result that is stored in the unified data management device.
2. The method of claim 1 , wherein determining that the authentication result of the terminal device needs to be removed comprises determining, by the access and mobility management function device, that the authentication result of the terminal device needs to be removed in a non-access stratum (NAS) security mode command (SMC) reject scenario.
3. The method of claim 2 , wherein determining, by the access and mobility management function device, that the authentication result of the terminal device needs to be removed in the NAS SMC reject scenario comprises determining, by the access and mobility management function device, that the authentication result of the terminal device needs to be removed when receiving a security mode reject message from the terminal device.
4. The method of claim 1 , wherein determining that the authentication result of the terminal device needs to be removed comprises determining, by the access and mobility management function device, that the authentication result of the terminal device needs to be removed in a terminal device de-registration scenario.
5. The method of claim 4 , wherein determining, by the access and mobility management function device, that the authentication result of the terminal device needs to be removed in the terminal device de-registration scenario comprises:
determining, by the access and mobility management function device, that the authentication result of the terminal device needs to be removed when receiving a de-registration request message from the terminal device; or
determining, by the access and mobility management function device, that the authentication result of the terminal device needs to be removed when the access and mobility management function device initiates a de-registration procedure.
6. The method of claim 1 , wherein the request comprises identity information for uniquely identifying a serving network and the terminal device.
7. A method, comprising:
receiving, by a unified data management device, an authentication result from an authentication server, wherein the authentication result is a result of authentication of a terminal device;
receiving, by the unified data management device configured to store the authentication result, a request from the authentication server, wherein the request requests to remove the authentication result stored in the unified data management device; and
removing, by the unified data management device based on the request, the authentication result stored in the unified data management device.
8. The method of claim 7 , wherein the request comprises identity information of a serving network and subscription permanent identifier (SUPI).
9. The method of claim 7 , wherein before receiving the request, the method further comprises:
receiving, by the unified data management device, an authentication result confirmation request from the authentication server; and
sending, by the unified data management device, an authentication result confirmation response to the authentication server,
wherein the authentication result confirmation response indicates a status of storing the authentication result in the unified data management device.
10. An apparatus, comprising:
one or more processors; and
a memory coupled to the one or more processors and configured to store executable instructions for execution by the one or more processors to instruct the one or more processors to:
determine that an authentication result of a terminal device needs to be removed, wherein the authentication result is a result of authentication of the terminal device from an authentication server; and
send a request to the authentication server,
wherein the request requests the authentication server to inform a unified data management device, which is configured to receive the authentication result from the authentication server and store the authentication result, to remove the authentication result that is stored in the unified data management device.
11. The apparatus of claim 10 , wherein the executable instructions further instruct the one or more processors to determine that the authentication result of the terminal device needs to be removed in a non-access stratum (NAS) security mode command (SMC) reject scenario.
12. The apparatus of claim 11 , wherein the executable instructions further instruct the one or more processors to determine that the authentication result of the terminal device needs to be removed when receiving a security mode reject message from the terminal device.
13. The apparatus of claim 10 , wherein the executable instructions further instruct the one or more processors to determine that the authentication result of the terminal device needs to be removed in a terminal device de-registration scenario.
14. The apparatus of claim 13 , wherein the executable instructions further instruct the one or more processors to:
determine that the authentication result of the terminal device needs to be removed when the apparatus receives a de-registration request message from the terminal device; or
determine that the authentication result of the terminal device needs to be removed when the apparatus initiates a de-registration procedure.
15. The apparatus of claim 10 , wherein the request comprises identity information for uniquely identifying a serving network and the terminal device.
16. An apparatus, comprising:
one or more processors; and
a memory coupled to the one or more processors and configured to store executable instructions for execution by the one or more processors to instruct the one or more processors to:
receive an authentication result from an authentication server, wherein the authentication result is a result of authentication of a terminal device;
store the authentication result;
receive a request from the authentication server, wherein the request requests to remove the authentication result stored in the apparatus; and
remove the authentication result stored in the apparatus based on the request.
17. The apparatus of claim 16 , wherein the request comprises identity information of a serving network and subscription permanent identifier (SUPI).
18. The apparatus of claim 16 , wherein the executable instructions further instruct the one or more processors to:
receive an authentication result confirmation request from the authentication server; and
send an authentication result confirmation response to the authentication server,
wherein the authentication result confirmation response indicates a status of storing the authentication result in the apparatus, and
wherein the apparatus is a unified data management device.