Huawei Technologies Co., Limited

Shenzhen Yinwang Intelligent Technologies Co., Ltd.

Kai Pan

Jing Lan Chen

He Li

Li Hu

Jing Chen

Yong Qing Wang

Cuili Ge

Xiaojun Wang

A vehicle certificate application method implemented by a vehicle-mounted device includes sending a certificate proxy application message to a roadside unit RSU in response to determining that the Uu interface of the vehicle-mounted device is unavailable or the signal quality of the Uu interface is lower than the threshold. The certificate proxy application message includes certificate application information of a vehicle to which the vehicle-mounted device is mounted. The certificate application information is forwarded by the RSU to a third-party authority. The vehicle-mounted device receives, from the RSU, a certificate proxy application response that includes an identity certificate of the vehicle generated by the third-party authority based on the certificate application information.

Vehicle certificate application method, vehicle-mounted device, and roadside unit

A certificate revocation list updating method includes determining by a first road side unit (RSU), based on a first certificate revocation list stored by the first RSU, that a certificate used by a first on board unit (OBU) in a coverage area of the first RSU is revoked, sending, by the first RSU, a first notification message to one or more OBUs in the coverage area of the first RSU, where the first notification message notifies the one or more OBUs to update a certificate revocation list.

Certificate revocation list updating method and related device

The present disclosure provides example terminal devices, road side units, and servers. One example terminal device performs operations including sending certificate request information to a certificate authority server, where the certificate request information includes identity information of the terminal device. A communication key sent by the certificate authority server is received by the terminal device. Encrypted information that is sent by a road side unit is received by the terminal device, where the encrypted information is information encrypted by using the communication key. The encrypted broadcast information is decrypted by the terminal device by using the communication key.

Communication method, terminal device, road side unit, server, system, and medium

A service application programming interface (API) invoking method where a security method applied to an API exposing function entity is updated from an original security method to a new security method, and where the security method of the API exposing function entity is used for communication between the API exposing function entity and an invoker. The method includes: obtaining, by the invoker, a new security method of the API exposing function entity; and sending, by the invoker, a first invoking request to the API exposing function entity using the new security method, where the first invoking request includes a name of a service API, and where the first invoking request is used to invoke the service API.

Service API invoking method and related apparatus

A key generation method includes determining, by an access and mobility management function node, key-related information. The method also includes sending, by the access and mobility management function node, a redirection request message to a mobility management entity. The redirection request message includes the key-related information, and the redirection request message is used to request to hand over a voice service from a packet switched (PS) domain to a circuit switched (CS) domain. The method further includes receiving, by the mobility management entity, the redirection request message. The method additionally includes generating, by the mobility management entity, an encryption key and an integrity protection key for the voice service based on the key-related information.

Key generation method, apparatus, and system

This application provides a method for restricting access of a terminal device, and an apparatus. The method includes: receiving, by an access network device, a first identifier that is from a terminal device, where the first identifier is used to identify the terminal device; and if the first identifier matches a second identifier, restricting, by the access network device, access of the terminal device, where the second identifier is used to identify a terminal device having abnormal behavior. Based on the solution, the access network device pre-records the second identifier of the terminal device having the abnormal behavior.

Method for restricting access of terminal device and apparatus

A method for security handling in a mobility of a terminal device, where the method includes: a target access and mobility management function (AMF) entity receiving a first message for registering a terminal device; the target AMF entity sending a second message to a source AMF entity after receiving the first message; the source AMF entity deriving a first key based on a key between the source AMF entity and the terminal device; the source AMF entity sending the first key to the target AMF entity; the target AMF entity determining to use the first key based on security related information after receiving the first key; and the target AMF entity determining a communication key between the target AMF entity and the terminal device based on the first key after determining to use the first key.

Key obtaining method and device, and communications system

A method includes receiving, by a mobility management entity (MME), a redirection request message from an access and mobility management function (AMF) node, where the redirection request message includes key-related information. The method also includes generating, by the MME, an encryption key and an integrity protection key based on the key-related information. The redirection request message is used to request to hand over a voice service from a packet switched (PS) domain to a circuit switched (CS) domain.

A message protection method and an apparatus are disclosed. The method includes: When a terminal prepares to hand over from a first-standard system to a second-standard system, the terminal may not have a security context of the second-standard system after handover. Therefore, in the method of the present disclosure, the terminal performs integrity protection on a registration request message and a location update request message by using an integrity key in a security context of the first-standard system before handover. Both the registration request message and the location update request message are messages for triggering handover. Therefore, in the method, security protection is implemented on the message for triggering handover, thereby helping improve communication security.

Message protection method and apparatus

This application provides a user authentication method and an apparatus. Before establishing, for a terminal device, a session used to transmit service data, an SMF entity receives a session establishment request message; determines, based on the session establishment request message, to perform user authentication on a user using the terminal device; and sends a session establishment message to a UPF entity, where the session establishment message is used to establish a first session for the terminal device, and a session attribute of the first session is: a session used to transmit only a user authentication message. Subsequently, the terminal device and an AAA server transmit the user authentication message through the first session, to complete user authentication.

User authentication method and apparatus

The present disclosure discloses a communication method performed by a management function entity, including: receiving a first request message sent by user equipment UE; sending a second request message to a storage function entity based on the first request message, where the second request message is used to request a security service identifier for the UE, and the security service identifier is used to indicate a security service procedure; receiving a response message including the security service identifier from the storage function entity; obtaining a target security service identifier based on the security service identifier, where the target security service identifier is used to indicate a security service procedure to be initiated by the management function entity; and initiating the security service procedure indicated by the target security service identifier. The present disclosure further discloses a communications device.

Communication method and device

Embodiments of the present invention provide a communication method. The communication method includes: performing, by a terminal, a handover from a source base station to a target base station via an interface between the source base station and the target base station, obtaining, by the target base station, a first security capability, and sending, by the target base station, the first security capability to another base station, to establish dual connections. The source base station does not support the first security capability, and the target base station, the another base station, and a core-network network element support the first security capability. The target base station obtains the first security capability, so that the terminal can establish the dual connections to the target base station and the another base station.

Communication method, apparatus, and system

The present disclosure relates to methods, apparatus, and systems for protecting data in a communications system. One example method includes obtaining, by a core network node, information associated with a service of a terminal device, and determining, by the core network node and based on the information associated with the service, a network node that is to perform security protection on data of the service.

Method, apparatus, and system for protecting data

A communication method and a communications apparatus in which the method includes: a terminal device receiving a first authentication request from a security function network element, and obtaining authentication reference information based on the first authentication request, where the authentication reference information is a response value, a resynchronization token, or a cause indication value. The terminal device sends an authentication response message to the security function network element, where the authentication response message includes a first information element used to carry the response value, a second information element used to carry the resynchronization token, and a third information element used to carry the cause indication value, and the authentication reference information is carried in an information element corresponding to the authentication reference information.

Communication method and communications apparatus

A communication method and related device are disclosed. In at least one embodiment, a reference message authentication code is obtained by a terminal device based on a first message authentication code and a second message authentication code. The first message authentication code is used by an AMF to check a service request message, and the second message authentication code is used by an SMF to check the service request message. and sending, by the terminal device, first information and the service request message are sent by the terminal device to the AMF. The first information is used to instruct the AMF to send the service request message to the SMF. The service request message includes second information. The second information includes the reference message authentication code. The SMF can perform a security check on the service request message to ensure security of a communications network.

Growing community of inventors

Shanghai, China

Kai Pan