Huawei International Pte. Ltd.

Huawei Technologies Co., Limited

Zte Corporation

Tencent Technology (Shenzhen) Company Limited

Lichun Li

Zhongding Lei

Haiguang Wang

Xin Kang

Hua Li

Fei Liu

Yan Wang

Tao Zhang

Jie Shi

Rong Wu

Lu Gan

Sen Wang

Feng Lu

Quanjun Tao

Marco Spini

Yonghui Zhang

Zhenyu Lei

Yonglin Peng

Xiaofeng Qiu

Chunhong Zhang

Hao Hu

Wei Mi

Chen Tao

Embodiments of this application disclose a network key processing system, including user equipment, a security anchor network element, and an access and mobility management network element, where the security anchor network element is configured to: obtain a first key parameter from a slice selection network element, where the first key parameter includes identifier information of N network slices; generate N slice-dedicated keys based on the first key parameter; and send the N slice-dedicated keys to the corresponding N network slices respectively; the access and mobility management network element is configured to: obtain the first key parameter, and send the first key parameter to the user equipment; and the user equipment is configured to: generate the N slice-dedicated keys for the N network slices based on the first key parameter, and access the N network slices based on the generated N slice-dedicated keys.

Network key processing method and system and related device

Embodiments of this application provide a network security management method and an apparatus. The method includes: receiving, by a first network device, a session request sent by a terminal device, where the session request is used to request establishment of a first session with a first data network, the session request includes first authentication information for the first session, and the first authentication information includes identifier information of the first data network; obtaining, by the first network device, second authentication information for a second session of the terminal device, where the second authentication information includes identifier information of a second data network to which the second session is connected; and if the identifier information of the first data network is the same as the identifier information of the second data network, authorizing the terminal device to establish the first session with the first data network.

Network security management method, and apparatus

Embodiments of a session processing method and a device relating to a data network are provided. The method includes a data-network network element in the data network receiving a data network access request sent by a session management function (SMF) network element of the data network, where the data network access request includes an identifier of user equipment UE and a session address to be used by the UE. The data-network network element sends a response message to the SMF, where the response message instructs the SMF to allow the UE to access the data network, so that the SMF establishes a data packet unit session of the UE. The data-network network element detects, based on the session address or the identifier of the UE, that the data packet unit session of the UE needs to be processed, generates a session processing request, and instructs, by using the session processing request, the SMF to process the data packet unit session of the UE.

Session processing method and device

Embodiments of the present invention disclose a communication method, a related device, and a system. The system may include a terminal, a first access network node (AN), and a second AN. The first AN is configured to determine that the terminal meets a condition of being handed over from the first AN to the second AN, where a value of a target parameter used for encryption and/or integrity protection when the terminal and the first AN communicate with each other before the terminal is handed over to the second AN is equal to a first reference value. In the system, the first AN may further be configured to send a target message to the second AN to instruct the second AN to obtain a second reference value. The second AN may be configured to obtain the second reference value based on the target message. Furthermore, the terminal may be configured to obtain the second reference value, where the second reference value is used as a value of the target parameter used for encryption and/or integrity protection when the second AN and the terminal communicate with each other. According to the embodiments of the present invention, security performance of the terminal can be improved.

Communication method, related device, and system

Embodiments of the present invention disclose a cyber security management system, method, and apparatus. The system includes user equipment (UE), an access network (AN), a network function selection module, and at least two authentication modules. The UE is configured to send a first service request to the network function selection module, where the first service request carries authentication protocol information. The network function selection module is configured to: select a target authentication module based on the authentication protocol information, and send a second service request to the target authentication module. The target authentication module is configured to perform mutual authentication with the UE. The target authentication module is further configured to: determine a first security configuration according to a specified security policy, and send the first security configuration to the AN.

Cyber security management system, method, and apparatus

This application provides a network slice allocation method, device, and system, including a terminal device, a first core network device, a second core network device, and a third core network device. The terminal device encrypts NSSAI and an ID of the terminal device to obtain encrypted information, and sends a slice access request message to the first core network device. The first core network device sends the encrypted information to the second core network device. The second core network device decrypts the encrypted information to obtain the NSSAI and the ID of the terminal device, generates an authentication vector, and sends the NSSAI and the authentication vector to the first core network device.

Network slice allocation method, device, and system

A User Equipment (UE) for communicating directly with a core network is provided. The UE comprises: a first communication device; a second communication device; an authentication management module; a processor; a storage medium; instructions stored on the storage medium and executable by the processor to: perform a first authentication with the core network to obtain a security context; transmit a security context from the authentication management module to at least one of the first and second communication devices; and perform a second authentication for one of the first and second communication devices with the core network using the security context from the authentication management module to establish connection with the core network.

Unified authentication for heterogeneous networks

A system for managing and distributing a blacklist of User Equipment IDs (UE IDs) in a network. The system comprises a number of groups of networks, each of the groups of networks comprise a blacklist server and a number of authentication servers. The system further comprises a Package Key Generator (PKG). The blacklist server is configured to: store a blacklist containing UE IDs that are not allowed to gain access to the network; transmit the blacklist to the plurality of authentication servers in the same group; receive a message; determine a content in the message is an order to add a new revoked UE ID to the blacklist; update the blacklist to include the new revoked UE ID; and send an update blacklist message to the plurality of authentication servers in the same group.

Blacklist management method for IBC-based distributed authentication framework

A method for collecting statistics on network communication data includes: acquiring, by a first client, an identification code, requesting corresponding webpage content from a server according to the identification code, and displaying the webpage content; receiving, by the first client, a user-entered communication operation instruction including an operation type, sending the instruction to the server, and receiving an operation binding identification code that is returned by the server; acquiring, by a second client, the operation binding identification code displayed on the first client, and extracting the first client operation information and the entry prompt information from the operation binding identification code, the first client operation information including an operation type; and acquiring, by the second client, operation description information based on the entry prompt information, generating a binding relationship between the first client operation information and the operation description information, and sending the binding relationship to the server for statistics collection.

Method and system for collecting statistics on network communication data

The present invention provides a method for resource information backup operation based on peer to peer network, comprising: an initiating node sending an out-of-domain backup node determining request to a connecting node in backup domain, and said out-of-domain backup node determining request including the resource global identifier of said resource information to be backed up, and the connecting node in said backup domain and said host node in which the resource information is saved have different domain identifiers; the connecting node in said backup domain determining an out-of-domain backup node according to information of said resource global identifier and out-of-domain backup rules, and sending routing information of said out-of-domain backup node to said initiating node; and said initiating node sending an out-of-domain backup operation request to said out-of-domain backup node according to said routing information, and said out-of-domain backup node implementing corresponding processing according to said out-of-domain backup operation request.

Growing community of inventors

Shenzhen, China

Lichun Li