Network roaming protection method, related device, and system

A network roaming protection system, comprising:

• a visited session management device (V-SM) configured to:
• receive a first session establishment request from a user equipment (UE);
• select a visited user plane gateway (VUP-GW) in a visited network (VPLMN) for the UE;
• and
• send a second session establishment request to a session management device in a home network (H-SM);
• the H-SM configured to:
• obtain a security policy and a reference shared key;
• and
• send the security policy and the reference shared key to the V-SM:
• wherein the V-SM further is further configured to:
• generate based on the security policy and the reference shared key, a shared key for protecting end-to-end secure transmission of data between the UE and the VUP-GW in the VPLMN;
• send the shared key to the selected VUP-GW;
• and
• send the security policy to the UE.

A network roaming protection method, comprising:

• sending, by user equipment (UE), a first session establishment request to a visited session management device (V-SM), wherein the visited session management device is a session management device in a visited network of the UE;
• receiving, by the UE, a security policy sent by the V-SM;
• generating, by the UE, a shared key based on a reference shared key and the security policy;
• and
• protecting, by the UE, secure data transmission between the UE and a visited gateway using the shared key.

User equipment (UE), comprising:

• a transmitter configured to send a first session establishment request to a visited session management device (V-SM), wherein the visited session management device is a session management device in a visited network of the UE;
• a receiver configured to receive a security policy sent by the V-SM;
• at least one processor;
• and
• a non-transitory computer-readable storage medium coupled to the at least one processor and storing programming instructions for execution by the at least one processor, wherein the programming instructions instruct the at least one processor to:
• generate a shared key based on a reference shared key and the security policy;
• and
• protect secure data transmission between the UE and a visited gateway using the shared key.