# US 12,764,112 B2 · Security verification method and apparatus

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,764,112 B2
- Document ID: US12764112B2
- Status: Granted
- Kind: B2
- Application number: 18/926,758
- Filed: 2024-10-25
- Published: 2025-02-06
- Granted: 2026-10-13
- Earliest claimed: 2022-04-26
- Assignees: Huawei Technologies Co., Ltd.
- Applicants: Huawei Technologies Co., Ltd.
- Inventors: Zheng Zhang; Fei Li; Zaifeng Zong
- Web page: https://patentgrep.com/patent/US12764112B2

## CPC

- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Embodiments of this application disclose a security verification method and apparatus. The method includes receiving a first command from a network device, where the first command includes a first value, and the first command is one of a select command, a query command, a query repeat command, a query adjust command, or an acknowledgment command. The method further includes determining a first response value based on the first value and a security key; and sending a first request, where the first request includes the first response value, and the first response value is used by a verification function to verify a terminal device. According to embodiments of this application, communication security can be ensured.

## Claims

### Claim 1

A method, wherein the method comprises:
receiving a first command from a network device, wherein the first command comprises a first value, and the first command is a select command, a query command, a query repeat command, a query adjust command, or an acknowledgment command;
determining a first response value based on the first value and a security key;
sending a first request, wherein the first request comprises the first response value and a second value, and the first response value is used by a verification function to verify a terminal device;
receiving a first response message, wherein the first response message comprises a second response value that is determined based on the second value and the security key; and
verifying the network device based on the second response value, wherein a second response message is sent to an access and mobility management function or a tag management function, the second response message comprises a derived key, the derived key is generated based on the security key, an electronic product code, and at least one of the first value or the second value, and the electronic product code is used to identify the terminal device.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the verifying the network device based on the second response value comprises:
determining a third response value based on the second value and the security key;
determining whether the second response value is the same as the third response value; and
when the second response value is the same as the third response value, determining that the network device passes verification.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the first response message further comprises the electronic product code.

### Claim 4 (depends on 1)

The method according to claim 1, wherein
the first request further comprises the electronic product code.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the verification function comprises an application function, an authentication, authorization, and accounting function or a unified data management function.

### Claim 6

A method, wherein the method comprises:
receiving a first request, wherein the first request comprises a first response value and a second value, the first response value is determined based on a security key and a first value comprised in a first command of a network device, and the first command is a select command, a query command, a query repeat command, a query adjust command, or an acknowledgment command;
verifying a terminal device based on the first response value;
determining a second response value based on the second value and the security key;
sending a first response message, wherein the first response message comprises the second response value, and the second response value is used by the terminal device to verify the network device; and
sending a second response message to an access and mobility management function or a tag management function, wherein the second response message comprises a derived key, the derived key is generated based on the security key, an electronic product code, and at least one of the first value or the second value, and the electronic product code is used to identify the terminal device.

### Claim 7 (depends on 6)

The method according to claim 6, wherein the verifying the terminal device based on the first response value comprises:
determining a third value, and determining a fourth response value based on the third value and the security key;
determining whether the first response value is the same as the fourth response value; and
when the first response value is the same as the fourth response value, determining that the terminal device passes verification.

### Claim 8

An apparatus, comprising at least one processor and at least one memory, wherein the at least one processor is coupled to the at least one memory, the at least one memory stores instructions which, when executed by the at least one processor, cause the apparatus to:
receive a first command from a network device, wherein the first command comprises a first value, and the first command is a select command, a query command, a query repeat command, a query adjust command, or an acknowledgment command;
determine a first response value based on the first value and a security key;
send a first request, wherein the first request comprises the first response value and a second value, and the first response value is used by a verification function to verify the apparatus;
receive a first response message, wherein the first response message comprises a second response value that is determined based on the second value and the security key; and
verify the network device based on the second response value, wherein a second response message is sent to an access and mobility management function or a tag management function, the second response message comprises a derived key, the derived key is generated based on the security key, an electronic product code, and at least one of the first value or the second value, and the electronic product code is used to identify the apparatus.

### Claim 9 (depends on 8)

The apparatus according to claim 8, wherein the apparatus is further configured to:
determine a third response value based on the second value and the security key;
determine whether the second response value is the same as the third response value; and
when the second response value is the same as the third response value, determine that the network device passes verification.

### Claim 10 (depends on 8)

The apparatus according to claim 8, wherein the first response message further comprises an electronic product code.

### Claim 11 (depends on 8)

The apparatus according to claim 8, wherein
the first request further comprises the electronic product code.

### Claim 12 (depends on 8)

The apparatus according to claim 8, wherein the verification function comprises an application function, an authentication, authorization, and accounting function or a unified data management function.

### Claim 13

An apparatus, comprising at least one processor and at least one memory, wherein the at least one processor is coupled to the at least one memory, the at least one memory stores instructions which, when executed by the at least one processor, cause the apparatus to:
receive a first request, wherein the first request comprises a first response value and a second value, the first response value is determined based on a security key and a first value comprised in a first command of a network device, and the first command is a select command, a query command, a query repeat command, a query adjust command, or an acknowledgment command;
verify a terminal device based on the first response value;
determine a second response value based on the second value and the security key;
send a first response message, wherein the first response message comprises the second response value, and the second response value is used by the terminal device to verify the network device; and
send a second response message to an access and mobility management function or a tag management function, wherein the second response message comprises a derived key, the derived key is generated based on the security key, an electronic product code, and at least one of the first value or the second value, and the electronic product code is used to identify the terminal device.

### Claim 14 (depends on 13)

The apparatus according to claim 13, wherein the apparatus is further configured to:
determine a third value, and determine a fourth response value based on the third value and the security key;
determine whether the first response value is the same as the fourth response value; and
when the first response value is the same as the fourth response value, determine that the terminal device passes verification.

### Claim 15 (depends on 13)

The apparatus according to claim 13, wherein the access and mobility management function and the tag management function are in a core network.

### Claim 16 (depends on 13)

The apparatus according to claim 13, wherein the apparatus comprises a verification function.

### Claim 17 (depends on 16)

The apparatus according to claim 16, wherein the verification function comprises an application function or an authentication, authorization, and accounting function.

### Claim 18 (depends on 1)

The method according to claim 1, wherein the method is performed by the terminal device.

### Claim 19 (depends on 18)

The method according to claim 18, wherein the terminal device is a tag.

### Claim 20 (depends on 8)

The apparatus according to claim 8, wherein the apparatus is a terminal device.