Key Obtaining Method and Device, and Communications System

A method for security handling in mobility of a terminal device, comprising:

• receiving, by a target access and mobility management function (AMF) entity, a first message for registering the terminal device;
• sending, by the target AMF entity, a second message to a source AMF entity after receiving the first message, wherein the second message includes an identifier of the terminal device;
• receiving, by the target AMF entity, a first key from the source AMF entity, wherein the first key is based on a key between the source AMF entity and the terminal device;
• determining, by the target AMF entity after receiving the first key, whether to use the first key based on security related information;
• determining, by the target AMF entity after determining to use the first key, a communication key between the target AMF entity and the terminal device based on the first key, wherein the communication key is for performing integrity protection on signaling between the target AMF entity and the terminal device;
• and
• sending, by the target AMF entity, to the terminal device, a non-access stratum (NAS) security mode command (SMC) that carries indication information instructing the terminal device to derive the first key.

A key obtaining method, comprising:

• sending, by a terminal device, a first message to a target access and mobility management function (AMF) entity, wherein the first message requests registering the terminal device;
• receiving, by the terminal device, a non-access stratum (NAS) security mode command (SMC) from the target AMF entity, wherein the NAS SMC carries indication information instructing the terminal device to derive a first key between the terminal device and the target AMF entity;
• deriving, by the terminal device, the first key between the terminal device and the target AMF entity based on a shared key between a source AMF entity and the terminal device;
• and
• determining, by the terminal device, a communication key between the terminal device and the target AMF entity according to the first key,
• wherein the communication key is for performing integrity protection on signaling between the target AMF entity and the terminal device.

A key obtaining apparatus, comprising:

• a transceiver;
• and
• a processor coupled to the transceiver and configured to:
• receive, via the transceiver, a first message for registering a terminal device;
• send a second message to a source access and mobility management function (AMF) entity after receiving the first message, wherein the second message includes an identifier of the terminal device;
• receive, via the transceiver, a first key from the source AMF entity, wherein the first key is derived based on a key between the source AMF entity and the terminal device;
• determine, after receiving the first key, whether to use the first key based on security related information;
• determine, after determining to use the first key, a communication key between the source AMF entity and the terminal device based on the first key, wherein the communication key is for performing integrity protection on signaling between the source AMF entity and the terminal device;
• and
• send, to the terminal device via the transceiver, a non-access stratum (NAS) security mode command (SMC) that carries indication information instructing the terminal device to derive the first key.

A terminal device, comprising:

• a transceiver;
• and
• a processor coupled to the transceiver and configured to:
• send, via the transceiver, a first message to a target access and mobility management function (AMF) entity, wherein the first message requests registering the terminal device;
• receive, via the transceiver, a non-access stratum (NAS) security mode command (SMC) from the target AMF entity, wherein the NAS SMC carries indication information instructing the terminal device to derive a first key between the terminal device and the target AMF entity;
• derive the first key between the terminal device and the target AMF entity based on a shared key between a source AMF entity and the terminal device;
• and
• determine a communication key between the terminal device and the target AMF entity according to the first key, wherein the communication key is for performing integrity protection on signaling between the target AMF entity and the terminal device.