# US 2025/0097015 A1 · Communication Authentication Method and Related Device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0097015 A1
- Document ID: US20250097015A1
- Status: Published application
- Kind: A1
- Application number: 18/901,444
- Filed: 2024-09-30
- Published: 2025-03-20
- Earliest claimed: 2019-09-30
- Assignees: Huawei Technologies Co., Ltd.
- Applicants: Huawei Technologies Co., Ltd.
- Inventors: Bo Zhang
- Web page: https://patentgrep.com/patent/US20250097015A1

## CPC

- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04W 12/043: using a trusted network node as an anchor
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04W 12/069: using certificates or pre-shared keys
- H04W 12/10: Integrity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

communication authentication method and a related device, the method including sending, by a user terminal, a generic bootstrapping architecture (GBA) authentication request carrying a user terminal identifier, receiving, by the user terminal, an authentication request carrying an authentication token (AUTN) and a random number (RAND), and deriving, by the user terminal, a first authentication vector based on the AUTN and the RAND, where the first authentication vector is different from a second authentication vector of the user terminal, the first authentication vector is a 5th generation (5G) GBA authentication vector, and the second authentication vector includes at least one of a 3rd generation/4th generation (3G/4G) GBA authentication vector or a 5G authentication vector.

## Claims

### Claim 1

A method, comprising:
receiving, by a unified data management entity, an authentication request carrying a user terminal identifier;
determining, by the unified data management entity, that the authentication request is a generic bootstrapping architecture (GBA) authentication request based on a dedicated authentication request message name or type of the authentication request;
generating, by the unified data management entity, a first authentication vector of a user terminal represented by the user terminal identifier, wherein the first authentication vector is different from a second authentication vector of the user terminal, the first authentication vector is a GBA authentication vector, and the second authentication vector is an authentication vector; and
sending, by the unified data management entity, a GBA authentication response carrying the first authentication vector.

### Claim 2 (depends on 1)

The method according to claim 1, wherein
the first authentication vector is an authentication vector with 5-tuple parameters (CK′, IK′, RAND, AUTN, XRES), wherein CK′ is a cypher key, IK′ is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response; and
the second authentication vector is an authentication vector with 5-tuple parameters (CK, IK, RAND, AUTN, XRES), wherein CK is a cypher key, IK is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, wherein
the cipher key CK′ is different from the cipher key CK, or the integrity protection key IK′ is different from the integrity protection key IK.

### Claim 3 (depends on 2)

The method according to claim 2, wherein
parameters used to derive the cipher key CK′ comprise the random number RAND, a root key K, and a derivation parameter y1, and parameters used to derive the integrity protection key IK′ comprise the random number RAND, the root key K, and a derivation parameter y2;
a derivation function f3′ used to derive the cypher key CK′ is different from a derivation function f3 used to derive the cypher key CK, and a derivation function f4′ used to derive the integrity protection key IK′ is different from a derivation function f4 used to derive the integrity protection key IK;
the cypher key CK′ and the integrity protection key IK′ are derived from the cypher key CK, the integrity protection key IK, and an FC value, and the FC value is different from an FC value used to derive the second authentication vector; or
a first sequence number SQN is to be used to derive the authentication token AUTN in the first authentication vector, and a second sequence number SQN is to be used to derive the authentication token AUTN in the second authentication vector, wherein the first sequence number SQN and the second sequence number SQN each comprise a flag bit, and the flag bit of the first sequence number SQN is different from the flag bit of the second sequence number SQN.

### Claim 4 (depends on 1)

The method according to claim 1, wherein
the first authentication vector is an authentication vector with 4-tuple parameters (Kgba, RAND, AUTN, XRES), wherein Kgba is a key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response; and
the second authentication vector is an authentication vector with 5-tuple parameters (CK, IK, RAND, AUTN, XRES), wherein CK is a cypher key, IK is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, or an authentication vector with 4-tuple parameters (Kausf, RAND, AUTN, XRES), wherein Kausf is a key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, wherein
derivation parameters used to derive the key Kgba comprise the cipher key CK, the integrity protection key IK, and a parameter y2.

### Claim 5 (depends on 1)

The method according to claim 1, wherein receiving, by the unified data management entity, the authentication request carrying the user terminal identifier comprises: receiving, by the unified data management entity from a bootstrapping server function entity, the authentication request carrying the user terminal identifier.

### Claim 6 (depends on 3)

The method according to claim 3, wherein the parameter y1 or the parameter y2 comprises one or more of the following parameters:
a string GBA, a GBA dedicated identifier, an identifier of a bootstrapping server function entity, a 5G identifier, a counter, a nonce, or a sequence number.

### Claim 7

A method, comprising:
sending, by a bootstrapping server function entity, an authentication request carrying a user terminal identifier, wherein the authentication request is with a dedicated authentication request message name or type indicating that the authentication request is an authentication request for generic bootstrapping architecture (GBA) authentication; and
receiving, by the bootstrapping server function entity, a GBA authentication response carrying a first authentication vector of a user terminal represented by the user terminal identifier, wherein the first authentication vector is different from a second authentication vector of the user terminal, the first authentication vector is a GBA authentication vector, and the second authentication vector is an authentication vector.

### Claim 8 (depends on 7)

The method according to claim 7, further comprising:
receiving, by the bootstrapping server function entity before sending the authentication request, a request carrying the user terminal identifier.

### Claim 9 (depends on 7)

The method according to claim 7, further comprising:
determining, by the bootstrapping server function entity before sending the authentication request, information about a unified data management entity based on the user terminal identifier.

### Claim 10 (depends on 7)

The method according to claim 7, wherein
the first authentication vector is an authentication vector with 5-tuple parameters (CK′, IK′, RAND, AUTN, XRES), wherein CK′ is a cypher key, IK′ is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response; and
the second authentication vector is an authentication vector with 5-tuple parameters (CK, IK, RAND, AUTN, XRES), wherein CK is a cypher key, IK is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, wherein
the cipher key CK′ is different from the cipher key CK, or the integrity protection key IK′ is different from the integrity protection key IK.

### Claim 11

An apparatus, comprising:
at least one processor; and
a memory coupled to the at least one processor and storing programming instructions for execution by the at least one processor to cause the apparatus to perform operations comprising:
receiving an authentication request carrying a user terminal identifier;
determining that the authentication request is a generic bootstrapping architecture (GBA) authentication request based on a dedicated authentication request message name or type of the authentication request;
generating a first authentication vector of a user terminal represented by the user terminal identifier, wherein the first authentication vector is different from a second authentication vector of the user terminal, the first authentication vector is a GBA authentication vector, and the second authentication vector is an authentication vector; and
sending a GBA authentication response carrying the first authentication vector.

### Claim 12 (depends on 11)

The apparatus according to the claim 11, wherein
the first authentication vector is an authentication vector with 5-tuple parameters (CK′, IK′, RAND, AUTN, XRES), wherein CK′ is a cypher key, IK′ is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response; and
the second authentication vector is an authentication vector with 5-tuple parameters (CK, IK, RAND, AUTN, XRES), wherein CK is a cypher key, IK is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, wherein
the cipher key CK′ is different from the cipher key CK, or the integrity protection key IK′ is different from the integrity protection key IK.

### Claim 13 (depends on 12)

The apparatus according to the claim 12, wherein
parameters used to derive the cipher key CK′ comprise the random number RAND, a root key K, and a derivation parameter y1, and parameters used to derive the integrity protection key IK′ comprise the random number RAND, the root key K, and a derivation parameter y2;
a derivation function f3′ used to derive the cypher key CK′ is different from a derivation function f3 used to derive the cypher key CK, and a derivation function f4′ used to derive the integrity protection key IK′ is different from a derivation function f4 used to derive the integrity protection key IK;
the cypher key CK′ and the integrity protection key IK′ are derived from the cypher key CK, the integrity protection key IK, and an FC value, and the FC value is different from an FC value used to derive the second authentication vector; or
a first sequence number SQN is to be used to derive the authentication token AUTN in the first authentication vector, and a second sequence number SQN is to be used to derive the authentication token AUTN in the second authentication vector, wherein the first sequence number SQN and the second sequence number SQN each comprise a flag bit, and the flag bit of the first sequence number SQN is different from the flag bit of the second sequence number SQN.

### Claim 14 (depends on 11)

The apparatus according to the claim 11, wherein
the first authentication vector is an authentication vector with 4-tuple parameters (Kgba, RAND, AUTN, XRES), wherein Kgba is a key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response; and
the second authentication vector is an authentication vector with 5-tuple parameters (CK, IK, RAND, AUTN, XRES), wherein CK is a cypher key, IK is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, or an authentication vector with 4-tuple parameters (Kausf, RAND, AUTN, XRES), wherein Kausf is a key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, wherein
derivation parameters used to derive the key Kgba comprise the cipher key CK, the integrity protection key IK, and a parameter y2.

### Claim 15 (depends on 11)

The apparatus according to the claim 11, wherein receiving the authentication request carrying the user terminal identifier comprises: receiving, from a bootstrapping server function entity, the authentication request carrying the user terminal identifier.

### Claim 16 (depends on 13)

The apparatus according to the claim 13, wherein the parameter y1 or the parameter y2 comprises one or more of the following parameters:
a string GBA, a GBA dedicated identifier, an identifier of a bootstrapping server function entity, a 5G identifier, a counter, a nonce, or a sequence number.

### Claim 17

An apparatus, comprising:
at least one processor; and
a memory coupled to the at least one processor and storing programming instructions for execution by the at least one processor to cause the apparatus to perform operations comprising:
sending an authentication request carrying a user terminal identifier, wherein the authentication request is with a dedicated authentication request message name or type indicating that the authentication request is an authentication request for generic bootstrapping architecture (GBA) authentication; and
receiving a GBA authentication response carrying a first authentication vector of a user terminal represented by the user terminal identifier, wherein the first authentication vector is different from a second authentication vector of the user terminal, the first authentication vector is a GBA authentication vector, and the second authentication vector is an authentication vector.

### Claim 18 (depends on 17)

The apparatus according to claim 17, the programming instructions for execution by the at least one processor to cause the apparatus to perform operations further comprising:
receiving a request carrying the user terminal identifier before the sending authentication request.

### Claim 19 (depends on 17)

The apparatus according to claim 17, the programming instructions for execution by the at least one processor to cause the apparatus to perform operations further comprising:
determining information about a unified data management entity based on the user terminal identifier before the sending authentication request.

### Claim 20 (depends on 17)

The apparatus according to claim 17, wherein
the first authentication vector is an authentication vector with 5-tuple parameters (CK′, IK′, RAND, AUTN, XRES), wherein CK′ is a cypher key, IK′ is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response; and
the second authentication vector is an authentication vector with 5-tuple parameters (CK, IK, RAND, AUTN, XRES), wherein CK is a cypher key, IK is an integrity protection key, RAND is a random number, AUTN is an authentication token, and XRES is an expected response, wherein
the cipher key CK′ is different from the cipher key CK, or the integrity protection key IK′ is different from the integrity protection key IK.