WO2018170646A1

WO2018170646A1 - Method and device for use in downlink transmission

Info

Publication number: WO2018170646A1
Application number: PCT/CN2017/077197
Authority: WO
Inventors: 张晓博
Original assignee: 南通朗恒通信技术有限公司
Priority date: 2017-03-19
Filing date: 2017-03-19
Publication date: 2018-09-27
Also published as: CN110268797B; CN110268797A; CN115119198A

Abstract

Disclosed are a method and device for use in downlink transmission. A UE first executes a first operation in a first layer then executes a second operation in a second layer. A first modified byte is used for the input of the first operation, a first byte is for the output of the first operation; a second modified byte is used for the input of the second operation, and a second byte is for the output of the second operation. The first modified byte and the second modified byte correspond to a same protocol data unit. The bytes comprise a positive integer-number of bits. The first operation comprises at least one of {decompression, decryption, and integrity verification}; the second operation comprises at least one of {decryption and integrity verification}. The present invention meets QoS requirements and security requirements of different services. In addition, the present invention reduces the access network delay of downlink transmission and increases the access network confidentiality of downlink transmission.

Description

Method and device for downlink transmission

Technical field

The present invention relates to a scheme for downlink transmission in a wireless communication system, and more particularly to a method and apparatus for secure transmission.

Background technique

In the LTE (Long Term Evolution) system, the Packet Data Convergence Protocol (PDCP) layer is located on the Radio Link Control (RLC) layer and under the Internet Protocol (IP) layer. , or under the Radio Resource Control (RRC) layer. The PDCP layer supports the header compression (Header Compression) function, mainly using the Robust Header Compression (ROHC) algorithm. Header compression is mainly used for header compression of IP packets. Header compression is mainly for data radio bearers (DRB, Data Radio Bearer). The PDCP layer also supports security functions, including integrity protection and ciphering. The integrity protection is mainly for the Signaling Radio Bearer (SRB), and the encryption is mainly for the data radio bearer and the signaling radio bearer.

There are multiple services in the NR (New Radio) system. The QoS of different services is different, and the requirements for security functions are also different. In the NR system, different services may be transmitted in different network slices. A network slice is a logical network that includes a core network and an access network.

Summary of the invention

The inventor found through research that if the NR system only performs security operations on the downlink data at the PDCP layer, similar to the LTE system, the PDCP layer needs to perform network slice-specific security operations for each network slice, which increases the complexity of the PDCP layer. degree.

The inventor has further researched that, for delay-sensitive services, the security operations performed on the access network side may increase the delay on the access network side; for some services with higher security requirements, on the access network side. Encryption may increase the possibility of leaking on the access network side.

According to the above inventor's research, different services in the NR system may adopt different encryption and An entity that integrity protects operations. These entities can be grouped into different network slices and located in different protocol entities. For the downlink transmission, the user equipment encrypts the data (header + load) at the non-access layer, and the user equipment performs header compression on the encrypted data (header + load) sent by the upper layer at the PDCP sending end. The PDCP receiving end of the base station side cannot be decompressed correctly.

In response to the above problems, the present invention provides a solution. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments of the present application may be combined with each other arbitrarily. For example, the features in the embodiments and embodiments in the UE of the present application can be applied to a base station or a core network device, and vice versa.

The invention discloses a method in a user equipment used for wireless communication, which comprises the following steps:

- Step A. Performing the first operation at the first level;

- Step B. Perform a second operation at the second level.

Wherein the first modified bit group is used for the input of the first operation, the first bit group is the output of the first operation; the second modified bit group is used for the input of the second operation, The second bit is the output of the second operation. The first modified bit group and the second modified bit group correspond to the same protocol data unit. The bit group includes a positive integer number of bits. The first operation includes at least one of {decompression, decryption, integrity verification}, and the second operation includes at least one of {decryption, integrity verification}.

In one embodiment, the first bit group is an Internet Protocol (IP) header, and the second bit group is an Internet Protocol (IP) packet Payload.

As a sub-embodiment of the foregoing embodiment, the second modified bit group is a PDCP SDU (Service Data Unit).

As an embodiment, the second layer is an upper layer of the first layer.

As an embodiment, the first layer is a PDCP layer and the second layer is a non-access stratum (NAS, Non Access Stratum).

As a sub-embodiment of the foregoing embodiment, the first modified bit group and the second modified bit group belong to the same PDCP PDU (Protocol Data Unit).

As an embodiment, whether the second layer and the first layer are the same is configurable.

As an embodiment, for the decompression, the number of output data bits is greater than the number of input data bits.

As an embodiment, the decompression is to compare the original header and the compressed header to obtain a header before compression.

As an embodiment, the decompression is an inverse operation of a Robust Header Compression (ROHC) algorithm.

As an embodiment, the decompression is an inverse of the compression algorithm exemplified in TS 36.323 Table 5.5.1.1.

As an embodiment, the decryption is raw data and a string of keys to mask.

As a sub-embodiment, the de-masking is a data and mask operation or operation.

As a sub-embodiment, the string of keys includes a Hyper Frame Number (HFN).

As a sub-embodiment, the string of keys includes a radio bearer identifier (Radio Bearer ID).

As a sub-embodiment, the string of keys includes a PDCP sequence number (PDCP SN).

As a sub-embodiment, the string of keycasts includes a first security key.

As an embodiment, the decryption is a decryption algorithm described by TS 36.323.

As an embodiment, the integrity verification is implemented by comparing X Message-Code-Integrity (XMAC-I) with Message Authentication Code-Integrity.

As a sub-embodiment, if the X message verification code-integrity is consistent with the message verification code-integrity, the integrity verification is passed, and vice versa.

As a sub-embodiment, the X message verification code-integrity is implemented by an integrity verification algorithm.

As a sub-embodiment, the input parameters of the integrity verification algorithm include a Hyper Frame Number (HFN).

As a sub-embodiment, the input parameters of the integrity verification algorithm include a Radio Bearer ID.

As a sub-embodiment, the input parameters of the integrity verification algorithm include a PDCP sequence number (PDCP SN).

As a sub-embodiment, the input parameters of the integrity verification algorithm include a first security key.

As a sub-embodiment, the input parameters of the integrity verification algorithm include data.

Specifically, according to an aspect of the present invention, the step A further includes the following step A1, the step B further comprising the following step B1:

Step A1. Passing a first set of bits from the lower layer to the first layer;

Step B1. Passing the first bit group and the second modified bit group from the first layer to the second layer.

The first set of bits includes the first modified bit group and the second modified bit group.

As an embodiment, the first set of bits is a PDCP PDU.

As an embodiment, the first set of bits is a downlink high layer PDU.

As an embodiment, the first set of bits is a downlink PDCP PDU.

As an embodiment, the first set of bits includes a {PDCP header, the first modified bit group, and the second modified bit group}.

As an embodiment, the first layer is a PDCP layer and the lower layer is an RLC layer.

As an embodiment, the second layer is a non-access stratum (NAS, Non Access Stratum).

As an embodiment, the second layer is a PDCP layer.

As an embodiment, the entity where the second layer is located is a core network device after supporting the 3GPP Rel-15 version.

Specifically, according to an aspect of the present invention, the step A further includes the following steps:

- Step A10. Receive the first information.

Wherein the first information is used for the first operation and the second operation.

As an embodiment, the first information is associated with a first service group. The first service group includes one or more services.

As an embodiment, the first information is carried in RRC (Radio Resource Control) signaling.

As an embodiment, the first information is carried in the NAS information.

As an embodiment, the first information is carried in higher layer signaling.

As an embodiment, the first information is related to S1 signaling.

In one embodiment, the first information includes a first security key, and the first security key is configured by a higher layer.

As an embodiment, the first security key is KASME.

As an embodiment, the encryption is used for a Signal Radio Bearer (SRB) and a Data Radio Bearer (DRB) of the PDCP layer.

As an embodiment, the integrity protection is used for a Signal Radio Bearer (SRB) of the PDCP layer.

As an embodiment, the second security key required for the encryption is obtained from the first security key.

As an embodiment, the second security key is KRRCenc.

As an embodiment, the second security key is KUPenc.

As an embodiment, the third security key required for the integrity protection is obtained from the first security key.

As an embodiment, the third security key is KRRCint.

As an embodiment, the sender of the first information is a base station device supporting 3GPP Rel-15 and later versions.

As an embodiment, the sender of the first information is a base station device.

As an embodiment, the sender of the first information is a User Packet System (UPS).

As an embodiment, the first information is generated in a NAS layer of the network side device.

As an embodiment, the first information is generated in the second layer of the network side device.

As an embodiment, the first information is generated in a User Packet System (UPS).

- Step A11. Receiving the second information.

Wherein the second information is used to determine at least one of {the first layer, the second layer}; or the second information is used to determine the first layer and the second Whether the layers are the same.

As an embodiment, the second information is associated with the first service group. The first service group includes one or more services.

As an embodiment, the second information is applied to the first radio bearer. The first bit group and the second bit group are transmitted in the first radio bearer.

As an embodiment, the second information is generated by a base station device.

As an embodiment, the second information is carried in RRC signaling.

As an embodiment, the second information is generated at the second layer of the network side device.

As an embodiment, the second information is generated at a NAS layer of the network side device.

As an embodiment, the second information is carried in the NAS information.

As an embodiment, the second information is generated at a PDCP layer of the network side device.

As an embodiment, the second information indicates that the first layer and the second layer are both PDCP layers.

As an embodiment, the second information indicates that the first layer and the second layer are both NAS layers.

Specifically, according to an aspect of the present invention, the first bit group and the second bit group correspond to a first service group, and the first service group includes one or more services.

As an embodiment, the first service group is a network slice.

As an embodiment, the service includes different QoS requirements.

As an embodiment, the service contains different security requirements.

Specifically, according to an aspect of the present invention, the first layer is a packet data convergence protocol layer, and the second layer is a non-access layer.

The invention discloses a method in a base station device used for wireless communication, which comprises the following steps:

- Step A. The third operation in the {third operation, fourth operation} is performed at the first layer.

Wherein the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second modification The bit group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.

As an embodiment, in the above aspect, the fourth operation is not performed in the first layer.

Step A1. Receiving the first bit group and the second modified bit group from the second layer, and transmitting the first bit set from the first layer to the lower layer.

The first set of bits includes the first modified bit group and the second modified bit group. The fourth operation is performed in the second layer.

As an embodiment, the second layer is maintained by a device other than the base station device.

As an embodiment, the first layer and the second layer are connected by an S1 interface.

As a sub-embodiment, the core network side device belongs to a household grouping system (UPS, User). Packet System).

As an embodiment, the second layer is an upper layer of the first layer.

As a sub-embodiment of the foregoing embodiment, the first modified bit group and the second modified bit group belong to the same PDCP PDU.

As an embodiment, the first set of bits is a PDCP PDU.

As an embodiment, the first set of bits is a downlink high layer PDU.

As an embodiment, the first set of bits is a downlink PDCP PDU.

As an embodiment, the first set of bits includes a {PDCP header, the first bit group, the second bit group}.

As an embodiment, the compression is that the number of input data bits is less than the number of output data bits.

As an embodiment, the compression is Robust Header Compression (ROHC).

As an embodiment, the compression is a compression algorithm exemplified in TS 36.323 Table 5.5.1.1.

As an embodiment, the encryption is to ensure that the data remains confidential between the originating and the terminating end.

As an embodiment, the encryption is raw data and a string of key masking.

As a sub-embodiment, the masking is two data operations or operations.

As a sub-embodiment, the string of keys includes a Hyper Frame Number (HFN).

As a sub-embodiment, the string of keycasts includes a first security key.

As an embodiment, the encryption is an encryption algorithm described by TS 36.323.

As an embodiment, the integrity protection is implemented by Message Authentication Code-Integrity (MAC-I) and data masking.

As a sub-embodiment, the message verification code-integrity is implemented by an integrity protection algorithm.

As a sub-embodiment, the input parameters protected by the integrity algorithm include a Hyper Frame Number (HFN).

As a sub-embodiment, the input parameters protected by the integrity algorithm include a Radio Bearer ID.

As a sub-embodiment, the input parameters protected by the integrity algorithm include a PDCP sequence number (PDCP SN).

As a sub-embodiment, the input parameters of the integrity protection algorithm include a first security key.

As a sub-embodiment, the input parameters of the integrity protection algorithm include data.

Step A10. Receive the first information via the S1 interface; or send the first information over the air interface.

Wherein the first information is used for the third operation and the fourth operation.

As an embodiment, the first security key is KASME.

As an embodiment, the second security key is KRRCenc.

As an embodiment, the second security key is KUPenc.

As an embodiment, the third security key is KRRCint.

As an embodiment, the sender of the first information is supported by 3GPP Rel-15 and later versions. Base station equipment.

As an embodiment, the sender of the first information is a base station device.

As an embodiment, the first information is carried in RRC signaling.

As an embodiment, the first information is carried in higher layer signaling.

As an embodiment, the first information is related to an S1 signaling.

As an embodiment, the sender of the S1 signaling is a User Packet System (UPS).

- Step A11. Receive the second information via the S1 interface; or send the second information over the air interface.

As an embodiment, the foregoing aspect ensures that the base station can perform correct operations on the first modified bit group and the second modified bit group, preventing the base station from performing the fourth on the second modified bit group. operating.

As an embodiment, the second information is carried in RRC signaling.

As an embodiment, the second information is generated by a base station device.

As an embodiment, the second information is carried in higher layer signaling.

As an embodiment, the second information is related to an S1 signaling.

As an embodiment, the QoS requirements of the service are independently configured.

As an embodiment, the security requirements corresponding to the service are independently configured.

As an embodiment, the first service group is a network slice.

As an embodiment, all services in the first service group share the same security requirements.

As an embodiment, all services in the first service group share the same QoS requirements.

As an embodiment, the above aspects can meet variable QoS requirements and security requirements for different services.

The invention discloses a method in a non-access network device, which comprises the following steps:

- Step A. The fourth operation in the {third operation, fourth operation} is performed at the second layer.

Wherein the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second modified bit The group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.

As an embodiment, in the above aspect, the third operation is not performed in the second layer.

As an embodiment, the first layer is maintained by a device other than the non-access network device.

As an embodiment, the first layer is maintained by a base station.

As a sub-embodiment, the base station supports 3GPP Rel-15 and later versions.

As an embodiment, the first bit group is an Internet Protocol (IP). In the header, the second bit group is an Internet Protocol (IP) packet Payload (load).

Step A1. Passing the first bit group and the second modified bit group from the second layer to the first layer;

Wherein the third operation is performed in the first layer. The first modified bit group and the second modified bit group correspond to the same protocol data unit.

- Step A10. The first information is sent via the S1 interface.

As an embodiment, the first information is related to an S1 signaling.

As an embodiment, the first information is carried in a Non-Access Stratum (NAS) message.

- Step A11. Send the second information via the S1 interface.

As an embodiment, the second information is related to an S1 signaling.

As an embodiment, the second information is carried in non-access stratum (NAS) information.

As an embodiment, the above aspects can meet variable QoS requirements for different services. And safety requirements

The invention discloses a user equipment used for wireless communication, which comprises the following modules:

a first processing module: for performing a first operation at the first layer;

- a second processing module: for performing a second operation at the second layer.

As an embodiment, the user equipment is characterized in that: the first processing module is further configured to: pass a first set of bits from the lower layer to the first layer; and the second processing module is further configured to use the first layer Passing the first bit group and the second modified bit group to the second layer. The first set of bits includes the first modified bit group and the second modified bit group.

As an embodiment, the user equipment is characterized in that the first processing module is further configured to receive the first information. Wherein the first information is used for the first operation and the second operation.

As an embodiment, the user equipment is characterized in that the first processing module is further configured to receive the second information. Wherein the second information is used to determine at least one of {the first layer, the second layer}; or the second information is used to determine the first layer and the second Whether the layers are the same.

As an embodiment, the foregoing user equipment is characterized in that the first bit group and the second bit group correspond to a first service group, and the first service group includes one or more services.

As an embodiment, the foregoing user equipment is characterized in that the first layer is a packet data convergence protocol layer, and the second layer is a non-access layer.

The invention discloses a base station device used for wireless communication, which comprises the following modules:

a third processing module: for performing a third operation in the {third operation, fourth operation} at the first layer.

Wherein the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second modified bit The group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, The fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.

As an embodiment, the foregoing base station device is characterized in that: the third processing module is further configured to receive the first bit group and the second modified bit group from a second layer, and transmit the first bit from the first layer A set of bits is given to the lower layer. The first set of bits includes the first modified bit group and the second modified bit group. The fourth operation is performed in the second layer.

As an embodiment, the foregoing base station device is characterized in that the third processing module is further used for at least one of the following:

- receiving the first information through the S1 interface; or transmitting the first information over the air interface.

- receiving the second information via the S1 interface; or transmitting the second information over the air interface.

Wherein the first information is used for the third operation and the fourth operation. The second information is used to determine at least the latter of {the first layer, the second layer}; or the second information is used to determine whether the first layer and the second layer are the same.

As an embodiment, the foregoing base station device is characterized in that the first bit group and the second bit group correspond to a first service group, and the first service group includes one or more services.

As an embodiment, the foregoing base station device is characterized in that the first layer is a packet data convergence protocol layer, and the second layer is a non-access layer.

The invention discloses a non-access network device, which comprises the following modules:

a fourth processing module: for performing a fourth operation in the {third operation, fourth operation} at the second layer.

As an embodiment, the non-access network device is characterized in that: the fourth processing module is further configured to: deliver the first bit group and the second modified bit group from the second layer to the first layer. Wherein the third operation is performed in the first layer. The first modified bit group and the second modified bit group correspond to the same protocol data unit.

As an embodiment, the non-access network device is characterized in that: the fourth processing module is further used to At least one of the following:

- Step A0. Sending the first information through the S1 interface;

- Step A2. Send the second message via the S1 interface.

As an embodiment, the non-access network device is characterized in that the first bit group and the second bit group correspond to a first service group, and the first service group includes one or more services.

As an embodiment, the non-access network device is characterized in that the first layer is a packet data convergence protocol layer, and the second layer is a non-access layer.

As an embodiment, the present invention has the following technical advantages over the prior art:

- By encrypting the header and payload of the data packet in different entities to meet the QoS requirements of different services, while meeting the security requirements for different services;

- Helping the base station side entity to decompress the receiving end by indicating that the header and payload of the data packet are encrypted at the transmitting end of an entity of the user equipment;

- Reduce the delay of the access network;

-. Reduces the risk of access network loss and improves the security of transmission.

DRAWINGS

Other features, objects, and advantages of the present invention will become more apparent from the Detailed Description of Description

Figure 1 shows a schematic diagram of a first operation in accordance with one embodiment of the present invention;

Figure 2 shows a schematic diagram of a third operation in accordance with one embodiment of the present invention;

Figure 3 shows a schematic diagram of a second operation in accordance with one embodiment of the present invention;

Figure 4 shows a schematic diagram of a fourth operation in accordance with one embodiment of the present invention;

Figure 5 shows a schematic diagram of a first operation and a third operation in accordance with one embodiment of the present invention;

Figure 6 shows a schematic diagram of a second operation and a fourth operation in accordance with one embodiment of the present invention;

Figure 7 is a flow chart showing the transmission and reception of downlink data in accordance with one embodiment of the present invention;

Figure 8 is a flow chart showing the reception of downlink data in accordance with one embodiment of the present invention;

Figure 9 is a flow chart showing the transmission of downlink data in accordance with one embodiment of the present invention;

Figure 10 shows a schematic diagram of a first set of bits in accordance with one embodiment of the present invention;

Figure 11 shows a schematic diagram of a network slice in accordance with one embodiment of the present invention;

FIG. 12 is a block diagram showing the structure of a processing device in a UE according to an embodiment of the present invention; FIG.

Figure 13 is a block diagram showing the structure of a processing device in a base station according to an embodiment of the present invention;

Figure 14 is a block diagram showing the structure of a processing device in a core network device in accordance with one embodiment of the present invention.

detailed description

The technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings. It should be noted that the features of the embodiments and the embodiments of the present application may be combined with each other without conflict.

Example 1

Embodiment 1 illustrates a schematic diagram of the first operation, as shown in FIG.

In Embodiment 1, the first modified bit group becomes the first bit group after the first operation. The first bit group and the first modified bit group respectively comprise a positive integer number of bits. The first operation includes at least one of {decompression, decryption, integrity verification}.

As an embodiment, the first bit group is an IP header. The first operation is performed in a PDCP layer in the UE.

As an embodiment, the first operation includes {decompression, decryption}; or the first operation includes {decompression, decryption, integrity verification}.

As an embodiment, the first bit group is generated by the first modified bit group after the integrity verification, the decryption and the decompression.

As an embodiment, the first bit group is generated after the first modified bit group is sequentially subjected to the decryption and the decompression.

As an embodiment, the number of bits after the first modified bit group is decompressed is greater than the number of bits in the first modified bit group.

As an embodiment, the decryption is raw data and a string of keys to mask.

As a sub-embodiment, the de-masking is a data and mask operation or operation.

As a sub-embodiment, the string of keys includes a Hyper Frame Number (HFN).

As a sub-embodiment, the string of keycasts includes a first security key.

As an embodiment, the first operation is performed in a user equipment.

As an embodiment, the first operation is implemented by a software program in the user device.

Example 2

Embodiment 2 exemplifies a schematic view of the third operation, as shown in FIG.

In Embodiment 2, the first bit group becomes the first modified bit group after the third operation. The first bit group and the first modified bit group respectively comprise a positive integer number of bits. The third operation includes at least one of {compression, encryption, integrity protection}.

As an embodiment, the first bit group is an IP header. The third operation is performed in the PDCP layer in the base station.

As an embodiment, the third operation includes {compression, encryption}; or the third operation includes {compression, encryption, integrity protection}.

As an embodiment, the first modified bit group is generated after the first bit group is sequentially subjected to the integrity protection, the encryption and the compression.

As an embodiment, the first bit group is generated after the first modified bit group is sequentially subjected to the encryption and the compression.

As an embodiment, the number of bits of the first bit group after compression is smaller than the number of bits in the first bit group.

As an embodiment, for the compression, the number of bits output is less than the number of bits input.

As an embodiment, the compression is Robust Header Compression (ROHC).

As an embodiment, the compression employs the compression algorithm exemplified in Table 5.5.1.1 of 3GPP TS 36.323.

As an embodiment, the encryption is used to ensure that the data remains confidential between the originating and terminating ends.

As an embodiment, the encryption uses a string of keys to mask the original data.

As an embodiment, the masking is an XOR operation of two data.

As an embodiment, the string of keys includes a Hyper Frame Number (HFN).

As an embodiment, the string of keys includes a Radio Bearer ID.

As an embodiment, the string of keys includes a PDCP sequence number (PDCP SN).

As an embodiment, the string of keycasts includes a first security key.

As an embodiment, the encryption uses the encryption algorithm described in TS 36.323.

As an embodiment, the integrity protection refers to: Implementing Message Authentication Code-Integrity (MAC-I) and data masking.

As an embodiment, the message verification code-integrity is implemented by an integrity protection algorithm.

As an embodiment, the input parameters protected by the integrity algorithm include a Hyper Frame Number (HFN).

As an embodiment, the input parameters protected by the integrity algorithm include a Radio Bearer ID.

As an embodiment, the input parameters protected by the integrity algorithm include a PDCP sequence number (PDCP SN).

As an embodiment, the input parameters of the integrity protection algorithm include a first security key.

As an embodiment, the input parameters of the integrity protection algorithm include data.

As an embodiment, the first operation is performed in a base station device.

As an embodiment, the first operation is implemented by a software program in a base station device.

Example 3

Embodiment 3 illustrates a schematic diagram of the second operation, as shown in FIG.

In Embodiment 3, the second modified bit group becomes a second bit group after the second operation. The second bit group and the second modified bit group respectively comprise a positive integer number of bits. The second operation includes at least one of {decryption, integrity verification}.

As an embodiment, the second bit group is an IP payload. The second operation is performed in the NAS of the UE.

As an embodiment, the second operation comprises decryption; or the second operation comprises {integrity verification, decryption}.

In one embodiment, the second bit group is generated after the second modified bit group is sequentially subjected to the integrity verification and the decryption.

As an embodiment, the second bit group is generated after the second modified bit group is subjected to the decryption.

As an embodiment, the decryption is raw data and a string of keys to mask.

As a sub-embodiment, the de-masking is a data and mask operation or operation.

As a sub-embodiment, the string of keys includes a Hyper Frame Number (HFN).

As a sub-embodiment, the string of keycasts includes a first security key.

As an embodiment, the second operation is performed in a user equipment.

As an embodiment, the second operation is implemented by a software program in the user device.

Example 4

Embodiment 4 exemplifies a schematic view of the fourth operation, as shown in FIG.

In Embodiment 4, the second bit group becomes the second modified bit group after the fourth operation. The second bit group and the second modified bit group respectively comprise a positive integer number of bits. The fourth operation includes at least one of {encryption, integrity protection}.

As an embodiment, the second bit group is an IP payload. The fourth operation is performed in a NAS in the core network device.

As an embodiment, the fourth operation includes encryption; or the fourth operation includes {encryption, Integrity protection}.

As an embodiment, the second modified bit group is generated after the second bit group sequentially passes the encryption and the integrity protection.

As an embodiment, the second modified bit group is generated after the second bit group is subjected to the encryption.

As an embodiment, the masking is an XOR operation of two data.

As an embodiment, the string of keys includes a Hyper Frame Number (HFN).

As an embodiment, the string of keys includes a Radio Bearer ID.

As an embodiment, the string of keys includes a PDCP sequence number (PDCP SN).

As an embodiment, the string of keycasts includes a first security key.

As an embodiment, the fourth operation is performed in a non-access network device, ie, a core network device.

As an embodiment, the fourth operation is implemented by a software program in the core network device.

Example 5

Embodiment 5 exemplifies a first operation and a third operation, as shown in FIG.

In Embodiment 5, the third operation includes at least a front of {compression, encryption, integrity protection} Both; the first operation includes at least two of {integrity verification, decryption, decompression}.

In Embodiment 5, the compression and the decompression are inverse operations, and the encryption and the decryption are inverse operations, and the integrity protection and the integrity verification are inverse operations.

As an embodiment, the first operation and the third operation are performed in a UE and a base station, respectively.

As an embodiment, the first operation and the third operation are performed in a PDCP layer of a UE and a PDCP layer of a base station, respectively.

As an embodiment, the first operation and the third operation are performed in a peer-to-peer layer of the UE and the base station, respectively.

Example 6

Embodiment 6 exemplifies a schematic diagram of the second operation and the fourth operation, as shown in FIG.

In Embodiment 6, the fourth operation includes at least the former of {Encryption, Integrity Protection}, and the second operation includes at least the latter of {Integrity Verification, Decryption}.

In Embodiment 6, the encryption and the decryption are inverse operations, and the integrity protection and the integrity verification are mutually reverse operations.

As an embodiment, the second operation and the fourth operation are performed in the UE and the core network device, respectively.

As an embodiment, the second operation and the fourth operation are performed in a NAS of a UE and a NAS of a core network device, respectively.

As an embodiment, the first operation and the third operation are performed in a peer-to-peer layer of the UE and the core network device, respectively.

Example 7

Embodiment 7 exemplifies a flow chart of transmission and reception of downlink data, as shown in FIG. In Fig. 7, step S31 is optional.

In Embodiment 7, the UE maintains the lower layer D0, the first layer D1, and the second layer D2; the base station maintains the lower layer C0 and the first layer C1; and the core network device maintains the second layer C2.

In step S10, the second layer C2 performs a fourth operation of transferring the first bit group and the second modified bit group to the first layer C1; in step S11, the first layer C1 performs a third operation, Pass The first set of bits is handed to the lower layer C0.

In step S21, the first layer D1 receives the first bit set from the lower layer D0, the first layer D1 performs a first operation; in step S20, the first layer D1 delivers the first bit group and the second modified bit group A second operation is performed on the second layer D2, the second layer D2.

In Embodiment 7, the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, The second modified bit group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group is used for the input of the first operation, the first bit group is the output of the first operation; the second modified bit group is used for the input of the second operation, the second bit group is The output of the second operation. The first operation includes at least one of {decompression, decryption, integrity verification}, and the second operation includes at least one of {decryption, integrity verification}. The first modified bit group and the second modified bit group belong to the same protocol data unit. The first set of bits includes the first modified bit group and the second modified bit group.

As an embodiment, the protocol data unit is a PDCP PDU.

As an embodiment, in step S31, the second layer C2 transmits the target information to the second layer D2.

As a sub-embodiment of the above embodiment, the data channel between the second layer C2 and the second layer D2 includes {first layer C1, lower layer C0, wireless channel, lower layer D0, first layer D1}.

As an embodiment, the target information includes at least one of {the first information in the present invention, the second information in the present invention}.

As an embodiment, the target information is carried by RRC signaling.

As an embodiment, the target information is carried by NAS information.

As an embodiment, the lower layer C0, the first layer C1, the second layer C2, the lower layer D0, and the first layer D1 and the second layer D2 respectively include an RLC layer, a PDCP layer, a NAS, an RLC layer, a PDCP layer, and a NAS.

As a sub-embodiment of the foregoing embodiment, the first layer C1 further includes an RRC (Radio Resource Control) layer, and the first layer D1 further includes an RRC layer.

As a sub-embodiment of the foregoing embodiment, the lower layer D0 further includes a MAC (Media Access Control) layer and a physical layer, and the lower layer C0 further includes a MAC layer and a physical layer.

As an embodiment, the core network device and the base station are connected through an S1 interface.

As an embodiment, the first modified bit group and the second modified bit group belong to the same PDCP PDU.

Example 8

Embodiment 8 exemplifies a flowchart of reception of downlink data, as shown in FIG. In Figure 8, the second layer, the first layer and the lower layer are all maintained by the UE.

In Embodiment 8, the first layer receives the first modified bit group and the second modified bit group from the lower layer; the first layer performs a first operation on the first modified bit group therein, and the second modified The bit group is transparently passed to the second layer; the second layer performs a second operation on the received second modified bit group. The first modified bit group and the second modified bit group belong to one higher layer PDU.

As an embodiment, the lower layer is an RLC layer.

As an embodiment, the first layer and the second layer are a PDCP layer and a NAS, respectively.

As an embodiment, the second information in the present invention is used to determine:

The first layer and the second layer are respectively a PDCP layer and a NAS; or

- the first layer and the second layer both belong to the PDCP layer; or

- The first layer and the second layer both belong to the NAS.

Example 9

Embodiment 9 exemplifies a flow chart of transmission of downlink data, as shown in FIG. In Figure 9, the lower layer is maintained by the base station.

In Embodiment 9, the second layer performs the fourth operation on the latter of the {first bit group, the second bit group} and then passes the diliver to the lower layer; the first layer pairs the {first bit from the second layer. The former of the group, the second modified bit group} is subjected to the third operation and then passed to the lower layer; the first layer transparently passes the second modified bit group from the second layer to the lower layer. The first modified bit group and the second modified bit group belong to one higher layer PDU.

As an embodiment, the lower layer is an RLC layer.

As an embodiment, the first layer includes at least a former one of a {PDCP layer, an RRC layer}, and the second layer is a NAS. The first layer and the second layer are respectively maintained by the base station and the UPS

- the first layer and the second layer both belong to the PDCP layer; or

- The first layer and the second layer both belong to the NAS.

Example 10

Embodiment 10 illustrates a schematic diagram of a first set of bits, as shown in FIG.

In Embodiment 10, the first set of bits is formed by a third bit group, the first modified bit group and the second modified bit group are sequentially cascaded.

As an embodiment, the first set of bits is a PDCP PDU, and the third set of bits includes a PDCP header.

Example 11

Embodiment 11 illustrates a schematic diagram of a network slice, as shown in FIG. In Figure 11, a given RAT (Radio Access Technology) includes three of the network slices, the network slice #1 shown corresponds to user type #1, and the network slice #2 shown corresponds to user type #2, The network slice #3 shown corresponds to user type #3. The network slice #1 shown corresponds to the service group #1, the network slice #2 shown corresponds to the service group #2, and the network slice #3 shown corresponds to the service group #3.

As an embodiment, the user type #1 is for a mobile broadband user.

As an embodiment, the user type #2 is for a general IOT (Internet of Things) user.

As an embodiment, the user type #3 is for an IOT user with special needs.

As an embodiment, the special demanded IOT user corresponds to a medical IOT user.

As an embodiment, the special demanded IOT user corresponds to a car network IOT user.

As an embodiment, the special demanded IOT user corresponds to an industrial robot IOT user.

As a sub-embodiment, the service group #1 includes at least one of {wireless communication, Internet} services.

As a sub-embodiment, the business group #2 includes at least one of {logistics, agriculture, weather} services.

As a sub-embodiment, the service group #3 includes {autopilot, industrial manufacturing} business At least one of them.

As a sub-embodiment, the given RAT is a RAT based on 5G technology.

As a sub-embodiment, the given RAT is a RAT based on NR (New Radio) technology.

Example 12

Embodiment 12 exemplifies a structural block diagram of a processing device in a UE, as shown in FIG. In FIG. 12, the UE processing apparatus 100 is mainly composed of a first processing module 101 and a second processing module 102.

The first processing module 101 is configured to perform a first operation at the first layer; the second processing module 102 is configured to perform a second operation at the second layer.

In Embodiment 12, the first modified bit group is used for the input of the first operation, the first bit group is an output of the first operation; the second modified bit group is used for the second operation Input, the second set of bits is the output of the second operation. The first modified bit group and the second modified bit group correspond to the same protocol data unit. The bit group includes a positive integer number of bits. The first operation includes {integrity verification, decryption, decompression}, the second operation includes {integrity verification, decryption}; or the first operation includes {decryption, decompression}, the second operation Includes decryption.

As an embodiment, the first processing module 101 is further used for at least one of the following:

- Receive the first message.

- Receive the second message.

Wherein the first information is used for the first operation and the second operation. The second information is used to determine that the first operation and the second operation are performed in the first layer and the second layer, respectively. The first layer includes a PDCP layer and the second layer is a NAS.

As an embodiment, the first processing module 101 is further configured to: pass the first set of bits from the lower layer to the first layer; and the second processing module 102 is further configured to deliver the first bit group from the first layer. And the second modified bit group is given to the second layer. The first set of bits includes the first modified bit group and the second modified bit group.

As an embodiment, the first bit block is an IP header and the second bit block is an IP payload.

Example 13

Embodiment 13 exemplifies a structural block diagram of a processing device in a base station, as shown in FIG. In FIG. 13, the base station processing apparatus 200 is mainly composed of a third processing module 201.

The third processing module 201 is configured to perform the third operation in the {third operation, the fourth operation} in the first layer.

In Embodiment 13, the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second The modified bit group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.

As an embodiment, the third processing module 201 is further configured to:

Receiving the first bit group and the second modified bit group from the second layer, and transmitting the first bit set from the first layer to the lower layer.

As an embodiment, the third processing module 201 is further used for at least one of the following:

Step A10. Receive the first information over the S1 interface; and transmit the first information over the air interface.

Wherein the first information is used for the third operation and the fourth operation. The second information is used to determine the first layer and the second layer; or the second information is used to determine whether {the first layer, the second layer} are the same.

Example 14

Embodiment 14 exemplifies a structural block diagram of a processing device in a core king device, as shown in FIG. In FIG. 14, the processing device 300 of the core network device is mainly composed of a fourth processing module 301.

The fourth processing module 301 is configured to perform the fourth operation in the {third operation, fourth operation} in the second layer.

In Embodiment 14, the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second Modified bit group Is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same PDCP PDU.

As an embodiment, the fourth processing module 301 is further configured to:

Passing the first bit group and the second modified bit group from the second layer to the first layer;

Wherein the third operation is performed in the first layer. The first modified bit group and the second modified bit group correspond to the same protocol data unit. The first layer is maintained by a base station device.

As an embodiment, the fourth processing module 301 is further used for at least one of the following:

- Send the first information through the S1 interface;

- Send the second message through the S1 interface.

Wherein the first information is used for the third operation and the fourth operation. The second information is used to determine at least the latter of {the first layer, the second layer}; or the second information is used to determine {the first layer, the second layer } Is it the same? The second layer is a NAS, and the first layer is a PDCP layer. The first information is a network slice (Slice) specific. The second information is a network slice (Slice) specific.

One of ordinary skill in the art can appreciate that all or part of the above steps can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium such as a read only memory, a hard disk or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module unit in the above embodiment may be implemented in hardware form or in the form of a software function module. The application is not limited to any specific combination of software and hardware. The UE and the terminal in the present invention include but are not limited to RFID, IoT terminal equipment, MTC (Machine Type Communication) terminal, vehicle communication device, wireless sensor, network card, mobile phone, tablet computer, notebook and other wireless communication devices. . The base station, the base station device, and the network side device in the present invention include, but are not limited to, a macro communication base station, a micro cell base station, a home base station, a relay base station, and the like.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modification made, equivalent to replacement, within the spirit and principles of the present invention, Improvements and the like should be included in the scope of protection of the present invention.

Claims

A method in a user equipment for wireless communication, comprising the steps of:

- Step A. Performing the first operation at the first level;

- Step B. Perform a second operation at the second level.

Wherein the first modified bit group is used for the input of the first operation, the first bit group is the output of the first operation; the second modified bit group is used for the input of the second operation, The second bit is the output of the second operation. The first modified bit group and the second modified bit group correspond to the same protocol data unit. The bit group includes a positive integer number of bits. The first operation includes at least one of {decompression, decryption, integrity verification}, and the second operation includes at least one of {decryption, integrity verification}.
The method according to claim 1, wherein the step A further comprises the following step A1, the step B further comprising the following step B1:

Step A1. Passing a first set of bits from the lower layer to the first layer;

Step B1. Passing the first bit group and the second modified bit group from the first layer to the second layer.

The first set of bits includes the first modified bit group and the second modified bit group.
The method according to claim 1, wherein the step A further comprises the following steps:

- Step A10. Receive the first information.

Wherein the first information is used for the first operation and the second operation.
The method according to any one of claims 1-3, wherein the step A further comprises the following steps:

- Step A11. Receiving the second information.

Wherein the second information is used to determine at least one of {the first layer, the second layer}; or the second information is used to determine the first layer and the second Whether the layers are the same.
The method according to any one of claims 1-4, wherein the first bit group and the second bit group correspond to a first service group, and the first service group includes one or more services.
The method of claims 1-5, wherein the first layer is a packet data convergence protocol layer and the second layer is a non-access layer.
A method in a base station device for wireless communication, comprising the steps of:

- Step A. The third operation in the {third operation, fourth operation} is performed at the first layer.

Wherein the first bit group is used for the input of the third operation, and the first modified bit group is the first bit The output of the three operations; the second bit group is used for the input of the fourth operation, and the second modified bit group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.
The method according to claim 7, wherein said step A further comprises the steps of:

Step A1. Receiving the first bit group and the second modified bit group from the second layer, and transmitting the first bit set from the first layer to the lower layer.

The first set of bits includes the first modified bit group and the second modified bit group. The fourth operation is performed in the second layer.
The method according to claim 7, wherein said step A further comprises at least one of the following steps:

Step A10. Receive the first information via the S1 interface; or send the first information over the air interface.

- Step A11. Receive the second information via the S1 interface; or send the second information over the air interface.

Wherein the first information is used for the third operation and the fourth operation. The second information is used to determine at least the latter of {the first layer, the second layer}; or the second information is used to determine whether the first layer and the second layer are the same.
The method according to any of claims 7-9, wherein the first bit group and the second bit group correspond to a first service group, and the first service group includes one or more services.
The method of claims 7-10, wherein the first layer is a packet data convergence protocol layer and the second layer is a non-access layer.
A method in a non-access network device, comprising the steps of:

- Step A. The fourth operation in the {third operation, fourth operation} is performed at the second layer.

Wherein the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second modified bit The group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.
The method according to claim 12, wherein said step A further comprises the steps of:

Step A1. Passing the first bit group and the second modified bit group from the second layer to the first layer;

Wherein the third operation is performed in the first layer. The first modified bit group and the second modified bit group correspond to the same protocol data unit.
The method according to claim 12, 13, wherein said step A further comprises at least one of the following steps:

- Step A10. Sending the first information through the S1 interface;

- Step A11. Send the second information via the S1 interface.

Wherein the first information is used for the third operation and the fourth operation. The second information is used to determine at least the latter of {the first layer, the second layer}; or the second information is used to determine whether the first layer and the second layer are the same.
The method according to any one of claims 12-14, wherein the first bit group and the second bit group correspond to a first service group, and the first service group includes one or more services.
The method according to claims 12-15, wherein the first layer is a packet data convergence protocol layer and the second layer is a non-access layer.
A user equipment used for wireless communication, comprising the following modules:

a first processing module: for performing a first operation at the first layer;

- a second processing module: for performing a second operation at the second layer.

Wherein the first modified bit group is used for the input of the first operation, the first bit group is the output of the first operation; the second modified bit group is used for the input of the second operation, The second bit is the output of the second operation. The first modified bit group and the second modified bit group correspond to the same protocol data unit. The bit group includes a positive integer number of bits. The first operation includes at least one of {decompression, decryption, integrity verification}, and the second operation includes at least one of {decryption, integrity verification}.
A base station device used for wireless communication, comprising the following modules:

a third processing module: for performing a third operation in the {third operation, fourth operation} at the first layer.

Wherein the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second modified bit The group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.
A non-access network device, which includes the following modules:

a fourth processing module: for performing a fourth operation in the {third operation, fourth operation} at the second layer.

Wherein the first bit group is used for the input of the third operation, the first modified bit group is the output of the third operation; the second bit group is used for the input of the fourth operation, the second modified bit The group is the output of the fourth operation. The third operation includes at least one of {compression, encryption, integrity protection}, and the fourth operation includes at least one of {encryption, integrity protection}. The first modified bit group and the second modified bit group correspond to the same protocol data unit.