WO2020147643A1

WO2020147643A1 - Security protection method and apparatus

Info

Publication number: WO2020147643A1
Application number: PCT/CN2020/071237
Authority: WO
Inventors: 张博
Original assignee: 华为技术有限公司
Priority date: 2019-01-15
Filing date: 2020-01-09
Publication date: 2020-07-23
Also published as: CN111436086A; CN111436086B

Abstract

The present application provides a security protection method and apparatus, relating to the technical field of communications and used for ensuring the security of a session in a switching scene. The method comprises: a second access network device receives a switching request, wherein the switching request is used for indicating to switch a terminal from a first access network device to the second access network device, and comprises the information of M sessions, and the information of each session in the information of the M sessions comprises the first identifier of the session; the second access network device determines N target sessions from the M sessions, wherein the N target sessions are the non-zero subset of the M sessions; the second access network device determines the second identifier of each of the N target sessions; the second access network device transmits N pieces of correspondence information to the terminal, wherein the N pieces of correspondence information has one-to-one correspondence to the N target sessions, and each of the N pieces of correspondence information is used for indicating a correspondence between the first identifier and the second identifier of a corresponding target session.

Description

Safety protection method and device

This application claims the priority of a Chinese patent application filed with the State Intellectual Property Office, the application number is 201910037122.0, and the application name is "Security Protection Method and Device" on January 15, 2019, the entire content of which is incorporated into this application by reference.

Technical field

The embodiments of the present application relate to the field of communications, and in particular to a security protection method and device.

Background technique

In the wireless communication system, an end-to-end protection mechanism is adopted between the terminal and the core network to protect the information in the session. However, the end-to-end protection mechanism does not encrypt the information (for example, session ID, bearer ID, etc.) used to identify the session in the data packet, so an attacker can easily obtain this information during the air interface transmission stage and track it based on this information To the session, thereby threatening the security of the session.

In order to solve this technical problem, the industry proposes a technical solution: during the session establishment process, the access network device generates a short-term identifier corresponding to the session, and sends the short-term identifier to the terminal. Therefore, the data packet transmitted between the access network device and the terminal does not carry information for identifying the session, but carries the short-term identifier. In this way, even if the attacker obtains the short-term identifier, since the attacker does not know the correspondence between the short-term identifier and the information used to identify the session, the attacker cannot track the session, thereby ensuring the security of the session.

However, in a scenario where the access network device is switched, the industry has not yet provided a corresponding solution on how to ensure the security of the session.

Summary of the invention

This application provides a security protection method and device, which are used to ensure the security of the session in a handover scenario.

In order to achieve the above purpose, this application adopts the following technical solutions:

In a first aspect, a security protection method is provided, including: a second access network device receives a handover request, the handover request is used to instruct the terminal to switch from the first access network device to the second access network device, and the handover request includes M The information of each session, the information of each session in the information of M sessions includes the first identifier of the session, where M is a positive integer; the second access network device determines N target sessions from the M sessions; the N target sessions are A non-zero subset of M sessions, N is less than or equal to M, and N is a positive integer; the second access network device determines the second identifier of each target session in the N target sessions; the second access network device sends to the terminal N pieces of correspondence information, the N pieces of correspondence information correspond to the N target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the corresponding target session. Based on the above technical solution, in the handover process, both the terminal and the second access network device can obtain N correspondence information. In this way, after the handover is completed, since the correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the target session, when the terminal and the second access network device send the message of the target session, The message of the target session does not carry the first identifier, but carries the second identifier, thereby preventing the target session from being tracked by an attacker and ensuring the security of the target session.

In a possible design, the second access network device determining the second identifier of each of the N target sessions includes: the second access network device sends information about the N target sessions to the core network device; second The access network device receives the second identifier of each target session in the N target sessions from the core network device.

In a possible design, the second access network device determines the second identifier of each target session in the N target sessions, including: the second access network device generates each target in the N target sessions according to a preset rule The second identifier of the session.

In a possible design, the first identifier of the session includes at least one of the following parameters: the identifier of the link between the terminal and the user plane function (UPF), and the link between the terminal and the UPF Tunnel ID, session ID, UPF address, terminal ID, quality of service flow ID, bearer ID, slice ID, and UPF ID.

In a possible design, the correspondence information includes the first identifier and the second identifier of the target session.

In a second aspect, a security protection method is provided, including: a second AMF receives information about M sessions sent by a first AMF, the information about each session in the information about M sessions includes a first identifier of the session, and M is a positive integer ; The second AMF determines N target sessions from M sessions, where N target sessions are a non-zero subset of M sessions, where N is less than or equal to M, and N is a positive integer; the second AMF determines each of the N target sessions The second identifier of a target session; the second AMF sends N pieces of correspondence information to the second access network device, and the N pieces of correspondence information correspond to the N pieces of target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information The corresponding relationship between the first identifier and the second identifier used to indicate the corresponding target session; the second AMF sends N pieces of corresponding relationship information to the terminal. Based on the above technical solution, in the handover process, both the terminal and the second access network device can obtain N correspondence information. In this way, after the handover is completed, since the correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the target session, when the terminal and the second access network device send the message of the target session, The message of the target session does not carry the first identifier, but carries the second identifier, thereby preventing the target session from being tracked by an attacker and ensuring the security of the target session.

In a possible design, the second AMF receives information about M sessions sent by the first AMF, including: the second AMF receives a registration request, and the registration request includes the identification of the terminal; the second AMF sends a context establishment request to the first AMF , The context establishment request is used to request the information of the session of the terminal; the second AMF receives the information of the M sessions sent by the first AMF.

In a possible design, the second AMF determines N target sessions from M sessions, including: the second AMF sends M session information to the network device; after that, the second AMF receives N target session information sent by the network device . Exemplarily, the network device may be a second access network device or a session management function network element (session management function, SMF).

In a possible design, the second AMF determines the second identifier of each of the N target sessions, including: the second AMF sends information about the N target sessions to the network device; after that, the second AMF receives the information sent by the network device N correspondence information of.

In a possible design, the second AMF sending N pieces of correspondence information to the terminal includes: the second AMF sends N pieces of correspondence information to the terminal through the second access network device.

In a possible design, the second AMF sending N pieces of correspondence information to the terminal includes: the second AMF sends N pieces of correspondence information to the terminal through the first access network device and the first AMF.

In a third aspect, a security protection method is provided, including: AMF receives M bearer information sent by MME; AMF sends M bearer information to SMF; AMF receives M session information from SMF, and M session information There is a one-to-one correspondence with the information carried by M. The information of each session in the information of the M sessions includes the first identifier of the session, where M is a positive integer; AMF determines N target sessions from M sessions, and N is less than or equal to M , N is a positive integer; AMF determines the second identifier of each target session in N target sessions; AMF sends N correspondence information to the second access network device, and N correspondence information corresponds to N target sessions one-to-one Each of the N correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the corresponding target session; the AMF sends N correspondence information to the terminal. Based on this technical solution, in the handover process, both the terminal and the second access network device can obtain N correspondence information. In this way, after the handover is completed, since the correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the target session, when the terminal and the second access network device send the message of the target session, The message of the target session does not carry the first identifier, but carries the second identifier, thereby preventing the target session from being tracked by an attacker and ensuring the security of the target session.

In a possible design, before the AMF receives the M bearer information sent by the MME, it includes: the MME receives a handover request, the handover request is used to instruct the terminal to switch from the first access network device to the second access network Device, the handover request includes M bearer information.

In a possible design, before the AMF receives the M bearer information sent by the MME, it includes: the AMF receives a registration request, the registration request includes the identification of the terminal; the AMF sends a context establishment request to the MME, and the context establishment request is used for the request Information carried by the terminal.

In a possible design, the AMF determines N target sessions from the M sessions, including: the AMF sends M session information to the network device; after that, the AMF receives the N target session information sent by the network device. Exemplarily, the network device may be a second access network device or a session management function network element (session management function, SMF).

In a possible design, the AMF determines the second identifier of each of the N target sessions, including: the second AMF sends the information of the N target sessions to the network device; after that, the AMF receives the N corresponding information sent by the network device Relationship information.

In a possible design, the AMF sending N pieces of correspondence information to the terminal includes: the AMF sends N pieces of correspondence information to the terminal through the second access network device.

In a possible design, the second AMF sending N pieces of correspondence information to the terminal includes: the AMF sends N pieces of correspondence information to the terminal through the first access network device and the MME.

In a fourth aspect, a security protection method is provided, including: a first access network device determines N target sessions from M sessions of a terminal, where N is less than or equal to M, and both M and N are positive integers; The network access device determines the second identifier of each target session in the N target sessions; the first access network device sends N correspondence information to the second access network device, and the N correspondence information is one for the N target sessions Correspondingly, each of the N correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the corresponding target session; the first access network device sends N correspondence information to the terminal. Based on this technical solution, both the terminal and the second access network device can obtain N correspondence information. In this way, after the handover is completed, since the correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the target session, when the terminal and the second access network device send the message of the target session, The message of the target session does not carry the first identifier, but carries the second identifier, thereby preventing the target session from being tracked by an attacker and ensuring the security of the target session.

In a possible design, before the first access network device determines N target sessions from the M sessions of the terminal, the method further includes: the first access network device determines to initiate a handover procedure.

In a fifth aspect, a security protection method is provided, including: a first AMF receives a handover request sent by a first access network device, the handover request is used to instruct the terminal to switch from the first access network device to the second access network Device, the handover request includes information about M sessions, and the information about each session in the information about M sessions includes the first identifier of the session, where M is a positive integer; the first AMF determines N target sessions from the M sessions, and N is less than Or equal to M, both M and N are positive integers; the first AMF determines the second identifier of each target session in N target sessions; the first AMF sends N correspondence information to the second access network device through the second AMF , The N correspondence information corresponds to the N target sessions one-to-one, and each correspondence information in the N correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the corresponding target session; the first AMF passes the first An access network device sends N correspondence information to the terminal. Based on this technical solution, in the handover process, both the terminal and the second access network device can obtain N correspondence information. In this way, after the handover is completed, since the correspondence information is used to indicate the correspondence between the first identifier and the second identifier of the target session, when the terminal and the second access network device send the message of the target session, The message of the target session does not carry the first identifier, but carries the second identifier, thereby preventing the target session from being tracked by an attacker and ensuring the security of the target session.

In a sixth aspect, a communication device is provided, including: a receiving module, a processing module, and a sending module. The communication device is configured to execute the method according to any one of the first aspect or the fifth aspect.

In a seventh aspect, a communication device is provided, including: a processor, configured to couple with a memory, read instructions in the memory, and implement any one of the first to fifth aspects according to the instructions The method described.

In an eighth aspect, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions that, when run on a communication device, enable the communication device to execute any one of the first to fifth aspects. The method described.

In a ninth aspect, a computer program product containing instructions is provided, which when running on a communication device, enables the communication device to execute the method described in any one of the first aspect to the fifth aspect.

In a tenth aspect, a chip is provided. The chip includes a processing module and a communication interface. The communication interface is used to transmit received code instructions to the processing module. The processing module is used to run the code instructions to support the communication device to execute the first aspect to The method of any one of the fifth aspect. The code instruction can come from the memory of the chip content, or from the memory outside the chip. Optionally, the processing module may be a processor or a microprocessor or an integrated circuit integrated on the chip. The communication interface may be an input/output circuit or a transceiver pin on the chip.

Among them, the technical effects brought by any of the design methods of the sixth aspect to the tenth aspect can be referred to the beneficial effects of the corresponding method provided above, which are the same as the technical effects brought about by the design method, and will not be repeated here. .

BRIEF DESCRIPTION

1 is a schematic structural diagram of a communication system provided by an embodiment of the present application;

2 is a schematic structural diagram of a communication device provided by an embodiment of this application;

FIG. 3 is a flowchart of a security protection method provided by an embodiment of the application;

4 is a flowchart of another security protection method provided by an embodiment of the application;

FIG. 5 is a flowchart of another security protection method provided by an embodiment of the application;

FIG. 6 is a flowchart of another security protection method provided by an embodiment of the application;

FIG. 7 is a flowchart of another security protection method provided by an embodiment of the application;

FIG. 8 is a flowchart of another security protection method provided by an embodiment of the application;

FIG. 9 is a flowchart of another security protection method provided by an embodiment of the application;

FIG. 10 is a schematic structural diagram of a communication device provided by an embodiment of your application.

detailed description

As an example to facilitate the understanding of the technical solutions of the present application, some concepts will be briefly introduced below.

1. The first access network device, the second access network device, the first AMF, and the second AMF

The first access network device is the access network device that the terminal is connected to before the handover. The first access network device may also be referred to as the source access network device.

The second access network device is an access network device to which the terminal is connected after handover, or an access network device to which the second access network device is connected after the terminal is reregistered. The second access network device may also be referred to as a target access network device.

The first AMF is the AMF that provides services to the terminal before handover. The first AMF may also be referred to as the source AMF.

The second AMF is the AMF that provides services for the terminal after the handover. The second AMF may also be referred to as the target AMF.

2. The first identification and the second identification of the session

Optionally, the first identifier of the session is one of the following parameters: the identifier of the link between the terminal and the UPF, the tunnel identifier of the link between the terminal and the UPF, the slice identifier, the session identifier, the address of the UPF, the address of the UPF Identifier, terminal identifier, quality of service (QoS) flow identifier, and bearer identifier. Wherein, the address of the UPF includes: an internet protocol (IP) address of the UPF, a media access control (MAC) address of the UPF, or an instance identifier of the UPF. The above-mentioned bearer identifier includes: a radio bearer identifier, an evolved packet system (evolved packet system, EPS) bearer identifier, an evolved radio access bearer (E-RAB) identifier or a future network bearer identifier.

The second identifier of the session has a corresponding relationship with the first identifier of the session. The second identifier of the session is used to ensure the security of the session. It is understandable that in this embodiment of the application, the second identifier of the session is not required to reflect the relevant information of the session, even if the attacker intercepts the second identifier of the session, because the attacker does not know the second identifier of the session and the first Correspondence between one identifier, so the attacker cannot track the session through the second identifier of the session.

The second identifier of the session can be a value generated using a certain derivation rule, or a random number generated randomly, or some existing identifiers, such as the relevant identifier of the cell where the terminal is located, the cell terminal identifier, and the temporary wireless network identifier (radio network temporary identity, RNTI), or carrier frequency, or identification related to air interface resources. Exemplarily, the carrier frequency may be a 5G carrier frequency, or a 4G carrier frequency, etc. Among them, the 4G carrier frequency can also be called the long-term evolution radio access network absolute radio frequency channel number (E-UTRA absolute radio frequency channel number, EARFCN). Among them, the wireless network temporary identity may be a cell radio network temporary identity (C-RNTI), a temporary C-RNTI, a paging RNTI, a multicast broadcast RNTI, an inactive RNTI, etc., without limitation.

In the description of this application, unless otherwise stated, "/" means "or", for example, A/B may mean A or B. The "and/or" in this article is only an association relationship describing the associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone These three situations. In addition, "at least one" means one or more, and "multiple" means two or more. The words "first" and "second" do not limit the number and execution order, and the words "first" and "second" are not necessarily different.

It should be noted that, in this application, the words "exemplary" or "for example" are used as examples, illustrations or explanations. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being more preferred or advantageous than other embodiments or design. Rather, the use of words such as "exemplary" or "for example" is intended to present relevant concepts in a specific manner.

In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly explain the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. With the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

The technical solutions provided in the embodiments of the present application may be applied to various communication systems, for example, a new radio (NR) communication system using 5th generation (5G) communication technology, a future evolution system, or multiple communication fusion Systems, etc. The technical solution provided in this application can be applied to a variety of application scenarios, such as machine to machine (M2M), macro and micro communications, enhanced mobile broadband (eMBB), ultra-high reliability and ultra-low latency Scenarios such as communication (ultra-reliable&low latency communication, uRLLC) and massive Internet of Things communication (massive machine type communication, mMTC).

As shown in FIG. 1, it is a schematic structural diagram of a communication system provided by an embodiment of this application. The communication system includes: terminals, access network (AN) equipment, and core network (core network).

Among them, the terminal is used to provide users with voice and/or data connectivity services. The terminal may have different names, such as user equipment (UE), access terminal, terminal unit, terminal station, mobile station, mobile station, remote station, remote terminal, mobile device, wireless communication device, terminal agent Or terminal devices, etc. Optionally, the terminal may be various handheld devices with communication functions, vehicle-mounted devices, wearable devices, and computers, which are not limited in this embodiment of the present application. For example, the handheld device may be a smart phone or a virtual reality (VR) device. The vehicle-mounted device may be a vehicle-mounted navigation system. The wearable device may be a smart bracelet. The computer can be a personal digital assistant (PDA) computer, a tablet computer, and a laptop computer.

The access network device can be an access point for wireless communication or wired communication, such as a base station or a base station controller, an access point or wifi controller for wireless-fidelity (wifi), or an access for fixed network access Wait. The base station may include various types of base stations, such as micro base stations (also called small stations), macro base stations, relay stations, access points, etc., which are not specifically limited in the embodiment of the present application. In the embodiment of this application, the base station may be a base station (BTS) in the global system for mobile communication (GSM), code division multiple access (CDMA), and broadband The base station (node B) in wideband code division multiple access (WCDMA), the evolutional node B (eNB or e-NodeB) in the long term evolution (LTE), the Internet of Things ( eNB in internet of things (IoT) or narrowband-internet of things (NB-IoT), base station in future 5G mobile communication network or future evolution of public land mobile network (PLMN) The embodiment of this application does not impose any restriction on this.

As a bearer network, the core network provides an interface from a terminal to a data network (data network, DN), provides communication connection, authentication, management, policy control, and completes the bearing of data services for the terminal. The core network includes various core network equipment, such as access and mobility management function (AMF), UPF, SMF, etc.

Among them, the AMF is used for access control and mobility management for the terminal to access the network, and the AMF communicates with the access network equipment through the N2 interface.

SMF is used to manage the user's packet data unit (PDU) session and QoS flow, and to formulate packet inspection and forwarding rules for UPF.

UPF is used for functions such as routing and forwarding of user data.

The foregoing AMF, SMF, and UPF are only a name, which does not constitute a limitation on the device itself. It is understandable that in the 5G network and other future networks, AMF, SMF, and UPF may also be other names, which are not specifically limited in the embodiment of the present application. For example, the UPF may also be referred to as a UPF network element or a UPF entity, and a unified description is provided here, and details are not described below.

Optionally, the core network device may be implemented by one device, or jointly implemented by multiple devices, or may be a functional module in one device, which is not specifically limited in the embodiment of the present application. It is understandable that the above-mentioned functional modules can be network elements in hardware devices, software functional modules running on dedicated hardware, or virtualized functional modules instantiated on a platform (for example, a cloud platform).

The terminal, access network equipment, and core network equipment in FIG. 1 can be implemented by the communication device in FIG. 2. As shown in FIG. 2, the communication device includes: at least one processor 101, a communication line 102, a memory 103 and at least one communication interface 104.

The processor 101 may be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more used to control the execution of the program program of the present application integrated circuit.

The communication line 102 may include a path to transfer information between the aforementioned components.

The communication interface 104 uses any transceiver-like device to communicate with other devices or communication networks, such as Ethernet, RAN, wireless local area networks (WLAN), and so on.

The memory 103 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), or other types of information and instructions that can be stored The dynamic storage device can also be electrically erasable programmable read-only memory (electrically erasable programmable-read-only memory (EEPROM), read-only compact disc (compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (Including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by a computer Any other media accessed, but not limited to this. The memory can exist independently and is connected to the processor through the communication line 102. The memory can also be integrated with the processor. The memory provided by the embodiments of the present application may generally be non-volatile. The memory 103 is used to store computer execution instructions for executing the solution of the present application, and the processor 101 controls the execution. The processor 101 is configured to execute computer-executable instructions stored in the memory 103, so as to implement the methods provided in the following embodiments of the present application.

Optionally, the computer execution instructions in the embodiments of the present application may also be called application program codes, which are not specifically limited in the embodiments of the present application.

In a specific implementation, as an embodiment, the processor 101 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 2.

In a specific implementation, as an embodiment, the communication device may include multiple processors, such as the processor 101 and the processor 107 in FIG. 2. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here may refer to one or more devices, circuits, and/or processing cores for processing data (for example, computer program instructions).

In a specific implementation, as an embodiment, the communication apparatus may further include an output device 105 and an input device 106. The output device 105 communicates with the processor 101 and can display information in various ways. For example, the output device 105 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait. The input device 106 communicates with the processor 101 and can receive user input in a variety of ways. For example, the input device 106 may be a mouse, a keyboard, a touch screen device, or a sensing device.

The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

Example one

As shown in FIG. 3, a security protection method provided by an embodiment of the present application is applied in a scenario where a handover occurs between a terminal and an access network device. The handover request can be transmitted through the interface between the two access network devices. The interface between two access network devices can be called an Xn interface. Hereinafter, for ease of description, the switching scenario involved in FIG. 3 is referred to as Xn switching (or Xn interface switching) for short. The method shown in Figure 3 includes the following steps:

S101. The first access network device sends a handover request to the second access network device.

Wherein, the handover request is used to instruct to handover the terminal from the first access network device to the second access network device.

The handover request includes information about M sessions, and M is a positive integer. Wherein, the session information includes the first identifier of the session. Optionally, the session information further includes at least one of the following parameters: session type, access type, data network name (DNN) and single network slice selection assistance information, S-NSSAI).

In the embodiment of the present application, the handover request may further include at least one of the terminal's identity and the slice identity (ID).

It should be noted that the reason why the first access network device initiates the handover process can refer to the description in the prior art, which is not repeated here. For example, when the first access network device detects that the terminal moves out of the area covered by the first access network device, the first access network device may initiate a handover procedure.

S102. The second access network device determines N target sessions from the M sessions.

Among them, N target sessions are a non-zero subset of M sessions. N is less than or equal to M, and N is a positive integer.

In the embodiment of the present application, the target session is a session that requires security protection from the terminal to the UPF. In other words, the target session is the session for which the second identifier needs to be allocated.

Implementation method 1: M sessions are all target sessions by default.

Optionally, the protocol defines that all sessions of the terminal are target sessions. Or, the network pre-configures all sessions of the terminal to be target sessions. For example, the core network device may send indication information to notify the second access network device to determine all the M sessions as target sessions.

Implementation manner 2: For each of the M sessions, the second access network device determines whether the session is a target session according to at least one parameter included in the session information.

For example, the second access network device determines whether the session is a target session according to the session type included in the session information. For example, if the session belongs to the first session type, the second access network device determines that the session is a target session; if the session belongs to the second session type, the second access network device determines that the session is not a target session.

For another example, the second access network device determines whether the session is a target session according to the S-NSSAI and/or DNN included in the session information. For example, the second access network device is pre-configured with whitelist information, and the whitelist information includes one or more S-NSSAIs. It is understandable that if the S-NSSAI included in the session information is in the whitelist information, the session is the target session. If the S-NSSAI part contained in the session information and the whitelist information, the session is not a target session.

Implementation manner 3: For each of the M sessions, the second access network device determines whether the session is a target session according to the first indication information corresponding to the session. Wherein, the first indication information is used to indicate whether the session is a target session.

Optionally, the first indication information corresponding to the session may be carried in the information of the session.

Or, the first indication information corresponding to the session is obtained by the second access network device from other network devices (for example, the access network device or the core network device). For example, the second access network device may send all or part of the session information to other network devices, so that other network devices can determine whether the session is a target session; after that, the second access network device receives the information sent by other network devices. The first instruction information. It is understandable that other network devices can refer to the second implementation manner above to determine whether the session is a target session.

Optionally, the first indication information may be represented by one or more bits. Taking 1 bit as an example, "0" indicates that the session is a target session, and "1" indicates that the session is not a target session.

Implementation manner 4: For each of the M sessions, if the session information carries second indication information, the second access network device determines that the session is the target session. If the information of the session does not carry the second indication information, the second access network device determines that the session is not a target session.

Implementation manner 5: The second access network device determines whether the M sessions are all target sessions according to the third indication information. Wherein, the third indication information is used to indicate whether the M sessions are all target sessions.

Optionally, the third indication information is carried in the handover request.

Or, the third indication information is obtained by the second access network device from other network devices. For example, the second access network device may send information about M sessions to other network devices. After that, the second access network device receives the third indication information sent by other network devices.

Optionally, the third indication information may be represented by one or more bits. Taking 1 bit as an example, "0" indicates that M sessions are all target sessions, and "1" indicates that M sessions are not all target sessions.

It can be understood that, in the case where the M sessions are not all target sessions, the second access network device may determine N target sessions from the M sessions according to the foregoing implementation manner 1 to implementation manner 4.

Implementation manner 6. If the second access network device receives the fourth indication information, the second access network device determines that the M sessions are all target sessions; if the second access network device does not receive the fourth indication information, then The second access network device determines that the M sessions are not all target sessions.

Optionally, the fourth indication information may be carried in the handover request or other signaling.

It is understandable that, by adopting implementation manner 5 or implementation manner 6, the first access network device may use a third indication information or fourth indication information to enable the second access network device to learn that the M sessions are all target sessions, so that Conducive to saving signaling overhead.

The foregoing implementation manners 1 to 6 are examples of methods for the second access network device to determine the target session, and do not constitute specific limitations.

S103. The second access network device determines the second identifier of each target session in the N target sessions.

For each target session, the second access network device may generate the second identifier of the target session according to a preset rule. The preset rules are pre-configured or defined in the protocol. For example, taking the preset rule as an encryption algorithm as an example, the second access network device encrypts the first identifier of the target session according to the preset encryption algorithm to generate the second identifier of the target session. For another example, taking the preset rule as a hash type algorithm as an example, the second access network device performs a hash operation on the first identifier of the target session according to the preset hash type algorithm to generate the second identifier of the target session. Among them, the hash type algorithm is a function designed based on a hash algorithm or an extended hash algorithm.

Or, for each target session, the second access network device may obtain the second identifier of the target session from other network devices. For example, the second access network device sends fifth indication information to the network device, where the fifth indication information includes information about the target session, and the fifth indication information is used to enable the network device to generate a second identifier of the target session; after that, The second access network device receives the second identifier of the target session sent by the network device.

It is understandable that, for each target session, the second access network device will store the correspondence between the second identifier of the target session and the first identifier of the target session. On the one hand, the message of the target session sent by the second access network device to the terminal carries the second identifier instead of the first identifier, which prevents the session from being tracked by an attacker and ensures the security of the session. On the other hand, after the second access network device receives the message of the target session, the second access network device uses the corresponding relationship between the first identifier of the target session and the second identifier of the target The first identifier replaces the second identifier included in the message of the target session to ensure that the message of the target session sent by the terminal can be normally transmitted in the core network.

S104. The second access network device sends N pieces of correspondence information to the first access network device.

Among them, N pieces of correspondence information correspond to N pieces of target sessions one-to-one. The corresponding relationship information is used to indicate the corresponding relationship between the first identifier and the second identifier of the corresponding target session; in other words, the corresponding relationship information is used to indicate the corresponding relationship between the corresponding target session and the second identifier. Optionally, the correspondence information includes a first identifier of the target session and a second identifier of the target session.

It can be understood that the N correspondence information can be sent independently, or can be encapsulated in one signaling and sent together.

As an implementation manner, the second access network device sends handover request response information to the first access network device, where the handover request response information carries N pieces of correspondence information.

S105. The first access network device sends N pieces of correspondence information to the terminal.

As an implementation manner, the first access network device sends handover command information to the terminal. Wherein, the switching command information is used to request the terminal to switch the interface between the terminal and the access network device, and the switching command information carries N correspondence information. It should be noted that the interface between the terminal and the access network device can be the interface between the terminal and the 4G access network device (such as the UU interface), or the interface between the terminal and the 5G access network device, or the terminal and the future network Interfaces between access network devices are not restricted in this embodiment of the application. The interface between the terminal and the access network equipment can also be called the air interface.

Optionally, after receiving the handover command information, the terminal sends a handover complete message to the second access network device to complete the handover.

It should be noted that, for each target session, the terminal will store the corresponding relationship between the second identifier of the target session and the first identifier of the target session. On the one hand, the message of the target session sent by the terminal to the second access network device carries the second identifier instead of the first identifier, which prevents the session from being tracked by an attacker and ensures the security of the session. On the other hand, after the terminal receives the message of the target session, the terminal replaces the message location of the target session with the first identifier of the target session according to the correspondence between the first identifier of the target session and the second identifier of the target session. The second identifier included to determine the session to which the message belongs.

Optionally, as shown in FIG. 3, the above steps S102-S103 can be replaced with steps S201-S204.

S201. The second access network device sends information about M sessions to the core network device.

Optionally, the core network device may be AMF.

S202. The core network device determines N target sessions from the M sessions.

S203. The core network device determines the second identifier of each target session in the N target sessions.

S204: The core network device sends N pieces of correspondence information to the second access network device.

Based on the technical solution shown in Figure 3, in the scenario where the first access network device triggers the Xn handover procedure, both the terminal and the second access network device can obtain N correspondence information, so that after the handover, the N For each target session in the two target sessions, the terminal and the second access network device can ensure the security of the session.

Example 2

As shown in FIG. 4, another security protection method provided by this embodiment of the present application is applied in a scenario where a handover occurs between a terminal and an access network device. The handover request can be transmitted through the interface (for example, the N2 interface) between the two AMFs. Hereinafter, for ease of description, the switching scenario involved in FIG. 3 is referred to as N2 switching (or N2 interface switching) for short. The method shown in Figure 4 includes the following steps:

S301. The first access network device sends a handover request to the first AMF, where the handover request includes information about M sessions.

S302. The first AMF sends information about M sessions to the second AMF.

As an implementation manner, the first AMF sends context establishment request information to the second AMF, and the context establishment request information includes information about M sessions.

S303. The second AMF determines N target sessions from the M sessions.

S304. The second AMF determines the second identifier of each target session in the N target sessions.

S305. The second AMF sends N pieces of correspondence information to the second access network device.

As an implementation manner, the second AMF sends a handover request to the second access network device, and the handover request carries N correspondence information. Optionally, after the second access network device receives the handover request sent by the second AMF, the second access network device sends handover request response information to the second AMF.

S306. The second AMF sends N pieces of correspondence information to the first AMF.

As an implementation manner, the second AMF sends context establishment response information to the first AMF, and the context establishment response information includes N pieces of correspondence information.

It should be noted that the embodiment of the present application does not limit the execution sequence of steps S305 and S306. For example, step S306 may be executed first, and then step S305 may be executed. For another example, steps S305 and S306 can be executed simultaneously.

S307: The first AMF sends N pieces of correspondence information to the first access network device.

As an implementation manner, the first AMF sends handover request response information to the first access network device, and the handover request response information carries N correspondence information.

S308: The first access network device sends N pieces of correspondence information to the terminal.

Based on the technical solution shown in Figure 4, in a scenario where the first access network device triggers the N2 interface switching process, both the terminal and the second access network device can obtain N correspondence information, so that after the switching, the For each of the N target sessions, the terminal and the second access network device can ensure the security of the session.

Optionally, as shown in FIG. 4, the above steps S303-S305 can be replaced with steps S401-S405.

S401. The second AMF sends M session information to the SMF.

As an implementation manner, when the handover request sent by the first access network device carries the second indication information, the second AMF sends the second indication information and information of M sessions to the SMF.

S402. The SMF determines N target sessions from the M sessions.

Optionally, steps S401-S402 can be replaced with: the second AMF determines N target sessions from the M sessions; after that, the second AMF sends information about the N target sessions to the SMF.

S403. The SMF determines the second identifier of each target session in the N target sessions.

S404. The SMF sends N pieces of correspondence information to the second AMF.

S405. The second AMF sends N pieces of correspondence information to the second access network device.

Or, as shown in FIG. 4, the above steps S303-S305 can be replaced with steps S501-S504.

S501. The second AMF sends M session information to the second access network device.

As an implementation manner, the second AMF sends a handover request to the second access network device, and the handover request carries information of M sessions.

S502. The second access network device determines N target sessions from the M sessions.

Optionally, in this embodiment of the application, steps S501-S502 can also be replaced with the following implementation: the second AMF determines N target sessions from the M sessions; after that, the second AMF sends a message to the second access network The device sends information about N target sessions.

S503. The second access network device determines a second identifier corresponding to each of the N target sessions.

S504. The second access network device sends N pieces of correspondence information to the second AMF.

As an implementation manner, the second access network device sends handover request response information to the second AMF, and the handover request response information carries N pieces of correspondence information.

Example three

In Figure 4, the N2 handover procedure is triggered by the first access network device. In actual application scenarios, the handover process can also be triggered by the terminal. Optionally, as shown in FIG. 5, a security protection method provided in an embodiment of this application is applied to a scenario where a terminal triggers an N2 handover process. The method includes the following steps:

S601. The terminal sends a registration request to the second AMF through the second access network device.

Wherein, the registration request is used to access the network. The registration request includes the identification of the terminal.

Optionally, step S601 includes the following steps: S601a and S601b.

S601a. The terminal sends a registration request to the second access network device.

S601b. The second access network device sends a registration request to the second AMF.

S602. The second AMF sends a context establishment request to the first AMF.

Wherein, the context establishment request is used to request session information of the terminal, so that the second AMF can reuse the existing session information.

In the embodiment of the present application, the second AMF determines the first AMF according to the identification of the terminal included in the registration request.

S603: The first AMF sends information about M sessions to the second AMF.

S604. The second AMF determines N target sessions from the M sessions.

S605. The second AMF determines the second identifier of each target session in the N target sessions.

S606. The second AMF sends N pieces of correspondence information to the second access network device.

S607: The second access network device sends N pieces of correspondence information to the terminal.

Based on the technical solution shown in Figure 5, in the scenario where the terminal triggers the N2 handover process, both the terminal and the second access network device can obtain N correspondence information, so that after the handover, for the N2 target sessions For each target session, the terminal and the second access network device can ensure the security of the session.

Optionally, as shown in FIG. 5, steps S604-S606 can be replaced with steps S701-S705. For steps S701-S705, reference may be made to the related descriptions of steps S401-S405 in FIG. 4, which will not be repeated here.

Or, as shown in FIG. 5, steps S604-S606 can be replaced with steps S801-S803. For steps S801-S803, reference may be made to the related descriptions of steps S501-S503 in FIG. 4, which will not be repeated here.

Example 4

As shown in FIG. 6, a security protection method provided by this embodiment of the present application is applied to a communication system switching scenario, for example, a terminal switches from a 4G communication system to a 5G communication system. The method includes the following steps:

S901. The first access network device sends a handover request to a mobility management entity (MME).

Wherein, the handover request includes M bearer information. The carried information includes: terminal identification, bearer identification, S-NSSAI, access type, access network identification, target network IP address, packet data network (PDN) type, public data network (public data network) At least one of network, PDN) type and DNN.

It should be noted that the MME is a key control node in the LTE communication system and is responsible for functions such as access control, mobility management, attachment and detachment.

S902. The MME sends M bearer information to the AMF.

S903. The AMF sends M bearer information to the SMF.

S904. The SMF determines the information of the M sessions according to the information of the M bearers.

Among them, the information carried by M has a one-to-one correspondence with the information of M sessions. That is, the information carried by one of the M carried information corresponds to the information of one session in the information of the M sessions.

It should be noted that the main difference between the carried information and the session information is that the carried information includes the bearer identifier, and the session information includes the first identifier of the session. Therefore, the SMF can map the bearer identifier to the first identifier of the corresponding session according to the preset mapping rule to determine the information of the session.

S905. The SMF determines N target sessions from the M sessions.

Optionally, step S1005 can be specifically implemented as: SMF sends information about M sessions to AMF; AMF determines N target sessions from the M sessions; AMF sends information about N target sessions to SMF, so that SMF determines N target sessions from the M sessions.

S906: The SMF determines the second identifier of each target session in the N target sessions.

S907. The SMF sends N pieces of correspondence information to the AMF.

Optionally, in this embodiment of the application, steps S906 and S907 can also be replaced by the following implementation: SMF sends information about N target sessions to AMF; after that, AMF determines the second of each target session in the N target sessions Logo.

S908. The AMF sends N pieces of correspondence information to the second access network device.

S909. The AMF sends N correspondence information to the MME.

It should be noted that the execution sequence of steps S908 and S909 is not limited in the embodiment of the present application. For example, step S909 may be executed first, and then step S908 may be executed. For another example, steps S908 and S909 can be executed simultaneously.

S910. The MME sends N pieces of correspondence information to the first access network device.

S911: The first access network device sends the N correspondence information to the terminal.

Based on the technical solution shown in FIG. 6, in the scenario where the first access network device triggers the handover of the communication system, both the terminal and the second access network device can obtain N correspondence information, so that after the handover, for these N For each target session in the two target sessions, the terminal and the second access network device can ensure the security of the session.

Optionally, steps S905-S908 in FIG. 6 can be replaced with steps S1001-S1004.

S1001. The SMF sends information about M sessions to the AMF.

S1002. The AMF determines N target sessions from the M sessions.

S1003. The AMF determines the second identifier of each target session in the N target sessions.

S1004. The AMF sends N correspondences to the second access network device.

Alternatively, steps S905-S908 in FIG. 6 can be replaced with steps S1101-S1105.

S1101. The SMF sends information about M sessions to the AMF.

S1102. The AMF sends information about M sessions to the second access network device.

S1103. The second access network device determines N target sessions from the M sessions.

Optionally, in this embodiment of the application, steps S1102 and S1103 can also be replaced with the following implementation: AMF determines N target sessions from the M sessions; after that, AMF sends N target sessions to the second access network device. Information about the target session.

S1104. The second access network device determines the second identifier of each target session in the N target sessions.

S1105. The second access network device sends N pieces of correspondence information to the AMF.

Example 5

In Figure 6, the handover process of the communication system is triggered by the first access network device. In actual application scenarios, the communication system switching process can also be triggered by the terminal. Optionally, as shown in FIG. 7, a security protection method provided in this embodiment of the present application is applied to a scenario where a terminal triggers a handover process of a communication system. The method includes the following steps:

S1201. The terminal sends a registration request to the AMF through the second access network device.

Wherein, the registration request is used to access the network. The registration request includes the identification of the terminal. The registration request includes the identification of the terminal.

Optionally, step S1201 includes the following steps S1201a and S1201b.

S1201a. The terminal sends a registration request to the second access network device.

S1201b. The second access network device sends a registration request to the AMF.

S1202. The AMF sends a context establishment request to the MME.

In the embodiment of this application, the AMF determines the MME according to the terminal identifier included in the registration request.

Wherein, the context establishment request is used to request the bearer information of the terminal.

S1203. The MME sends M bearer information to the AMF.

S1204. The AMF sends M bearer information to the SMF.

S1205. The SMF determines the information of the M sessions according to the information of the M bearers.

S1206. The SMF determines N target sessions from the M sessions.

S1207. The SMF determines the second identifier of each target session in the N target sessions.

S1208: The SMF sends N correspondence information to the AMF.

S1209. The SMF sends N pieces of correspondence information to the second access network device.

For the related description of the above steps S1204-S1209, please refer to the steps S903-S908 in FIG. 6, which will not be repeated here.

S1210. The second access network device sends N pieces of correspondence information to the terminal.

Based on the technical solution of Figure 7, in the scenario where the terminal triggers the communication system handover procedure, both the terminal and the second access network device can obtain N correspondence information, so that after the handover, for each of the N target sessions For a target session, the terminal and the second access network device can ensure the security of the session.

Optionally, steps S1206-S1209 can be replaced with steps S1301-S1304. For the related description of steps S1301-S1304, please refer to steps S1001-S1004 in FIG. 6, which will not be repeated here.

Alternatively, steps S1206-S1209 can be replaced with steps S1401-S1404. Among them, the related description of steps S1401-S1404 can refer to steps S1101-S1104 in FIG. 6, which will not be repeated here.

Example Six

As shown in FIG. 8, another security protection method provided by this embodiment of the application includes the following steps S1501-S1505:

S1501. The first access network device determines to initiate a handover procedure.

For example, the first access network device may determine whether to initiate the handover process according to whether the terminal moves out of the area covered by the first access network device. That is, when the terminal moves out of the area covered by the first access network device, the first access network device initiates a handover procedure.

S1502. The first access network device determines N target sessions from the M sessions of the terminal.

S1503. The first access network device determines the second identifier of each target session in the N target sessions.

S1504. The first access network device sends N pieces of correspondence information to the second access network device.

Optionally, the N correspondence information may be carried in the handover request.

In the scenario of Xn interface handover, the first access network device directly sends the N correspondence information to the second access network device.

In the scenario of N2 interface handover, the first access network device sends the N correspondence information to the first AMF; after that, the first AMF sends the N correspondence information to the second AMF; the second AMF sends the N correspondence information to the second AMF. 2. The access network device sends N correspondence information.

S1505. The first access network device sends N pieces of correspondence information to the terminal.

It should be noted that the embodiment of the present application does not limit the execution sequence of steps S1504 and S1505. For example, step S1505 may be executed first, and then step S1504 may be executed. For another example, step S1504 and step S1505 can be executed simultaneously.

Based on the technical solution in Figure 8, during the handover process, both the terminal and the second access network device can obtain N correspondence information, so that after the handover, for each of the N target sessions, the terminal and The second access network device can ensure the security of the target session.

Example 7

As shown in FIG. 9, another security protection method provided by this embodiment of the application is applied to the scenario of N2 interface handover, and the method includes the following steps S1601-S1607:

S1601. The first access network device sends a handover request to the first AMF, where the handover request includes information about M sessions.

S1602. The first AMF determines N target sessions from the M sessions of the terminal.

S1603. The first AMF determines the second identifier of each target session in the N target sessions.

S1604. The first AMF sends N pieces of correspondence information to the second AMF.

S1605. The second AMF sends N pieces of correspondence information to the second access network device.

S1606. The first AMF sends N pieces of correspondence information to the first access network device.

S1607. The first access network device sends N pieces of correspondence information to the terminal.

It should be noted that the embodiment of the present application does not limit the execution sequence of steps S1604-S1605 and S1606-S1607. For example, steps S1606-S1607 may be executed first, and then steps S1604-S1605 may be executed; or, steps S1604-S1605 and steps S1606-S1607 may be executed simultaneously.

Based on the technical solution of FIG. 9, during the handover process, both the terminal and the second access network device can obtain N correspondence information, so that after the handover, for each of the N target sessions, the terminal and The second access network device can ensure the security of the target session.

It should be noted that, in the technical solutions of FIGS. 3 to 9, the N correspondence information sent by the first access network device (or the second access network device) to the terminal can be carried in radio resource control (radio resource control). , RRC) signaling, media access control (media access control, MAC)-control element (CE) signaling, or downlink control information (DCI).

In the technical solutions shown in FIG. 3 to FIG. 9, any device (for example, the first AMF, the second AMF, etc.) can refer to step S102 for the implementation manner of determining N target sessions from M sessions, which will not be repeated here. Repeat. For the implementation of determining the second identifier of the target session by any device, refer to step S103, which will not be repeated here.

Optionally, in the technical solutions shown in FIGS. 3 to 9, after the terminal receives N pieces of correspondence information, the terminal sends handover completion information to the second access network device and/or the first access network device.

Optionally, in the technical solutions shown in FIGS. 3 to 9, after the second access network device receives the handover completion information sent by the terminal, the second access network device sends the N correspondence information to the AMF , So that the AMF saves the N correspondence information.

Optionally, in the technical solutions shown in FIG. 3 to FIG. 9, the steps executed by the SMF may be executed by other core network equipment, such as UPF.

The technical solutions shown in FIG. 3 to FIG. 9 only introduce the relevant procedures of the target session, and for non-target sessions, the solution in the prior art can be used to perform the corresponding switching operation, which will not be repeated here.

The technical solutions shown in FIGS. 3 to 9 only introduce the steps related to the embodiment of the present application in the handover process, and other steps in the handover process can refer to the prior art, which will not be repeated here.

Each step in the above technical solution may be executed by a communication device or a chip in the communication device.

The above mainly introduces the solutions provided by the embodiments of the present application from the perspective of interaction between each network element. It can be understood that each network element, such as an access network device and a core network device, includes hardware structures and/or software modules corresponding to each function in order to realize the aforementioned functions. Those skilled in the art should easily realize that, in conjunction with the exemplary units and algorithm steps described in the embodiments disclosed herein, the present application can be implemented in hardware, or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driven hardware depends on the specific application of the technical solution and design constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

The embodiments of the present application can divide the access network equipment and the core network equipment into functional modules according to the foregoing method examples. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated in In a processing module. The above integrated modules can be implemented in the form of hardware or software function modules. It should be noted that the division of the modules in the embodiments of the present application is schematic, and is only a division of logical functions. In actual implementation, there may be another division manner. The following uses an example of dividing each function module corresponding to each function as an example:

FIG. 10 is a schematic structural diagram of a communication device provided by an embodiment of this application. The schematic structural diagram shown in FIG. 10 can be used to implement various devices such as the first access network device, the second access network device, the first AMF, the second AMF, and the SMF in the embodiment of the present application. As shown in FIG. 10, the communication device includes a receiving module 201, a processing module 202, and a sending module 203. Wherein, the receiving module 201 can be used to perform the steps related to receiving in the embodiment of the present application, and the receiving module 201 can be a receiver, a receiver, a receiving circuit, and the like. The sending module 203 may be used to perform the steps related to sending in the embodiment of the present application. The sending module 203 may be a transmitter, a transmitter, a sending circuit, and the like.

When the schematic structural diagram shown in FIG. 10 is used to implement the second access network device in the above embodiment, the receiving module 201 is used to receive a handover request, and the handover request is used to instruct the terminal to switch from the first access network device to the second For the access network device, the handover request includes information about M sessions, the information about each session in the information about M sessions includes the first identifier of the session, and M is a positive integer. The processing module 202 is configured to determine N target sessions from M sessions; N target sessions are a non-zero subset of M sessions, N is less than or equal to M, and N is a positive integer. The processing module 202 is further configured to determine the second identifier of each target session in the N target sessions. The sending module 203 is configured to send N pieces of correspondence information to the terminal. The N pieces of correspondence information correspond to the N target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information is used to indicate the first identifier of the corresponding target session. Correspondence with the second identifier.

In a possible design, the processing module 202 is specifically configured to send information about N target sessions to the core network device through the sending module 203; and receive information about each of the N target sessions sent by the core network device through the receiving module 201. The second logo.

In a possible design, the processing module 202 is specifically configured for the second access network device to generate the second identifier of each of the N target sessions according to a preset rule.

In a possible design, the first identifier of the session includes at least one of the following parameters: the identifier of the link between the terminal and the UPF, the tunnel identifier of the link between the terminal and the UPF, the session identifier, the address of the UPF, and the terminal ID, QoS flow ID, bearer ID, slice ID, and UPF ID.

When the schematic structural diagram shown in FIG. 10 is used to implement the second AMF in the foregoing embodiment, the receiving module 201 is used to receive information about M sessions sent by the first AMF, and the information about each session in the information about the M sessions includes the session The first identifier of M is a positive integer. The processing module 202 is configured to determine N target sessions from M sessions, where N target sessions are a non-zero subset of M sessions, N is less than or equal to M, and N is a positive integer. The processing module 202 is further configured to determine the second identifier of each target session in the N target sessions. The sending module 203 is configured to send N pieces of correspondence information to the second access network device. The N pieces of correspondence information correspond to N target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information is used to indicate the corresponding target. The correspondence between the first identifier and the second identifier of the session. The sending module 203 is also used to send N correspondence information to the terminal.

In a possible design, the receiving module 201 is further configured to receive a registration request, and the registration request includes the identification of the terminal. The sending module 203 is further configured to send a context establishment request to the first AMF, and the context establishment request is used to request information about the session of the terminal.

In a possible design, the processing module 202 is specifically configured to send M session information to the network device through the sending module 203; and to receive N target session information sent by the network device through the receiving module 201. Exemplarily, the network device may be a second access network device or SMF.

In a possible design, the processing module 202 is specifically configured to send information of N target sessions to the network device through the sending module 203; and, to receive the N correspondence information sent by the network device through the receiving module 201.

In a possible design, the sending module 203 is specifically configured to send N pieces of correspondence information to the terminal through the second access network device.

In a possible design, the sending module 203 is specifically configured to send N pieces of correspondence information to the terminal through the first access network device and the first AMF.

When the schematic structural diagram shown in FIG. 10 is used to implement the AMF shown in FIG. 6 or FIG. 7, the receiving module 201 is used to receive M bearer information sent by the MME. The sending module 203 is configured to send M carried information to the SMF. The receiving module 201 is configured to receive information about M sessions from the SMF. The information about the M sessions corresponds to the information carried by the M, and the information about each session in the information about the M sessions includes the first identifier of the session, and M is positive. Integer. The processing module 202 is configured to determine N target sessions from the M sessions. The processing module 202 is further configured to determine the second identifier of each target session in the N target sessions. The sending module 203 is further configured to send N pieces of correspondence information to the second access network device. The N pieces of correspondence information correspond to the N target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information is used to indicate the corresponding The corresponding relationship between the first identifier and the second identifier of the target session. The sending module 203 is also used to send N correspondence information to the terminal.

In a possible design, the receiving module 201 is also used to receive a registration request, the registration request includes the terminal identification; the sending module 203 is also used to send a context establishment request to the MME, the context establishment request is used to request the terminal bearer information .

In a possible design, the processing module 202 is specifically configured to send M session information to the network device through the sending module 203; and to receive N target session information sent by the network device through the receiving module 201.

In a possible design, the sending module 203 is specifically configured to send N pieces of correspondence information to the terminal through the first access network device and the MME.

When the structural diagram shown in FIG. 10 is used to implement the first access network device in the above embodiment, the processing module 202 is used to determine N target sessions from M sessions of the terminal, where N is less than or equal to M, M, N All are positive integers. The processing module 202 is further configured to determine the second identifier of each target session in the N target sessions. The sending module 203 is configured to send N pieces of correspondence information to the second access network device. The N pieces of correspondence information correspond to N target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information is used to indicate the corresponding target. The correspondence between the first identifier and the second identifier of the session. The sending module 203 is also used to send N correspondence information to the terminal.

In a possible design, the processing module 202 is also used to determine the initiation of the handover procedure.

When the schematic structural diagram shown in FIG. 10 is used to implement the first AMF in the foregoing embodiment, the receiving module 201 is used to receive a handover request sent by the first access network device, and the handover request is used to instruct the terminal to switch from the first access network The device switches to the second access network device, the switching request includes information about M sessions, the information about each session in the information about M sessions includes the first identifier of the session, and M is a positive integer. The processing module 202 is configured to determine N target sessions from M sessions, where N is less than or equal to M, and both M and N are positive integers. The processing module 202 is further configured to determine the second identifier of each target session in the N target sessions. The sending module 203 is also configured to send N pieces of correspondence information to the second access network device through the second AMF. The N pieces of correspondence information correspond to the N target sessions one-to-one, and each piece of the N correspondence information is used for To indicate the corresponding relationship between the first identifier and the second identifier of the corresponding target session. The sending module 203 is further configured to send N pieces of correspondence information to the terminal through the first access network device.

As an example, combined with the communication device shown in FIG. 2, the sending module 203 and the receiving module 201 in FIG. 10 may be implemented by the communication interface 104 in FIG. 2, and the processing module 202 in FIG. 10 may be implemented by the processing in FIG. The embodiment of the present application does not impose any limitation on this.

The embodiment of the present application also provides a computer-readable storage medium in which computer instructions are stored; when the computer-readable storage medium runs on the communication device shown in FIG. 2, the communication The device executes the method shown in Figure 3-9. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, computer, server or data center Transmission to another website, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device including one or more servers and data centers that can be integrated with the medium. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium, or a semiconductor medium (for example, a solid state disk (SSD)) or the like.

An embodiment of the present application also provides a chip, which includes a processing module and a communication interface. The communication interface is used to transmit received code instructions to the processing module. The code instructions may come from the internal memory of the chip or from the chip. An external memory or other device, the processing is used to execute code instructions to support the communication device to execute the methods shown in FIGS. 3-9. The processing module is a processor or microprocessor or integrated circuit integrated on the chip. The communication interface may be an input/output circuit or a transceiver pin.

The embodiment of the present application also provides a computer program product containing computer instructions, when it runs on the communication device shown in FIG. 2, the communication device can execute the methods shown in FIGS. 3 to 9.

The communication devices, computer storage media, chips, and computer program products provided in the above embodiments of the present application are all used to execute the methods provided above. Therefore, the beneficial effects that can be achieved can refer to the corresponding benefits of the methods provided above. The effect will not be repeated here.

Although the present application has been described with reference to specific features and embodiments, it is obvious that various modifications and combinations can be made without departing from the spirit and scope of the present application. Accordingly, the specification and drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to cover any and all modifications, changes, combinations, or equivalents within the scope of the present application. Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

A security protection method, characterized in that the method includes:

The second access network device receives a handover request, the handover request is used to instruct the terminal to switch from the first access network device to the second access network device, the handover request includes information about M sessions, the The information of each of the M sessions includes the first identifier of the session, and M is a positive integer;

The second access network device determines N target sessions from the M sessions; the N target sessions are a non-zero subset of the M sessions, N is less than or equal to M, and N is a positive integer;

Determining, by the second access network device, the second identifier of each target session in the N target sessions;

The second access network device sends N pieces of correspondence information to the terminal, the N pieces of correspondence information correspond to the N target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information is used for The corresponding relationship between the first identifier and the second identifier of the corresponding target session is indicated.
The security protection method according to claim 1, wherein the second access network device determining the second identifier of each of the N target sessions comprises:

Sending, by the second access network device, information about the N target sessions to a core network device;

The second access network device receives the second identifier of each target session in the N target sessions from the core network device.
The security protection method according to claim 1, wherein the second access network device determining the second identifier of each of the N target sessions comprises:

The second access network device generates a second identifier of each target session in the N target sessions according to a preset rule.
The security protection method according to any one of claims 1 to 3, wherein the first identifier of the session includes at least one of the following parameters: the identifier of the link between the terminal and the user plane function network element UPF, the terminal The tunnel identifier, session identifier, UPF address, terminal identifier, quality of service flow identifier, bearer identifier, slice identifier, and UPF identifier of the link with the UPF.
The security protection method according to any one of claims 1 to 4, wherein the correspondence information includes a first identifier and a second identifier of the target session.
A communication device, characterized in that it includes:

The receiving module is configured to receive a handover request, the handover request is used to instruct the terminal to switch from the first access network device to the second access network device, the handover request includes information about M sessions, and the M sessions The information of each session in the information includes the first identifier of the session, and M is a positive integer;

A processing module, configured to determine N target sessions from the M sessions; the N target sessions are a non-zero subset of the M sessions, N is less than or equal to M, and N is a positive integer;

The processing module is further configured to determine the second identifier of each target session in the N target sessions;

The sending module is configured to send N pieces of correspondence information to the terminal, where the N pieces of correspondence information correspond to the N target sessions one-to-one, and each piece of correspondence information in the N pieces of correspondence information is used to indicate the corresponding The corresponding relationship between the first identifier and the second identifier of the target session.
The communication device according to claim 6, wherein the processing module is specifically configured to send information about the N target sessions to a core network device through a sending module; and receive all information sent by the core network device through a receiving module. The second identifier of each of the N target sessions.
The communication device according to claim 6, wherein the processing module is specifically configured to generate the second identifier of each of the N target sessions according to a preset rule.
The communication device according to any one of claims 6 to 8, wherein the first identifier of the session includes at least one of the following parameters: the identifier of the link between the terminal and the user plane function network element UPF, the terminal and The tunnel identifier, session identifier, UPF address, terminal identifier, quality of service flow identifier, bearer identifier, slice identifier, and UPF identifier of the link between UPFs.
The communication device according to any one of claims 6 to 9, wherein the correspondence information includes a first identifier and a second identifier of the target session.
A computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed by a communication device, cause the communication device to execute the security protection method of any one of claims 1 to 5.