WO2022082667A1

WO2022082667A1 - Method and apparatus for secure transmission of data

Info

Publication number: WO2022082667A1
Application number: PCT/CN2020/122994
Authority: WO
Inventors: 郝金平; 晋英豪; 郭龙华
Original assignee: 华为技术有限公司
Priority date: 2020-10-22
Filing date: 2020-10-22
Publication date: 2022-04-28

Abstract

Provided is a method for secure transmission of data. The method comprises: a core network device acquiring core-network-side security information from a terminal device; the core network device receiving encrypted data and auxiliary information from the terminal device; and the core network device decrypting the encrypted data according to the core-network-side security information and the auxiliary information from the terminal device. By implementing the embodiments of the present application, a core network device can effectively decrypt encrypted data sent by a terminal device in a non-connected state, thereby realizing secure transmission of data between the terminal device in a non-connected state and a network.

Description

Method and device for safe data transmission

technical field

The present invention relates to the field of wireless communication, and in particular, to a method and device for secure data transmission.

Background technique

In mobile communication, in order to realize the secure transmission of data between the terminal device and the mobile network, the terminal device establishes a radio resource control (RRC) connection with the radio access network (RAN) to realize the connection between the terminal device and the mobile network. The access stratum (AS) of the mobile network is connected to the core network (CN) to establish a non-access stratum (NAS) connection. The terminal device performs network registration (registration) through the NAS connection and performs user authentication and authentication procedures, so as to obtain the security information required for subsequent data transmission between the terminal device and the network.

With the diversity of communication services, such as the development of the Internet of Things, some forms of terminal equipment are often in a disconnected state for the network to save power consumption of the terminal equipment. A terminal device in a disconnected state, for example, the terminal device is in a de-registered (de-registered) state or in an RRC idle state, and the terminal device has neither AS connection with the RAN nor NAS connection with the CN. At this time, the CN side also does not have the context information of the terminal device. Therefore, the exchange of keys and security parameters required for data encryption cannot be completed between the terminal device and the CN. There is no suitable solution in the prior art for how to enable the terminal device in the disconnected state to realize the safe transmission of data to the mobile network.

SUMMARY OF THE INVENTION

The embodiment of the present application provides a method for secure data transmission, which can realize that a terminal device in a disconnected state securely transmits data to a network. Further, the method can effectively realize the positioning of the terminal device in the disconnected state.

The present application is described below from various aspects, and it is easy to understand that the implementation manners of the following various aspects can be referred to each other.

In a first aspect, the present application provides a method for secure data transmission, and the execution body of the method may be a core network device or a chip applied in the core network device. The method includes: a core network device acquires core network side security information of a terminal device; the core network device receives encrypted data and auxiliary information from the terminal device; and the core network device obtains the core network side security information of the terminal device and the The auxiliary information decrypts the encrypted data.

It can be seen that the method provided by the embodiment of the present application enables the core network device to effectively decrypt the encrypted data sent by the terminal device in the disconnected state, and realizes the secure transmission of data between the terminal device and the network in the disconnected state.

In a possible implementation, the core network-side security information of the terminal device includes a permanent identifier and security parameters of the terminal device, the security parameters include a key and encryption/decryption algorithm information, or the security parameters include the key, the Encryption and decryption algorithm information and calculation method information of the encrypted identification of the terminal device.

In a possible implementation, the auxiliary information includes a first timeliness parameter and a first encrypted identifier of the terminal device.

In a possible implementation, the core network device decrypts the encrypted data according to the core network side security information and auxiliary information of the terminal device, including: the core network device obtains a second timeliness parameter; If the value is not less than the value of the second timeliness parameter, the core network device decrypts the encrypted data; or if the value of the first timeliness parameter is less than the value of the second timeliness parameter, the core network device discards the encrypted data. Encrypted data.

In a possible implementation, decrypting the encrypted data by the core network device includes: the core network device obtains the permanent identification of the terminal device according to the auxiliary information; the core network device obtains the permanent identification of the terminal device, the security parameter according to the The key and the encryption and decryption algorithm information in the encrypted data are decrypted.

In a possible implementation, decrypting the encrypted data by the core network device includes: acquiring, by the core network device, a permanent identifier of the terminal device according to the auxiliary information; generating, by the core network device, a first key according to the key in the security parameter. key; the core network device decrypts the encrypted data according to the permanent identification of the terminal device, the first key and the encryption and decryption algorithm information.

In a possible implementation, the method further includes: the core network device adds 1 to the value of the second timeliness parameter; or the core network device sets the value of the second timeliness parameter to the value of the first timeliness parameter ; or the core network device sets the value of the second timeliness parameter to the value of the first timeliness parameter plus 1.

In a possible implementation, the core network equipment is an access and mobility management function AMF or a location management function LMF.

In a possible implementation, the core network device obtains the core network side security information of the terminal device from the AMF or the gateway mobile location center GMLC.

In one possible implementation, the first timeliness parameter is a sequence number, a count, or a timestamp.

In one possible implementation, the second timeliness parameter is a sequence number, a count, or a timestamp.

In a possible implementation, the core network device obtains the permanent identifier of the terminal device according to the first encrypted identifier and the first time-sensitive parameter, including: the core network device obtains the encrypted identifier, the time-sensitive parameter and the permanent identifier of the terminal device. The corresponding relationship of the identification; the core network device determines the permanent identification of the terminal device corresponding to the first encrypted identification and the first time-sensitive parameter according to the corresponding relationship.

In a possible implementation, the core network device obtains the permanent identifier of the terminal device according to the first encrypted identifier and the first time-sensitive parameter, including: the core network device determines, according to the encrypted identifier, the time-sensitive parameter, and the key, The permanent identifier of the terminal device; or, the core network device determines the permanent identifier of the terminal device according to the encrypted identifier, the time-sensitive parameter, the key, and the encrypted identifier calculation method.

In a possible implementation, the core network device acquires the permanent identifier of the terminal device according to the first encrypted identifier and the first time-sensitive parameter, including: the core network device obtains the encrypted identifier, the time-sensitive parameter and the encryption/decryption algorithm The corresponding relationship of information; the core network device determines the first encryption and decryption algorithm corresponding to the first encryption identifier and the first timeliness parameter according to the corresponding relationship; and the core network device determines according to the first encryption identifier, the first encryption and decryption algorithm The timeliness parameter, the first encryption and decryption algorithm and the key determine the permanent identity of the terminal device.

In a second aspect, the present application provides a method for secure data transmission, and the execution body of the method may be a terminal device or a chip applied in the terminal device. The method includes: the terminal device obtains a first time-sensitive parameter; the terminal device encrypts the transmission data according to the terminal device side security information of the terminal device to generate encrypted data; the terminal device generates auxiliary information; The encrypted data and the auxiliary information are sent.

It can be seen that the method provided by the embodiment of the present application enables the encrypted data and auxiliary information sent by the terminal device in the disconnected state to the network, so that the core network device can effectively decrypt and obtain the transmission data of the terminal device, and realizes the terminal device in the disconnected state. Secure transmission of data between and over the network.

In a possible implementation, the security information on the terminal device side includes the permanent identification of the terminal device and security parameters, the security parameters include the key and encryption/decryption algorithm information, or the security parameters include the key, the encryption/decryption algorithm information and information on the calculation method of the encrypted identification of the terminal device.

In a possible implementation, the terminal device encrypts the transmission data according to the terminal device-side security information of the terminal device to generate encrypted data, including: the terminal device encrypts the transmission data according to the terminal device-side security information of the terminal device according to the key and The encryption and decryption algorithm encrypts the transmitted data to generate encrypted data.

In a possible implementation, the terminal device encrypts the transmission data according to the terminal device side security information of the terminal device to generate encrypted data, including: the terminal device generates encrypted data according to the key in the terminal device side security information of the terminal device. A first key, the terminal device encrypts the transmission data according to the first key and the encryption/decryption algorithm to generate encrypted data.

In a possible implementation, the auxiliary information includes the first time-sensitive parameter and the first encrypted identifier, and the first encrypted identifier is generated by the terminal device according to the permanent identifier of the terminal device and the security parameter.

In a possible implementation, the terminal device generates the first encrypted identification according to the permanent identification of the terminal device and the security parameter, including: the terminal device generates the first encrypted identification according to the permanent identification of the terminal device, the key and the first validity parameter Generate the first encrypted identification; or, the terminal device generates the first encrypted identification according to the permanent identification of the terminal device, the key, the first time-sensitive parameter, and the calculation method information of the encrypted identification.

In a possible implementation, the method further includes: updating, by the terminal device, the first timeliness parameter.

In a possible implementation, the terminal device updates the first timeliness parameter, including adding 1 to the value of the first timeliness parameter by the terminal device.

In a third aspect, the present application provides a method for locating a terminal device, and the execution body of the method may be a location management function LMF. The method includes: the LMF obtains the core network side security information of the terminal equipment; the LMF and the terminal equipment execute a positioning measurement process; the LMF receives encrypted positioning measurement data and auxiliary information from the terminal equipment; The network-side security information and the auxiliary information decrypt the encrypted positioning measurement data; the LMF calculates the location information of the terminal device.

It can be seen that the method provided by the embodiment of the present application enables the LMF to locate the terminal device in the disconnected state, and obtain the location information of the terminal device in the disconnected state.

In a possible implementation, the method further includes: the LMF sends the location information of the terminal device to the AMF or the gateway mobile positioning center GMLC.

In a possible implementation, the LMF decrypts the encrypted positioning measurement data according to the core network side security information and auxiliary information of the terminal device, including: the LMF obtains a second timeliness parameter; In the case that the value is not less than the value of the second timeliness parameter, the LMF decrypts the encrypted positioning measurement data; or when the value of the first timeliness parameter is smaller than the value of the second timeliness parameter, the LMF discards the encryption positioning measurement data.

In a possible implementation, the LMF decrypts the encrypted positioning measurement data, including: the LMF obtains the permanent identifier of the terminal device according to the auxiliary information; the LMF obtains the permanent identifier of the terminal device according to the permanent identifier of the terminal device, the security parameter in the security parameter The encryption key and the encryption and decryption algorithm information are used to decrypt the encrypted positioning measurement data.

In a possible implementation, decrypting the encrypted data by the LMF includes: the LMF obtains the permanent identifier of the terminal device according to the auxiliary information; the LMF generates a first key according to the key in the security parameter; the LMF according to The permanent identification of the terminal device, the first key and the encryption and decryption algorithm information are used to decrypt the encrypted data.

In a possible implementation, the method further includes: the LMF increases the value of the second timeliness parameter by 1; or the LMF sets the value of the second timeliness parameter to the value of the first timeliness parameter; or the LMF The value of the second timeliness parameter is set to the value of the first timeliness parameter plus 1.

In a possible implementation, the LMF obtains the core network side security information of the terminal device from the AMF or the GMLC.

In a possible implementation, the LMF obtains the permanent identification of the terminal device according to the first encrypted identification and the first time-sensitive parameter, including: the LMF obtains the corresponding relationship between the encrypted identification and the time-sensitive parameter and the permanent identification of the terminal device ; the LMF determines the first encrypted identifier and the permanent identifier of the terminal device corresponding to the first time-sensitive parameter according to the corresponding relationship.

In a possible implementation, the LMF obtains the permanent identification of the terminal device according to the first encrypted identification and the first time-sensitive parameter, including: the LMF determines the terminal device according to the encrypted identification, the time-sensitive parameter and the key or, the LMF determines the permanent identifier of the terminal device according to the encrypted identifier, the time-sensitive parameter, the key, and the encrypted identifier calculation method.

In a possible implementation, the LMF acquires the permanent identifier of the terminal device according to the first encryption identifier and the first timeliness parameter, including: the LMF acquires the correspondence between the encryption identifier, the timeliness parameter and the encryption/decryption algorithm information ; The LMF determines the first encryption and decryption algorithm corresponding to the first encryption representation and the first timeliness parameter according to the corresponding relationship; The decryption algorithm and the key determine the permanent identity of the terminal device.

In a fourth aspect, the present application provides a method for locating a terminal device, and the execution body of the method may be a location management function LMF. The method includes: the LMF obtains the permanent identification of the terminal device; the LMF and the terminal device perform a positioning measurement procedure; the LMF receives the positioning measurement data of the terminal device from the AMF; and the LMF calculates the position information of the terminal device.

In a fifth aspect, the present application provides a method for locating a terminal device. The execution body of the method may be a terminal device or a chip applied in the terminal device. The method includes: a terminal device and an LMF perform a positioning measurement process; the terminal device obtains a first timeliness parameter; the terminal device encrypts the positioning measurement data according to the terminal device-side security information of the terminal device to generate encrypted positioning measurement data; The terminal device generates auxiliary information; and the terminal device sends the encrypted positioning measurement data and the auxiliary information to the core network device.

It can be seen that the method provided by the embodiment of the present application enables the encrypted positioning measurement data and auxiliary information sent by the terminal device in the disconnected state to the network, so that the core network device can effectively decrypt and obtain the positioning measurement data of the terminal device. The location of the terminal device in the non-connected state.

In a possible implementation, the terminal device encrypts the positioning measurement data according to the terminal device-side security information of the terminal device to generate encrypted positioning measurement data, including: the terminal device encrypts the positioning measurement data according to the terminal device-side security information of the terminal device. The encryption key and the encryption/decryption algorithm encrypt the positioning measurement data to generate encrypted positioning measurement data.

In a possible implementation, the terminal device encrypts the positioning measurement data according to the terminal device-side security information of the terminal device to generate encrypted positioning measurement data, including: the terminal device encrypts the positioning measurement data according to the terminal device-side security information of the terminal device. The key generated by the terminal device generates a first key, and the terminal device encrypts the positioning measurement data according to the first key and the encryption and decryption algorithm to generate encrypted positioning measurement data.

In a possible implementation, the terminal device generates the first encrypted identification according to the permanent identification of the terminal device and the security parameter, including: the terminal device generates the first encrypted identification according to the permanent identification of the terminal device, the key, and the first validity period parameters to generate the first encrypted identifier; or, the terminal device generates the first encrypted identifier according to the permanent identifier of the terminal device, the key, the first time-sensitive parameter, and the information on the calculation method of the encrypted identifier.

In a possible implementation, the terminal device updates the first timeliness parameter, including adding 1 to the value of the first timeliness parameter by the terminal device. In a possible implementation, the core network equipment is an access and mobility management function AMF or a location management function LMF.

In a possible implementation, the first timeliness parameter is a serial number or a timestamp.

In a possible implementation, updating the first timeliness parameter by the terminal device includes: after the terminal device sends the encrypted data and the auxiliary information to the core network device, adding the value of the first timeliness parameter to the terminal device 1.

In a sixth aspect, the present application provides a communication device, and the device may be a terminal device, or a device in a terminal device, or a device that can be matched and used with the terminal device. Wherein, the communication device may also be a chip system. The communication apparatus is configured to perform the method in the second aspect or any possible implementation manner of the second aspect, or the fifth aspect or any possible implementation manner of the fifth aspect. The functions of the communication device may be implemented by hardware, or by executing corresponding software by hardware. The hardware or software includes one or more units corresponding to the above-mentioned functions. The unit may be software and/or hardware. For operations and beneficial effects performed by the communication device, reference may be made to the methods and beneficial effects described in the first aspect or the fifth aspect, and repeated descriptions will not be repeated.

In a seventh aspect, the present application provides a communication device, and the device may be a network device, a device in a network device, or a device that can be matched and used with the network device. Wherein, the communication device may also be a chip system. The communication device is configured to perform the first aspect or any possible implementation manner of the first aspect, or the third aspect or any possible implementation manner of the third aspect, or the fourth aspect or any one of the fourth aspects method in one possible implementation. The functions of the communication device may be implemented by hardware, or by executing corresponding software by hardware. The hardware or software includes one or more units corresponding to the above-mentioned functions. The unit may be software and/or hardware. For operations and beneficial effects performed by the communication device, reference may be made to the methods and beneficial effects described in the first aspect, the third aspect, or the fourth aspect, and repeated details will not be repeated.

In an eighth aspect, the present application provides a communication device, the communication device includes a processor, and when the processor calls a computer program in a memory, the first aspect or any possible implementation manner of the first aspect, or the second aspect or any possible implementation of the second aspect, or the third aspect or any possible implementation of the third aspect, or the fourth aspect or any possible implementation of the fourth aspect , or the method in the fifth aspect or any possible implementation manner of the fifth aspect is performed.

In a ninth aspect, the present application provides a communication device, the communication device includes a processor, a memory and a transceiver, the transceiver is used for receiving a channel or a signal, or sending a channel or signal; the memory is used for Store program code; the processor is configured to call the program code from the memory to execute the first aspect or any possible implementation manner of the first aspect, or the second aspect or any possible implementation manner of the second aspect implementation, or the third aspect or any possible implementation of the third aspect, or the fourth aspect or any possible implementation of the fourth aspect, or any of the fifth or fifth aspect methods in possible implementations.

In a tenth aspect, the present application provides a communication device, the communication device includes a processor and an interface circuit, the interface circuit is configured to receive a code instruction and transmit it to the processor; the processor executes the code instructions to perform the first aspect or any possible implementation of the first aspect, or the second aspect or any possible implementation of the second aspect, or the third aspect or any possible implementation of the third aspect An implementation manner, or the fourth aspect or any possible implementation manner of the fourth aspect, or the fifth aspect or a method in any possible implementation manner of the fifth aspect.

In an eleventh aspect, the present application provides a computer-readable storage medium, where the computer-readable storage medium is used to store instructions, and when the instructions are executed, the first aspect or any one of the first aspects is possible. implementation, or the second aspect or any possible implementation of the second aspect, or the third aspect or any possible implementation of the third aspect, or the fourth aspect or any of the fourth aspects A possible implementation, or the method in the fifth aspect or any of the possible implementations of the fifth aspect is implemented.

In a twelfth aspect, the present application provides a computer program product comprising instructions that, when executed, enable the first aspect or any possible implementation of the first aspect, or the second aspect or the second aspect Any possible implementation of the third aspect or any possible implementation of the third aspect, or the fourth aspect or any possible implementation of the fourth aspect, or the fifth aspect or the fifth The method of any possible implementation of the aspect is implemented.

In a thirteenth aspect, the present application provides a chip, the chip includes a logic circuit and an input-output interface, the input-output interface is used for communicating with modules other than the chip, and the logic circuit is used for running a computer program or instruction to realize the first aspect or any possible implementation of the first aspect, or the second aspect or any possible implementation of the second aspect, or the third aspect or any possible implementation of the third aspect, or the fourth aspect or any possible implementation manner of the fourth aspect, or the fifth aspect or the method in any possible implementation manner of the fifth aspect.

These and other aspects of the invention will be more clearly understood in the following description of the embodiment(s).

Description of drawings

The accompanying drawings used in the embodiments of the present application or the description of the prior art are briefly introduced below:

1 is a schematic diagram of a communication system provided by an embodiment of the present application;

2 is a schematic flowchart of a method for secure data transmission provided by an embodiment of the present application;

3 is a schematic flowchart of another method for data security transmission provided by an embodiment of the present application;

4 is a schematic diagram of a process method for processing a second timeliness parameter by a core network device according to an embodiment of the present application;

FIG. 5 is a schematic flowchart of another method for secure data transmission provided by an embodiment of the present application;

6 is a schematic flowchart of a method for locating a terminal device according to an embodiment of the present application;

FIG. 7 is a schematic flowchart of another method for locating a terminal device according to an embodiment of the present application;

8 is a schematic block diagram of a network device provided by an embodiment of the present application;

FIG. 9 is another schematic block diagram of a network device provided by an embodiment of the present application;

FIG. 10 is a schematic block diagram of the structure of a chip provided by an embodiment of the present application;

FIG. 11 is a schematic block diagram of a terminal device provided by an embodiment of the present application;

FIG. 12 is another schematic block diagram of a terminal device provided by an embodiment of the present application;

FIG. 13 is a schematic block diagram of the structure of another chip provided by an embodiment of the present application.

Detailed ways

The embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

In this application, the word "exemplary" is used to mean "serving as an example, illustration, or illustration." Any embodiment described in this application as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments. The following description is presented to enable any person skilled in the art to make and use the present invention. In the following description, details are set forth for the purpose of explanation. It will be understood by one of ordinary skill in the art that the present invention may be practiced without the use of these specific details. In other instances, well-known structures and procedures have not been described in detail so as not to obscure the description of the present invention with unnecessary detail. Thus, the present invention is not intended to be limited to the embodiments shown but is to be accorded the widest scope consistent with the principles and features disclosed herein.

The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances so that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having" and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those expressly listed Rather, those steps or units may include other steps or units not expressly listed or inherent to these processes, methods, products or devices.

The terms "system" and "network" are often used interchangeably herein.

The technical solutions of the embodiments of the present application can be applied to various wireless communication systems, such as: long term evolution (Long Term Evolution, LTE) system, fifth generation (5th generation, 5G) mobile communication system, new radio (new radio, NR) Communication systems, next generation (NG) communication systems and future mobile communication systems, etc.

In a wireless communication system, a terminal device is connected to a RAN device through a wireless link, and communicates with other terminal devices or accesses the wireless Internet through a CN device connected to the RAN device. Typically, a terminal device is wirelessly connected to a RAN device for communication. FIG. 1 shows a schematic diagram of a wireless communication system 100 provided by an embodiment of the present application. The terminal device 120 establishes a wireless connection with the RAN device 140 through the air interface, and accesses the core network 160 . In an actual system, in order to meet the coverage of a wireless network, multiple RAN devices are usually deployed in an area, and cells controlled by different RAN devices need to provide seamless coverage as much as possible. As shown in FIG. 1 , a RAN device 142 , a RAN device 144 and a RAN device 146 are deployed around the RAN device 140 . Different RAN devices may have interfaces for mutual communication, such as X2 interface or Xn interface. In a possible scenario, these RAN devices operate on the same frequency band and are deployed in different geographic locations, and the cells controlled by each of them jointly provide seamless coverage, such as the cells controlled by the RAN device 140 and the RAN device 142 There is a certain degree of overlapping coverage between the cells under control. The overlapping coverage area is usually neither too large nor too small, and the determination of the size of the overlapping coverage area needs to consider the interference between intra-frequency cells and the compromise between the performance of handover between cells. In another possible scenario, some RAN devices work in different frequency bands to form heterogeneous network coverage. For example, cells controlled by RAN device 140 work in lower frequency bands and have larger coverage areas, while cells controlled by RAN device 142 work in lower frequency bands and have larger coverage areas. Cells operate in higher frequency bands and have smaller coverage areas, these RAN devices may be deployed in the same or different geographic locations, and the cells controlled by each may have completely overlapping coverage areas, e.g. RAN device 140 operates in lower frequency bands , the RAN device 142 operates in a higher frequency band, and the coverage area of the cell controlled by the RAN device 140 can completely or mostly cover the coverage area of the cell controlled by the RAN device 142 .

In an actual system, the RAN device shown in Figure 1 can be a next-generation base station, such as a next-generation Node B (gNB) or a next-generation evolved Node B (ng-eNB) ), etc., it can also be an access point (AP) in a wireless local area network (Wireless Local Area Networks, WLAN), or an evolved base station (evolved Node B, eNB or eNodeB) in LTE, or a relay station or access point. point, or in-vehicle equipment, wearable equipment, and transmission and reception point (TRP), etc. It should be understood that the terminal device communicates with the RAN device through transmission resources (eg, frequency domain resources, time domain resources, code domain resources, etc.) used by one or more cells managed by the RAN device, and the cell may belong to a macro cell (macro cell). cell), super cell (hyper cell), can also belong to small cell (small cell), the small cell here can include: urban cell (metro cell), micro cell (micro cell), pico cell (pico cell), femto cell These small cells have the characteristics of small coverage and low transmission power, and are suitable for providing high-speed data transmission services. The terminal equipment in FIG. 1 may also be referred to as user equipment (UE), access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless Communication equipment, user agent or user equipment. The terminal device can be a station (station, ST) in the WLAN, and can be a cellular phone, a cordless phone, a SIP phone, a wireless local loop (WLL) station, a personal digital assistant (PDA) device, Handheld devices, relay devices, computing devices or other processing devices coupled to wireless modems, in-vehicle devices, wearable devices, and next-generation communication systems with wireless communication capabilities, such as end devices in 5G networks or future evolution of public terrestrial Terminal equipment in the mobile network (public land mobile network, PLMN) network, etc. As an example and not a limitation, in this embodiment of the present application, the terminal device may also be a wearable device. Wearable devices can also be called wearable smart devices, which are the general term for the intelligent design of daily wear and the development of wearable devices using wearable technology, such as glasses, gloves, watches, clothing and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable device is not only a hardware device, but also realizes powerful functions through software support, data interaction, and cloud interaction. In a broad sense, wearable smart devices include full-featured, large-scale, complete or partial functions without relying on smart phones, such as smart watches or smart glasses, and only focus on a certain type of application function, which needs to cooperate with other devices such as smart phones. Use, such as all kinds of smart bracelets, smart jewelry, etc. for physical sign monitoring.

For ease of understanding, several concepts involved in the embodiments of the present application are first introduced. It should be understood that the following concept explanations may be limited due to the specific circumstances of the embodiments of the present application, but it does not mean that the present application can only be limited to the specific circumstances. There will be differences:

1) Permanent identification of terminal equipment: a globally unique permanent identification used to identify terminal equipment, such as subscription permanent identifier (SUPI) or international mobile subscriber identity (IMSI).

2) Terminal equipment encryption identification: a temporary identification generated by a permanent identification of the terminal equipment and other parameters through an encryption and decryption algorithm, other parameters such as keys, time-sensitive parameters, etc.

3) Key: a key used to encrypt/decrypt data, or a key used to generate an encryption/decryption key or an integrity key.

4) Timeliness parameter: used to judge whether the current message is a valid message to prevent replay attacks. The timeliness parameter may be a sequence number (sequence number, SN), a count value (count), or a timestamp (timestamp) corresponding to the current message.

The following embodiments are specifically provided herein, and the technical solutions of the present application will be described in detail with specific method embodiments below with reference to FIGS. 2 to 7 . The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. Actions, terms, etc. involved in the various embodiments of the present application may refer to each other, which is not specifically limited in the present application. In the embodiments of the present application, the names of messages exchanged between devices or the names of parameters in the messages are just an example, and other names may also be used in specific implementations, which are not specifically limited in the present application. It should be noted that FIG. 2 to FIG. 7 are schematic flowcharts of method embodiments of the present application, showing detailed communication steps or operations of the method, but these steps or operations are only examples, and the embodiments of the present application further Other operations or variations of the various operations in FIGS. 2-7 may be performed. In addition, the steps in FIGS. 2 to 7 may be performed in a different order from those presented in FIGS. 2 to 7 , or may not be performed in the order presented, and may not be performed in the order shown in FIGS. 2 to 7 . all operations in .

FIG. 2 is a schematic flowchart of a method for secure data transmission provided by an embodiment of the present application. The method 200 is applied to a scenario in which a terminal device transmits data to a network when the terminal device is in a disconnected state. In this scenario, the terminal device in the disconnected state encrypts the data to be transmitted according to the security information on the terminal device side and sends it to the network, and the network decrypts the data according to the security information on the network side of the terminal device. The process described in Figure 2 includes the following steps:

S201. The core network device acquires core network side security information of the terminal device.

In this step, the core network device acquires the security information stored by the terminal device on the core network side, and the security information is the security information signed by the terminal device and the operator, which may also be called a subscription profile of the terminal device or Part of the contract document.

It should be noted that the core network device can obtain the core network side security information of the terminal device in various ways.

In a possible manner, the core network device pre-stores the core network side security information of the terminal device.

In another possible manner, the core network device obtains the core network side security information of the terminal device from other devices (such as other core network devices, a unified data management (UDM) function, a network management device, etc.).

S202, the terminal device generates encrypted data and auxiliary information according to the security information on the terminal device side.

In this step, the terminal device generates encrypted data according to the security information stored on the terminal device side.

It should be understood that the security information stored on the terminal device side and the security information stored on the core network side signed by the terminal device and the operator are the same. In other words, when a terminal device signs a contract with an operator, the security information signed by the terminal device will be stored on the core network side of the operator's network, and will also be stored on the terminal device (for example, stored in the subscriber identity module of the terminal device). , SIM) on).

When the terminal device needs to send data to the network, the terminal device encrypts the transmission data according to the security information stored on the terminal device side, thereby generating encrypted data. It should be understood that the transmission data is the source data sent by the terminal device to the network, and in the actual sending process, the terminal device encrypts the transmission data into encrypted data for transmission.

In addition, the terminal device further generates auxiliary information according to the security information stored on the terminal device side. It should be noted that all the auxiliary information is generated based on the security information stored on the terminal device side; or part of the auxiliary information is generated based on the security information stored on the terminal device side, and other parts of the auxiliary information are not The security information on the device side is generated. The auxiliary information is used to assist the core network device in decrypting the encrypted data sent by the terminal device.

It should be understood that the present application does not limit the sequence in which the terminal device performs the above step S201 and the core network device performs the above step S202. The terminal device may perform the above step S201 first; or the core network device may perform the above step S202 first; or the terminal device may perform the above step S202 first; The above step S201 is executed, and the core network device executes the above step S202 at the same time.

S203. The terminal device sends encrypted data and auxiliary information to the core network device. Correspondingly, the core network equipment receives encrypted data and auxiliary information from the terminal equipment.

In this step, the terminal device sends the encrypted data and auxiliary information to the core network device. It should be noted that the terminal device sends encrypted data and auxiliary information to the core network device through the RAN device. In other words, the RAN device receives encrypted data and auxiliary information sent by the terminal device, and then sends the encrypted data and auxiliary information to the core network device after processing or not processing the encrypted data and auxiliary information.

It should be understood that, unlike transmission data, the above-mentioned auxiliary information is directly sent by the terminal device without encryption.

S204, the core network device decrypts the data according to the core network side security information and auxiliary information of the terminal device.

In this step, the core network device decrypts the encrypted data from the terminal device according to the auxiliary information obtained from the above step S203 and the core network side security information of the terminal device obtained in the above step S201, and obtains the terminal device of transmission data.

It should be noted that the above-mentioned core network equipment can be any type of equipment in the core network, for example, access and mobility management function (access and mobility management function, AMF), session management function (session management function, SMF), Location management function (location management function, LMF), etc.

Through the above steps of this embodiment, the terminal device in the disconnected state can securely transmit data to the network and decrypted by the core network device, thereby realizing the secure transmission of data between the terminal device and the network in the disconnected state.

FIG. 3 is a schematic flowchart of another method for secure data transmission provided by an embodiment of the present application. The method 300 is applied to a scenario in which a core network device processes data sent by a terminal device in a disconnected state to the network. In this scenario, the core network device receives encrypted data transmission from the terminal device in the disconnected state, and decrypts the data according to the security information of the terminal device on the network side. It should be understood that the process shown in FIG. 3 is a specific implementation manner of the operation of the core network device in the process of FIG. 2 . The process described in Figure 3 includes the following steps:

S301. The core network device acquires the permanent identifier and security parameters of the terminal device.

In this step, the core network device acquires the permanent identification and security parameters of the terminal device stored in the core network by the terminal device, and the permanent identification and security parameters constitute the security information signed by the terminal device and the operator. The security parameters of the terminal device include keys, encryption and decryption algorithm information, and encryption identification calculation method information. It should be noted that the calculation method of the encrypted identifier of a terminal device is an algorithm negotiated or preset by the network and the terminal device. In the case where the same encryption identification calculation method is used between the network and all terminal devices (for example, the standard defines or the operator sets the encryption identification calculation method used by the network and each terminal device to be a specific calculation method), the terminal device The security parameters can only include the key and encryption and decryption algorithm information. The key is used to encrypt or decrypt the data, or to verify the integrity of the data, or to generate an encryption key or an integrity key; the encryption and decryption algorithm is used to encrypt or decrypt the data, and the encryption and decryption algorithm can is an encryption algorithm or a decryption algorithm; the calculation method of the encrypted identification is used to generate the encrypted identification. It should be understood that the above-mentioned encryption/decryption algorithm information is used to indicate the encryption/decryption algorithm of the terminal device obtained by the core network device, which may be the name, index or identification of the encryption/decryption algorithm, and may be in the form of numbers, characters, or a combination of numbers and characters. combination, which is not specifically limited in this application. Similarly, the calculation method information of the above-mentioned encrypted identification is used to indicate the calculation method of the encrypted identification of the terminal device obtained by the core network device, which can be the name, index or identification of the calculation method, and the expression can be numbers, characters or numbers. The combination with characters is not specifically limited in this application.

It should be noted that the core network device can obtain the permanent identification and security parameters of the terminal device in various ways. For example, the core network device pre-stores the permanent identification and security parameters of the terminal device; or the core network device obtains the permanent identification and security parameters of the terminal device from other devices (such as other core network devices, UDM functions, network management devices, etc.).

S302. The core network device receives the encrypted data and auxiliary information of the terminal device.

In this step, the core network device receives the encrypted transmission data and the corresponding auxiliary information of the terminal device. The encrypted data is encrypted data generated by the terminal device according to the security information stored on the terminal device side and the transmission data of the terminal device. The auxiliary information includes a first timeliness parameter and a first encryption identifier. The first timeliness parameter is a parameter generated by the terminal device each time it sends data, and is used to indicate the timeliness of the data sent by the terminal device this time, such as the serial number of the data sent this time, the count value corresponding to the data or the data sent this time. Timestamp of sent data, etc. Exemplarily, the value of the first timeliness parameter is a non-negative integer or a positive integer, such as (0), 1, 2, 3, and so on. The first encrypted identifier is an encrypted identifier generated by the terminal device each time it sends data to identify the terminal device.

S303. The core network device initializes, maintains or updates the second time-sensitive parameter.

The core network device generates the second timeliness parameter, and updates the second timeliness parameter in the process of receiving the data transmission of the terminal device. The second validity parameter is used to verify the validity of the received data of the terminal device. The value manner of the second timeliness parameter is the same as that of the first timeliness parameter. Exemplarily, during a certain process of receiving data sent by a terminal device, if the value of the first timeliness parameter received by the terminal device this time is not less than the current second timeliness parameter value of the core network device, the core network The device determines that the terminal device data received this time is valid; on the contrary, if the first timeliness parameter sent by the terminal device received this time is less than the current second timeliness parameter value of the core network device, the core network device determines that the The terminal device data received this time is invalid. Through this mechanism, replay attacks can be effectively prevented. For example, other equipment duplicates the data that has been sent by the terminal equipment and repeatedly sends it to the core network equipment, thereby causing an attack on the core network equipment.

Specifically, before the core network device does not receive the first data transmission from the terminal device, the core network device initializes the second timeliness parameter. After the core network device receives the data of the terminal device, the core network device determines whether to decrypt the encrypted data of the terminal device according to the second timeliness parameter and the first timeliness parameter received from the terminal device. If it is determined to decrypt the encrypted data of the terminal device, the core network device updates the second timeliness parameter, adds 1 to the second timeliness parameter value, or makes the second timeliness parameter value the same as the first timeliness parameter received in this data transmission. The value of the timeliness parameter is equal, or the value of the second timeliness parameter is equal to the value of the first timeliness parameter received in this data transmission plus 1; if it is determined not to decrypt the encrypted data of the terminal device, the core network device maintains the current The second timeliness parameter value.

Exemplarily, before the core network device does not receive the first data transmission from the terminal device, the core network device initializes the second timeliness parameter value to 0; when the core network device receives the encrypted data from the terminal device for the first time and In the case of determining the decrypted data, the core network device sets the value of the second timeliness parameter to 1, or sets the value of the second timeliness parameter to the first timeliness parameter received by the core network device and sent from the terminal device for the first time value; when the core network device receives the encrypted data from the terminal device for the second time and determines to decrypt the data, the core network device sets the second timeliness parameter value to 2, or sets the second timeliness parameter value to the core network device. The first timeliness parameter value received by the network device from the terminal device for the second time; and so on, when the core network device receives the encrypted data from the terminal device for the Nth time and determines the decrypted data, the core network device The second timeliness parameter value is set to N, or the second timeliness parameter value is set to the first timeliness parameter value received by the core network device and sent from the terminal device for the Nth time, where N is an integer greater than 1. It should be understood that in the case where the core network device receives the encrypted data from the terminal device for the Nth time but determines not to decrypt the data, the core network device maintains the value of the second timeliness parameter as the value of the Nth-time data received by the core network device from the terminal device. The value of the second timeliness parameter at the time of 1 transmission, or the value of the second timeliness parameter that is maintained is the value of the first timeliness parameter received by the core network device from the terminal device for the N-1th transmission; wherein, the core network device Nth -1 time to receive encrypted data from terminal device and determine decrypted data.

FIG. 4 shows a schematic diagram of a flow method for a core network device to process a second timeliness parameter. In this process, the core network device initializes, maintains or updates the second timeliness parameter according to different situations. First, the core network device initializes the second timeliness parameter. Before the core network device does not receive the first data transmission from the terminal device, the core network device initializes the second timeliness parameter. Optionally, the value of the second time-sensitive parameter is initialized to 0. Secondly, after the core network device receives the data transmission from the terminal device, the core network device compares the received first timeliness parameter value with the current second timeliness parameter value. If the first timeliness parameter value is greater than or equal to the current second timeliness parameter value, determine to decrypt the encrypted data from the terminal device, and update the second timeliness parameter value plus 1, or update the second timeliness parameter value equal to the first The value of the timeliness parameter, or the updated value of the second timeliness parameter is equal to the value of the first timeliness parameter plus 1. If the value of the first timeliness parameter is smaller than the current value of the second timeliness parameter, it is determined not to decrypt the encrypted data from the terminal device, and the current value of the second timeliness parameter remains unchanged. Optionally, when the value of the second timeliness parameter reaches a preset threshold, the second timeliness parameter may be re-initialized. For example, when the value of the second timeliness parameter is 1024, when the data sent by the terminal device is received next time, the value of the second timeliness parameter is re-initialized to 0.

It should be understood that the representation form of the second timeliness parameter can be not only a positive integer that increases successively as described above, but also a positive integer that decreases successively (such as initializing the second timeliness parameter to a specific value and receiving the terminal every subsequent time). The data sent by the device is determined to decrement the value of the second timeliness parameter when the data is decrypted), and may also be expressed in other forms, which are not specifically limited in this application. If the value of the second timeliness parameter is in a decreasing manner, the core network device initializes the second timeliness parameter to a positive integer; each time the core network device subsequently receives data sent by the terminal device and determines to decrypt the data, it can update the The second timeliness parameter value is minus 1 from the original value, or the second timeliness parameter value is updated to the currently received first timeliness parameter value sent by the terminal device. In this form, the condition for the core network device to determine the decrypted data is that the received value of the first timeliness parameter is smaller than the current value of the second timeliness parameter.

It should be noted that, if the second timeliness parameter is in the form of a timestamp, optionally, the current time information of the core network device is used as the second timeliness parameter during initialization or each time data sent by the terminal device is received. value, that is, to initialize, maintain or update the second timeliness parameter is to set the second timeliness parameter value to the current time information. In this form, the condition for the core network device to determine the decrypted data is that the received value of the first timeliness parameter is not less than the value of the second timeliness parameter.

S304. The core network device decrypts the data according to the second timeliness parameter and the auxiliary information.

In this step, after the core network device determines to decrypt the encrypted data from the terminal device according to the first timeliness parameter value and the second timeliness parameter value, the core network device determines the terminal device according to the terminal device auxiliary information obtained in the above step S302. The permanent identifier is the same as the permanent identifier of the terminal device in the core network side security information of the terminal device obtained by the core network device in the above step S301. Specifically, the core network device receives the first encrypted identifier from the terminal device in the foregoing step S302, and the core network device determines the permanent identifier of the terminal device according to the first encrypted identifier. In this way, the core network device can determine which terminal device sends the encrypted data through the received first encryption identifier of the terminal device, thereby providing help for further decrypting the data. The core network device may determine the permanent identifier of the terminal device according to the first encrypted identifier of the terminal device in the following two ways:

Manner 1: The core network device determines the permanent identifier of the terminal device according to the received first encrypted identifier and the first time-sensitive parameter of the terminal device by means of a table lookup.

In a possible implementation, the core network device may establish a correspondence table between the permanent identifier of the terminal device and the encrypted identifier of the terminal device according to the core network side security information of the terminal device before this step. Optionally, the encrypted identifier of the terminal device in the correspondence table may be calculated by the core network device according to the permanent identifier of the terminal device, the security parameter and the value of the timeliness parameter. For example, the encrypted identification is obtained by calculating the permanent identification, key, and time-sensitive parameters of the terminal device; or, the encrypted identification is obtained by the core network device based on the permanent identification, key and time-sensitive parameters of the terminal device using the calculation method of encrypted identification. . Based on the correspondence table, the core network can determine the permanent identification of the terminal device corresponding to the encrypted identification of the terminal device by looking up the table. Exemplarily, Table 1 shows the correspondence table between the permanent identifier of the terminal device and the encrypted identifier of the terminal device established by the core network device using the core network side security information of the terminal device. Among them, the first column of Table 1 is the permanent identification of the terminal device, and the second column is the encrypted identification of the terminal device. The permanent identification of each terminal device and the encrypted identification corresponding to the terminal device are recorded in the table, for example, the permanent identification of terminal device #1 and the encrypted identification of terminal device #1 corresponding to terminal device #1, the permanent identification of terminal device #2 and the encrypted identification of terminal device #1 The encrypted identification of terminal device #2 corresponding to #2, etc. It should be noted that the correspondence between the permanent identification of the terminal device and the encrypted identification of the terminal device in Table 1 is based on a specific time-sensitive parameter value. When the value of the validity parameter is different, the permanent identification of the terminal device corresponds to the encrypted identification of the terminal device. The core network device receives the encrypted identifier of the terminal device #1 and the first timeliness parameter value from the above step S302, and when the first timeliness parameter value is not less than the second timeliness parameter value, according to the first timeliness parameter value, Find Table 1 corresponding to this first timeliness parameter value. Further, by querying Table 1, the core network device can learn the permanent identifier of the terminal device #1. It should be understood that the contents of the above two columns in Table 1 can also be interchanged, the first column is the encrypted identification of the terminal device, and the second column is the permanent identification of the terminal device.

Table 1

终端设备永久标识Permanent identification of terminal equipment	终端设备加密标识End Device Encrypted Identification
终端设备#1永久标识Terminal Equipment #1 Permanent Identification	终端设备#1加密标识End Device #1 Encrypted Identification
终端设备#2永久标识Terminal Equipment #2 Permanent Identification	终端设备#2加密标识End Device #2 Encrypted Identification
……...	……...

Exemplarily, Table 2 shows the correspondence between the permanent identification of the terminal device and the encrypted identification of the terminal device for different time-sensitive parameter values. For example, the permanent identification of terminal device #1 corresponds to the encrypted identification A of terminal device #1 when the value of the timeliness parameter is A, and the permanent identification of terminal device #1 corresponds to the encrypted identification of terminal device #1 when the value of the timeliness parameter is B. When the value of the timeliness parameter is C, the permanent identification #1 corresponds to the encrypted identification C of terminal equipment #1, and the permanent identification of terminal equipment #1 corresponds to the encrypted identification D of terminal equipment #1 when the value of the aging parameter is D; similarly, the terminal equipment # 2 The permanent identifier also corresponds to different encrypted identifiers of terminal equipment #2 when different time-sensitive parameters have different values. The core network device receives the encrypted identifier of the terminal device #1 and the first timeliness parameter value from the above step S302, and when the first timeliness parameter value is not less than the second timeliness parameter value, compares the first timeliness parameter value with the value of the first timeliness parameter. The time-sensitive parameter values in Table 2 are matched, and by querying Table 2, the core network device can learn the permanent identifier of the terminal device #1. It should be understood that the contents of each column in Table 2 can also be interchanged, for example, the first column is the encrypted identifier of the terminal device, the second column is the time-sensitive parameter, and the third column is the permanent identifier of the terminal device.

Table 2

In another possible implementation, the core network device may establish a correspondence table between the encryption and decryption algorithm of the terminal device and the encryption identifier of the terminal device according to the core network side security information of the terminal device before this step. Based on the correspondence table, the core network can determine the permanent identification of the terminal device corresponding to the encrypted identification of the terminal device by looking up the table. Exemplarily, Table 3 shows the correspondence table between the terminal device encryption and decryption algorithm information and the terminal device encryption identifier established by the core network device using the core network side security information of the terminal device. Among them, the first column of Table 3 is the encryption and decryption algorithm information of the terminal device, and the second column is the encryption identifier of the terminal device. The encryption and decryption algorithm information used by each terminal device and the encryption identifier corresponding to the terminal device are recorded in the table, for example, the encryption and decryption algorithm information of terminal device #1 and the encrypted identifier of terminal device #1 corresponding to terminal device #1, terminal device #2 The encryption and decryption algorithm information and the encryption identifier of the terminal device #2 corresponding to the terminal device #2, etc. The core network device receives the encrypted identifier of the terminal device #1 from the above step S302, and by querying Table 2, the core network device can learn the encryption and decryption algorithm information of the terminal device #1. Further, the core network device calculates and obtains the permanent identifier of the terminal device #1 according to the encrypted identification of the terminal device #1 from the terminal device, the encryption and decryption algorithm information of the terminal device #1, and the first timeliness parameter. It should be understood that the contents of the above two columns in Table 3 can also be interchanged, the first column is the encryption identifier of the terminal device, and the second column is the encryption and decryption algorithm information of the terminal device.

table 3

终端设备加解密算法信息Terminal device encryption and decryption algorithm information	终端设备加密标识End Device Encrypted Identification
终端设备#1加解密算法信息Terminal device #1 encryption and decryption algorithm information	终端设备#1加密标识End Device #1 Encrypted Identification
终端设备#2加解密算法信息Terminal device #2 encryption and decryption algorithm information	终端设备#2加密标识End Device #2 Encrypted Identification
……...	……...

Exemplarily, Table 4 shows the correspondence table of the permanent identification of the terminal device, the encrypted identification of the terminal device, and the encryption and decryption algorithm information of the terminal device established by the core network device using the core network side security information of the terminal device. Among them, the first column of Table 4 is the permanent identification of the terminal device, the second column is the encryption and decryption algorithm information of the terminal device, and the third column is the encrypted identification of the terminal device. In this table, record the permanent identification of each terminal device, the encryption and decryption algorithm information corresponding to the terminal device, and the encryption identification corresponding to the terminal device, such as the permanent identification of terminal device #1 and the encryption and decryption algorithm information of terminal device #1 and terminal device # 1 corresponds to the encrypted identification of terminal device #1, the permanent identification of terminal device #2, the encryption and decryption algorithm information of terminal device #2, and the encrypted identification of terminal device #2 corresponding to terminal device #2. The core network device receives the encrypted identifier of the terminal device #1 from the above step S302, and by querying Table 4, the core network device can learn the permanent identifier of the terminal device #1 and the encryption and decryption algorithm information of the terminal device. It should be understood that the contents of the above three columns in Table 4 can also be interchanged, and the specific forms will not be repeated here. It should be noted that the correspondence between the permanent identification of the terminal device and the encrypted identification of the terminal device in Table 4 is based on a specific second time-sensitive parameter value. When the value of the second validity parameter is different, the permanent identification of the terminal device corresponds to the encrypted identification of the terminal device. Table 4 may also further include information on the second timeliness parameter in a manner similar to Table 2.

Table 4

Optionally, in the above-mentioned way 1, the core network device establishes a correspondence table between the permanent identifier of the terminal device and the encrypted identifier of the terminal device according to the core network side security information of the terminal device, and the encrypted identifier of the terminal device in the correspondence table may be the core network device. It is calculated according to the permanent identification and security parameters of the terminal equipment, as well as the time-sensitive parameter value. For example, the encrypted identifier is calculated from the permanent identifier, the key, and the time-sensitive parameter; or, the encrypted identifier is calculated from the permanent identifier, the key, and the time-sensitive parameter by using the calculation method of the encrypted identifier.

Manner 2: The core network device determines the permanent identifier of the terminal device according to the received first encrypted identifier of the terminal device by means of calculation.

When the core network device determines to decrypt the encrypted data of the terminal device (that is, the value of the first timeliness parameter is not less than the value of the second timeliness parameter), the core network device determines according to the terminal device auxiliary information obtained from the above step S302, and The permanent identifier of the terminal device is calculated by the method for calculating the encrypted identifier of the terminal device determined in the above step S201. Exemplarily, the calculation method of the terminal device encryption identification can be a mathematical function whose input parameters include a terminal device permanent identification, a key and a timeliness parameter, and the output parameter of the function is the terminal device encryption identification corresponding to the terminal device permanent identification; similar Preferably, the method for calculating the encrypted identification of the terminal device may also be a mathematical function whose input parameters include the encrypted identification of the terminal device and the time-sensitive parameter, and the output parameter of the function is the permanent identification of the terminal device corresponding to the encrypted identification of the terminal device. Specifically, the core network device will use the first encrypted identifier and the first time-sensitive parameter of the terminal device obtained in the above step S302, and the key of the terminal device obtained by the core network device from the above step S301 as the encrypted identifier of the terminal device. The input parameters of the calculation method through which the permanent identification of the terminal device is obtained.

Through any of the above methods, the core network device can obtain the permanent identifier of the terminal device. Next, the core network device determines the corresponding key and encryption/decryption algorithm from the core network side security information of the terminal device according to the permanent identifier.

Further, the core network device decrypts the encrypted data according to the key of the terminal device and the encryption and decryption algorithm, and obtains the transmission data of the terminal device. In a possible implementation, the core network device decrypts the encrypted data using the key of the terminal device and an encryption/decryption algorithm to obtain the transmission data of the terminal device. In another possible implementation, the core network device obtains the first key by deriving the key of the terminal device, and uses the first key and an encryption/decryption algorithm to decrypt the encrypted data to obtain the transmission data of the terminal device.

Through the above steps in this embodiment, the core network device can effectively decrypt the encrypted data sent by the terminal device in the disconnected state, thereby realizing the secure transmission of data between the terminal device and the network in the disconnected state.

FIG. 5 is a schematic flowchart of another method for data security transmission provided by an embodiment of the present application. The method 500 is applied to a scenario where a terminal device processes data sent to a network in a disconnected state. In this scenario, the terminal device generates encrypted data and auxiliary information according to the security information on the terminal device side, and sends the encrypted data and auxiliary information to the core network device. It should be understood that the process shown in FIG. 5 is a specific implementation manner of the operation of the terminal device in the process of FIG. 2 . The process shown in Figure 5 includes the following steps:

S501. A terminal device initializes a first time-sensitive parameter.

In this step, the terminal device initializes the first time-sensitive parameter. The first time-sensitive parameter is a parameter generated by the terminal device each time data transmission is performed. When the terminal device sends data to the network for the first time, the first time-sensitive parameter is initialized. Each time the subsequent terminal device sends data to the network, the terminal device needs to update the first timeliness parameter. Exemplarily, the terminal device initializes the value of the first timeliness parameter to 0.

It can be seen that step S501 is optional. When sending data to the network for the first time, the terminal device initializes the first time-sensitive parameter.

S502, the terminal device encrypts the transmission data according to the security information on the terminal device side and generates a first encryption identifier of the terminal device.

In this step, the terminal device generates encrypted data according to the security information stored on the terminal device side, wherein the security information on the terminal device side includes the permanent identification and security parameters of the terminal device, and the security parameters include the key, encryption and decryption algorithm information, and further Alternatively, the security parameter may also include information on a calculation method of the encrypted identification of the terminal device. It should be understood that the security information stored on the side of the terminal device and the security information subscribed by the terminal device stored in the core network are the same.

When the terminal device needs to transmit data to the network, the terminal device can encrypt the transmitted data according to the key and encryption/decryption algorithm stored on the terminal device side, thereby generating encrypted data. In a possible implementation, the terminal device encrypts the transmission data by using a key and an encryption/decryption algorithm stored on the terminal device side, thereby generating encrypted data. In another possible implementation, the terminal device obtains the first key by deriving the key stored on the terminal device side, and encrypts the transmission data by using the first key and an encryption/decryption algorithm, thereby generating encrypted data.

In addition, the terminal device further generates auxiliary information. Wherein, the auxiliary information includes a first timeliness parameter and a first encrypted identifier of the terminal device. In the case that the terminal device sends data to the network for the first time, the first time-sensitive parameter value is the first time-sensitive parameter value initialized by the terminal device in the foregoing step S501. In the case where the terminal device subsequently sends data to the network, the value of the first timeliness parameter is the value of the first timeliness parameter updated when the terminal device previously sent data to the network. Exemplarily, each time the terminal device sends data to the network, the value of the first timeliness parameter is updated to the original value of the first timeliness parameter plus 1. The first encrypted identifier of the terminal device is generated by the terminal device according to the security information stored on the side of the terminal device. Specifically, the terminal device uses the terminal device's permanent identifier, key and first time-sensitive parameter as input to the terminal device encrypted identifier calculation method, and generates the terminal device's first encrypted identifier through the terminal device encrypted identifier calculation method. Optionally, the method for calculating the encrypted identification of the terminal device is a hash algorithm.

S503, the terminal device sends encrypted data and auxiliary information.

In this step, the terminal device sends encrypted data, the first timeliness parameter and the first encrypted identifier to the core network device. The first time-sensitive parameter and the first encrypted identifier are used to provide the core network device, so that the core network device can determine the permanent identifier of the terminal device accordingly.

S504. The terminal device updates the first time-sensitive parameter.

Each time the terminal device sends data to the network, the terminal device updates the first timeliness parameter. When sending data for the first time, the terminal device initializes the first timeliness parameter; each time the terminal device sends data to the network subsequently, the updated value of the first timeliness parameter is plus 1 to the original value. For example, when the terminal device sends data for the first time, it initializes the value of the first timeliness parameter to 0; when the terminal device sends data for the second time, it updates the value of the first timeliness parameter to 1; when the terminal device sends data for the third time, Update the value of the first timeliness parameter to 2; and so on. Optionally, when the value of the first timeliness parameter reaches a preset threshold, the first timeliness parameter may be re-initialized. For example, when the value of the first timeliness parameter is 1024, when the terminal device sends data next time, the value of the first timeliness parameter is reinitialized to be 0.

It should be understood that the representation form of the first timeliness parameter can be not only a positive integer that increases successively as described above, but also a positive integer that decreases successively (for example, initializing the first timeliness parameter to a specific value and sending data every subsequent time) Decrease the value of the first timeliness parameter), and may also be in other forms, which are not specifically limited in this application. If the value of the first timeliness parameter is in a decreasing form, the terminal device initializes the first timeliness parameter to a positive integer when sending data for the first time; the first timeliness parameter can be updated each time the terminal device sends data subsequently The value is the original value minus 1.

It should be noted that, if the first timeliness parameter is in the form of a timestamp, optionally, the current time information of the terminal device is used as the value of the first timeliness parameter during initialization or each time data is sent.

Through the above steps of this embodiment, the encrypted data and auxiliary information sent by the terminal device in the disconnected state to the network are enabled, so that the core network device can effectively decrypt and obtain the transmission data of the terminal device, and the terminal device in the disconnected state can communicate with the network. Secure transmission of data between.

The above method for secure data transmission can be further applied to a scenario where a network locates a terminal device. In the existing terminal equipment positioning technology, a gateway mobile location center (Gateway Mobile Location Center, GMLC) triggers or requests terminal equipment positioning. After the terminal device registers with the network for authentication, it establishes a radio resource control (RRC) connection with the RAN device, and the LMF on the core network side establishes an LTE positioning protocol (LPP) based on the AMF and the RAN device and the terminal device. Or the connection of the New Radio Positioning Protocol A (NRPPa) to realize the measurement configuration and measurement reporting related to positioning, and the LMF will calculate according to the reported measurement results to obtain the location information of the terminal equipment. When the terminal device is in the disconnected state, since the terminal device has neither AS connection with the RAN nor NAS connection with the core network, it is difficult to locate the terminal device in the disconnected state in the prior art.

FIG. 6 is a schematic flowchart of a method for locating a terminal device according to an embodiment of the present application. The method 600 is applied to a scenario where a network locates a terminal device in a disconnected state. In this scenario, the terminal device generates encrypted positioning measurement data and auxiliary information according to the security information on the terminal device side, and sends them to the LMF. The LMF decrypts the positioning measurement data and calculates the position of the terminal device according to the security information on the network side of the terminal device. information. The process described in Figure 6 includes the following steps:

S601. The GMLC acquires core network side security information of the terminal device.

In a possible manner, the GMLC stores the core network side security information of the terminal device in advance.

In another possible manner, the GMLC acquires the core network side security information of the terminal device from the UDM, where the UDM stores the subscription information of the terminal device. For example, the GMLC sends a first request to the UDM, where the first request includes the permanent identification of the terminal device. The first request is for the GMLC to request the UDM to obtain the security parameters of the terminal device. Wherein, the security parameters of the terminal device include keys and encryption and decryption algorithm information. Optionally, the security parameter of the terminal device further includes information on the calculation method of the encrypted identification. In response to the first request, the UDM sends a first response to the GMLC, the first response including the security parameters of the terminal device.

S602. The GMLC sends the core network side security information of the terminal device to the LMF. Correspondingly, the LMF receives the core network side security information of the terminal equipment from the GMLC.

Optionally, the GMLC sends the core network side security information of the terminal device to the LMF through the AMF.

Optionally, the GMLC sends the core network side security information of the terminal device to the AMF; the AMF includes the core network side security information of the terminal device in the message sent to the LMF.

Optionally, the GMLC sends the second request to the LMF; or the GMLC sends the second request to the LMF through the AMF; or the GMLC sends the second request to the AMF, and the AMF then sends the third request to the LMF. The second request/third request includes the core network side security information of the terminal device. The second request is for the GMLC to request the location information of the terminal device. The third request is for the AMF to request the location information of the terminal device.

S603, a positioning measurement process is performed between the LMF and the terminal device.

In this step, the LMF determines the positioning method of the terminal equipment, and executes the corresponding positioning measurement procedure of the positioning method with the terminal equipment. It should be understood that the positioning measurement process may be a positioning process or a measurement process. The LMF interacts with the terminal device in the disconnected state, and the corresponding interactive information usually needs to be forwarded through the AMF and the RAN device. It should be understood that the positioning measurement process between the LMF and the terminal device may adopt various methods in the prior art, including the methods of downlink positioning and uplink positioning, which will not be repeated in this application.

S604. The terminal device generates encrypted positioning measurement data and auxiliary information.

In the positioning measurement process, the terminal device needs to provide the LMF with data related to the positioning measurement (referred to as positioning measurement data here), so that the LMF can calculate the position of the terminal device. It should be understood that the positioning measurement data may also be other data that the terminal device needs to send, such as capability information of the terminal device, positioning assistance information requested by the terminal device, and other information of the terminal device. This application does not specifically limit the content included in the positioning measurement data of the terminal device.

In this step, the terminal device encrypts the positioning measurement data according to the security information on the terminal device side, and generates auxiliary information.

S605. The terminal device sends encrypted positioning measurement data and auxiliary information to the LMF. Accordingly, the LMF receives encrypted positioning measurement data and assistance information from the terminal device.

S606. The LMF decrypts the positioning measurement data according to the core network side security information and auxiliary information of the terminal device.

The foregoing steps S604 to S606 are respectively similar to the steps S202 to S204 in the foregoing embodiment, which will not be repeated herein.

S607. The LMF calculates the location information of the terminal device.

In this step, the LMF calculates the location information of the terminal device according to the decrypted positioning measurement data. There are many methods for the LMF to calculate the location information of the terminal device, such as the method based on the uplink time difference of arrival, the method based on the angle of arrival, etc., which will not be repeated in this article.

S608. The LMF sends the location information of the terminal device to the GMLC. Accordingly, the GMLC receives the location information of the terminal equipment from the LMF.

Optionally, as a response to the second request, the LMF sends a second response to the GMLC, or the LMF sends a second response to the GMLC through the AMF, where the second response includes the location information of the terminal device.

Optionally, as a response to the third request, the LMF sends a third response to the AMF; the AMF then sends a second response to the GMLC, where both the second response and the third response include the location information of the terminal device.

Optionally, before the above-mentioned step S601, the method can also include that the GMLC obtains a positioning request to the terminal equipment from a client (client) or an external client (external client), so that the GMLC further requests the AMF or LMF for the position of the terminal equipment. information. Similarly, after the above step S608, the method may further include the GMLC sending the location information of the terminal device to the client or external client.

Through the above steps in this embodiment, the LMF can locate the terminal device in the disconnected state, so that the GMLC can obtain the location information of the terminal device in the disconnected state.

FIG. 7 is a schematic flowchart of another method for locating a terminal device according to an embodiment of the present application. The method 700 is applied to a scenario where a network locates a terminal device in a disconnected state. In this scenario, the terminal device generates encrypted positioning measurement data and auxiliary information according to the security information on the terminal device side, and sends it to the AMF. The AMF decrypts the positioning measurement data according to the security information on the network side of the terminal device and sends it to the LMF for calculation. Terminal device location information. The process shown in Figure 7 includes the following steps:

S701. The GMLC acquires the core network side security information of the terminal device.

The above steps are similar to step S601 in the foregoing embodiment, and details are not described herein again.

S702. The GMLC sends the core network side security information of the terminal device to the AMF. Correspondingly, the AMF receives the core network side security information of the terminal equipment from the GMLC.

Optionally, the GMLC sends a fourth request to the AMF. The fourth request includes the core network side security information of the terminal device. The fourth request is for the GMLC to request the location information of the terminal device.

S703. The AMF sends the permanent identifier of the terminal device to the LMF. Accordingly, the LMF receives the permanent identification of the terminal device from the AMF.

In this step, the AMF sends the permanent identification of the terminal device obtained in the above step S702 to the LMF. Optionally, the AMF sends a fifth request to the LMF, where the fifth request includes the permanent identification of the terminal device. The fifth request is for the AMF to request the LMF to locate the terminal device.

S704, a positioning measurement process is performed between the LMF and the terminal device.

S705, the terminal device generates encrypted positioning measurement data and auxiliary information.

S706, the terminal device sends the encrypted positioning measurement data and auxiliary information to the AMF. Accordingly, the AMF receives encrypted positioning measurement data and assistance information from the terminal device.

S707, the AMF decrypts the positioning measurement data according to the core network side security information and auxiliary information of the terminal device.

The foregoing steps S704 to S707 are respectively similar to the steps S603 to S606 in the foregoing embodiment, which will not be repeated herein. The main difference is that, in the foregoing embodiment, the LMF receives the encrypted positioning measurement data and auxiliary information from the terminal equipment, and decrypts the positioning measurement data according to the core network side security information and auxiliary information of the terminal equipment. In this embodiment, the AMF receives the encrypted positioning measurement data and auxiliary information from the terminal device, and decrypts the positioning measurement data according to the core network side security information and auxiliary information of the terminal device. Optionally, the terminal device includes the positioning measurement data to be sent to the LMF in the form of a protocol data unit (protocol data unit, PDU) in a message sent by the terminal device to the AMF.

S708: The AMF sends the positioning measurement data of the terminal device to the LMF. Accordingly, the LMF receives measurement data from the terminal equipment of the AMF.

In this step, the AMF sends the location measurement data of the terminal device decrypted in the above step S707 to the LMF, so that the LMF can calculate the location information of the terminal device.

Optionally, the AMF sends the decrypted PDU to be sent by the terminal device to the LMF to the LMF.

S709, the LMF calculates the location information of the terminal device.

S710. The LMF sends the location information of the terminal device to the GMLC. Accordingly, the GMLC receives the location information of the terminal equipment from the LMF.

The foregoing steps S709 and S710 are respectively similar to the steps S607 and S608 in the foregoing embodiment, which will not be repeated herein.

Optionally, as a response to the fifth request, the LMF sends a fifth response to the AMF, where the fifth response includes the location information of the terminal device. In response to the fourth request, the AMF sends a fourth response to the GMLC, the fourth response including the location information of the terminal device.

Optionally, before the above step S702, the method may further include that the GMLC obtains a positioning request for the terminal device from the client or an external client, so that the GMLC further requests the AMF for the location information of the terminal device. Similarly, after the above step S710, the method may further include the GMLC sending the location information of the terminal device to the client or external client.

Through the above steps in this embodiment, the AMF can trigger the LMF to locate the terminal device in the disconnected state, so that the GMLC can obtain the location information of the disconnected state terminal device.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this patent application.

The method embodiments of the present application are described in detail above with reference to FIGS. 2 to 7 , and the device embodiments of the present application are described in detail below with reference to FIGS. 8 to 13 . It should be understood that the apparatus embodiments and the method embodiments correspond to each other, and for similar descriptions, reference may be made to the method embodiments. Notably, the apparatus embodiments may be used in conjunction with the above-described methods, or may be used alone.

8 shows a schematic block diagram of a network device according to an embodiment of the present application. The network device 800 may correspond to (for example, may be configured in or be itself) the core network device described in the foregoing method 200, or the foregoing method 300. or the core network equipment described in the above method 400, or the LMF described in the above method 600, or the GMLC described in the above method 600, or the LMF described in the above method 700, or the above method 700. AMF, or GMLC as described in method 700 above.

The network device 800 may include a communication unit 801 and a processing unit 802 . The communication unit 801 may include a sending unit and/or a receiving unit, the sending unit is used to implement the sending function, the receiving unit is used to implement the receiving function, and the communication unit 801 may implement the sending function and/or the receiving function. The communication unit may also be described as a transceiving unit. The network device 800 may further include a storage unit 803 for storing programs or data to be executed by the processing unit 802 or storing information received and/or transmitted through the communication unit 801 . The network device 800 may be a network device, a device in another device, or a device that can be used in combination with the network device.

Each unit in the network device 800 is respectively configured to execute the core network device described in the foregoing method 200, or the core network device described in the foregoing method 300, or the core network device described in the foregoing method 400, or the foregoing method 600. The LMF, or the GMLC described in the above method 600, or the LMF described in the above method 700, or the AMF described in the above method 700, or the GMLC described in the above method 700, perform each action or process. Here, in order to avoid redundant description, the detailed description thereof is omitted.

FIG. 9 shows a schematic block diagram of a network device 900 according to an embodiment of the present application. The network device 900 may correspond to (for example, may be configured in or be itself) the core network device described in the foregoing method 200, or the foregoing method 300. The described core network device, or the core network device described in the above method 400, or the LMF described in the above method 600, or the GMLC described in the above method 600, or the LMF described in the above method 700, or described in the above method 700 AMF, or GMLC as described in method 700 above.

The network device 900 may include one or more processors 901 . The processor 901 may be a general-purpose processor or a special-purpose processor, or the like. For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control the network device 900, execute computer programs, and process data of the computer programs.

The network device 900 may further include a transceiver 902 and an antenna 903 . The transceiver 902 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., and is used to implement a transceiver function. The transceiver 902 may include a receiver and a transmitter, the receiver may be called a receiver or a receiving circuit, etc., for implementing a receiving function; the transmitter may be called a transmitter or a transmitting circuit, etc., for implementing a transmitting function.

Optionally, the network device 900 may include one or more memories 904 on which a computer program 905 may be stored, and the computer program may be executed on the network device 900, so that the network device 900 executes the methods described in the foregoing method embodiments. method. Optionally, the memory 904 may also store data. The network device 900 and the memory 904 can be provided separately or integrated together.

In a possible implementation, the processor 901 may include a transceiver for implementing the functions of receiving and transmitting. For example, the transceiver may be a transceiver circuit, or an interface, or an interface circuit. Transceiver circuits, interfaces or interface circuits used to implement receiving and transmitting functions may be separate or integrated. The above-mentioned transceiver circuit, interface or interface circuit can be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface or interface circuit can be used for signal transmission or transmission.

In a possible implementation, the processor 901 may store a computer program 906, and the computer program 906 runs on the processor 901 to enable the network device 900 to execute the methods described in the above method embodiments. The computer program 906 may be embodied in the processor 901, in which case the processor 901 may be implemented by hardware.

In a possible implementation, the network device 900 may include a circuit, and the circuit may implement the function of sending or receiving or communicating in the foregoing method embodiments. The processors and transceivers described in this application can be implemented in integrated circuits (ICs), analog ICs, radio frequency integrated circuits (RFICs), mixed-signal ICs, application specific integrated circuits (ASICs), printed circuit boards ( printed circuit board, PCB), electronic equipment, etc. The processor and transceiver can also be fabricated using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), nMetal-oxide-semiconductor (NMOS), P-type Metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

It should be understood that the processor 901 may be a central processing unit (central processing unit, CPU), a network processor (network processor, NP), a hardware chip or any combination thereof. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The memory 904 may be a volatile memory (volatile memory), such as random-access memory (RAM); or a non-volatile memory (non-volatile memory), such as a read-only memory (read-only memory) , ROM), flash memory (flash memory), hard disk drive (HDD) or solid-state drive (solid-state drive, SSD); it can also be a combination of the above types of memory.

Each processor 901 and transceiver 902 in the network device 900 are respectively configured to execute the core network device described in the above method 200, or the core network device described in the above method 300, or the core network device described in the above method 400, or The LMF described in the above method 600, or the GMLC described in the above method 600, or the LMF described in the above method 700, or the AMF described in the above method 700, or the GMLC described in the above method 700, the actions performed or processing. Here, in order to avoid redundant description, the detailed description thereof is omitted.

The structure of the network device 900 may not be limited by FIG. 9 . Network device 900 may be a stand-alone device or may be part of a larger device. For example, the network device 900 can be:

(1) Independent integrated circuit IC, or chip, or, chip system or subsystem;

(2) a set with one or more ICs, optionally, the IC set can also include a storage component for storing data and computer programs;

(3) ASIC, such as modem (Modem);

(4) Modules that can be embedded in other equipment;

(5) Receivers, terminals, smart terminals, cellular phones, wireless devices, handsets, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.;

(6) Others, etc.

For the case that the network device 900 may be a chip or a chip system, reference may be made to the schematic structural diagram of the chip 1000 shown in FIG. 10 . The chip 1000 shown in FIG. 10 includes a logic circuit 1001 and an input-output interface 1002, the input-output interface 1002 is used for communicating with modules other than the chip 1000, and the logic circuit 1001 is used for running a computer program or instruction to realize the above Function of any method embodiment. The number of input and output interfaces 1002 may be multiple.

Optionally, the chip 1000 further includes a memory 1003, and the memory 1003 is used to store necessary computer programs (or instructions) and data.

The logic circuit 1001 and the input/output interface 1002 in the chip 1000 are respectively used to execute the core network device described in the above method 200, or the core network device described in the above method 300, or the core network device described in the above method 400, or the above method. The LMF described in 600, or the GMLC described in the above method 600, or the LMF described in the above method 700, or the AMF described in the above method 700, or the GMLC described in the above method 700, each action or process performed . Here, in order to avoid redundant description, the detailed description thereof is omitted.

FIG. 11 shows a schematic block diagram of a terminal device 1100 according to an embodiment of the present application. The terminal device 1100 may correspond to (for example, may be configured in or be itself) the terminal device described in the foregoing method 200, or the foregoing method 500. The terminal device, or the terminal device described in the above method 600, or the terminal device described in the above method 700.

The terminal device 1100 may include a communication unit 1101 and a processing unit 1102 . The communication unit 1101 may include a sending unit and/or a receiving unit, the sending unit is used to implement the sending function, the receiving unit is used to implement the receiving function, and the communication unit 1101 may implement the sending function and/or the receiving function. The communication unit may also be described as a transceiving unit. The terminal device 1100 may further include a storage unit 1103 for storing programs or data to be executed by the processing unit 1102 , or storing information received and/or transmitted through the communication unit 1101 . The terminal device 1100 may be a terminal device, a device in another device, or a device that can be used in combination with the terminal device.

Each unit in the terminal device 1100 is respectively configured to execute the terminal device described in the above method 200, or the terminal device described in the above method 500, or the terminal device described in the above method 600, or the terminal device described in the above method 700, Each action or process performed. Here, in order to avoid redundant description, the detailed description thereof is omitted.

FIG. 12 shows a schematic block diagram of a terminal device 1200 according to an embodiment of the present application. The terminal device 1200 may correspond to (for example, may be configured in or be itself) the terminal device described in the foregoing method 200, or the foregoing method 500. The terminal device, or the terminal device described in the above method 600, or the terminal device described in the above method 700.

The terminal device 1200 may include one or more processors 1201 . The processor 1201 may be a general-purpose processor or a special-purpose processor, or the like. For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control the terminal device 1200, execute computer programs, and process data of the computer programs.

The terminal device 1200 may further include a transceiver 1202 and an antenna 1203 . The transceiver 1202 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., and is used to implement a transceiver function. The transceiver 1202 may include a receiver and a transmitter. The receiver may be called a receiver or a receiving circuit, etc., for implementing a receiving function; the transmitter may be called a transmitter or a transmitting circuit, etc., and is used for implementing a transmitting function.

Optionally, the terminal device 1200 may include one or more memories 1204, and a computer program 1205 may be stored thereon, and the computer program may be executed on the terminal device 1200, so that the terminal device 1200 executes the methods described in the foregoing method embodiments. method. Optionally, the memory 1204 may also store data. The terminal device 1200 and the memory 1204 can be set separately or integrated together.

In a possible implementation, the processor 1201 may include a transceiver for implementing the functions of receiving and transmitting. For example, the transceiver may be a transceiver circuit, or an interface, or an interface circuit. Transceiver circuits, interfaces or interface circuits used to implement receiving and transmitting functions may be separate or integrated. The above-mentioned transceiver circuit, interface or interface circuit can be used for reading and writing code/data, or the above-mentioned transceiver circuit, interface or interface circuit can be used for signal transmission or transmission.

In a possible implementation, the processor 1201 may store a computer program 1206, and the computer program 1206 runs on the processor 1201 to enable the terminal device 1200 to execute the methods described in the above method embodiments. The computer program 1206 may be embodied in the processor 1201, in which case the processor 1201 may be implemented by hardware.

In a possible implementation, the terminal device 1200 may include a circuit, and the circuit may implement the function of sending or receiving or communicating in the foregoing method embodiments. The processors and transceivers described in this application can be implemented in integrated circuits (ICs), analog ICs, radio frequency integrated circuits (RFICs), mixed-signal ICs, application specific integrated circuits (ASICs), printed circuit boards ( printed circuit board, PCB), electronic equipment, etc. The processor and transceiver can also be fabricated using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), nMetal-oxide-semiconductor (NMOS), P-type Metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

It should be understood that the processor 1201 may be a central processing unit (CPU), a network processor (NP), a hardware chip or any combination thereof. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The memory 1204 may be a volatile memory (volatile memory), such as random-access memory (RAM); or a non-volatile memory (non-volatile memory), such as read-only memory (read-only memory) , ROM), flash memory (flash memory), hard disk drive (HDD) or solid-state drive (solid-state drive, SSD); it can also be a combination of the above types of memory.

Each processor 1201 and transceiver 1202 in the terminal device 1200 are respectively configured to execute the terminal device described in the above method 200, or the terminal device described in the above method 500, or the terminal device described in the above method 600, or the above method 700 Each action or process performed by the terminal device described in . Here, in order to avoid redundant description, the detailed description thereof is omitted.

The structure of the terminal device 1200 may not be limited by FIG. 12 . Terminal device 1200 may be a stand-alone device or may be part of a larger device. For example, the terminal device 1200 may be:

(1) Independent integrated circuit IC, or chip, or, chip system or subsystem;

(3) ASIC, such as modem (Modem);

(4) Modules that can be embedded in other equipment;

(6) Others, etc.

For the case that the terminal device 1200 may be a chip or a chip system, reference may be made to the schematic structural diagram of the chip 1300 shown in FIG. 13 . The chip 1300 shown in FIG. 13 includes a logic circuit 1301 and an input-output interface 1302, the input-output interface 1302 is used for communicating with modules other than the chip 1300, and the logic circuit 1301 is used for running a computer program or instruction to realize the above-mentioned Function of any method embodiment. The number of input and output interfaces 1302 may be multiple.

Optionally, the chip 1300 further includes a memory 1303 for storing necessary computer programs (or instructions) and data.

The logic circuit 1301 and the input/output interface 1302 in the chip 1300 are respectively used to execute the terminal device described in the above method 200, or the terminal device described in the above method 500, or the terminal device described in the above method 600, or the above method 700. The terminal equipment, each action or processing process performed. Here, in order to avoid redundant description, the detailed description thereof is omitted.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication coupling may be through some interfaces, indirect coupling or communication coupling of devices or units, and may be in electrical, mechanical or other forms.

Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present patent application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present patent application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution, and the computer software product is stored in a storage medium, Several instructions are included to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present patent application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

The above are only specific implementations of this patent application, but the protection scope of this patent application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this patent application, All should be covered within the scope of protection of this patent application. Therefore, the protection scope of this patent application shall be subject to the protection scope of the claims.

Claims

A method for safe data transmission, comprising:

The core network device obtains the core network side security information of the terminal device;

the core network device receives encrypted data and auxiliary information from the terminal device; and

The core network device decrypts the encrypted data according to the core network side security information and the auxiliary information of the terminal device.
The method according to claim 1, wherein the core network-side security information of the terminal device includes a permanent identifier and security parameters of the terminal device, and the security parameters include a key and encryption/decryption algorithm information, or The security parameter includes the key, the encryption/decryption algorithm information, and the calculation method information of the encryption identifier of the terminal device.
The method according to claim 1, wherein the auxiliary information includes a first time-sensitive parameter and a first encrypted identifier of the terminal device.
The method according to claim 3, wherein the core network device decrypts the encrypted data according to the core network side security information and auxiliary information of the terminal device, comprising:

obtaining, by the core network device, the second timeliness parameter;

In the case that the value of the first timeliness parameter is not less than the value of the second timeliness parameter, the core network device decrypts the encrypted data; or

In the case that the value of the first timeliness parameter is smaller than the value of the second timeliness parameter, the core network device discards the encrypted data.
The method according to claim 4, wherein decrypting the encrypted data by the core network device comprises:

obtaining, by the core network device, the permanent identifier of the terminal device according to the auxiliary information;

The core network device decrypts the encrypted data according to the permanent identifier of the terminal device, the key in the security parameter, and the encryption and decryption algorithm information.
The method according to claim 5, wherein the method further comprises:

The core network device adds 1 to the value of the second timeliness parameter; or

The core network device sets the value of the second timeliness parameter to the value of the first timeliness parameter; or

The core network device sets the value of the second timeliness parameter to be the value of the first timeliness parameter plus 1.
The method according to any one of claims 1-6, wherein the core network device is an access and mobility management function AMF or a location management function LMF.
A method for safe data transmission, comprising:

The terminal device obtains the first timeliness parameter;

The terminal device encrypts the transmission data according to the terminal device side security information of the terminal device to generate encrypted data;

the terminal device generates auxiliary information; and

The terminal device sends the encrypted data and the auxiliary information to the core network device.
The method according to claim 8, wherein the security information on the terminal device side includes a permanent identifier and security parameters of the terminal device, and the security parameters include keys and encryption/decryption algorithm information, or the security parameters It includes the key, the encryption and decryption algorithm information, and the calculation method information of the encryption identifier of the terminal device.
The method according to claim 8 or 9, wherein the auxiliary information includes the first time-sensitive parameter and the first encrypted identifier, and the first encrypted identifier is used by the terminal device according to the The permanent identification of the device, the key and the first time-sensitive parameter are generated.
The method according to claim 8, wherein the method further comprises:

The terminal device updates the first timeliness parameter.
The method according to claim 8, wherein the core network device is an access and mobility management function AMF or a location management function LMF.
A core network device, the core network device includes a processing unit and a communication unit, wherein,

the processing unit, configured to obtain the core network side security information of the terminal device;

the communication unit is communicatively coupled to the processing unit for receiving encrypted data and auxiliary information from the terminal device; and

The processing unit decrypts the encrypted data according to the core network side security information and the auxiliary information of the terminal device.
The core network device according to claim 13, wherein the core network side security information of the terminal device includes a permanent identifier of the terminal device and a security parameter, and the security parameter includes a key and encryption/decryption algorithm information, Or the security parameter includes the key, the encryption/decryption algorithm information, and the calculation method information of the encryption identifier of the terminal device.
The core network device according to claim 13, wherein the auxiliary information includes a first timeliness parameter and a first encrypted identifier of the terminal device.
The core network device according to claim 15, wherein the processing unit decrypts the encrypted data according to the core network side security information and auxiliary information of the terminal device, comprising:

the processing unit obtains the second time-sensitive parameter;

In the case that the value of the first time-sensitive parameter is not less than the value of the second time-sensitive parameter, the processing unit decrypts the encrypted data; or

In the case that the value of the first time-sensitive parameter is smaller than the value of the second time-sensitive parameter, the processing unit discards the encrypted data.
The core network device according to claim 16, wherein the processing unit decrypts the encrypted data, comprising:

The processing unit acquires the permanent identifier of the terminal device according to the auxiliary information;

The processing unit decrypts the encrypted data according to the permanent identification of the terminal device, the key in the security parameter, and the encryption and decryption algorithm information.
The core network device according to claim 17, wherein the processing unit is further configured to:

adding 1 to the value of the second timeliness parameter; or

setting the value of the second timeliness parameter to the value of the first timeliness parameter; or

The core network device sets the value of the second timeliness parameter to be the value of the first timeliness parameter plus 1.
The core network device according to any one of claims 13-18, wherein the core network device is an access and mobility management function AMF or a location management function LMF.
A terminal device, the terminal device includes a processing unit and a communication unit, wherein,

the processing unit, configured to obtain the first timeliness parameter;

The processing unit is further configured to encrypt the transmission data according to the terminal device side security information of the terminal device to generate encrypted data;

the processing unit, further configured to generate auxiliary information; and

The communication unit is communicatively coupled with the processing unit, and is configured to send the encrypted data and the auxiliary information to the core network device.
The terminal device according to claim 20, wherein the security information on the terminal device side includes a permanent identifier of the terminal device and security parameters, and the security parameters include a key and encryption/decryption algorithm information, or the security The parameters include the key, the encryption/decryption algorithm information, and the calculation method information of the encryption identifier of the terminal device.
The terminal device according to claim 20 or 21, wherein the auxiliary information includes the first timeliness parameter and the first encrypted identifier, and the first encrypted identifier is used by the processing unit according to the The permanent identification of the terminal device, the key and the first time-sensitive parameter are generated.
The terminal device according to claim 20, wherein the processing unit is further configured to update the first timeliness parameter.
A communication device, comprising: a processor and a memory, wherein the processor and the memory are communicatively coupled, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor , a method as claimed in any one of claims 1 to 7 is implemented.
A chip, characterized in that the chip includes a logic circuit and an input-output interface, the input-output interface is used to communicate with modules other than the chip, and the logic circuit is used to run a computer program or instruction to achieve A method as claimed in any one of claims 1 to 7.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and the computer program includes program instructions, and when the program instructions are executed by a communication device, the communication device executes the program as claimed in the claims The method of any one of 1 to 7.
A communication device, comprising: a processor and a memory, wherein the processor and the memory are communicatively coupled, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor , a method as claimed in any one of claims 8 to 12 is implemented.
A chip, characterized in that the chip includes a logic circuit and an input-output interface, the input-output interface is used to communicate with modules other than the chip, and the logic circuit is used to run a computer program or instruction to achieve A method as claimed in any one of claims 8 to 12.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and the computer program includes program instructions, and when the program instructions are executed by a communication device, the communication device executes the program as claimed in the claims The method of any one of 8 to 12.