CN111641947B

CN111641947B - Key configuration method, device and terminal

Info

Publication number: CN111641947B
Application number: CN201910157643.XA
Authority: CN
Inventors: 张博
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2019-03-01
Filing date: 2019-03-01
Publication date: 2021-12-03
Anticipated expiration: 2039-03-01
Also published as: CN111641947A; WO2020177501A1

Abstract

The application provides a method, a device and a terminal for key configuration, wherein the method comprises the following steps: a target mobility management entity receives a first message sent by a source mobility management entity, wherein the first message comprises first bearing information of terminal equipment in a source network; the target mobility management entity determines first information according to the first bearer information, wherein the first information is used for indicating a security protection mode of first bearer data in a target network; and the target mobility management entity sends the first information to the source mobility management entity. The key configuration method, the key configuration device and the terminal can realize that the terminal equipment adopts a flexible safety protection mode in an intercommunication network.

Description

Key configuration method, device and terminal

Technical Field

The present application relates to the field of communications, and in particular, to a method, an apparatus, and a terminal for key configuration.

Background

The 4G/5G fusion networking means that the network, data and service all need to be integrated and fused for evolution. Air interface transmission is a key characteristic of wireless communication, any attacker can eavesdrop the transmission content of the air interface through an air interface technology, and data transmitted by the air interface can be better protected by adopting an encryption mode. In the existing interconnection, the data of the user is protected by an air interface encryption mode between the deployment terminal and the base station. The air interface protection mechanism only supports one set of user data protection mechanism, and when various types of service data are transmitted between the terminal equipment and the base station, the same encryption algorithm and integrity protection algorithm are adopted for safety protection.

The 4G system and the 5G system support different user data protection mechanisms, for example, the 5G system supports service-based security policy negotiation and security algorithm negotiation, and the LTE system supports user plane-based or control plane-based security algorithm negotiation. When the terminal device is switched between the 4G system and the 5G system, the security keys and security algorithms corresponding to different protection mechanisms of the terminal device in the target network need to be determined. Therefore, how to implement a flexible data protection mechanism in an interworking network becomes an urgent problem to be solved.

Disclosure of Invention

The application provides a method, a device and a terminal for key configuration, which can realize that terminal equipment adopts a flexible security protection mode in an interworking network.

In a first aspect, a method for configuring a key is provided, where the method includes:

a target mobility management entity receives a first message sent by a source mobility management entity, wherein the first message comprises first bearing information of terminal equipment in a source network; the target mobility management entity determines first information according to the first bearer information, wherein the first information is used for indicating a security protection mode of first bearer data in a target network; and the target mobility management entity sends the first information to the source mobility management entity.

When the N26 interface is deployed in the interworking network of 5GS and EPS, the existence of the N26 interface will be able to support the interworking procedure of MME and AMF, transferring the mobility management state and the session management state between the source network and the target network.

For example, the security protection mode of bearer data # D1 in network #2 may be: NAS security mode between UE-AMF, AS security mode between UE-AN, or user plane data protection mode between UE-UPF; further, referring to table 2, the protection manner may be specifically what kind of message protection and/or data transmission path protection mechanism is adopted, for example, RRC signaling related to non-RRC-inactive state between the UE and the base station is adopted.

It should be understood that user data and signaling data between the UE and the network need to be protected for confidentiality and integrity. Wherein NAS signaling needs to be protected by mandatory integrity protection and optional confidentiality protection; RRC signaling requires mandatory integrity protection and optional confidentiality protection; UP data needs to be protected by confidentiality as required and integrity as required; at the UE and the network, the input parameters of the encryption and decryption algorithms and the integrity algorithm should be kept synchronized. Confidentiality protection for RRC and UP should be done at PDCP layer and confidentiality protection for NAS signaling should be provided by NAS protocol.

By way of example and not limitation, the bearer data # D1 may be carried in the network #1 by a radio bearer (DRB) transport channel bearer, or an EPS transport channel bearer.

If the bearing information #1 has the QoS flow ID corresponding to the QoS flow transmission channel in the network #2, the AMF #2 determines the data protection mode that the QoS flow corresponding to the QoS flow ID #1 needs to adopt in the 5G network, and selects the QoS flow transmission channel to transmit the user data.

If the bearing information #1 has the Session identifier Session ID of the Session transmission channel corresponding to the Session ID #2 in the network #2, the AMF #2 determines a data protection mode that the Session corresponding to the Session ID #1 needs to adopt in the 5G network, and selects the Session transmission channel to transmit the user data.

With reference to the first aspect, in certain implementations of the first aspect, the first information includes any one of the following information: non-access stratum (NAS) protection indication information, Access Stratum (AS) protection indication information and user plane function entity (UPF) protection indication information; wherein, the UPF protection indication information is used to indicate that the first bearer data adopts a security protection mechanism from a terminal to a user plane functional entity in the target network.

With reference to the first aspect, in certain implementations of the first aspect, the method further includes: the target mobility management entity sends first indication information to a target session management entity, wherein the first indication information comprises first information and a first intermediate key, and the first information is used for indicating a security mode of the first bearer data in a target network.

With reference to the first aspect, in certain implementations of the first aspect, the first bearer information includes at least one of: the identification information of the first bearer data, network slice selection information S-NSSAI, the access type information of the first bearer data, a data network name DNN and safety indication information; the security indication information is used to indicate whether the first bearer data needs encryption protection and/or integrity protection.

With reference to the first aspect, in certain implementations of the first aspect, the security protection mode of the first bearer data in the target network includes: a non-access stratum (NAS) safety mode, an Access Stratum (AS) safety mode and a user plane function entity (UPF) safety mode; and the UPF security mode is used for data security protection between the terminal equipment and the user plane functional entity.

It should be understood that the NAS security mode uses NAS layer security algorithm and NAS layer security key between UE and MME for data security protection in EPC, and uses NAS layer security algorithm and NAS layer security key between UE and AMF for data security protection in 5 GC.

With reference to the first aspect, in certain implementations of the first aspect, the method further includes: the target mobility management entity determines security policy information of the first bearer data in a target network; and the target mobility management entity sends the security policy information to the source mobility management entity.

With reference to the first aspect, in certain implementation manners of the first aspect, the security policy information includes a first security algorithm and/or a first security policy, the first security algorithm includes a confidentiality protection algorithm and an integrity protection algorithm, and the first security policy includes confidentiality protection indication information and integrity protection indication information.

In a second aspect, a method for configuring a key is provided, the method including: a source mobility management entity receives switching request information sent by a source access network AN, wherein the switching request information comprises first bearing information of terminal equipment in a source network, and the switching request information is used for requesting to switch the terminal equipment from the source network to a target network; the source mobility management entity sends the first bearing information to a target mobility management entity; the first bearer information is used for the target mobility management entity to determine a security protection mode of the first bearer data in the target network.

Case # A1

When the UE needs to be handed over from the EPC network to the 5GC network, the source mobility management entity may be an MME in the 4G network, e.g., MME #1 in network #1 described above, and the target mobility management entity may be an AMF in the 5G network, e.g., AMF #2 in network #2 described above.

Case # A2

When the UE needs to be handed over from the 5GC network to the EPC network, the source mobility management entity may be an AMF in the 5G network, e.g., AMF #2 in network #1 described above, and the target mobility management entity may be an MME in the 4G network, e.g., MME #1 in network #2 described above.

The MME #1 and the AMF #2 can transmit a mobility management state and a session management state between a source network and a target network through an N26 interface in an EPC and 5GC interworking network, and service and session continuity of terminal equipment in a network switching process is guaranteed.

For example, in case # a1, MME #1 receives a Handover Required message sent by AN #1, where the message includes bearer information #1 of the terminal device in the source network (network #1), and the Handover request information is used to request the terminal device to Handover from network #1 to network # 2.

Alternatively, in case # a2, AMF #2 receives a Handover Required message sent by AN #2, where the message includes session information #1 of the terminal device in the source network (network #2), and the Handover request message is used to request the terminal device to Handover from network #2 to network # 1.

With reference to the second aspect, in some implementations of the second aspect, the first bearer information is used to identify the first bearer data in a handover procedure of the terminal device from a source network to the target network.

With reference to the second aspect, in certain implementations of the second aspect, the first bearer information includes at least one of the following information: the identification information of the first bearer data, network slice selection information S-NSSAI, the access type information of the first bearer data, a data network name DNN and safety indication information; the security indication information is used to indicate whether the first bearer data needs encryption protection and/or integrity protection.

With reference to the second aspect, in some implementations of the second aspect, the handover request information further includes: the second information is used for indicating the security protection mode of the first bearer data in the source network.

With reference to the second aspect, in some implementations of the second aspect, the security protection mode of the first bearer data in the source network includes: non-access stratum (NAS) security mode and Access Stratum (AS) security mode.

With reference to the second aspect, in certain implementations of the second aspect, the method further includes: the source mobility management entity receives security policy information and first information sent by the target mobility management entity, wherein the first information is used for indicating a security mode of the first bearer data in a target network; and the source mobility management entity sends the security policy information and the first information to the terminal equipment.

For example, in case # a1, MME #1 receives the security protection algorithm and/or the indication information # E1 sent by AMF #2, and the indication information # E1 is used to indicate the security protection mode of bearer data # D1 in network #2, that is, the security protection mode in the 5G network.

Alternatively, in case # a2, AMF #2 receives the security protection algorithm and/or the indication information # E2 transmitted by MME #1, and the indication information # E2 indicates the security protection scheme of the session data # D1 in the network #1, that is, in the 4G network.

With reference to the second aspect, in some implementations of the second aspect, the security policy information includes a first security algorithm and/or a first security policy, where the first security algorithm includes a confidentiality protection algorithm and an integrity protection algorithm, and the first security policy includes confidentiality protection indication information and integrity protection indication information.

With reference to the second aspect, in some implementations of the second aspect, the security protection mode of the first bearer data in the target network includes: a non-access stratum (NAS) safety mode, an Access Stratum (AS) safety mode and a user plane function entity (UPF) safety mode; and the UPF security mode is used for data security protection between the terminal equipment and the user plane functional entity.

In a third aspect, a method for configuring a key is provided, where the method includes: a target session management entity receives first indication information sent by a target mobility management entity; the target session management entity determines a first security key according to the first indication information, wherein the first security key is used for performing data security protection on the first bearer data in a target network; and the target session management entity sends the first security key to a target user plane functional entity.

With reference to the third aspect, in certain implementations of the third aspect, the first indication information includes first information and a first intermediate key, where the first information is used to indicate a security mode of the first bearer data in the target network.

With reference to the third aspect, in certain implementations of the third aspect, the method further includes: the target session management entity determines the security policy information of the first bearer data in the target network according to the first information; or the target session management entity receives a second message sent by the target mobility management entity, where the second message includes security policy information of the first bearer data in the target network.

With reference to the third aspect, in certain implementations of the third aspect, the security policy information includes a first security algorithm, and/or a first security policy; the first security algorithm comprises a confidentiality protection algorithm and/or an integrity protection algorithm, and the first security policy comprises confidentiality protection indication information and integrity protection indication information.

With reference to the third aspect, in certain implementations of the third aspect, the determining, by the target session management entity, the first security key according to the first indication information includes: the target session management entity generates an encryption key according to the first intermediate key and the confidentiality protection algorithm; and/or the target session management entity generates an integrity protection key according to the first intermediate key and the integrity protection key.

With reference to the third aspect, in certain implementations of the third aspect, the determining, by the target session management entity, the first security key according to the first indication information includes: the target session management entity generates an encryption key according to the confidentiality protection indication information; and/or the target session management entity generates an integrity protection key according to the integrity protection indication information.

In a fourth aspect, a method of key configuration is provided, the method comprising: the method comprises the steps that terminal equipment receives security policy information and first information sent by a source mobility management entity, wherein the first information is used for indicating a security protection mode of first bearer data in a target network; the terminal equipment determines a first security key according to the security policy information and the first information; the first security key is used for performing data security protection on the first bearer data in a target network.

When the terminal device switches between the source network and the target network, the secret key for confidentiality protection and the secret key for integrity protection are changed, and confidentiality protection and integrity protection between the terminal device and the target network can be realized under the condition that the security protection algorithm, the security protection secret key and the security protection algorithm and the security protection secret key which are determined by the target network and are sent to the terminal device by the target network are consistent.

With reference to the fourth aspect, in some implementations of the fourth aspect, the security policy information includes a first security algorithm, and/or a first security policy; the first security algorithm comprises a confidentiality protection algorithm and/or an integrity protection algorithm, and the first security policy comprises confidentiality protection indication information and integrity protection indication information.

With reference to the fourth aspect, in some implementations of the fourth aspect, the determining, by the terminal device, a first security key according to the security policy information and the first information includes: the terminal equipment generates an encryption key according to a first intermediate key and the confidentiality protection algorithm; and/or the terminal equipment generates an integrity protection key according to the first intermediate key and the integrity protection algorithm.

With reference to the fourth aspect, in some implementations of the fourth aspect, the determining, by the terminal device, a first security key according to the security policy information and the first information includes: the terminal equipment generates an encryption key according to the confidentiality protection indication information; and/or the terminal equipment generates an integrity protection key according to the integrity protection indication information.

With reference to the fourth aspect, in some implementations of the fourth aspect, the security protection mode of the first bearer data in the target network includes: NAS safe mode, AS safe mode, UPF safe mode; wherein, the UPF security mode adopts a security protection mechanism from a terminal to a user plane functional entity.

In a fifth aspect, the present application provides a communication device, comprising: a processor coupled with a memory for storing a program that, when executed by the processor, causes a communication device to implement the method of any of the first to fourth aspects described above.

In a sixth aspect, the present application provides a storage medium having stored thereon a computer program which, when executed by a processor, implements the method of any of the first to fourth aspects described above.

In a seventh aspect, the present application provides a chip system, including: a processor configured to perform the method of any of the first to fourth aspects described above.

The key configuration method is suitable for user data intercommunication between a 5G network and a 4G network in a communication system, and network security protection based on DRB, Session and Qos flow granularity is realized. When the terminal is switched from the 5G network to the 4G network or the terminal is switched from the 4G network to the 5G network, the terminal equipment adopts a flexible safety protection mode in the intercommunication network.

Drawings

Fig. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of the present application.

Fig. 2 shows a schematic diagram of a terminal device switching in an interworking network according to the present application.

Fig. 3 shows a schematic interaction diagram of a key configuration method provided in the present application.

Fig. 4 shows a schematic interaction diagram of another key configuration method provided by the present application.

Fig. 5 shows a schematic interaction diagram of yet another key configuration method provided by the present application.

Fig. 6 shows a schematic flow chart of a key configuration method provided in the present application.

Fig. 7 shows a schematic flow chart of another key configuration method provided in the present application.

Fig. 8 shows a schematic flow chart of still another key configuration method provided in the present application.

Fig. 9 shows a schematic flow chart of still another key configuration method provided in the present application.

Fig. 10 shows a schematic structural diagram of an AMF network element provided in the present application.

Fig. 11 shows a schematic structural diagram of an MME network element provided in the present application.

Fig. 12 shows a schematic structural diagram of an SMF network element provided in the present application.

Fig. 13 shows a schematic structural diagram of a terminal device provided in the present application.

Detailed Description

The technical solution in the present application will be described below with reference to the accompanying drawings.

The technical scheme of the embodiment of the application can be applied to various communication systems, for example: a Global System for Mobile communications (GSM) System, a Code Division Multiple Access (CDMA) System, a Wideband Code Division Multiple Access (WCDMA) System, a General Packet Radio Service (GPRS), a Long Term Evolution (Long Term Evolution, LTE) System, an LTE Frequency Division Duplex (FDD) System, an LTE Time Division Duplex (TDD), a Universal Mobile Telecommunications System (UMTS), a Worldwide Interoperability for Microwave Access (WiMAX) communication System, an Evolved Packet System (Evolved Packet System, GSM), a future fifth Generation (5, 5G) or New Radio Network (NR) System, and the like.

A terminal device in the embodiments of the present application may refer to a user equipment, an access terminal, a subscriber unit, a subscriber station, a mobile station, a remote terminal, a mobile device, a user terminal, a wireless communication device, a user agent, or a user device. The terminal device may also be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a handheld device with Wireless communication function, a computing device or other processing device connected to a Wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a future 5G Network or a terminal device in a future evolved Public Land Mobile Network (PLMN), and the like, which are not limited in this embodiment.

The Base Station in this embodiment may be a device for communicating with a terminal device, and the Base Station may be a Base Transceiver Station (BTS) in a Global System for Mobile communications (GSM) System or a Code Division Multiple Access (CDMA) System, may also be a Base Station (NodeB, NB) in a Wideband Code Division Multiple Access (WCDMA) System, may also be an evolved Base Station (eNB, eNodeB) in an LTE System, may also be a wireless controller in a Cloud Radio Access Network (CRAN) scenario, and the like, and the present embodiment is not limited.

The network element in the embodiment of the present application may include a network device in a 5G system architecture and/or a 4G system architecture. Wherein the 4G system architecture may comprise an EPS system architecture. For example, a Network element may include an Access and Mobility Management Function (AMF) Entity, a Mobility Management Entity (MME), a Session Management Function (SMF) Entity, a Unified Data Management (UDM), a Policy Control Function (PCF) Entity, a Policy and Charging Rule Function (PCRF) Entity, a Packet Data Network (PDN), a Packet Data Unit (PDU), a Control plane Gateway (PDN Gateway-Control plane, PGW-C), a User plane Gateway (PDN Gateway-User plane, PGW-U), a home Subscriber Server (home Subscriber Server, HSS), an Application Function Entity (HSS), an Application Function (AF), and the like.

Fig. 1 shows an interworking architecture in a non-roaming scenario of the 5GS and EPS systems.

In an interworking architecture under a non-roaming scene of a 5GS and an EPS system, an N26 interface is introduced for supporting interworking between the 5G system and the EPS system, and an N26 interface refers to a communication interface between a mobility management entity of the 5G system and a mobility management entity of the EPS system. The mobility management entity of the 5G system may be an AMF, and the mobility management entity of the EPS system may be an MME. In the case where the system architecture supports the N26 interface, the interworking architecture can support handover between the 5G and EPS systems. In the interworking architecture, the support of the N26 interface is optional, and the continuity of the service can be ensured by using a switching flow in the interworking network supporting the N26 interface.

5GS and EPS systems can share UPF + PGW-U, SMF + PGW-C, PCF + PCRF and HSS + UDM. Here "+" indicates a convergence, where UPF is a user plane function of 5G, PGW-U is a gateway user plane function of 4G corresponding to UPF, SMF is a session management function of 5G, PGW-C is a gateway control plane function in 4G corresponding to SMF, PCF is a policy control function of 5G, and PCRF is a policy charging rule function of corresponding 4G.

The UPF + PGW-U is used for transmission management of user data, and in an intercommunication framework, the module can be used for data transmission of EPS and can provide a 5G data transmission function. The SMF + PGW-C is used for session establishment, deletion and modification management, and in an intercommunication framework, the module can provide the session management function of EPS and the session management function of 5G. PCF + PCRF is used for a policy and charging control entity, and in an interworking architecture, the module can provide policy and charging control of EPS for a terminal device and can also provide policy and charging control of 5G. The HSS + UDM is used to store the subscription data of the user, and in the interworking architecture, this module stores both the subscription information of the EPS of the terminal device and the subscription information of the 5G of the terminal device.

A 5G Radio Access Network (RAN) provides a radio interface for a terminal device to access a core network, thereby acquiring a corresponding service.

An Application Function (AF) interacts with a core network to provide services or services, supports an access capability opening Function, interacts with a policy framework, provides Application information, and the like.

An evolved universal terrestrial radio access network (E-UTRAN) is used for radio resource management to establish, modify, or delete air interface resources for a terminal device. Provide for transmission of data and signaling, etc. for the terminal device.

The AMF is used for user access and mobility management, and mainly comprises user registration management, reachability management mobility management, paging management, access authentication, encryption and integrity protection of authorized non-access layer signaling and the like.

The MME is used for mobility management of users. For example, the method mainly comprises the attachment management, the reachability management, the mobility management, the paging management, the access authentication, the encryption and integrity protection of the authorized non-access layer signaling and the like of the user.

A gateway of the SGW user plane and a user plane termination of the E-UTRAN. As a local mobility anchor for handovers between base stations. Managing the routing and transmission of data packets, adding packet labels at the transport layer, etc.

The S1-MME interface is the control plane interface between MME and E-UTRAN. The S1-U interface is the user plane interface between the S-GW and the E-UTRAN. And the S5-U interface is a user plane interface between the SGW and the PGW-U and is used for transmitting user plane data of the UE. And the S5-C interface is a control plane management interface between the SGW and the PGW-U and is used for establishing the user plane connection between the SGW and the PGW-U for the UE. The S6a interface is an interface between the MME and the HSS, and is used to acquire subscription data of a user and perform authentication and authorization functions for the UE. The S11 interface is an interface between the SGW and the MME, and is used to establish a bearer for the user plane.

The N1 interface is the interface between UE and AMF, the signaling management and transmission of non-access stratum of user. The N2 interface is AN interface between the (R) AN and the AMF for the transmission of signaling. The N3 interface is a direct interface between the UPF and (R) AN for transferring user data. The N4 interface is an interface between SMF and UPF, and is used to establish a transmission channel of the user plane. The N5 interface is an interface between PCF and AF, and is used for AF to directly interact with PCF and transmit service-related information. The N7 interface is the interface between SMF and PCF, which is used to make and send down the strategy control and charging information. The N8 interface is an interface between the AMF and the UDM, and is used for acquiring the subscription information related to the mobility of the user. The N10 interface is an interface between the SMF and the UDM, and is used for acquiring session management related subscription information of a user, and the like. The N11 interface is an interface between the SMF and the AMF, and is used for transmission of session management information and the like. The N15 interface is an interface between the AMF and the PCF for obtaining access and mobility related policy information.

In a 4G network, the user plane data transmission path of the UE may be: UE-AN-SGW-PDN gateway-DN, wherein RRC signaling of the UE is UE-AN, and NAS signaling of the UE is UE-MME. As shown in table 1, in IoT traffic of 4G network, there may be the following protection modes: NAS protection mode between UE-MME and AS UP protection mode between UE-AN, wherein the AS UP protection mode adopts a user plane protection method between UE and a base station to protect service data.

TABLE 1 data Security protection mechanism in 4G networks (IOT traffic)

In a 5G network, the user plane data transmission path of the UE may be: UE-AN-UPF-DN, RRC signaling of UE is UE-AN, NAS signaling of UE is UE-AMF. As shown in table 2, in the IoT traffic of the 5G network, there may be the following protection modes: NAS security mode between UE-AMF, AS security mode between UE-AN, and security protection mode between UE-UPF.

Wherein, the AS security mode between the UE and the AN comprises: AS UP protection, namely protecting service data by adopting a user plane protection method between UE and a base station; AS RRC signaling protection, namely, adopting non-RRC-inactive related RRC signaling between UE and a base station to protect service data; and the RRC signaling protection of the AS inactive adopts the RRC signaling between the UE and the base station related to the RRC-inactive state to protect the service data.

In NAS security mode between UE-AMFs, possible data transmission paths include: UE-AMF-SMF-UPF-DN, UE-AMF-NEF-AF, UE-AMF-SMF-NEF-DN.

TABLE 2 data Security protection mechanism in 5G networks (IOT traffic)

By way of example and not limitation, the above tables 1 and 2 only show the protection mechanisms that may exist in the 5GS and EPS systems, and do not exclude the possibility of adding a security protection mechanism in the future, which is not limited in the present application.

In the LTE protocol architecture, the protocol layers are divided into a non-access layer and an access layer. The security protection mechanism in LTE systems employs different security mode command procedures in the non-access stratum and the access stratum to activate the respective integrity and ciphering functions. The security mode command procedure of the AS is configured with Radio Resource Control (RRC) signaling and a security algorithm of a user plane, and the security mode command procedure of the NAS is configured with a security algorithm of the NAS signaling.

The Security protection mechanism is used for realizing the secure interaction of the message, and comprises two aspects of bidirectional authentication between the UE and the network side, encryption of the air interface message and integrity protection. There are NAS Security and AS Security. The NAS Security is responsible for encryption and integrity protection of NAS data and is realized at a peer NAS layer between the MME and the UE. AS Security is responsible for ciphering and integrity protection of control plane (RRC) data (i.e., SRB1, SRB2) in AS data, and ciphering of data plane (UP) data (i.e., all DRBs), implemented at the peer PDCP layer between eNodeB and UE.

For NAS information, at a sending end, encryption is carried out first, and then integrity protection is carried out; at the receiving end, integrity is verified a priori, and if verification is successful, the message is decrypted. For RRC message, at the sending end, integrity protection is firstly carried out, and encryption is carried out again; at the receiving end, the message is decrypted and then the integrity of the decrypted message is verified. For UP data, only encryption is performed.

In the switching process of the existing 4G network and 5G network, the following switching processes are included:

1. a source base station eNB sends Handover request information (Handover Required) to an MME in a source network; 2. MME sends a Request message Relocation Request (EPS security context including Kasme) to AMF in the target network; 3. the AMF generates a security context in the 5G network according to the Kasme; 4. the AMF sends a Handover Request [ KgNB, UE security capability, 4G to 5G NAS transit container (NASC) ] to the target base station gNB; 5. the target base station sends an acknowledgement message Handover Request Ack [5G AS security algorithm, 4G to 5G Handover container (NASC) ] to the AMF; 6. AMF sends Response message Relocation Response [ security parameters from step 5] to MME; 7. the MME sends a Handover Command to the source base station eNB, and the base station eNB sends the Handover Command to the UE; 8. and the UE generates a security context in the 5G network according to the Kasme.

In the above switching process, both the 4G network and the 5G network adopt an AS security mode, i.e. a user plane data protection method from the UE to the base station. Wherein, K_ASMEThe method is used for deriving the key used for encryption and integrity protection when the terminal communicates with the network side. K_ASMEAs a result of authentication and key agreement, it is an intermediate key that both the UE and the Access Security Management Entity (ASME) can generate. For example, the function of the ASME in E-UTRAN can be implemented by the mobility management element MME.

Hereinafter, some concepts or terms referred to in the present application will be briefly described.

1. NAS security mode

The security mode command procedure of the NAS layer is initiated by the MME (or AMF in 5G network). And the MME selects an encryption algorithm and an integrity protection algorithm used by the NAS layer according to the security capability reported by the UE and the security algorithm list arranged according to the priority sequence of the MME, and calculates an encryption key and an integrity protection key of the NAS layer by using the selected algorithm and the KASME. And the MME sends a security mode command message to the UE, and the MME performs integrity protection on the message. The message contains NAS layer encryption algorithm and integrity protection algorithm selected by the MME and the currently used KASME key identification, and the MME returns the previously received UE security capability to the UE for verification in the message so as to ensure that the previously received security capability of the UE is correct.

The MME informs the UE by sending a Security Mode Command message to the UE, the MME is authenticated by the network and indicates that NAS Security establishment procedures for message Security transport have been initiated. The Security Mode Command message is integrity protected and then sent to the UE, which then computes the NAS Security keys (ciphering and integrity keys) and verifies the integrity of this message using the integrity keys.

And after receiving the security mode command message, the UE verifies whether the security capability returned by the MME is consistent with the security capability stored by the UE, if so, calculates the integrity protection key of the NAS layer according to the integrity protection algorithm selected by the MME, and performs integrity verification on the message. And if the verification is successful, after the encryption key is calculated by utilizing the integrity encryption algorithm of the NAS, starting integrity protection and encryption on NAS information and returning an NAS security mode command completion message to the MME. The MME decrypts it and verifies the integrity.

2. AS Security mode

The security mode command procedure of the AS layer is initiated by the ENB. And the ENB selects an encryption algorithm and an integrity protection algorithm used by the AS layer according to the security capability reported by the UE and the security algorithm list arranged according to the priority sequence of the ENB, and calculates an AS layer encryption key and an integrity protection key by using the selected algorithm and the KeNB. The ENB sends a security mode command message to the UE, and the ENB carries out integrity protection on the message, wherein the message comprises an AS layer encryption algorithm and an integrity protection algorithm selected by the ENB. After the ENB sends the message, the encryption protection of the RRC message and the user data in the downlink direction is started.

Wherein, KeNB is the base station key, and is K-slave by ME and MME_ASMEAnd deriving or deriving during switching, wherein the key is used for further deriving three keys (KRRCint, KRRCenc and KUPoenc) which are subsequently related to the integrity protection and encryption of the air interface RRC signaling and are used as the user data encryption key.

And after receiving the security mode command message, the UE calculates an AS layer integrity protection key according to an integrity protection algorithm selected by the ENB and performs integrity verification on the message. If the verification is successful, the encryption key is calculated by using the AS encryption algorithm and the KENB to perform integrity protection on the subsequent RRC message and encryption protection on user data, and an AS security mode command completion message is returned to the ENB. After the UE sends the security mode command message, it starts the ciphering protection for the subsequent RRC message and the ciphering protection for the user data. The ENB receives the AS security mode command message to verify its integrity. And if the verification is successful, starting RRC and user plane data downlink encryption.

The above AS security mode is the description of the 4G network, after the AS layer security mode in the 5G network is executed, the gNB starts the downlink direction to encrypt and protect the RRC message, and the protection and activation of the user data are executed in the RRC reconfiguration flow.

3. Key hierarchy

The 4G/5G system is provided with two layers of security protection, namely an NAS layer and an AS layer. The 4G/5G key system is more complex due to the two-layer security design, and the NAS layer encryption key and the integrity protection key used by the UE and the MME/AMF can be directly deduced by taking the Kasme generated in the AKA process as a root key. Wherein, Kasme derived KeNB is a temporary key between the UE and the eNB/gNB for calculating the AS layer encryption and integrity protection keys.

4. Confidentiality protection

The encryption process can protect information from being utilized or compromised by unauthorized persons, entities or processes. The 2G/3G/4G/5G supports the encryption of data and signaling, the basic principle follows the sequence (stream) encryption principle in cryptography, and the main difference is that the encryption algorithms are different. Specifically, the transmitting side calculates a key stream (key block) using a key, that is, other parameters, as input parameters of an encryption algorithm, performs an exclusive or operation with a plaintext, generates a ciphertext, and transmits the ciphertext to the receiving side. And the receiving end performs the same operation to generate the same key stream, and performs exclusive OR operation with the ciphertext to generate a plaintext. The XOR operation is performed twice corresponding to the plaintext, so that the normal recovery can be realized.

5. Integrity protection

The basic principle of integrity protection is that a sending end uses an integrity protection key, other parameters and a message as the input of an integrity protection algorithm to generate an integrity check code MAC-I, and the sending end sends the message and the MAC-I to a receiving end together. And the receiving terminal calculates the integrity check code XMAC-I in the same way, compares the integrity check code XMAC-I with the MAC-I received by the receiving terminal, and if the integrity check code XMAC-I is the same as the MAC-I received by the receiving terminal, the integrity protection is considered to be passed.

6. Radio access bearer

In 3GPP, a Radio Access Bearer (RAB) provides a data connection capability from a core network to a User Equipment (UE) for a User, and in LTE, the RAB is referred to as an E-RAB. The E-RAB of LTE starts from an S-GW (serving gateway) and ends at a UE, and is formed by connecting an S1-U Bearer and a Data Radio Bearer (DRB) in series, and service Data entering the LTE system is mainly transmitted through the E-RAB. In order to manage the E-RAB, control signaling between corresponding signaling connection transmission network elements is needed in the LTE system to complete, including establishment, modification and release of the E-RAB. In addition, an EPS (evolved packet system) bearer is also included in the LTE network, and represents a logical channel between the UE and the P-GW.

The 5GC supports PDU connection service, namely the service of exchanging PDU data packets between the UE and the DN; the PDU connection service is realized by the establishment of a PDU session initiated by the UE, wherein the PDU session corresponds to the data transmission channel of the UE and the DN. The UE may establish multiple PDU session connections to the same DN and connect to the DN through different UPFs. The UE establishes a plurality of PDU session connections, and SMFs corresponding to each PDU session can be different. The serving SMF information for each PDU session will be registered in the UDM.

Hereinafter, for understanding the embodiment of the present application, the 4G network and the 5G network are referred to as network #1 and network #2, respectively, where network #1 includes AN #1 and MME #1, and network #2 includes AN #2, AMF #2, SMF #2 and UPF # 2.

Fig. 2 shows a schematic diagram of a terminal device in handover in an interworking network according to the present application.

As shown in fig. 2, when an N26 interface is deployed in the interworking network of 5GS and EPS, the existence of the N26 interface will be able to support the interworking procedure of MME and AMF, transferring the mobility management state and the session management state between the source network and the target network. Wherein the S1-MME interface is a control plane interface between the MME and the E-UTRAN. The N2 interface is AN interface between the (R) AN and the AMF for the transmission of signaling.

For example, when the ue moves from the bs cell #2 to the bs cell #1, the network connection of the ue needs to be switched from the access network AN #2 to AN #1, that is, in AN interworking interconnection scenario, AN #2 needs to initiate network handover of the ue between AN #1 and AN # 2.

Here, AN #1 may be AN access network of the base station cell #1, and AN #2 may be AN access network of the base station cell # 2.

AN #1 and AN #2 may be heterogeneous networks, for example, AN #1 may be a 4G network and AN #2 may be a 5G network, where the data security protection policy in the 4G network is different from the data security protection policy in the 5G network.

Fig. 3 shows a schematic interaction diagram of a terminal device handing over from network #1 to network #2, see fig. 3, which handover procedure may be initiated by a base station.

In the embodiment of the present application, AN #1 and MME #1 belong to a network element in a network #1, and AN #2, AMF #2, SMF #2 and UPF #2 belong to a network element in a network # 2. The network #1 may be a 4G network and the network #2 may be a 5G network.

At S301, AN #1 initiates a network handoff of AN #1 to AN # 2.

When the UE is in the connected state, no matter the UE moves from the 5GC to the EPC or from the EPC to the 5GC, a cross-system handover procedure is performed, and during the handover procedure, the HSS + UDM will not accept any registration request sent by the AMF or the MME for the UE.

For example, when the user equipment moves from the base station cell #1 to the base station cell #2, the network connection of the user equipment needs to be switched from the access network AN #1 to AN #2, that is, in AN interworking interconnection scenario, AN #1 needs to initiate network switching of the terminal equipment between AN #1 and AN # 2.

There are two basic operating modes of a UE in LTE: idle mode and connected mode. After the UE is started, when an RRC connection is established, the UE is in an RRC _ CONNECTED state; if the RRC connection has not been established, the UE is in an RRC _ IDLE state.

For example, when a base station serving the user equipment is not suitable for serving it, the UE may handover to another base station. The source base station sends a Handover Request (Handover Request) message to an MME (MME #1) in the source network.

At S302, AN #1 transmits handover request information for requesting a terminal apparatus to handover from network #1 to network #2 to MME # 1.

In the process of switching the terminal device from the 4G network to the 5G network, as shown in fig. 2, AN (AN #1) sends handover request information to MME (MME #1) through AN S1 interface, the handover request information includes a bearer information list, the bearer information list includes at least one piece of bearer information, and is referred to as bearer information # 1.

For example, the bearer information #1 includes at least one of the following information: bearing identification information ID, network slice selection information S-NSSAI, access type, data network name DNN, safety indication information and identification information of UE.

The DNN is a data network identifier requested by the terminal device to access, and the subscription information of the S-NSSAI may include a default DNN and a plurality of DNNs.

The security indication information is used to indicate whether integrity protection and/or security protection is required for bearer data # D1 corresponding to bearer information # 1.

Optionally, the handover request information further includes indication information #1, where the indication information #1 is used to indicate a data protection mechanism of the bearer data # D1 in the source network (network # 1).

For example, the data protection mechanism of bearer data # D1 in the 4G network may be: NAS security mode between UE-AMF, AS security mode of UE-AN.

Optionally, the handover request information further includes security capability information of the UE, including 5GC NAS, or EPC NAS capability.

At S303, MME #1 transmits bearer information #1 to AMF # 2.

For example, MME #1 sends a Forward migration message (Forward Relocation Request) to AMF #2, which includes: at least one of an access point name, a gateway IP address/name, a serving network name, security protection indication information, bearer information #1, and identification information of the UE.

As shown in fig. 1, when the N26 interface is deployed in the network, the presence of the N26 interface will support the transfer of the mobility management state and the session management state between the source network and the target network in an interworking process, so when the N26 interface is deployed by an operator, the UE only needs to operate in a single registration mode, and the network only needs to simultaneously maintain one available mobility management state of the UE, so that seamless service and session continuity can be guaranteed for the user.

The MME (MME #1) sends a Forward migration message (Forward Relocation Request) to the AMF (AMF #2) through the N26 interface.

For example, the identification information of the UE may be a permanent identification of the UE, such as an international mobile subscriber identity IMSI (IMSI) or a temporary identification of the UE.

At S304, AMF #2 determines a data protection manner of the bearer data # D1 in the network # 2.

The AMF #2 determines a data protection method of the bearer data # D1 corresponding to the bearer identification information #1 in the 5G network.

For example, AMF #2 may determine the data protection manner of bearer data # D1 in network #2 according to at least one of access point name, gateway IP address/name, serving network name, UE identification ID, serving network identification, bearer identification information ID, network slice selection information S-NSSAI, access type information, session type information, data network name DNN, security indication information, and security protection indication information. The network slice selection auxiliary information corresponds to one network slice and comprises the type of the service and the difference factor of the service type.

Optionally, AMF #2 may also send at least one of an access point name, a gateway IP address/name, a service network name, a UE identifier ID, a service network identifier, a bearer identifier ID, network slice selection information S-NSSAI, access type information, session type information, a data network name DNN, security indication information, and security protection indication information to another network element, determine a data protection method by the other network element, and return the data protection method to AMF # 2. Here, the other network elements may be functional network elements such as UDM #2, PCF, SMF, or the like, without limitation.

Here, the data protection method of the session data # D1 in the network #2 may be: NAS security mode between UE-AMF, AS security mode between UE-AN, or user plane data protection mode between UE-UPF; further, referring to table 2, the protection manner may be specifically what kind of message protection and/or data transmission path protection mechanism is adopted, for example, RRC signaling related to non-RRC-inactive state between the UE and the base station is adopted. For simplicity of description, the following description will be given by taking a data protection manner as an example.

That is, AMF #2 can determine the data protection method of bearer data # D1 in network #2 according to the bearer information # 1.

Because the bearer information #1 and the service data have a corresponding relationship, and different bearer information corresponds to different service data, the target mobility management network element can implement service-based security policy negotiation and security algorithm negotiation in the network switching process according to the bearer information of the terminal device in the source network.

For example, bearer information #1 may correspond to IoT traffic data, and AMF #2 may determine, according to bearer information #1, a data protection manner of IoT traffic data in the 5G network, such as: a protection mode between UE-UPF, AN NAS security mode between UE-AMF, and AN AS security mode between UE-AN.

The AMF #2 generates the key1 from the shared key #1, which shared key #1 may be a key that the AMF #2 shares with the UE, such as an AMF key, or a seaf key, or a key generated from a key that the UE shares with the network # 1.

Hereinafter, a protection scheme between UE and UPF will be described as an example.

And the AMF determines the protection mode of the UE-UPF to be executed according to the judgment rule. For example, the network slice selection information S-NSSAI #1 in the bearer information #1 indicates that the bearer data # D1 needs to adopt the security protection mechanism of the UE-UPF, and the AMF #2 generates the UPF protection indication information according to the S-NSSAI # 1.

At S305, AMF #2 transmits instruction information # E1 to SMF # 2.

The indication information # E1 is used to indicate a data protection manner of the bearer data # D1 in the network # 2.

For example, the indication information # E1 may be any one of non-access stratum NAS protection indication information, access stratum AS protection indication information, and user plane function entity UPF protection indication information.

The NAS protection indication information is used to indicate that the bearer data # D1 adopts a NAS security mode between UE and AMF in the network #2, the AS protection indication information is used to indicate that the bearer data # D1 adopts AN AS security mode between UE and AN in the network #2, the UPF protection indication information is used to indicate that the bearer data # D1 adopts a security protection mechanism between UE and UPF in the network #2, and the security protection mechanism between UE and UPF adopts UPF AS a security termination point of user plane data.

Optionally, the AMF #2 sends the UE identity information, the bearer information #1, the serving network identity, and the intermediate key to the SMF # 2.

Hereinafter, the user plane security key is referred to as UPF key, and the intermediate key is referred to as key 1.

At S306, SMF #2 determines a user plane security policy and selects a UPF security algorithm; the UPF key is generated based on key1 and the UPF security algorithm.

As shown in fig. 1, the SMF (SMF #2) may send reference information, which may be at least one of a UE ID and bearer information, to the UDM to obtain a subscribed user plane security policy; or the SMF #2 determines the user plane security policy according to at least one item of the bearer information #1, for example, the SMF determines the user plane security policy according to DNN and S-NSSAI, or the security indication information, and the like, and the user plane security policy may be a locally configured user plane security policy. The user plane security policy includes whether confidentiality protection and/or integrity protection is performed.

And the SMF #2 determines a data security protection algorithm between the UE and the UPF according to the security capability of the UE and the security algorithm priority list of the UPF, wherein the data security protection algorithm comprises a confidentiality protection algorithm and an integrity protection algorithm. SMF #2 generates a UPF encryption key according to key1 and the confidentiality protection algorithm identification, and SMF #2 generates a UPF integrity protection key according to key1 and the integrity protection algorithm identification.

SMF #2 may determine user plane security keys, including UPF ciphering keys, and/or UPF integrity protection keys, based on the user plane security policy. For example, if the user plane security policy indicates that encryption is required, a UPF encryption key is generated; and if the user plane security policy indicates that integrity protection is required, generating a UPF integrity protection key.

At S307, the SMF #2 transmits the user plane security key to the UPF # 2.

Alternatively, SMF #2 sends the security protection algorithm to UPF # 2.

As shown in fig. 1, SMF (SMF #2) sends user plane security keys, security protection algorithms, to UPF (UPF #2) via the N4 interface. The user surface security key comprises a confidentiality protection key and/or an integrity protection key; the security protection algorithm includes a confidentiality protection algorithm, and/or an integrity protection algorithm.

Or the SMF directly sends the key2, the user plane security policy and the security capability of the UE to the UPF, and the UPF selects a final security protection algorithm and generates a security protection key by using a method similar to the SMF. The Key2 can be derived by SMF according to Key1, or AMF directly sends to UPF through SMF.

At S308, the UPF #2 transmits ACK response information to the SMF # 2.

At S309, SMF #2 sends the security protection algorithm, and/or the user plane security policy, to AMF # 2.

Optionally, when the UE moves from 5GC to EPC, the SMF decides which PDU sessions can be relocated to target EPS based on EPS capability and operator specific management policy, and releases the part of PDU sessions that cannot be migrated to EPS.

At S310, AMF #2 transmits instruction information # E1 and the security protection algorithm to MME # 1.

For example, the AMF #2 sends a Forward migration message (Forward Relocation Response) to the MME #1, which includes the indication information # E1.

Optionally, AMF #2 sends the user plane security policy to MME # 1.

In S311, MME #1 transmits instruction information # E1 and the security protection algorithm to the terminal device.

Optionally, the MME #1 sends the user plane security policy to the terminal device.

For example, the MME #1 transmits a Handover Command message (Handover Command) including the instruction information # E1 and the security protection algorithm to the terminal device.

Optionally, the MME #1 sends a Handover Command message (Handover Command) to the AN #1, and the AN #1 sends the Handover Command message to the terminal device, where the Handover Command message includes the indication information # E1 and the security protection algorithm.

At S312, the terminal device determines a user plane protection security policy, and generates an UPF key based on the security protection algorithm and the intermediate key 1.

That is, the terminal device determines the final protection mode based on the instruction information # E1; and determining a final protection key according to a security protection algorithm and/or a user plane security policy.

The UE generates the key1 from the shared key #1, which shared key #1 may be a key that AMF #2 shares with the UE, such as an AMF key, or a search key. The UE may generate a user plane security key according to key1 and a security protection algorithm.

For example, the UE generates the UPF encryption key according to the key1 and the confidentiality protection algorithm identifier, and the UE generates the UPF integrity protection key according to the key1 and the integrity protection algorithm identifier.

The UE may determine user plane security keys, including UPF ciphering keys, and/or UPF integrity protection keys, according to the user plane security policy.

For example, if the user plane security policy indicates that encryption is required, a UPF encryption key is generated; and if the user plane security policy indicates that integrity protection is required, generating a UPF integrity protection key.

In the above embodiment, the bearer information #1 corresponds to the session identifier #1, the PDU session is identified by the PDU session ID, and the session identifier #1 corresponds to the PDU session ID 1. The multiple pieces of bearing information can correspond to multiple PDU sessions; different PDU sessions may have different protection modes, and the protection mode may be determined by AMF or SMF; the AMF sends an indication message (indicator) of the security requirement to the terminal equipment, and the PDU session has a corresponding relation.

The data connection is a transmission path from the UE to the core network, and includes a transmission path between the core network and the base station and a data radio bearer between the base station and the UE. A PDU Session is a connection between the UE and the packet data network, which is used to transmit data units, typically a PDU Session is established for a service.

For example, the PDU session ID1 corresponds to the indication information #1 of the security requirement, the user plane security policy # 1; and the PDU session ID2 corresponds to the indication information #2 of the security requirement, the user plane security policy #2, and the like.

The security protection method is suitable for user data intercommunication between the 5G network and the 4G network in the communication system, and network security protection based on DRB, Session and Qos flow granularity is realized. When the terminal is switched from the 5G network to the 4G network or the terminal is switched from the 4G network to the 5G network, the terminal equipment adopts a flexible safety protection mode in the intercommunication network.

The process of the SMF determining the user plane security policy in the above embodiment may also be implemented by the AMF, and the AMF may send the user plane security policy to the SMF. The AMF can obtain a security algorithm priority list of the UPF from the SMF or the UPF, and determine a security protection algorithm and a user plane security key according to the security capability of the UE and the security algorithm priority list of the UPF.

Referring to S303 to S305, if AMF #2 determines to adopt NAS signaling protection, at this time, the optional AMF #2 sends the determined security protection indication to the source MME #1, so that the source MME #1 sends the determined security protection indication terminal. The terminal determines which protection mode is adopted by the PDU session according to the determined safety protection indication; optionally, the AMF #2/SMF #2 determines a user plane security policy, and sends the user plane security policy to the terminal.

In the above embodiment, the process of determining the data protection mode of the bearer data # D1 in the network #2 by the AMF #2 may also be implemented by the SMF #2, in this case, the SMF #2 sends the determined security protection instruction to the AMF #2, and the AMF #2 sends the determined security protection instruction to the terminal.

Fig. 4 shows a schematic interaction diagram of a terminal device switching from network #2 to network # 1.

Referring to fig. 4, the handover procedure may be initiated by a base station, where the data security protection supported by the network #1 includes: NAS protection mode between UE-MME and AS UP protection mode between UE-AN, wherein the AS UP protection mode adopts a user plane protection method between UE and a base station to protect service data. In the network #1, the MME #1 may determine the data security protection method of the terminal device in the network #1 according to the indication information transmitted by the AMF # 2.

At S401, AN #2 initiates a network handoff of AN #2 to AN # 1.

At S402, AN #2 transmits handover request information to AMF # 2.

In the process of switching the terminal equipment from the 5G network to the 4G network, AN (AN #2) sends switching request information (Handover Required) to AMF (AMF #2) through AN N2 interface, wherein the switching request information comprises a session information list, and the session information list comprises at least one piece of session information and is recorded as session information # 1.

For example, the session information #1 includes at least one of the following information: session identification information (Session ID), network slice selection information S-NSSAI, access type, data network name, security indication information.

The security indication information indicates whether the session data # D1 corresponding to the session information #1 requires integrity protection and/or security protection.

Optionally, the handover request information further includes indication information of security requirement, where the indication information of security requirement is used to indicate a data protection manner of the session data # D1.

Here, the data protection method of the session data # D1 in the network #2 may be: NAS security mode between UE-AMF, AS security mode between UE-AN, or user plane data protection mode between UE-UPF.

Further, referring to table 2, the protection manner may be specifically what kind of message protection and/or data transmission path protection mechanism is adopted, for example, RRC signaling related to non-RRC-inactive state between the UE and the base station is adopted.

Optionally, the handover request information further includes security capability information of the UE, an access point name, a gateway IP address/name, and a service network name.

At S403, AMF #2 transmits session information #1 to MME # 1.

Optionally, the AMF #2 sends the UE identification information, the serving network identifier, the security requirement indication information, the access point name, the gateway IP address/name, and the serving network name to the MME # 1.

At S404, the MME #1 determines the data protection scheme of the bearer data # D1 in the network # 1.

Here, the data protection method of the session data # D1 in the network #1 may be: NAS protection mode between UE-MME and AS UP protection mode between UE-AN. Further, referring to table 2, the protection manner may be specifically what kind of message protection and/or data transmission path protection mechanism is adopted, for example, RRC signaling related to non-RRC-inactive state between the UE and the base station is adopted.

MME #1 specifies the data protection scheme of session data # D1 in network #1 corresponding to session identification information # 1.

For example, the MME #1 determines the data protection manner of the session data # D1 in the network #1 according to at least one of the access point name, the gateway IP address/name, the serving network name, the UE identification ID, the serving network identification, the bearer identification information ID, the network slice selection information S-NSSAI, the access type information, the session type information type, the data network name DNN, and the indication information of the security requirement of the UE data.

That is, the target MME can determine the data protection scheme of the session data # D1 in the network #1 from the session information # 1.

It should be understood that the session information corresponds to a session identification PDU session ID. The plurality of session information may correspond to a plurality of PDU sessions; different PDU sessions may have different protection schemes.

The 5GC (5G Core Network) supports PDU connection service, and the PDU connection service is the service of exchanging PDU data packets between the UE and the DN; the PDU connection service is implemented by the UE initiating the establishment of a PDU session. After a PDU session is established, a data transmission channel between the UE and the DN is established.

The MME #1 may determine the data protection manner of the session data # D1 in the network #1 according to the indication information of the security requirement and the local policy. When the session information #1 includes the indication information of the security requirement of the session data # D1, the MME #1 may determine the data protection manner of the session data # D1 in the network #1 according to the indication information of the security requirement of the session data # D1.

At S405, MME #2 transmits to AMF #1 indication information # E2, which may be MME #1 determined according to the data protection manner of session data # D1 in network #1, for MME #2 # E2.

At S406, AMF #1 transmits the instruction information # E2 to the terminal device.

The indication information # E2 is used to indicate a data protection manner of the session data # D1 in the network # 1.

In S407, the terminal device determines a security protection algorithm and a security key from the instruction information # 2.

Fig. 5 shows a schematic interaction diagram of a terminal device switching from network #1 to network #2, see fig. 5, which switching procedure may be initiated by the terminal.

In order to support interoperation between 4G/5G, a 5G system defines two registration modes, namely single registration and double registration, for UE which supports both 5GC NAS and EPC NAS, wherein for the UE, the single registration is a necessary function, the double registration is an optional function, and an operator can perform requirements on UE capability according to specific network deployment conditions and service requirements. In the UE registration process, the UE should send an indication to the network side, indicating that the UE has both 5GC NAS and EPC NAS capabilities, so as to support the subsequent network interoperation processing.

In the single registration state, the UE only maintains one active mobility management state at a time, which may be a registration management state of 5GC or an EPS mobility management state of EPC. When UE needs to be switched from an EPC network to a 5GC network, the UE maps the current EPS-GUTI into a 5G-GUTI; and when the UE needs to be switched to the EPC network from the 5GC network, mapping the current 5G-GUTI into the EPS-GUTI.

In dual registration mode, the UE can independently handle registration flows to 5GC and EPC at the same time, while storing 5G-GUTI and EPC-GUTI, and both 5G-GUTI and EPC-GUTI are allocated by the 5GC or EPC system. The UE supporting the dual registration mode may be separately registered to the 5GC or the EPC, or may be simultaneously registered to the 5GC and the EPC.

At S501, the terminal device initiates network handover of AN #1 to AN # 2.

The terminal device triggers network registration in network #2 to determine whether to initiate network handover of AN #1 to AN #2, wherein AN #1 and AN #2 belong to network #1 and network #2, respectively, and network #1 may be a 4G network and network #2 may be a 5G network.

At S502, the terminal apparatus transmits handover request information to AN # 1.

At S503, AN #1 selects AMF #2 in network #2 to transmit registration request information to AMF # 2.

At S504, AN #1 transmits registration request information to AMF # 2; the registration request information includes identification information of the terminal device, and is referred to as terminal identification information # 1.

At S505, AMF #2 transmits request information to MME # 1; the request information is used to request bearer information #1 corresponding to terminal identification information # 1.

At S506, the MME #1 transmits response information to the AMF # 2.

It should be understood that the response information includes contents consistent with the contents sent by the MME #1 to the AMF #2 in step 303.

At S507, AMF #2 determines a data protection method of bearer data # D1 in network # 2.

Referring to step S304, in order to avoid repetition, description will not be made here.

At S508, the AMF #2 sends indication information # E1 to the SMF #2, where the indication information # E1 indicates a data protection method of the bearer data # D1 in the network # 2.

In S509, a user plane security policy is determined, and a UPF security algorithm is selected; the UPF key is generated based on key1 and the UPF security algorithm.

At S510, SMF #2 sends the user plane security key to UPF # 2.

Alternatively, SMF #2 sends the security protection algorithm to UPF # 2.

At S511, UPF #2 transmits ACK response information to SMF # 2.

At S512, SMF #2 sends the security protection algorithm, and/or the user plane security policy, to AMF # 2.

At S513, the AMF #2 transmits indication information # E1 to the AN #1, where the indication information # E1 indicates a data protection method of the bearer data # D1 in the network # 2.

At S514, AN #1 transmits instruction information # E1 to the terminal apparatus.

Optionally, a security protection algorithm and/or a user plane security policy are also sent.

At S515, the terminal device determines a final protection mode according to the instruction information # E1; and determining a final protection key according to a security protection algorithm and/or a user plane security policy.

The UE generates the key1 according to the shared key #1, where the shared key #1 may be a key shared by the AMF #2 and the UE, such as an AMF key, or a security anchor function (SEAF) search key. The UE may generate a user plane security key according to key1 and a security protection algorithm.

In the above embodiment, the bearer information #1 corresponds to the session identifier #1, and the session identifier #1 corresponds to the PDU session ID 1. The multiple pieces of bearing information can correspond to multiple PDU sessions; different PDU sessions may have different protection modes, and the protection mode may be determined by AMF or SMF; the AMF sends the indication information of the safety requirement to the terminal equipment, and the indication information of the safety requirement has a corresponding relation with the PDU session.

Fig. 6 shows a schematic flow diagram of a method of key provisioning of the present application, which may be performed by a target mobility management entity.

Case # A1

Case # A2

In S601, a first message sent by a source mobility management entity is received, where the first message includes first bearer information of a terminal device in a source network.

For example, in case # a1, AMF #2 receives a forward migration message (forward Relocation Request) sent by MME #1, which includes bearer information #1 of the terminal device in the source network (network # 1).

At S602, first information is determined according to the first bearer information, where the first information is used to indicate a data protection manner of the first bearer data in the target network (network # 2).

For example, the network slice selection information S-NSSAI #1 in the bearer information #1 indicates that the bearer data # D1 needs to adopt the security protection mechanism of the UE-UPF, and the AMF #2 generates the UPF protection indication information according to the S-NSSAI # 1.

That is, in case # a1, AMF #2 determines the data protection manner of bearer data # D1 in network # 2.

By way of example and not limitation, the data protection manner of the bearer data # D1 in the network #2 may be: NAS security mode between UE-AMF, AS security mode between UE-AN, or user plane data protection mode between UE-UPF.

At S603, security policy information and indication information # E1 are sent to the source mobility management entity, where the indication information # E1 is used to indicate a data protection manner of bearer data # D1 in the network # 2.

By way of example and not limitation, the indication information # E1 may be any one of non-access stratum NAS protection indication information, access stratum AS protection indication information, user plane function entity UPF protection indication information.

By way of example and not limitation, the security policy information may be a user plane security algorithm, and/or a user plane security policy. The user plane security protection algorithm comprises a confidentiality protection algorithm and an integrity protection algorithm.

Fig. 7 shows a schematic flow diagram of a method of key configuration of the present application, which may be performed by a source mobility management entity.

In S701, a source mobility management entity receives handover request information sent by a source access network AN, where the handover request information includes first bearer information of a terminal device in a source network, and the handover request information is used to request the terminal device to handover from the source network to a target network.

In S702, the source mobility management entity sends the first bearer information to the target mobility management entity; the first bearer information is used for the target mobility management entity to determine a data protection mode of the first bearer data in the target network.

For example, in case # a1, MME #1 sends bearer information #1 to AMF # 2.

Alternatively, in case # a2, AMF #2 transmits session information #1 to MME # 1.

In S703, the source mobility management entity receives security policy information and first information sent by the target mobility management entity, where the first information is used to indicate a security mode of the first bearer data in the target network.

At S704, the source mobility management entity sends the security policy information and the first information to the terminal device.

For example, in case # a1, MME #1 transmits the instruction information # E1 to the terminal device, and optionally MME #1 transmits the security protection algorithm to the terminal device.

Alternatively, in case # a2, AMF #2 transmits the instruction information # E2 to the terminal device, and optionally, MME #1 transmits the security protection algorithm to the terminal device.

Fig. 8 shows a schematic flow chart of a method of key provisioning of the present application, which may be performed by a target session management entity.

At S801, the target session management entity receives first indication information sent by the target mobility management entity.

For example, in case # a1, SMF #2 receives the indication information # E1 transmitted by AMF # 2.

At S802, the target session management entity determines a first security key according to the first indication information, where the first security key is used to perform data security protection on the first bearer data in the target network.

For example, in case # a1, the indication information # E1 may be UPF protection indication information, and the SMF #2 determines a UPF security key from the UPF indication information, referring to step S306.

For example, SMF #2 may generate a UPF encryption key based on key1 and the confidentiality protection algorithm identification, and a UPF integrity protection key based on key1 and the integrity protection algorithm identification. Or if the user plane security policy indicates that encryption is required, the SMF #2 generates a UPF encryption key according to the user plane security policy; if the user plane security policy indicates that integrity protection is required, the SMF #2 generates a UPF integrity protection key according to the user plane security policy.

At S803, the target session management entity sends the first security key to the target user plane function entity.

For example, in case # a1, SMF #2 sends UPF key to UPF #2, which is used for data security protection of bearer data # D1 by the terminal device in network # 2.

Fig. 9 shows a schematic flow chart of a method of key configuration of the present application.

In S901, the terminal device receives security policy information and first information sent by a source mobility management entity, where the first information is used to indicate a data protection manner of first bearer data in a target network.

For example, in case # a1, the terminal device receives a Handover Command (Handover Command) sent by MME #1, where the Handover Command includes indication information # E1, and the indication information # E1 indicates the data protection scheme of bearer data # D1 in network # 2.

Alternatively, in case # a2, the terminal device receives a Handover Command (Handover Command) transmitted from the AMF #2, the Handover Command including instruction information # E1, the instruction information # E1 being used to instruct the data protection method of the session data # D1 in the network # 1.

In S902, the terminal device determines a first security key according to the security policy information and the first information; the first security key is used for performing data security protection on the first bearer data in a target network.

For example, in case # a1, the terminal device determines the user plane security policy, selects the UPF security algorithm; and generating the UPF key based on the key1 and the UPF security algorithm, wherein the UPF security algorithm comprises a UPF confidentiality protection algorithm and a UPF integrity protection algorithm.

Or, in case # a2, the terminal device determines an access stratum AS security policy, selects an AS security algorithm, and generates an AS key based on key1 and the AS security algorithm, where the AS security algorithm includes an AS confidentiality protection algorithm and an AS integrity protection algorithm.

Fig. 10 is a schematic diagram of an AMF network element according to the foregoing method. It is to be understood that the AMF network element is capable of performing the various steps performed by AMF #2 in the methods of fig. 1-9. Wherein, AMF network element includes: a memory 1010 for storing a program; a communication interface 1020 for communicating with other devices; a processor 1030 for executing programs in memory 1010.

In one implementation, when the UE needs to be handed over from the EPC network to the 5GC network, the processor 1030 is configured to receive a first message from an MME (e.g., MME #1 described above) through the communication interface 1020, where the first message includes first bearer information of a terminal device in a source network (e.g., the EPC network described above).

The processor 1030 determines first information according to the first bearer information, where the first information is used to indicate a data protection manner of the first bearer data in a target network (e.g., the above-mentioned 5GC network). The processor 1030 sends security policy information, the first information, to an MME (e.g., MME #1 described above) through the communication interface 1020.

In one implementation, when the UE needs to be handed over from the 5GC network to the EPC network, the processor 1130 is configured to receive, through the communication interface 1120, handover request information sent by a source access network AN (e.g., the above-mentioned AN #2), where the handover request information includes first bearer information of the terminal device in the source network (e.g., the above-mentioned 5GC network), and the handover request information is used to request the terminal device to be handed over from the source network to the target network. The processor 1130 sends the first bearer information to an MME via the communication interface 1120; the first bearer information is used by the MME to determine a data protection manner of the first bearer data in the target network (e.g., the EPC network described above).

The processor 1130 receives, through the communication interface 1120, security policy information and first information sent by the MME, where the first information is used to indicate a security mode of the first bearer data in a target network. The processor 1130 sends the security policy information and the first information to the terminal device through the communication interface 1120.

Fig. 11 is a schematic diagram of an MME network element according to the foregoing method. It should be understood that the MME network element is capable of performing the various steps performed by MME #1 in the methods of fig. 1-9. Wherein, MME network element includes: a memory 1110 for storing programs; a communication interface 1120 for communicating with other devices; a processor 1130 for executing programs in the memory 1110.

In one implementation, when the UE needs to be handed over from the 5GC network to the EPC network, the processor 1030 is configured to receive a first message from an AMF (e.g., AMF #2 described above) through the communication interface 1020, where the first message includes first bearer information of a terminal device in a source network (e.g., the 5GC network described above).

The processor 1030 determines first information according to the first bearer information, where the first information is used to indicate a data protection manner of the first bearer data in a target network (e.g., the EPC network described above). The processor 1030 transmits security policy information, the first information, to an AMF (e.g., the AMF #2 described above) through the communication interface 1020.

In one implementation, when the UE needs to be handed over from the 5GC network to the EPC network, the processor 1130 is configured to receive, through the communication interface 1120, handover request information sent by a source access network AN (e.g., the above-mentioned AN #1), where the handover request information includes first bearer information of the terminal device in the source network, and the handover request information is used to request the terminal device to handover from the source network to a target network. The processor 1130 sends the first bearer information to the AMF through the communication interface 1120; the first bearer information is used by the AMF to determine a data protection manner of the first bearer data in a target network (e.g., the EPC network described above).

The processor 1130 receives, through the communication interface 1120, security policy information and first information sent by the AMF (for example, AMF #2 described above), where the first information is used to indicate a security mode of the first bearer data in a target network. The processor 1130 sends the security policy information and the first information to the terminal device through the communication interface 1120.

According to the foregoing method, fig. 12 is a schematic diagram of an SMF network element according to an embodiment of the present application. It is to be understood that the SMF network element is capable of performing the various steps performed by SMF #2 in the methods of fig. 1-9. Wherein, SMF network element includes: a memory 1210 for storing programs; a communication interface 1220 for communicating with other devices; a processor 1230 that executes programs in memory 1210.

In one implementation, the processor 1230 is configured to receive the first indication from the SMF via the communication interface 1220 when the program is executed. The processor 1230 determines a first security key according to the first indication information, where the first security key is used to perform data security protection on the first bearer data in the target network. The processor 1230 is configured to send the first security key to a target user plane function entity UPF through the communication interface 1220.

According to the foregoing method, fig. 13 is a schematic diagram of a communication apparatus 20 provided in this embodiment of the application, and as shown in fig. 13, the apparatus 20 may be a terminal device, or may be a chip or a circuit, such as a chip or a circuit that may be disposed on a terminal device.

For convenience of explanation, fig. 13 shows only main components of the terminal device. As shown in fig. 13, the terminal device 20 includes a processor, a memory, a control circuit, an antenna, and an input-output means.

The processor is mainly configured to process a communication protocol and communication data, control the entire terminal device, execute a software program, and process data of the software program, for example, to support the terminal device to perform the actions described in the above embodiment of the method for indicating a transmission precoding matrix. The memory is mainly used for storing software programs and data, for example, the codebook described in the above embodiments. The control circuit is mainly used for converting baseband signals and radio frequency signals and processing the radio frequency signals. The control circuit and the antenna together, which may also be called a transceiver, are mainly used for transceiving radio frequency signals in the form of electromagnetic waves. Input and output devices, such as touch screens, display screens, keyboards, etc., are used primarily for receiving data input by a user and for outputting data to the user.

When the terminal device is turned on, the processor can read the software program in the storage unit, interpret and execute the instruction of the software program, and process the data of the software program. When data needs to be sent wirelessly, the processor outputs a baseband signal to the radio frequency circuit after performing baseband processing on the data to be sent, and the radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal outwards in the form of electromagnetic waves through the antenna. When data is sent to the terminal equipment, the radio frequency circuit receives radio frequency signals through the antenna, converts the radio frequency signals into baseband signals and outputs the baseband signals to the processor, and the processor converts the baseband signals into the data and processes the data.

Those skilled in the art will appreciate that fig. 13 shows only one memory and processor for ease of illustration. In an actual terminal device, there may be multiple processors and memories. The memory may also be referred to as a storage medium or a storage device, and the like, which is not limited in this application. For example, the processor may include a baseband processor and a central processing unit, the baseband processor is mainly used for processing the communication protocol and the communication data, and the central processing unit is mainly used for controlling the whole terminal device, executing the software program, and processing the data of the software program.

The processor in fig. 13 integrates the functions of the baseband processor and the central processing unit, and those skilled in the art will understand that the baseband processor and the central processing unit may also be independent processors, and are interconnected through a bus or the like. Those skilled in the art will appreciate that the terminal device may include a plurality of baseband processors to accommodate different network formats, the terminal device may include a plurality of central processors to enhance its processing capability, and various components of the terminal device may be connected by various buses. The baseband processor can also be expressed as a baseband processing circuit or a baseband processing chip. The central processing unit can also be expressed as a central processing circuit or a central processing chip. The function of processing the communication protocol and the communication data may be built in the processor, or may be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.

For example, in the embodiment of the present application, the antenna and the control circuit having the transceiving function may be regarded as the transceiving unit 201 of the terminal device 20, and the processor having the processing function may be regarded as the processing unit 202 of the terminal device 20. As shown in fig. 13, the terminal device 20 includes a transceiving unit 201 and a processing unit 202. A transceiver unit may also be referred to as a transceiver, a transceiving device, etc. Optionally, a device for implementing the receiving function in the transceiver 201 may be regarded as a receiving unit, and a device for implementing the transmitting function in the transceiver 201 may be regarded as a transmitting unit, that is, the transceiver 201 includes a receiving unit and a transmitting unit. For example, the receiving unit may also be referred to as a receiver, a receiving circuit, etc., and the sending unit may be referred to as a transmitter, a transmitting circuit, etc.

In an implementation manner, the processing unit 202 is configured to receive, by the transceiving unit 201, security policy information and first information sent by an MME, where the first information is used to indicate a data protection manner of first bearer data in a target network.

For example, when the UE needs to be handed over from the EPC network to the 5GC network, the terminal device receives a Handover Command (Handover Command) sent by the MME #1, where the Handover Command includes indication information # E1, and the indication information # E1 is used to indicate a data protection method of bearer data # D1 in the network # 2.

The processing unit 202 determines a first security key according to the security policy information and the first information; the first security key is used for performing data security protection on the first bearer data in a target network.

For example, the terminal device determines a user plane security policy and selects a UPF security algorithm; and generating the UPF key based on the key1 and the UPF security algorithm, wherein the UPF security algorithm comprises a UPF confidentiality protection algorithm and a UPF integrity protection algorithm.

In one implementation manner, the processing unit 202 is configured to receive, through the transceiver unit 201, security policy information and first information sent by the AMF, where the first information is used to indicate a data protection manner of first bearer data in a target network.

For example, when the UE needs to be handed over from the 5GC network to the EPC network, the terminal device receives a Handover Command (Handover Command) sent by the AMF #2, where the Handover Command includes indication information # E1, and the indication information # E1 is used to indicate a data protection method of the session data # D1 in the network # 1.

For example, the terminal device determines an Access Stratum (AS) security policy, selects an AS security algorithm, and generates an AS key based on the key1 and the AS security algorithm, wherein the AS security algorithm includes an AS confidentiality protection algorithm and an AS integrity protection algorithm.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network element) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method of key provisioning, comprising:

a target mobility management entity receives a first message sent by a source mobility management entity, wherein the first message comprises first bearing information of terminal equipment in a source network;

the target mobility management entity determines first information according to the first bearer information, wherein the first information is used for indicating a security protection mode of first bearer data in a target network;

the target mobility management entity sends the first information to the source mobility management entity;

the first information includes at least one of the following information: non-access stratum (NAS) protection indication information, Access Stratum (AS) protection indication information and user plane function entity (UPF) protection indication information;

wherein, the UPF protection indication information is used to indicate that the first bearer data adopts a security protection mechanism from a terminal to a user plane functional entity in the target network.

2. The method of claim 1, further comprising:

the target mobility management entity sends first indication information to a target session management entity, wherein the first indication information comprises the first information and a first intermediate key;

the first indication information is used to indicate the target session management entity to determine a first security key, where the first security key is used to perform data security protection on the first bearer data in a target network.

3. The method according to claim 1 or 2, wherein the first bearer information comprises at least one of the following information:

the identification information of the first bearer data, network slice selection information S-NSSAI, the access type information of the first bearer data, a data network name DNN and safety indication information; the security indication information is used to indicate whether the first bearer data needs encryption protection and/or integrity protection.

4. The method of claim 3, wherein the secure mode of the first bearer data in the target network comprises: NAS safe mode, AS safe mode, UPF safe mode; wherein, the UPF security mode adopts a security protection mechanism from a terminal to a user plane functional entity.

5. The method of claim 3, further comprising:

the target mobility management entity determines security policy information of the first bearer data in a target network; and the target mobility management entity sends the security policy information to the source mobility management entity.

6. The method according to claim 5, wherein the security policy information comprises a first security algorithm and/or a first security policy, the first security algorithm comprises a confidentiality protection algorithm and an integrity protection algorithm, and the first security policy comprises confidentiality protection indication information and integrity protection indication information.

7. A method of key provisioning, comprising:

a source mobility management entity receives switching request information sent by a source access network AN, wherein the switching request information comprises first bearing information of terminal equipment in a source network, and the switching request information is used for requesting to switch the terminal equipment from the source network to a target network;

the source mobility management entity sends the first bearing information to a target mobility management entity; the first bearing information is used for the target mobility management entity to determine a security protection mode of the first bearing data in the target network;

the source mobility management entity receives first information sent by the target mobility management entity, wherein the first information is used for indicating a security protection mode of first bearer data in a target network;

the first information includes at least one of the following information: NAS protection indicating information, AS protection indicating information and UPF protection indicating information;

8. The method according to claim 7, wherein the first bearer information is used for identifying the first bearer data in the handover procedure of the terminal device from the source network to the target network.

9. The method according to claim 7 or 8, wherein the first bearer information comprises at least one of the following information:

10. The method of claim 9, wherein the handover request information further comprises: the security capability information of the terminal device, and/or second information, where the second information is used to indicate a security protection mode of the first bearer data in a source network.

11. The method of claim 9, wherein the secure mode of the first bearer data in the source network comprises: NAS security mode, AS security mode.

12. The method of claim 9, further comprising:

the source mobile management entity receives security policy information sent by the target mobile management entity;

and the source mobility management entity sends the security policy information to the terminal equipment.

13. The method according to claim 12, wherein the security policy information comprises a first security algorithm, and/or a first security policy,

the first security algorithm comprises a confidentiality protection algorithm and an integrity protection algorithm, and the first security policy comprises confidentiality protection indication information and integrity protection indication information.

14. The method of claim 9, wherein the secure mode of the first bearer data in the target network comprises: NAS safe mode, AS safe mode, UPF safe mode; wherein, the UPF security mode adopts a security protection mechanism from a terminal to a user plane functional entity.

15. A network device, comprising: a processor coupled with a memory for storing a program that, when executed by the processor, causes a communication device to perform the method of any of claims 1-14.

16. A chip system, comprising: a processor for calling and running a computer program from a memory so that a communication device in which the system-on-chip is installed performs the method of any one of claims 1 to 14.

17. A computer-readable storage medium, having stored thereon a computer program which, when run on a computer, causes the computer to perform the method of any one of claims 1 to 14.